Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 08:26
Static task
static1
Behavioral task
behavioral1
Sample
3ca63d0e669f10c343cb9a3dc649fad7_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3ca63d0e669f10c343cb9a3dc649fad7_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3ca63d0e669f10c343cb9a3dc649fad7_JaffaCakes118.html
-
Size
69KB
-
MD5
3ca63d0e669f10c343cb9a3dc649fad7
-
SHA1
bd8531f46465efaaeacb0ac2d57e5df8bcad633e
-
SHA256
cf60e085dd6593c50428a08f3dfa3d87cfb548d77a5a342760ce796dce7b9b39
-
SHA512
e374d531de1b0120cbc0945a27fe9add5bcb2e9270dd94232e58190396e97470f1646c0134b942a8475b0180896ceb7509b5267328318243eec80a9bbd2757b2
-
SSDEEP
1536:gQZBCCOdl0IxCrkgEYGsf7S6Ob5jx1ShIPwAgcIdphodOHVe4eldQrTCKgTqwzjT:gk230IxUEYGsf7S6OFjx1ShIPwAgcIdK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501f674d35d4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000009eabd02c2767f09ac18c2d38fa776b3410e7dd773ea07caf2f2652c261fceff000000000e800000000200002000000097e948a7510e4671d234f22c1ab90e42544500ead9da294b11e70106a43fd493200000005e8886f0665126b130e98972a3cd9c75427d369e4711ba72c455f1bb7d32f986400000009c0661bd241ae87c0e9e455c133898e4927009650031b24840eb189aa8bda235d1ad0d97f2b0a0f49a44fcda7ed91bf3bdc55ffef9373d84f6c500ada6340f6e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000002bc449814a1b892ea6850b0d3c89afa90f50df32d9d3cd49fbe8821e16fb9cec000000000e800000000200002000000063a2dc07e9d7fe691e1e5c3543c29830e5a4ffd04381864efb309d34bf3597949000000030f2274470f244e5530aabbda6b633116b738a015251dffac9b966cd02bf0195867a7809d126aaac7bf7b1c4792795ef7f4d4f08b0b9f7c5b37970de578167ee4ca9b9cf95573c9bb13f48a4104f89ca1fda4e6054c5c14b475c0b4d8fc5826f795be9ff3fbbd9621bf38faa1d6d44c3dd80da7c55cc69e303efca40e408319c967faf427f4c142d0d259573f2d775714000000055a345f9cbba1b9cb50f09b4434f42afd3636659b4c7be8e3e0b3e9ae8adadf2db08b903d22294463941afe5ecc7a810e63ec73d7b8fb64e5ccb060e11a37bf3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7689C2C1-4028-11EF-A248-D2C9064578DD} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426934667" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1748 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1748 iexplore.exe 1748 iexplore.exe 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1748 wrote to memory of 2192 1748 iexplore.exe 31 PID 1748 wrote to memory of 2192 1748 iexplore.exe 31 PID 1748 wrote to memory of 2192 1748 iexplore.exe 31 PID 1748 wrote to memory of 2192 1748 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3ca63d0e669f10c343cb9a3dc649fad7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2192
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525f911380767e8c0d83a43f4326fd3dc
SHA1a217b4893998d7cf02b924fcdf422fccd96cc817
SHA25690f83df57e26e84ef95d3d215935ea73e19225936d3b8b6d55172d0b93c12d3c
SHA512a211a38514d28ea71771b1d9431c9687edbfe72ca41a1545de12c9344f24eb451d1fd487587248c32311ae1cea42f3db37180c8e64c263596ee6ae0a71dcd008
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514427a3eec6a47536f989786de55671f
SHA1cf3e8bb98c38a6fdbb6ac9af6ce30fbc39394d59
SHA25645ca287c94050ccedd9db68ca25b77178cce0e72db93d9e96a91fda244b96cb0
SHA51201a1b88a20a070be29f62f1dc4fcd493b98274691903b5cc2f72308aa632870706a3b103788eb39be20bd7957204be308ea8f21d5c26b79ca1176d6f1bc76f26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd0ab6743e5a120c08e386ce0f1c1b03
SHA1a4e66b2b71c39a9168f110c1ed8f3d9f7226c82d
SHA25678976ca42eaf171ac86018f2133656c68988a16137ae4354fcaabef2abe7f09a
SHA512224cfe2b0cb029ce92c986f1a13b0105a5e4e21ebb0d5608031309f094303f037fe35fcd64f54576b2c7e20cf7dcc520c0762428db99bca317896ca2fa15c0a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b786e81020ad269bf21735acf5397eec
SHA17f53a4f06b553ac1981121ef7f72f74653eea809
SHA256efaf34c5b94896eb1ac15f0fec6196c93e68a07dd8f8f8e22c2a97c4b6627968
SHA5125a1ce8a6a3111865cfdfebc91de8f118b28230347a0bfbedb07511a431d9ce19a67984b09fda1ec21532196621e28359d12a56b19aca8610a21267f140ddad61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db6b51c9a84810229feb07d5889a1c5f
SHA183386216356c3be4f2be3eb1ae0bcd19aea4f43f
SHA2565f19417df154c756a1725b776a176b5300b45d3fb1f6762f2d0f9bab803e341c
SHA512d0dbb575872d88af037c82eaf1adf8732815726514a70866256923a62ef9ff94a948ab59e195c4f995395c58af4c536572dbbeaac8b401771f40a28d571dc7b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560830f823929632f10b0639e4c444632
SHA1e17709d1f8a4434839a148547c1e1bca04613882
SHA256d29f891aeffe4fd1f32e017721bfdcb2fbd416bc98c3af42ba501dff1697b3c8
SHA51245868ff52b52a3fa2907baa92f707c83ce8d802e1a32727fc4a2d894463d0b3dac8384bc16747d7e345a286571a84b007a1d65e589bacc2904d4e639eb043061
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5783f06d974e1b4f784d9e2cebbe61c76
SHA15671bc0db452c516fa19f94be42b28aff93a2206
SHA25602e0758128e377c76d851a498fe223eacbe314eeaaaefac49e133de6a61f6b08
SHA512723dc03279825863988b858b525588e32d572e02f4090930b28804643d604ee403f3e6be79b21cb9d480fbf8fb75cbef5368459913854ebbc05c124e03f1e6e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52fe611ec51cb9ef551971ecae7986065
SHA114f9890a2fe075cc762cf8c70fd95d67a5a7c199
SHA256252cad0a5c9a5f85970889e992001fad283c48141bbcd9cce4221344be6f868b
SHA512b5376ed9a91c692a6f55834a332098d722c3eecac6b6bc39604b8abbaddef1c5f2a478328267ccd2925594110de97cc3841ea2f34685036a58a42748837bdbbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1ca61148a43c84febc6a010c429c664
SHA1165285bc96f5b801c853f7eb9cfea4f49e946fe4
SHA25651cc711cc74f87dddf831f913d50dfae79669c25b888d654a8018089608a80a4
SHA512968a3076c91003eccf8406394dc757e6addef949f64b99b2cbcf71d1cb37f9831db860903011080fe0a66a1a4a6c0e15a5aa915a0d2268a7ffc17cc658e29cd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c814208f4fd20ca47b56751cc69cacac
SHA1c4d72b75e3f7756009a710086e4a0b9aceff6028
SHA256cfe6dd79a458aacbec36f9f8df2cd07bcdfce34ecccadea79ed1247dbc2ecc0d
SHA5126f2913d2d840222c22c52ce68deb0383aae36e134b0e4fc49254c4ae8e0464d92bcf4fc00d3a09501744054fc00cea9a535e179e6faa40601e896bbb342ed03b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae205a568dea513e8ffe7df9661a79a0
SHA1a53cfe3260d26ac44619b62af8dab963e5285607
SHA2564e020a863f5198d5975988de1c31e7ce5a2338cf1ebdb5b9f31f5857a75ac783
SHA512e4a5240f5e9610319e26875827726fc038ae68af2d9d3be6f2362eda4aeb09a8fc59b473ee0cd4f3b3a13c86e0b6c44e7d942e07c1d559e45f8cbb0dd9e6d76e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528363067da8989a0b3373f5dc9569eb9
SHA13fa38bbd48502bcb6f5e187a444c3b76b70abcba
SHA256261402bb346e93965607810a28f0ed3c0a9a3451b6e38fd57034be936e2f74c9
SHA51215186ba20311692666ee0b9ba4e15bcfda804854339fd49d02f1c1dcf9b199cf71226b3ba1a7348a3d58517941c56be79fe51a478b3f2009e0bb24e2ae680d22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe5d867d670760d5b2fa084dc4577b64
SHA150da31332f9031844a75948900dca68f66993adb
SHA256c8ff7787f8a5f1dafd2f13300c3afae64e129ccd0b4765b1724aa0eb37f2a8fb
SHA512f7be4d94d42c4af4504164ad2c98bf2b623a1b49c7a4a45d25aad6671eda4e1ce2b47dc4775b7d13f350c968c3299a573daa72c93dc43c511a421a5e1ae15033
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5844e2b8406f792db1f9330aa9660a0eb
SHA1c28f4f17c6066ef2fca8268a4c2cb576afb74ff2
SHA2564714d3b335a0d284c2713844af6516c8529fe8fedf5c503e525e660ffc7a6b0b
SHA512becdb1bfd288225583a9fc10772c5c148dc8443939cd5975aed88fbcf02076a61615ec3bbf0c6a4b98d70a336246ec2ccb99f71fd4967bd7e4090ab8350719ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f64018ad179f17f76a3ffd9ad513654b
SHA12c363e544d1e17f231a38ecc088fc40299f37bed
SHA25651afd097295ef22e59b528ce3f45a3357c5ff1ec91aa92308a33d790cd5a3da6
SHA5120336e52116fc6438a166fa28ebd973994fcaa7daabc8d28aecb4244177c29e15fbf642f9c2e27616fa1e5a2e364e39a49f7f6dc97c0c4ea7540e606421954ab6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544fdeb6e8808f439c79adbac517c8917
SHA1130be19986d29dea8061e5c239012b5c5f11c0bb
SHA2566a759eb857c2e65654ada5ce0f3afe68d8eae92541a538226d55f88adca4b24b
SHA51216a27fe0bccd37977ba1eef5a145a59116876ebd304e38d8cef10bdac9c8db679b552b838d7c58a9ea8049bc54173e49f4a97553389ee946e8d40d6e02d41e04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efb647442ba4480741c084b95431ff99
SHA12c6084d778ffa545599f4c03fdb8526b16fc91c6
SHA2563a76d9dc646c3c5ab05dc89c9400d66804167469f499bee2d831779786894627
SHA512e74478c444e4d2c81b89c9963181aacc34165b0633ef9e33bb09ba03cbadf24456293dbb666ede0c74405b46f27395e12ea40ffdb79e9709cd5219f9ef098b85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dfd5c884dbf9c76ec32d151bbcf36622
SHA1206a309f07e21c230c1e7e0c40a4907834201630
SHA25625bc248552b62fa76a02308fd5b5dae84764eaa2fe3eebf6018c0a0c18fceca5
SHA512e8b4f76f659f84f775f0e29e354d5d74d033cd0154e328e4dd90025aba32d82f6c8177589d2b7855c01a27842e82c512a0b7a793196700a35cfb4cc5f1ea4965
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cd62fe49243a525ea35300ea54f5750e
SHA16afa4661b728f2ed7cf65230c0ab9b2f59c26068
SHA256fbc03ae2b76dc96017587f019b71a1238c542d9b1339d22847b464aac989c08c
SHA512cf96b931afe6baf454eb74c8dfd7c3be7c2c8c1cdac3bfc07760d8d396a26ea35df1693dccf7e282047f7c277fb1a9f353c3620bdc6adb34826f7bdfec27f610
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b