Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 09:37
Static task
static1
Behavioral task
behavioral1
Sample
3cd9451da523af6353ccce37f0f9aff1_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3cd9451da523af6353ccce37f0f9aff1_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3cd9451da523af6353ccce37f0f9aff1_JaffaCakes118.html
-
Size
21KB
-
MD5
3cd9451da523af6353ccce37f0f9aff1
-
SHA1
84f8231d896e1838b15afc284900266bfc96c80a
-
SHA256
44a28ab2ae8a8d1befdf60ed849f34310327d223cdfdc9695077e0479e37c684
-
SHA512
94591428a76cdc99f6a7ea93a2779150a7875e94ec45f4afc5ea3dcf367f789d0504496e4c707b3621688a968ea14f8107329450cbedde6386798738e982b509
-
SSDEEP
384:jM6MKHuDfYxehrKepZd6b9EMDYXTw24G+F1bnxiQkPnGgtssnM98oC7ySTtqWY:j9O7YxGKed6b9EKcw2OhxiQsnGgtssnW
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0248e223fd4da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000f285d94544c52cf0c77a5333aeb05aacf4c38ac6d3b4af3b956a8a033d6e0108000000000e800000000200002000000075d42f13e89395ec7dc1a45ffcd3dafa44d6dbe2e87f09396575ca282a098bb090000000938a1236d49dcd9014d46bbe7f23c3cbfbe28208a03dcc6b4f7804ed1de1ef44b5c5ea2c386200e0d3b824c8209a7948a81fcffab22b78784345519bde6bcdcd1db9181ad857863aad4853445e8fe598aaf2062a9eb1732677491dd91e7e86b1f8012540e712fee7fb4160c6146d596b707ce022e278deb65e6a89318d9a2a9fbb20c7d1737ceff8b8f8a486ce58a329400000000c68ee4501096ec33b358793ab2c0aec36b9a9931460fe79719ea05ccdd5f7c0ac7c43d06706c21c00649ad742a59bc5c576efd098d9bce48f7fe86329705c13 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E083571-4032-11EF-BDB6-FE3EAF6E2A14} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426938895" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000069ee3e931661b30860b35499cde6ee8123253dbec2fa1250d937dffcc25242c2000000000e80000000020000200000003e6219990ac20896636b165ea4dbced060fed5ed6029d24ef5d1dc3f0d6161502000000034ec0dd93c0cfb86c8d204773c19129dfa47384a588e633f4e6a37566ee780f840000000d24968f3594c6f3e29d32169ea053cd0d630fd50827c9c23840cc7e83a82cd4cb3e4c76618944bc35f0baaacc6790649b9dd03a0b1975727e68d643ee4175833 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3012 iexplore.exe 3012 iexplore.exe 1744 IEXPLORE.EXE 1744 IEXPLORE.EXE 1744 IEXPLORE.EXE 1744 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3012 wrote to memory of 1744 3012 iexplore.exe 30 PID 3012 wrote to memory of 1744 3012 iexplore.exe 30 PID 3012 wrote to memory of 1744 3012 iexplore.exe 30 PID 3012 wrote to memory of 1744 3012 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3cd9451da523af6353ccce37f0f9aff1_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573bb1d1860c9e45f3a51bf0acc947c2a
SHA1a08ff72f6da2e3cda0e02e8e5d925cd93c6b7162
SHA256f75aa5cc7757a1308d743357c12cfb4810410d06577de92f67efb6d297461ccd
SHA51219a6f9beb39ed01de143f44a7f208c8c1a5210b609c39b227392306a07ec9a9a244465f928cad5eaa8577ba9257d9a07808c559a486b491fe1657b3cb91c692d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52450f5b075630321a52ecfa0ee4b84a3
SHA1fa0305229bd94c461a63bf08e04b5f56a677a19e
SHA256f8c16d099b100f4cd9711ea19d1fae6722ffb3372841b4edaeb30b040b3d66ad
SHA51224ecbb97793d7f30ae38a43216fe01f07b6ffb882473fd6d86fe7fe8d21a9d21430d0ca505e3b01f284d10c4a12823d82cb67b2b5472626442ab5da5623a0f38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8317723c42580ae879906b27b49a889
SHA17a9c79e237bb45bbe966ddcd58009202029b9c8f
SHA256f76500cd59dd2fe0cb89193439cec96d862c6bf58e4f060d5f2314d0a82a4b56
SHA51295ed5a3036bee64a5d0e297f254db9d9a41c64ec148de7812500fb5647cd64dfc5a627725b7485d532bfa85c8352a59bd31cf4fed4ef4f2f19ef6087302898b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb2f0ff650cd24eff62d409eb93beb7f
SHA1ae5b3a823800fb313299a9bcb274150797e7df9d
SHA256f308e5a8c54332368ad0575ee6005e8a4fa750a223f0f0646e0e8b5b3bc7e3e0
SHA5128b8e51a9ea2b2cd66a5f8b3eaf8e93a502b79ff7b350ceb5396331236d44f1c3abca7328da629286c56da5ccec6fcd908b93888e946970d295422f7ef2da2cb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5487b340aeae3bd06f84b2d20b61f5ee9
SHA1243ad845ccc68af0c696a06994bc076cae160c9e
SHA256fdd62c53d7660035971d1bc40be72a139a8818afed8dcf8494f35cc9c2b04ce6
SHA51208425fba6850cfd3a762d0543969cb6c497d15de99f1387717849bdbf5489ad3b32566b462ada0aa475ac35e9b7ff7885aaf6d7f4cd23173cf000b2243cdaef3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a778b338fbeb8152fb29d86846f1b2f7
SHA10b906a3364f09d605f66eb90c480845eb0afb62d
SHA25682d807b9ab07a1a10068806250f9353838d71338759b8e74e86a750b0c5d38c7
SHA512de532304e563dfbf3b4e240e183c8c19985d75c5f9380ad67d92f57927002fffcbe64c9b07c72cbcdc3338f0fcaccc702ed027b1d69c2f763978af7328fede56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a236c24e91c943cb2254222977e9c012
SHA10eba901ce67ff5d72bac6ba759cf4934a074f457
SHA25637bfbe420eb9380acbc4846024577c1c7393cbd5b9be699dfaac81f294a77068
SHA5129c09da1fea6947a9ec66776f9e0335c560057b54ab3d8d4ba8f85c89dd2d617c8deff02da47c5e9671171336d579fe0edcacb906b35722c0a21a5e8345b1895d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eaceeca642f6419fd370eced95099cc8
SHA147db9219752004f5c72ccb3b37963fb604aa66d0
SHA2569fec25e246879674b12fc1c1789a76bd9c34f999ad42af8df0c16366b83f1888
SHA5127d8c485ead08c13a746821d970bf1b61c1932330383ae90a7c644813012c5517fbcc4b32071903dfa573a2f5d415f322b850d8032c5654dd7854846a6f8f5a8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cd461badfde2e610ef77a266841b799
SHA150284f14619ea6ef3dd3cf46b506e78daa50df5d
SHA25650a4fe26600d353460c6c1db11c8a9908034a0a5ea9522e49d0d722bcb306e9c
SHA51233a6f45fccb66b4bb3e580b22e1d3b5a6b199e0aa31cd24643fa554cc33d0db8a4b5486e1a55a1eeddec9c704b4f61821d86ff282e9a4050a937077bc601fd86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a49026d7f3b510287510135aac0d2701
SHA182f22675db8e1f1bdc7f22f863d5ae6362a2d2c7
SHA25682c24c36b82274f04f2e8fce05edb6276739a4d007779cd33455c0a05b6c79f0
SHA512c6225cdabe1e09931026227fdd7d63ca49dfe29b6d40f80e49b834397d25f3c23d36809238b55e35f3cbcc2be7b6061c66da82687ad9529550d9d2f863ff6c56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f63bb0a8a7101e23c4d79cd107cfe62
SHA1103e652c4df834ad191bcbae69ab4a438f5a8296
SHA256802551d2a9f17c3b36bfbf72c0304bfee38fdb4199c8d8fff4267929a9cec4b3
SHA512cde4a900c222fd1729b9ad706b31499c14040aeaf0b839fbfaa0b025193a6abe63315aa6f1f310f5c85c14e7dd73ec7cbf6d3232f84dc9e5639e101e40bf09eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c51ddd30ee68329d19b6b2f6bf09a49d
SHA134b9bdf61e1b9bfd5037f88a496920143e4ae429
SHA256e88c50457886ae4070df00b1da4a2c8180721410815036debcf7878eb6be51c0
SHA5128b2c43931b862215d0a70975062ebdce0e698f3274b2155db706be73573801b73612dcbd83146ee0b57fb053dbcbc1dc319d7f50fc388511d158f81b6a2f9b03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b9c713c7b54ba1d985da606146879d7
SHA1422092c6cdac48271bf2a1eafa94b3f214c486dd
SHA256ff183e66d22ca7e556822d1b2bcad3a3b962529db42ce193ce08fdcf16d8455a
SHA51247c78e5930df18b860c799dd3a679b09d49dc0e3196dcfeb8dfda1080c90413d2395971133d8a024a88e2c351dbf88093f877c9cc815f9928215c7b8971b079d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f03e5e41e38e2d6d354c454eff5a600f
SHA148b674d50ee3c080db653cb34a833c1edcbe9e22
SHA2562d44460bc90ed1166f37b1bad8276330b219580e6dcee1b74624cfc6a822d11f
SHA512582d7db87863ad8490f1b2ed85216dfda22bda0ca3dfd68888b8d67a5b57f34fa72011b1028c9b68ebf035de7cdf6175b0eb37d305add39ac29fbb21a79329a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5867ec2b134a29003b5bf5e5828399337
SHA1b988b49424224b8ff7a2ceaebc073b7f8be53446
SHA25649105c631a86fa168125b544edfd8b5e67b3fe156de98a9484c19262622729fe
SHA5126984ad1a08b7b32b34c6f3b047930e437135449dbd16119be726db671d49a4a1957d9201ce7f00acfb7b7cc75d780202b66b6f2c215e2fd81680817e0411fffa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fcedb5ad574b4ba9ce0367865a0eac2
SHA1504aed57e0ffc1c52cac8d9dbcf46674871b9b37
SHA2569b6cdaf9946f197b0181f77431b421ab4442b28b24a5c716027428dc7f705b9c
SHA51244551541a356ede87489ddf8695700ca3a9f8563b1b01b2fbe8bd4487ba3c9e737f1ab1c1344a56f04f2d50b46c415bf4401fa4a9df3414b91610d52caa0c670
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ac46f4e9dee0651ca389a570fb4d2de
SHA182f4268c5df2ab46e04d0a55ad934fc9877599e3
SHA256b5f4f75893db74287da20bea5dd81022fa2c4d68a454f1b578e052c8e6886a14
SHA51276e8891dca15d2e1809f69e01d8193a9ef560a1c1b01a2b3a8ddbf06f4f3de12c5c36a8dd135a42190d950eea304b51c6dab475e209afceacb90e7c2dbb7a8ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af2669dd1c4b992c6616f1733685ddaf
SHA1f5474f0a886a1b4aefb0b3d2ac8198c145f130dc
SHA256e76f1e4cec33ff30d47b898c186cf27a7a2d2b9d941e255015619695cb47357c
SHA51282f8eaa4c60dfbe82411bdb7c740bbabfb70c5c93f394658f3655ae439ea01d92b07b8e76afa5c658df07e3ce2bd1787d05e6959b5d6017d3ed4731504726787
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5887d5283875ebe37f1f4b7b5630dbf1d
SHA1275a179ba12ecc4fe9e4623516d79cba729c14df
SHA2560bcdcb1befe51eb065815e3716e5d96b3d2251da1f715f321d147d2d9a60694b
SHA51246345782f273fc72763d9952a3b26cdfb3d55e7adeb56de135d6e99caee06f35d5f7d31c49d89052c68b6baed7a023b82b7204d78d5ea16e28e58fa3296043da
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b