Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 13:07
Static task
static1
Behavioral task
behavioral1
Sample
45f2ca234b1653dd3f54a6c254c0187c_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
45f2ca234b1653dd3f54a6c254c0187c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
45f2ca234b1653dd3f54a6c254c0187c_JaffaCakes118.html
-
Size
14KB
-
MD5
45f2ca234b1653dd3f54a6c254c0187c
-
SHA1
c45b5a477b89eb5a072ba27d41126ffde20cd4ec
-
SHA256
73e82c0ecd3185f8b4fb31661676ecab2ec121b7577f0d5e7588ef0a09acbcac
-
SHA512
83dde013637415e6ae89394eed55a162b29322af8f0a695b7254d82c85bfc6b61719dc8c8ac44ec30b96244ecf4353041a4c36f61fe1fce55cdc4f6a008b891c
-
SSDEEP
384:Js7F/YQtPWBsQC/L34QHVi8mldcd2y3XT532Vi2kcXoBq1Xf4:Mp+ssFY/
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427124336" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000003e0a0c72d791e9d5401dca746b1f8a1b5b966375cf5650ce1109e46b9daea1d4000000000e8000000002000020000000f80d8764e994c070aa83be53441ee83d187a1582337b6eee1454e94a784efea520000000ede0e7de6bfa1b6c6accd3585545fbdbe4b2c81d76240fd9b4a9f15a2a488a7540000000b547650c21914792ecc7bc1f23dceba78f24de77792496e1f848007a5a202b35d600a841821b9a7bfceeec3284b23e41883509a39a3d9da1a16d12445bf87637 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407df8e9eed5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10D77A11-41E2-11EF-9E0F-4E18907FF899} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000bbe09f879b3d15d446cc2550e1fc5d4c7499f228a1a141c564a91150398b8bdb000000000e8000000002000020000000d11937cda6ea49e60487e8101d04ca789b253a8fbd4730dd080310b95818cd9e90000000504eef36091bbcfe266c16a0e1ccdcdc421d7e30c26556ed2906cf19f8bf9f8ccfefae0fcd0a8df3405c0251a692b51ea9e50068e9e17ade606bf536e307c255d5bcfd7a46b5aca33db9fde53961936efc8599ed3f7891a31bd3943c5461ed11cd8b1fe06e2576cc08c17d43080985e8d707f6bef4b47a58dde637ac02a6697903f9cb216cfa261bd0550ad84322943b4000000006fb276f75528d18ce5580f7895dea9ca6f6ce1db0efcddb65f05facc152abdfa8472761052cd8c679568310c843f4fa2941c7c64359b868dbc1d8826921f8f0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1672 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1672 iexplore.exe 1672 iexplore.exe 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE 2200 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2200 1672 iexplore.exe 30 PID 1672 wrote to memory of 2200 1672 iexplore.exe 30 PID 1672 wrote to memory of 2200 1672 iexplore.exe 30 PID 1672 wrote to memory of 2200 1672 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\45f2ca234b1653dd3f54a6c254c0187c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2200
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f4859a74809fec85cca48f9bc8d0299
SHA12000003480c334adfdeb9e7dd79a4336337c6f6b
SHA2567e29e5139b70d8b9eac437eab5a1b84c186aa9f4bef4e7ef8352375b7ee31abd
SHA5129cc4e42f05da601607e03685bb949cc12868fab21f8cfc6df3e51ec189ccdadd83865b32503a17d31cf2c438056147a0442fbad51aeb6896651b4ae72e0fe3ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a51278f42165fa3daad6d39e9e1774ae
SHA168599f1b67805d986216103a897c1d1b489d9ebb
SHA256a284c59e656bf2bc69009a109cede702dd33d6f905244556508ebf82e09ab098
SHA5129f83632783008644b16f467788cac20d5d0df430997d0f4a92671f81deeb332646a085ed6562a0faaea89818fbfc9cddee3d03582403e6c7144d14c95f3e20a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c9d60eecccea6f946a774e3a5bb8b91
SHA15c419f37ee433a57145d654a6890c999cc879804
SHA25601e3cc238468be5d5be1a9f76b00e3696a7adcbbea8cc70da2d7ef91cce6f41b
SHA512761c80d9b1d2aa35349b6fe7e56bd441020e0884641733c6a4f75320d29beeb7e369e12b8ab319d04f4d8d6e83e768a97c05863051480eb3195067e54fac242a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e882aaf604e4416a1aaf29642f7e6684
SHA1a575c8278d8e644d0dd59d11a192a1c9cf4f26d8
SHA2567424731158300bc72a8f29ebc7f01df730167b453abf76afce395a61d1826899
SHA512eefd533e16b392c2d90679f351f0a0fb33b394d6c8dba1a396bcdfb1b14da3f23bd6a3ee091ace6d6761973ba01d8e99a1d72d540ceb3b96169a79e7b98417c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d40bb2cd83fb866129bec28846716075
SHA12c0003d4da183adca37ecfa11a58b0603655aa1b
SHA256eb05c18ced8ebd38eda189031042921e74ea439fa39dbbea78e1dd354fb589b4
SHA512d0a76b35fc17359775512b5845b2cb65dba6f492ad78458c5c88d28b6359fe8d9aab600b85e5241723ee42b3dd78c3ec0502e31b1e2a71a65cab226738db3be0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5181c8d855a8d6de8764638dc862bbd4c
SHA18759b4e5eef2e659b61ba2ca3858a6563983e774
SHA256f96da0258519183691c4a2b889366f69f6016ab25535128a35f36d631769ed0c
SHA512f0218787af8f2cd569d157bf17c8bea5fde9b82ad5d89e54adb776b10bd1b96e83419773c855cc4eb0ceffefffa21b22b81af477ab53d6f2f96c770539ce06f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578a4e1c2be82f984fb66efd1e4463b37
SHA1f9582b3f4a271e8f5d8616dbf5a6d07f17bb29b6
SHA25630463f48a870b5e7c466208884ba35fa6e2acead665bdad2364160445c43ce89
SHA51275e3a389d68d96afa2765ca80e459b529a2be26a4f0b483c6329bbe9223c7eb487ccb3493a446b301d5902face8005d5109f12c0f34e1a9fca4f337567893476
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD581f830e05bb23c16694eb038e48a4421
SHA109208f6625ef5c1c02249d1401a6dff2dfe6e5c1
SHA25696bc00e7e190387e77802fc3381e494082365df0c417ac4334539ef05c110de2
SHA512c7738a66d64f6ac77af338788fc51d79f4a22d67d1ee2b8d9b2fd6463a924d98fbbcd9abadcbacaa3fbc5b174bd26d9a7ad158a1831ea0423ae9e321d7d6acfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1a29aafdbc6b20e21f36b4fffdd2d45
SHA14e46cc07bad78ed66bd2a9a414254dff83f38a94
SHA25624ff31b4686aa31144b63961b980903bb911b7ba1590fb3634e8bfe12352c1d0
SHA512b106aadb2f684379be9daf4fec5ae81ce5739951fe7395c0d1a038676a03093f0f77ba459ca340f09d2201f548289ac0a0ddbca09ed610dc60392a0930b05ceb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c905c2bd05a179fa1b2d7c0e22b988e
SHA14adab2bb6a73853867d780726832914ab6fc53a4
SHA25633e3be319d3267172c52ca4fd2e75227a1499c0620753fd11f4484bc307998c5
SHA51200f977dcc6f502e80842381a664b427cb48e4ed70f48b780269b9efcdf8caddd5ef81210de2e349f83f7e8257fb22279e487b384e8297b546648ed080b9040eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcf7cd10ad89b202fad1abd336b6ec0a
SHA1a2a8caeba1d8764ef2243a684f11d24810d88272
SHA25672284a469176fb2e02b579a313008c6f19638c6cf11dc869591850693201d1db
SHA5121644e5f76e847b178320a02e6728adefcb58a5c1a71c1ca48d8c1f6bf472e586c112e290c70b9f4b230d592c07aae0fd2a08d4bc32e930943b5333db537370ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580041b3d60038eff979aa1847ca66e84
SHA178ca4e92a5220bacaaac125a6f4050525db8a069
SHA256c91adaf07ebea590d2e395c4168dd1f29e498887d34763c3d25a9cd25ab53e0f
SHA512da4f4f739522ec195bf8d03526564cd7c640a34a5ff43a5fd193313d6eaf94aa5e4a8dd68d97d96053f31007e57a0c14712ad20436c4f9b065e82507ecd03ae3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa3faff93297c1ccc79503d1752848a3
SHA11cc8a378fb5bc863c62a78950bd1f9cff7ca7aab
SHA256cb465d11a398079d06a09eb851e878622cf15ea226f315cff5f95a9ada6037dd
SHA5124d8a100242fff1a8d808c4b6c114d0693b4cb5ddc5c0d937701b01e06d0120f2463701dc0a7f6458cb8441ec09cf0d882334001225224ab2213dbb9a2062c74b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a81c0ee805fe9aff7c543ccc3157313d
SHA1e0cb2cc68692bd38da2dd01325828499b48e10d3
SHA2567a108e2a6e88f28875f79ebd6cd59014083001ea671c617991e20b4dfddf838b
SHA512fab81d38b94fbeffb61cc3cd02f8d0a15463c34fb757d2c382d27b38a4456dedc5c54cdf1fca58c73536b3b8b6728c26117926fb48f98658eea624521f15f167
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d209271b3227d3845e3074816a3dc26e
SHA11693ffea4573c62d9be74d73c8c86713cc9ca735
SHA2567c65776a8d66cf054664c2e062ea0e08c38201171202d6ab7c7a200e2c276a2c
SHA51240940c2a037300080c1d42f43976b11f8aefb6c471a58000f1c36800bc7c06e5b087f29055c73600daf66c93d29be3100ae811a2e70e62fc2bb2072583c0dc9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561a9680cfaea443fb0af8ad42062a0ce
SHA1d4235dcb7d8b33aa2412bd20cb21c66ea5c902d5
SHA25618de7015139197f21b65349a14d973748fd6e0343639f2821faa3fcff55b862f
SHA512a1bb35436ca87191162e27476a010936fc1b29f875dddffb1dc0bc1be287a059439d0930bbb4c5cc975b4d4ae796a45a48e5a8989cf181ddb6fdf45c018358b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5679823f07633ebe1612a9a2d80f9370c
SHA1fcd6ff6edd497440dd1a3338e13cec6fc94bb080
SHA256651c91c121ad0ed6244d7515f4f8f729924d5e882b25f99f84772380a6cd9ac1
SHA512f5ba559ffb20f3d3c1c4c2b14312dd96c1d51b60aecee0312aad922ad49ccf74e42532db823cb24ef080e1381ccef3819bdc4e5be0a1e22e0822489aa2de88df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f3d4101b63d332008bfdb9b3cf21c16
SHA1fc724c03d907a9ff3c1635ab88b375547f922535
SHA256ef9c48b22f4a036eebbc9e3537b1d24b754e68bab3f94fdef292a75d8ee96ae8
SHA51261065ec29017fec55d41353a8f448ac2fa3ccfcdd8495956fcc6f1bad179a65122ed91861dbf75e81a166c17e3c949984fed0033bee1b265971a843eed3a35da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f1ff74c0c70f884d55b647562e79c1c
SHA1d5e238b83eb9eec877aa87517d928e2207fb2f5d
SHA2563b8c4102ae0b2035eb442256eeeaf6845eb868ccb088f24d245850ab45c4f376
SHA5125b27aff00faeeae6647a2226d8095c7269b9c1eac63e10b2fac8aefb5e982504aefa3d789dffd4da255728c60549b349fb6e67019d47d48861c8f5e8459f614d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b