Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 00:28
Static task
static1
Behavioral task
behavioral1
Sample
477164edecef18be41885fefbd67ee1b_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
477164edecef18be41885fefbd67ee1b_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
477164edecef18be41885fefbd67ee1b_JaffaCakes118.html
-
Size
9KB
-
MD5
477164edecef18be41885fefbd67ee1b
-
SHA1
eef8b7950bfe749d65fe2f68621ed4fb1345b39b
-
SHA256
176e82a397b3c5ff69a7f7b2d1c10130509f7918a5ff8c9047f7d123f8f6608a
-
SHA512
43f79553674df97968c7a390b0ef55b8ece10039bc6e654a6e6bd53c40cc8a3348b6e636cea76cb59f60e15302df06ee9dca5c0e97d6811a70af2571d3842df3
-
SSDEEP
96:uzVs+ux7a6gLLY1k9o84d12ef7CSTUTGT/kPsdpUlVHcEZ7ru7f:csz7a6gAYS/y8UPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427165203" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0493f0f4ed6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000d5fdd1c4fde3e1075e418ca11bafc6d08ab78d3e381864a25fed4c49845895c1000000000e80000000020000200000004ec003a8d9dc389471707e5424bb5949f2521bb935f3802c98910b8f428c9ecf20000000c3a95ca841f65a1d79c908dc15bb80350496fda0cb5afdd66dccd9fde8e5a9804000000032f0cee18ed39c986ee0b6d3c45037f32cac19f457a84cfded6f2129d707926555b08d001153d87446f542b4cea391e20d2d7595337ef10370d4a7c5c7f811ee iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000007ae5e8832c87ef38405727e417cb9f38cbb1a75226d6c29ed1fed6a0343eaf41000000000e8000000002000020000000100e5506ff27f857cc99d1fa6656c3efda4f4443c365aaa8d90331ca660ed88f90000000bf34a4c0a603be2279c702d71ac085f2a6f13574b78b67dc37dfe84fc6f8307437b2ac2b81178f0ad714f49b614c0695cbcb603fa0f35cf1c4c59ed96448b933573f7b4d948a21ea349aa60dae72cf105a7c52e93d63be13197730aeeb4e72e2e7a2876768e38f218676d9ef2a2934d22484b93fb8d7b44d833fbed9ba2494fee5d67eaf18dbefa1b2e03b8581f1e2d040000000563c7fc003934221f204ef6da1e8c97d42419e5cd540d1edbd9bbeb6485a4578d07a1c36981f63f3c380db4f9f1e0deaf3feb59898d11bfa12f169e8c62133ed iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38B0E031-4241-11EF-83F9-EE33E2B06AA8} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 292 iexplore.exe 292 iexplore.exe 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 292 wrote to memory of 2484 292 iexplore.exe 30 PID 292 wrote to memory of 2484 292 iexplore.exe 30 PID 292 wrote to memory of 2484 292 iexplore.exe 30 PID 292 wrote to memory of 2484 292 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\477164edecef18be41885fefbd67ee1b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:292 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ef57c85fbda62786fcae3e08a4dba5a
SHA1c09f923e918147d84d43a1fded92bd1f11d41bf7
SHA256b8f44ece624a99e701f4d12dde755cad556b9aa1ad2ccbddb190f281cb0a562c
SHA512e5efc0cef43afd53bbaeaf5510325a36d20c50dd13ad4c092c8ea62375884f50c1f92543d38986ade6845923d8106710602696dbb60191c971c58a2089f7296b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5461d6252734848cc7e16d637d20a0d93
SHA1776470ff6b9da0555209a776730def7998180c84
SHA256efb481ec3454a87a2b250b2e500ecb571ae82898b42143f318ffaf3a0a4430a1
SHA51232388f56125ce5a295b2fe7fc42dcb6e30bb886a1e3dd37f36f492be68f4982a43df621bd7e7c85d1016fc64287cc980ecb9132ba6cedc8984e00105a1d1c943
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d6113cb9e1e71c5ee0ea73122671f4c
SHA111607816948d421c60a4cca7435ca074c626e974
SHA256e646dbb59cc3be6bed971f0f0764804ddf56c6b487c4bb5fc97f53d778480605
SHA512a5e99945b894b01929c0a9c4329b1b3b9953531c13156c585e4bca62a806d656216641c89b3212e9b732bd0590b61b2a00d428146d42ca0b50a7d1f54cf2fc4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae8f8a25b50ae7c6a023d62234c834a5
SHA1dd393a97b83659d6ce9678acd2303acf87c1f1dc
SHA256ece0771da2582ae938173fb7c672b5d4d8354fc8c58b71356481fc0262677d2a
SHA512da29b43d07f292f305c2117e6ece7c6c91b3215b5c88852b737f5ec5f6366b94336226cac7a9e10111ace2d7298700fca4b0bfe736b13a43950d3576ac94e710
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e561dd5b22d6e0ad1c6408ab2cf19c30
SHA115e9e41e5703e1bfaf8f5d48e1ea9c0b86b0a9ea
SHA256eed201762cee897d8ce28a536be23e5947aa8caa5e98bc7ec5b3a715b2bd147b
SHA5125be347bb85ad4325657b82ff05bdc4a849f889a905174d388aa498938dd179f85e0c822416f82733717d4f164cbed4d02bba1f41bd0f709d5a9a96af8e43b026
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b2e2e3b47af8e665635156ca910bc40
SHA1fb482ad52b4af1ccb1464914c7f2e12212c6b5da
SHA25629bb64739f8d0c5149a9a10ac0a1adda93e8fee758303643254de34d608c2c5c
SHA5123e32f75f95a30024b1d207202202f71e7e206298d703edcf023aea5c337ebfca31695ab97ee537cbcf5c5fb4a6763eafc4f235487ca893c1f7a84cff4d91a208
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ae2e524a7cbac7d4a9192674a076ab4
SHA12b90f56b167eadd6e101d593fca012e93e5af23f
SHA2567201184c9f287eaab0938ea71363965eedeffc7ef335a637ff3ec1093be81a1a
SHA512e29806371f1440142b315d4842d4cf0f429ca1827b83e6330f9377e30edd1a3ca7955639bc8a6aa458ae3a3089b7aa3f93b1705042d9e9bc0dfd4ff7f59e47e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce1517d58390db8ed7cc1ec75fca2e56
SHA127c48ecb9b1c82a9e1eb200d4f381b67e01b6c50
SHA256ea4d9257f1a5bbbea28934375adafd1d71533e39107825a17bdcef3fd07b7ef1
SHA512d9b311b8400ce79e6ef7fd06a63203fcf1ba7992fe5699b7711629ee9b06cb62ddea008c8bab3b9dfe1c868c9c0bf8097aaa26a86145bb7db59d32e3d64eeebf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5f18acd3b0ad155c1f4f3b1677993e4
SHA1f42a742b27547edb0ecb3c735846da0b69278272
SHA2567182cf0c9bbb30a2a89f6fb06e680d0905937218675ab3a39f27f3f553f794b2
SHA51243f6f17a3dca807ea519bb3f515c3009f2f11a56a50235b4fd22b4cc06ff6b5295261e451b6a3e3478c57e8921485298d2e772b7cecfe060799c1b5060dbba66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5397a33ad781b9591459f5b23108d5144
SHA14ab4601660156e6c22490fc7d6699c59cc457acc
SHA25621deb5a0ec2418eb4ff234807cc41066920eedee8463bd026a7529382720015d
SHA5121458d535dbb216a6582d812589eb183884c3240d21ccdac67b31f45ec41a11dc2ba108b67b6cc9a9b7f31aa99ee3166c48342c178c08f037cf6401f278a3e7aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c77d22a35d39fbaa9b60c4a3f9a988b6
SHA184f267f52e7f1d9ab9ba428deaf079f299a9828c
SHA256c057ed2dab137a00a077502e9f68da1e1434e1800f6bf336228af01564dfce17
SHA51248e6162101cbc2e0d7d09bdc0a5ecb55ef5d9ecde82191ab2f5a3cc192e54118252fdf20c6f7706f218db73461b238e622f62d21bf475e5b789d7c3d45bc75ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5deb8d842b9d0a2a08251e0216f891894
SHA14aaa27ed01a88e51011698f12d5a0bd0231571e7
SHA256990f81ce77084336a27649920ecc8a53139a16cf5d41259536f2ffc687b02c2b
SHA512da8aa329488c5f769ea0b4a3d0504e6d484d211a1ff2f7d74375d3804aa949e19f85fec153dfd28fdb3c8b37315ef80dc1e970ce6930861df8920d84d75eaa7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5192c833902efa5e66ab89cf87e35f9dc
SHA13e27971d7f960d493b73eb22f9a976d8e7b80073
SHA256eef769bf0df2d1e4f901ed95c88f6aee3c79f3a2abc12d9deea378b742a1916f
SHA512c7a02863f5c579076c86f533dd53113447bb7988d0fa2131e4bb7df7953b766bff11f6f95b22601f2c2d47775af969c6537614a4668af659f308862621f661df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a06cc02116ea2855c4de22ac52a7814
SHA1b228fc20c64a8a18d35eb8da7556dc5661ffc848
SHA2564cba0f3b993d26d42de0ebfe8d7ff87cdbcda606fc587da250a3cc637b7fc830
SHA51261f80cf1c7317c46acfdbb0bb11f9291d6a98573536d92f00ef9d3d465abc2991b0ab841ee8388d9f2a376e1178c6f79972d84ddab57febe3d9a60e44b0e828c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563156ea693705e1d359dec7b8e48a148
SHA1dd10212364c33b4a15a00587070d8a2f4f71c37c
SHA2561fa08952a9089e5ccb62c21b580c8b6214693ef4e9ef460b006193346e876108
SHA51285bd5dd79d7c848a8f943181098d86be43af6acd792dc6edc7a309a5134f749881ca6ffafc0ddb89a7906e66ee6b719de0e395529d2c3908639bec3e77d9be5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cdae26dc3b55066cf06efa7aa1af9a50
SHA1ba5bb712050cb7a59d08ff96522218979460ae6f
SHA256b66d1951db70002114b3f515de4d1e3f689258b72dbcf1f930e19a01bce61d1e
SHA51230a9654fb3c06f8abb8b79970364c718c31d8aeca9c2309ddf207ad8323a01640b927e6855090053e27f4ca171546daf2b55200150946056d8e3ae5e221865cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c5d555b70c9f75ca6c50bc55282db917
SHA1de28c19fd97c1a851aacdf541d7c78faab6ab038
SHA256fc8511ebbd338faad28c88138ef782e86ae0558cb8e6122184582ea896fa3ef4
SHA51272df041eb85d1ea4aee045e4aa2affce1b8ca2f6fb76a256b2a06a121560c26f6c2a94d05ab709d8e2e46105f141de9e4c87e7e635be0449cda05b365474c70b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb7c12936b7498f6bb359f7512b035a8
SHA182c309c675c58b40f1b55584c782f1a3597ac5cb
SHA256d26e27d4d7f6cc0444eb5de1345eb5fe87810b39efc9e8abaae9353630d0977a
SHA5127e69da58c65648bff32c7e57f3d78563bea9e5bab7007a72fc563499fd1b7c270e30fbcd2727e8c0aee614c026110be22af0e9bc46b9e90ec51f98144de68eb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ce981c686f91cb44a98f8fc04bca198
SHA19b719f3b533ae716fabb9e1d059c21c78ffa44c6
SHA25663ece87a30406f07c3655905daf33e40837dc7bb6690fe053bf4a0db383994a1
SHA51207b198145abd9f28ea1efea0a79fa6c88c4a75ad6f503b62e9280e74739284515d6f411e48de6ac8e9c43ffddb63e61f7396eb23a1936ab841dc5673f97805c5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b