Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15-07-2024 14:06
Static task
static1
Behavioral task
behavioral1
Sample
4a00051ea4be20e64b4f97026cd4e9ce_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4a00051ea4be20e64b4f97026cd4e9ce_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4a00051ea4be20e64b4f97026cd4e9ce_JaffaCakes118.html
-
Size
90KB
-
MD5
4a00051ea4be20e64b4f97026cd4e9ce
-
SHA1
327c0b8e768e996dc7d29ae10ebbf3746cffb138
-
SHA256
4bc316282fe7bfa81e383fba0a8d75f783fdc7ab81566874c6b3d8332309fabe
-
SHA512
0626fecb9c9298342f63bd00af68f57964fa65ad9ad31f6103d1845f916601573634df93442bcc12ba714e03bf5c8900d9a9f9d8fa444f92be21fc03f4591db8
-
SSDEEP
1536:0gVxaYj0e48lFRZXBqf5nIfGuDifBwEPwFuN+ZQ/WgJ5cBqPfVT0MMAHE5GFIkd5:xuS8mbMe6Xo+Ikd/dT
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000002cae0085aab31f524d7e25ca0236d01af37db8b34d73764e8afe2fcc85e37a04000000000e8000000002000020000000a63bc7151927f235afb62cbd33dcad140175e15136f08c9024f63dd40b46ef8a200000003bfe67b6b2f51e1ce478772e7cbe635c45be0bc6d7ad462d50a6371d46b68886400000009063d611683270363453b849167a08a9543e21aee67f3104f6902e2ca01712b4f2dd8d9faebb1cb8d6872a944cf14656617b602dcca0c16cc3c6607e3adf024d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81F0F811-42BA-11EF-82DA-D2C9064578DD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000002f56feebb406b38e24a7a4885b181cdc99e0c218bd1176a5feaea0cf516c48ea000000000e800000000200002000000071de2417746364a83c4b59a30747db85b8e6da42f5ee01ae7e69229bc47ce98890000000b03820b3572d32b1bad1f581d2d7af5fe64bcfc5dff81fd25194fe95caee58ae8e02953e5f8bce0047958840851f9749c637dde6ec57222a00c65a2e13cd09d6f0267f6044fa72464e430d7af8625a21f51dcc9af2314b88070bb0721bf562bef5a81118797b7fb59e76de8ab0d61f0d9c1d4f542c7e7bc60ef4e1e3ab5b136ad0745ab9359abef3c22a87189b066dea40000000ff2b0c84d8f87acb23957494b218ae443da578b44c7a043c2f3fa997884dfc7ceb83262f79179a35506402ca79366ed91593e71b7dd8f2a45752b04aa4b426c2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0109256c7d6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427217295" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2948 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2948 iexplore.exe 2948 iexplore.exe 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE 2324 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2948 wrote to memory of 2324 2948 iexplore.exe 30 PID 2948 wrote to memory of 2324 2948 iexplore.exe 30 PID 2948 wrote to memory of 2324 2948 iexplore.exe 30 PID 2948 wrote to memory of 2324 2948 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a00051ea4be20e64b4f97026cd4e9ce_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2324
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb8d50389980aa18bf1fad476f0745d3
SHA1f9f7c097b43bdfb7ef60e87e81f0055956234db7
SHA2562fe85d60e3f6aebb0d236d7193e95f6b88e669c4a6ea54b794362e7c8e735b3f
SHA512eff0bdb7bf6222c284615b0c598c2225f438d6afe23c205543fe8380ae05784e6a1830158f0ad06e16cc3115491c5f924af6dc6f409a41a79f11b5f86c45ed97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a622ce0bbd54723e91a5bf8a5db9353b
SHA19bb72917bde70139c2995af017caff2d91dd8a6c
SHA2563a6d3e7c99c3b2b9476305d5329abc8d92b8094c06f5a353acd385281cbaa039
SHA512ac5003ab4fc716f7728ba02acd51711ec2148f86b7494496f9f40ffdbc25b857591d3040f1243a141e93927af257382126ad1a9b2e8609e0027f9725e8bd522a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59074ccbe2ce28a27a817e626ae395cd3
SHA113b750308eb14c3c5ddd52b786dd221945e0d4f7
SHA256ca6b39fcaf92beab013fd9aa7d46b38b685316dce675bdde599e72e0fdede03f
SHA5121174623fbdba580bddcd6073b7ca08593d4bd633964145bcee7a8217c2d4fba13cec368eb0c78d96a362e00ba594f75f5124423376e146deacd77f86eaef3f7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7d0762eda64eb74239b5cf160b6a748
SHA1160f626bcac4b5222f26459ad1915be9b1a5dd13
SHA25614928f2f199c7e7c65f07eb9b64fc92fdabd22d957e97050d0724cf0846c6cba
SHA512de46e30e98e1dca57834d86b6d28d00f8e74ccfed244742734535858a939f427404e8245eb846fe7b5f14ec9238643a3d13f035fa0be7e48beb3e4145f694d66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a3b3fb5de063e0b8bd7b247d9fe3aa6
SHA19f0a5163d23e066d64aa7cc26b8d55884b7a5108
SHA256e1b8f8a449344da92c3b5cd821fc3be904b09d46a7d561a9479cbb3520a7b57b
SHA512d653d7957a05536e2b2606b29a43a7a32ba2922d92ea23e001852632efd686402edcd75df3b39f777773ca5353139bdacbdfe9601b1a7d2d5d7e7c94f3cad7d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a3744c6194939b017be4c726d116b4a7
SHA190e849c4d324277b77d68d10220691d82af4f1fb
SHA25628f460bb1881e5ffa629ae1676c133d23aeacd4557f5dd19fe4e424f943f5a65
SHA5127b381ac54185ff5eaf2f3034b47143b5b292df474b4230c1990fbe948382eaee79bbb5285287a3da1871183ae93e647c10cc23a168d38c1538a75f32ca3a8add
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9bdeb94f939dbb5bfeb0449632408be
SHA12f5bf675d9f1a99848d726081fcbd96f74516cc1
SHA2569b7935c0546e84dd4eb76ea6bced672e346148f5b032ce1ca240cb479392306f
SHA5127daf5c8f9b2008bb2561667d5e60bb8cd483f85da618d62f3c8271bac81df53ad6af4c5e681124beed11147e91b89a791c158242bb6aae5fa4f7e52ce083387b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56444441e781d2820c9b587480bbef9a4
SHA1345c7858d999f304bc56a10417d3d7aef2fe912a
SHA25602e5a920b885f88f222451a3756d24e1d65dba717c759fd9e1fabab28dce21a1
SHA5128e6ff09089685acc21e7e7ad72e4d564a60631e2428d0f78c1b9a6828eb03e0a4b941108c7f3b1f1991d5fd65d83aa2e6337622e53ed30c46332eff540430e13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdd2e73c575bf06b16bae1630f7c8252
SHA1f5e1d6c9472bb96e6692e2e1e2fb267078e02374
SHA256e1d18d9f59c4d4798179f116ab413f3545b6f10101d8b158713764f050b2b3c6
SHA512a46f4f318d1da21810db4a13c37fd8aa6184c8e9f4c1becd71ba694ba7e07956c8de74ef4134b8ed603a5243c22e99e1f4c30b28d85116621554fd74bd554a82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5262c04521a3f9951b8e5c49b0235a754
SHA1ceb237c75ec4026bfaa7e7842a234525864d02a6
SHA256206302dba7bccdc00118843e765e76500a32bd7f2f4c6ce7cfc0e89ed45c6498
SHA5122cca21319c911d5c97997227a7bbfc9cd0b28cf38bc287588c95e6495292ae504821b356d3a11b81ca33893cfca725a60c07e354129ae04ba75599b45b225560
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d24a544fd559056b34f2023d2579720
SHA1a778398ceedf16d7568f13b325a1d0c600e3f345
SHA256e93c5ddb3218580e1f6d6652897f47207cc5a24c089ab86c3d54683262a68979
SHA51287b53db4aeea61cdfc00a79fa23f35442b839cf5c97ee4561fe58812b447ec4a3f755b32148785eac98e5b50c5866fe06e755094f5ac9e3eedf0d2164866d885
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c462af26bf357dc98a56e2a234221a03
SHA1d73769c59a3de17c630e2d7a525c640417e6fc56
SHA2569a55fb4fd58152068631e803ed97a70e96b4764cc2beb0faee3c5a2a9560e92f
SHA51224ee978709cbb8dffbd3dd71b055e3f8e761b91c1da36c9e073454407e93ed8045ba48c05a95eb1066883753f03e6de84d2543427e669479f4f1faafe51a197f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59dfefde71d73393bbae0ec8da7ac0b80
SHA100ca338ad116ce61e482943bb07b46f689cb88ce
SHA2569c3462af14a5861944a7e9aa8225cf7a4a28b1c0d0380deb8248d07e8a7b6287
SHA5125bca8be6a6123278399c79b50b4682a5d79a9fc66dfbf7e53b947ee0ba9897251f164f0e6b875f94f83502d9c0323f183f5a2dc764de4570e388ef81cbd13613
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563887ac773fd39d7bebdd98fadb65d52
SHA1a370c85f7b8479ef7d9e28b34252f561fa01ae80
SHA256a2130da57a6e690311e43268708ad21c86817aa2f6752bc02dafd2239fa7fbe4
SHA51258783cd4b0d6e716bef0b9b3d019aaced3722bbd27e55e8fa6d872775e083759525e019770fd3b348121899df8585b5f3c8200c0936a1a5673aac7bc904d4d59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57deb6b304ec4ecfa2dda48d4a6d41571
SHA19c7a75b1faecad6fbde79157138b78acb7f93c9d
SHA256df7e131d698b8cebc1b23d7475e8fa900c302b9df3206c9c0c19c11bc7bcb0ec
SHA512a26e9c53b544022ca9292cafd25644cf62a2aca900bb4796aff3128dfdb8bf7299c909050efee4b009b760632944627e34bb42cc9850e6c071b7ce0e75d71b87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5322f97ee630cb89b3102a7394e5601cc
SHA15e0d68e93851b7edc6577c6fd02cfa76312886fd
SHA2565f9cda46b906ecd24638b9503e97e38aaca5348402b8866a10aafd45d035bf8f
SHA512bc1f179f1e7ecae23883483cf5ed001638d5651bdb8d6adfc0986613d1ce819ece54a0fea3b412c008d338257499cc0c67684f44a7fd1d786ee47f1b5b1420b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf5e7690e7da9e6e83db8fbf59ed61af
SHA17ba14e3b1ea0e8ceaf3d1374e2261289b9d5de51
SHA256ffff7cadc1dd0efdeef426a3a115ba669ae1ba66d03bce157f3a48ebeb0f1204
SHA5123afbcbad0710f69d7734c4f7d0489167b62c2da0dd1dd59cce6ff13eee5be4458da1aa6df480a67763a06918b578ec1a23f7cdd1f912f6ef0fd22ca8af0d6151
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5170b51573feba248aa5037c5cccbd682
SHA1d351a4c2a716fde44bb98679c9ad1125532ceb71
SHA256a0eda38a40de0d93dd2599f4e9752f754a6a6bbafe8db381eca763ec751cdfdc
SHA512ea1732baf7ef7d02de75d664e4919864aa48094198f34f5ca3fbeded17ef3dc97f2fed7519918c9bab7640ccc3045279a42d5007e9b52a74a181612a3441741b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8fb3919f6d5f8f70ec6b7ad12f8c45b
SHA13acf7055d2aad0133418556acf1763b6a3c17c07
SHA256c7ecc67a22a45511c4135ead62c98c01b5da6cb63cdf3782f9b6ead8ab43e7cc
SHA512370d7afa5ea59975a714b2267769b9688e2cae289ec986011c4dff4b4f940abd36850407ad961d1c744a1b4f440c465636b3aeca300e62e86e627dc21a92f8f8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b