Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 20:26
Static task
static1
Behavioral task
behavioral1
Sample
4b441b4945fd561169d5679ef3d90d6b_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4b441b4945fd561169d5679ef3d90d6b_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4b441b4945fd561169d5679ef3d90d6b_JaffaCakes118.html
-
Size
28KB
-
MD5
4b441b4945fd561169d5679ef3d90d6b
-
SHA1
66dc1a72b276098f204e4d8beefe5303e0da9295
-
SHA256
925846b2063cdef9daf62d3dbeee946d6ba6df42af9933b32a34239adcc480ad
-
SHA512
01df778387c0cccace0bdf4740cc8133c2fe524dc21f7e8ce0b55a7392e04ff16a6d35337c22fa152a714b5ea87d9c2c1d2adca9b21325b84bccde32f4fd1624
-
SSDEEP
768:Zcd9QZBC7mOdMMtpC5I9nC4BwbwOwlbPd:gQZBCCOdB0IxCswbwOwlbPd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000081320617975e34bd05d3345f2c87de32cc2b63dd8bbfc1837c3cb503ebebf645000000000e8000000002000020000000c8c28c7c2903d9e9aee235c13f24dddce605d839cda424173d780f18bfe8720d900000005df4207f8d8e360f8f7a974b39d5b4b2c200fa240c94f3afdd22fda9e7c143776cd40fc47c403f53d4170571357397cfe47575156ff603a77e604f6c3efe221a6083dbef23e3a1e8dfaeea9b13a19d636d7d28950cc42053fa6c14342287f2ad6ddfb2b5f856472e4c9711b62cd8c41eb0151f529b110968619779ee6bc53eb709d0147817afadcac5ef0a52db80cb4340000000ef83fdc9a51e0ee9fc9de4efcfcd897b32a398ac2bf3337b422475458b4a0eeb49b726a42123775dbebca823c32df8349e224d26ca1ede6aa0a29ef6983ebec0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427237074" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E00CDF1-42E8-11EF-914F-526E148F5AD5} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01e8363f5d6da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000de414e4bcc35babe6c31cea2a3f9b9eeb805d5b4acac371c011a08cbc794067b000000000e80000000020000200000002908d66ac2fee9e0f2dacc762f3cabd9b814e059d9458a8578d2033f043cca0120000000726fdbe94d22bca38165b114fed36564579074c4ab421449eefcdd7281c57d0040000000fe357684842e03c2dde291753b2fa9d9f98df89579b86de6c1cf286bb2d5231263acd9fd8a571ed479cc54a0d9cc49c68a65cde1070081590f716c15e6cd574f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2688 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2688 iexplore.exe 2688 iexplore.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2696 2688 iexplore.exe 30 PID 2688 wrote to memory of 2696 2688 iexplore.exe 30 PID 2688 wrote to memory of 2696 2688 iexplore.exe 30 PID 2688 wrote to memory of 2696 2688 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b441b4945fd561169d5679ef3d90d6b_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d07919ad7af597139bddbd35c8c9ab02
SHA10230556d1687385bcb101f932446f76dbe281c44
SHA2569a79081c1d74ddea62a83715d32a4889b5c0a4ce336076e17b4cabde9ad8c248
SHA512a4be7d3ce88820fe338b57f5ea507193fc80bfd3b3960bdad81b9fb912b3c8ef0c63ad42123164bc6eda9094bdbee0744abe2cf785235c6aa8e13de93cbc8b40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD566328090e7db386fdc64ef4eff332d11
SHA101c7af6ac7a2c53ec6534f15879af572128e9afc
SHA2566eebba1e1073ae0264193802dfa6e9798bc2a7de1d90905cccc78b176490688f
SHA51275d0607a68dc9fb38ce72df5a063902f7936a9a4d11575647fec56314dc4a47782b851854ef04e40c43bc964c1294dfae467300ea9464be55765730e952e3ed3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5157c2883c579e02afe7eb6d1298c0c5b
SHA1be03f8b75ff531c11927e6a694f3366d11128054
SHA256cbeb1e79b799cfeb51cae6e18f109bcb04000fd598975674152dcf619a87372e
SHA512d55822d59a1b281bf93c34624f2660ccadcea2f750d3754969914a71df38c334e8ac610dc0f31c67e832f38be5b1dbd0400950c4c155058d372afc9905a33b1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfbc42341d38c94ee5dc4189d0a3506e
SHA1ac524c1614ae566880140d473034e2dd84a8aaf3
SHA256f34f596961a032fd08a8ad2816978ada2dbf60a9ce2bb137e25ddd020b6cc217
SHA5126813bd75234f942a18a97f14e27043bf0fff4097bb60e7ca990c96ae1c2a3cabee04a71f2ea4629415ba93af292bdb6fc82d21987d337e5b0904203234463df9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50dd346b42a55fde742a255fa9f3dd094
SHA130c8792213d985a19eb1febc3b74b403bc82c336
SHA2569e163efc972fca48a9bd2dbe98ff538ede325dfe3ea1bb6bbf09221a0d0c58a1
SHA51213196bd0b4fbf4dea6c93987594fe4792f36b111e7948bb8b0e1dcaeb6ad32d8dc5e72470dc616295aeb5b9a7eb2f83c5c654ad2bfa056479fb9fc0247ccf737
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e0015ccb577c52a6aef77e97e7ebdc0
SHA1b7975ab2422f94c57608fc3f9dbdb9cabcc4a67b
SHA25607bb3ed13aa7fb9514d71405501949ec385179b2a11fd609dc5e5764cc7625be
SHA51247570759b57452b279c30a8248244f18ff5ee44d7b82a3b47589d087471c9b5b95eab4444b1834a9f24ec7b5d0e9327fd6277ac8c4a2a0ae215cb87f0b89951a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e854e3b9a96635a45bfdb0cdd2ebc747
SHA1e9ce03d0071e695f143381659197fd0e7aaba239
SHA256c051c1b0e63e198512b3e36d982b02ed703f924c4c7e748dcbcf6c741e48a40f
SHA51202508fb15d3517e11f190418bd09151553dec970014f0412fcc8dc3aea1bd667a96ac79cf9b56f05f02cadd50c295b171ca6df40d0637f6f0ff38954a1a71422
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa9066216b2732d8a29d954d68970f1e
SHA1ec649f83637332399f96300a867d10eec467383b
SHA256405d4769ef6a63893475fce61cf5a7fca46d499de03304e5cee7ddc9d72273c0
SHA512aede265ecba20bd8bd835f12d92b1a467bb60aca293c379012bf20d4122be3de251a8a74bd2f4c59c60c2ff4b9d3cfa31a91bbb7afa1075d7ebd2bd3a6bb58bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bddb297bd07865c1f32e7257567251c
SHA161f4c9a5746913a80ad1cd2a695abb54ae834f35
SHA2568347e2f8bc2654b0d202575fdde0258754e8da86faebb73b833d4f61bd4b8ec8
SHA512817f5f5f9cf8d8516ac5d5666504d2ae2d74300c6f48ef00c12a680e33f494c37aa7c5ec49e0ee3735d1961d7a3bfb5e6315716cb87ecb79061784751832aa53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb79c4c768d07f5c91348711ccf28b34
SHA1d23583105aa570a8656218f40ecca661eb61f93d
SHA256c4186556bf60e1638cb2a27f1a40af6f6c38b37a8c1c6062054cc39848181879
SHA512d6183ef3593733a4dbceba1537b033ed6e82f935c3baf565c4d2af4755a6d9e0cb1176df64b894c78281d89e49ac55483c23c84eddfb8a93ecb7c223012bcfcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576d4156fbb3fc0b217635abf665eda4b
SHA171a187ca7bcc40477468b9e8ab02aa22f3d85a26
SHA256efdf90f404f4ae3d504fa521a57706918bd2d146cb10d0205e75599c273f5383
SHA5129b9d2504ebd632c2c095c7bc2973d097f29728c346a7dc76ec590854c97d25eb10107b8eba5656f3f944a413d2c7e77d95795852746720ec39dbd7f1676c4cfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59bac18b369805415a64e2b58b58f4072
SHA1c3b5acd1e7b5689280b36892dc4c44af071d53e5
SHA2561cb87a782a2a7a43046810a9a42c059cc532b9d68a12e3516190a1356d03f9f4
SHA512592a348a60ee2b6cc324500a461547bb99a10ada500a7376c27f42a7a13b14fbd7b4795429b3925f1b2e3837b670b93c6e21314f6fd6806c83f35adb5d52dab7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b055a2a76e895094a2fd9651e8e6a621
SHA16591677dd7f79d4a351e99caed8574afb0647df6
SHA2565cb0e57d6604e26dd47cf7832910484c524a39b0225e6ad59ae5ded1bcefee2b
SHA512b60125136973a2043d626cf1772cf5dae273cb5e51bef10bc90ad9474d8476bc0424fdbe08596309cfdd1994a02ed75ca4bc77c7978337c5f4543ad8102b25ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5906e1c7215bae73556b2896f4cdecbd2
SHA110de93c9d79ef351927785c6d7bb4504a5e4bdd8
SHA256cba5c02df88ab62853b978feeb6fe68c049a154002b196d01795ad9e85982f32
SHA512eb277e73786bc3f81502278bb7457044c48c453ccb17dcd1eb1fc1b638e3cae61404a3e4678f5b1eb1d17cd0146e38d839c185d30708f2f0317454ea5441d77f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585b35b3e9c5bcd6f7294e5eac3bb0ab1
SHA1a13394482a398a1b0ed1f3fd496f0813f4080261
SHA256e19345d46ebc88fe526a99867009a0a26c73d5484863bd0b0525bcc6dbbf3519
SHA5126329030b3b54571262ccb099ccc18c543eeb5513fe68ff3c66d0f30a9db1fa95fecdd3340d905ab06fbccf6bb7989f7826358630f2fd8fcc5cd6bb6ce0ca720c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b61852b895debc7daa473a8703269286
SHA1ef87a0855c7218d0f9d125b5455de35715076a2c
SHA256906b6c1ba287ec5cef7754b604e23daa710a938686207b5e147ed824efa92437
SHA512d1dcea8ffd1a0d856e20933a9021832de02a8b41ec2c888365103047794d9a5e4369e03d765f61c32a60eb473601762c7ac154a2871c3bbde02e5f25e8a4e002
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa953af6068f79a332a4f293be87f7ea
SHA1c9c42bf9bde9a58c0129198c00e6838c8f0d2cc7
SHA256c5f0e9f7152438df839cebd92d0afec4dfca6db9ff0c79e8860aa0008f1d3751
SHA512689400ee7b8ba20f93dd4e7ee40ad194c8ada361b4d659ebb6cef4e50d9bb0368f9018f680738f57c55f7978bb6d185b5e86ed6a02e04b182c9bb07f1adda5ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7ad7f47f21d83d6ac6bf7dbf227381f
SHA18c870ceb6088d3169bdb424284388d6eb444782b
SHA2566fe2aad6082a617ba9d7e6903f581c8e1ca95bd0d7056ab9fc5148a407074f6c
SHA5121854aac3cd7eec353e2496764f269f92de368136e106971cbb2289e986386762114e1ae87e391b4290283bd9f4bdbcc68a8120f92cdf2e09e71ad66c8cec25c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f1e586e25fb0080f6f9fb345542183a
SHA16f4b584ffaa0586b7dac9d2ecf3f377b99f41830
SHA256bb19629866972af35da75ab5b76b5f704b1b6c5e54e1c4dab9a1f00388b16938
SHA5121d5f2fbd400ac961e0adf1cca0e1c708a4237742c6e65ddc6f10b5a6f883368c326c5a5da09b9eb085c349a203a40e60a80d0c19c6b158e20898baffa9374c11
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b