Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
16/07/2024, 02:42
Static task
static1
Behavioral task
behavioral1
Sample
4c799b947f081235d368c4912644629e_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4c799b947f081235d368c4912644629e_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4c799b947f081235d368c4912644629e_JaffaCakes118.html
-
Size
10KB
-
MD5
4c799b947f081235d368c4912644629e
-
SHA1
52fbf6d111ca2f2e18728e1ceb76325c9eae53ca
-
SHA256
90af5c108387b58a299fb57469dc77c186094a950a2c2184a682de332f168588
-
SHA512
8ee799c6c7d77f1b1d67a5ec39eb334f112adc2e6ecdd0df0bbfd8b242713aa1fb3feaee7147a5826e80057242b4d91ae1ff8b29f9fad2083278309643a2ec3a
-
SSDEEP
96:uzVs+ux7KpLLY1k9o84d12ef7CSTUpzfym/Hl5mX1mtTBR8BqYEBV1BBBoB1aZBl:csz7KpAYS/LgaFlYqDlWN9okYBb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000003f5ce5b7f13ab3a5c863a246adfad64911fd5c912f70437e30c800f0e4d5b68a000000000e80000000020000200000004aabe299dc5ac05d1ce70ab2f77e8f0d6ac74e14844097b56221b9a56de737d3900000001fe8a33a3a6d1ee505de5c5aa3cdc587909242a0a23f6225223beb09506abb72f6845762cc177b33afd333d0b655ae690d156ad225322b3be477245ced47a29911ce005bd19639064cfe5ad4100a0081c3ccec179b3099db672c848ce3bec7ec4a859f3a153f7d5cebe5cefe98186dd2f355890697eb1223937e3b193ce0bfaf37a0b9aba1b97844d8d48bebdfd84da4400000002269acef4b955394f698bc074954a170daa09f7144906185395c645277f820b4805559e0fb4eb909d09c445884223218d7e2030f55cf5fb791e2c9ce5566ff2f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{066DF221-431D-11EF-9051-EE5017308107} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000ff4bab47a16b3506cfe2f7f76b802ea87f841002d3207af3c8a426586325693e000000000e8000000002000020000000a3ac6c4cc427b9d438f9192e21f71546216a2571168bb530fb9ed42b7d74f211200000003677917d528ec4915750dd30f087bfe7a7229a9bc69b61a9b49e91f6af30b8734000000060b90c92a735728bf30fc6152577a3ca9a8a5d9d42a2901bdae009b1b967ecc7017c5b754b93f42ee5b1ffb3be05aa386d6e9ea669259b1430d95cd7daf1153a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4036e3dc29d7da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427259608" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2224 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2224 iexplore.exe 2224 iexplore.exe 1380 IEXPLORE.EXE 1380 IEXPLORE.EXE 1380 IEXPLORE.EXE 1380 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2224 wrote to memory of 1380 2224 iexplore.exe 30 PID 2224 wrote to memory of 1380 2224 iexplore.exe 30 PID 2224 wrote to memory of 1380 2224 iexplore.exe 30 PID 2224 wrote to memory of 1380 2224 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c799b947f081235d368c4912644629e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbef0741e48a8262b951ebedd947c2b1
SHA1adc341609f4960d3e8098ecdf08727cd3ff266d7
SHA25653d0cacbb5d9ebdb739862801235679272b948eebb60777f2ea5e39035fc2a00
SHA51239f7c599c5db2312405e134f076769271feb54b5a17558f47a9883e6d63362434a428bbcbc36d3bc683dda3bc837077fbe04435bac899c8a864ca477fb9faedb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9485f47a2dd79b82390bf64ce831b3d
SHA146228f3238a0d72252d289dba256189a5d106ac8
SHA25653c900dbe296057c1f0104b6402ad38544ffa3cd6b3958470e61f339a87f2299
SHA51230ab146da3c501ea66ea51c177a004334ca90966c17b72f60c5b05ab1edfd1e9177613c1ce20a66bbe65470212e0cf05196c3210ee196f57958b79f290ef56c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54876272a79c2b0b13389bb47271c773a
SHA18882eacf87156e57f6ab09fa75ab16407b5cb7ed
SHA2566331629b3f4c8c2a46c6c67cd7fec4263243b1317f4e905c7464f6c628da875b
SHA5127abe73d5150c573237fd1e27a59b4ee9e2f1aa62995790d5a2c26531c95997fbfc318e640b8fd22507e5dd3d81ad372c716ce4ca2a60ff8b01f2a68bc1912f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d826f2aa0c2f9c6022155b222c6ebe3
SHA1cf574234f9d3f2a0dd1a9feed7b98f135cbed37d
SHA256f151651c2daa71d9732a8b6f0612abb7844aef45014e73276fc2cbf83be0ed51
SHA51260ecaf4c45dd6e7d3f9084c8b975a1cf9b479ce4c2997559dcc5257b92610b2bb2989880861ef04b5bc45081deebc66c9a35303fe7f8b84aff36f862b31593bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1336a16d93d8036d6d5e2d3302f8757
SHA13156db405b242760337fa8325a7ac872bba9ac58
SHA256b96ec3073d9b6084275892118f81482321bcd8a799fb12b12f0a81635817df66
SHA51222e70a8add958c6d1353d0435b15b240428a8d2667cb3d247eac8625a22d60a226d9f3d060a95f13d4cfe1cae91d260ca6477fa432daa8e5d72c8491cb6cc32b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b430c84250d0dfc2f8932ce8bb376c3d
SHA147c586d2a8520e15ccf14d6cd27ceca6bea01271
SHA25667e3a0ce86d951fbe186771bdcf041eb7c991940f24fa97a602df6206a7cbf6f
SHA512c26dbe9264e8aafaf6d737947b1abc1564534a95e185cc858c7f6a6bcc6befb1b4f0bd46b84b1f9fa1cb8644582d4a5d5fa6d556d8909ff7b90b934e7efa6fff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b8ac374d247fa32922c181ed2aa9365
SHA1016e7748b383321408a59d2124aa0d373eca525c
SHA2561780e7d66a8e140ad33dc73217a296acc57aca4520adb3d939fcbc3488fed7cf
SHA51276ec211978f9a2544b758e0f96e00f4a1c03446f0305565a21ccbd9ed11b075c71adc1072fce1f904fa3b67142b835580ae799d3471965de45b5fb7c51965ded
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b62c3767404519f4325d2b19c876119
SHA12106b0655618b6860c2997fc2b55fe8805f1cde6
SHA256b62dc20dce0f34e54194fb72d7f325aeeed091788f95a4afbbc4bd76dd075207
SHA5124412cac56f8b3156dcaddbed7cdcdc076648ae1e815cda20ce0c7c350726081ab0a3983d9f9c4e9bc22e9d0f99064f0547fc95c004db60306241bf70be42fe04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f3a46508316805d95e1da3af0cd9afd
SHA1df981076c1238f4812f7a83ab4c453aed91bef1d
SHA2568bd4a238bf25178e0feca685cae4b44716d8d3ad10df27c990ca37e418ee1083
SHA512a614e07b5fb01baa6e354df3c2c9551cabbeca7be816ef9343991aba8a7d406fdcbc86b93f203f4635e6fcb5082e50503f0fe42912d83776253a74c62123e263
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55002b3e70625eadbbf2d40159f84cefc
SHA1953ad297480a7e8f7b056889c9e2f849063aaec8
SHA256b21e59ba86a55936b34b755eb8404e2cd59c4be358f0d5edb0ba48766605aabc
SHA512472a2b125899d7486bf513a2b32a5db9a647a55e0693616e1c2232f72959d442a4ff05a1d30f2350250c1388e23925b78d7738da851bd74e65d4b623ca706e53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f93a02649fd0c715394c17df597b4a38
SHA1b89eac1f0d5f4131091d203a7943ad545d588d47
SHA256dcd9cf26d327c62b273c18d9a17117a61e9ef37fedfd10d5febae734a6297ab8
SHA5127313cad82477e3cf8fb8321092153c8c1bc0434638ad048d79aabd4ba64e38946e20927416384fb3cf64154c15fd31e1e694621dc94351c8e93836892d3725e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b37ff3d3ffb28312aab91b4ce806197
SHA1bbb6ddb79f3c012f87d553c29b8c2a2661f3ffe1
SHA256e87961de5df89cc7d6d7ad047d888b7e7841392faee580edb9d51726d3eaae3d
SHA5120defc310a39c0e3bdeb4913755290de0ec973cb9fb9906b9b61c2428756b4a0703d7af5de6477fa53b0026a1ebe85f087fabf1be9c050045901d114d630607d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ba1dde8e45a3ce99ae258c7fde1a908
SHA1567bb1ff78d01dd2321995a0e849a9becd430825
SHA256699207adaefd16a8823439f8d35b680b1540cae6acdf4f9019ad14a3090ff2ad
SHA51268c7369c0009cb77c43c5f3cee8a7cae58384f9a95426b14c21a7d28cd6be5b81d737ac9e07529f0b572fc00687d7d4651f487cc989fea2643cee7d4a1fb3458
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5861fa007cedc5ca7372c7bc24653b655
SHA1f5f1e003b2fbfd8de4f5aa77960325c9e99e8452
SHA256f347fdf5e15150810f5df5cec6593b60d8a168437085f41dd4a1a2488629979a
SHA512da9a82b953469493d29a3bfb8a92768b4b8237b8a9ab1c9f4ea09e719040003c742f8b1760fe9c7d72fe91b1fb132e7eba4dfb2cad091c0630238f14bd48e486
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57dbf764536c9dff37800a5bb77ce506a
SHA14214692d6c99e9233120ad8053b4df8ef650a69c
SHA256455e40157f02ca4905008b8018905602f4d3d74cb73e152f797075baa06ff2f0
SHA512519b98a78beeefdcc767b65fa444da09a8dfec3ac60e72419ea849cc228dffa184a9298f09c6419b69eb2af0ad72f1c395234e4f8db96275fc429cb80aa59d04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD513410f2c16562cf2f25defadda8609a5
SHA1be80d7bd4a2e9478eb2e5a873800f4122219e92e
SHA2567943ae0fef818127f8820fcfd399487cf5b79cb974f3194f1c8bf1997622e1f8
SHA5124df3ec8954f9ff7688ce6d9852b0b26d99e0164a9cd2f5d15fe0b413049aed3fa982d575de308ef968feebb095f033009b8fcbf10774ca4907e00857c1c9996a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed6327af217087e6f872e6c48273757d
SHA19767e06ca5c55cca09ec39ca25a5fccb135b4c64
SHA2567347747ae48e38595dd0c7d18a0564701480c66a04a06c98cbd2e47f58cacc1d
SHA51268387d19751fad19281eac5b4c4306a12937e0e059e1969dfb35482e6c9de2f93d6e0d164e00b8f90b918ee5c1a16aa1d5ac1eed6000f2709a58f004bb5ddd78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a11e8bd6b2659a2e66fa835d63519a27
SHA1a35a622c25206c8769c273bed02c4985b22a35d1
SHA2569cdfd82e8b12004ef1536a24b71ccac165b05b9975e706c680f67ebfb4cd20cc
SHA512d9c1dc3baf4a4a9949dcf1329409dd5d014974642a5dc9c7d9c1295db481b184058d8d764ed93e013028090c66805c9c0da79ff7f4f784fc00f1eea184d42758
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5549fff8e246b04c5927823f1af7762b3
SHA180f16ead9a362b6452952af722afe749d51f8f8a
SHA256b8668059d06f9298c6c2da23db24ccc5fcc4cd94b16f26de212e3e3a4571aaa4
SHA512cd691940ed4e27bd68b5f19e787b89227d89474c11c19c89bea6b705875d25fbe7b152a85b785977d90f5e3129fea4497d42d6d257f29e01ad343d9b0bcc69e8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b