Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 15:01
Static task
static1
Behavioral task
behavioral1
Sample
5c7216bfbc32647bbd99c57450d339c9_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5c7216bfbc32647bbd99c57450d339c9_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5c7216bfbc32647bbd99c57450d339c9_JaffaCakes118.html
-
Size
68KB
-
MD5
5c7216bfbc32647bbd99c57450d339c9
-
SHA1
1e1a7e8d22051994182c5786fc3ba8f56a67098f
-
SHA256
bd01449fd7f33b2f6e614202f581184309faebe178a99615b98d5d96d19a3c8b
-
SHA512
3d3d267fc9ad4d63533154d11cfce9d0780ed58ee1c0e21d782ea98576d6a3343242ca7dbdde5904de81f4e5a4e601453871ae2863a2fc6aaf894e5dfb6a735f
-
SSDEEP
1536:OIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZwp0:dwpsvQWd
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000001781aad8037872265a5682ba57ffe06cbd7cc08377a28253c57ae504b42c7425000000000e8000000002000020000000e6992605023df48d8f3a26b51d9ab31f6ee806919be6087dd988f0b099b62370200000003a9d9963e4d22b94000ec0d9da2984d89955c9e669858b585f6041353f1f55d7400000005b839560841c07192a0b7ba5b4503f17218067759de3b1aa7b5965e28bbc1740194e876b34833c303bacc418fe7393cf84bc76d42f3db6abcdb8e7b0c63bb423 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000002802dbf1914010104cec8ba9d5c033e729ed8eb6976fde2739a9c381d07cf0d9000000000e8000000002000020000000feb12da72cc7bcc21d52ebfe7edbf676e4e9318453978b4f38d8905bbef35fe690000000eebf9913c5ef96aa9ccc5b207ab15dce85c3bc258b225e9f9cce208e5acf5dba796a055f150bfdf543972a21682a95396dc52fdcca88e234095808d5edf726aca9cb989cae54aadee6a61ff903cab32718c1ca6b3419bfdd88be44453d79caa653fb99755642529d613cf86d085acd1e7220e242be8c12f38da9433dc6273bce502436bf713e7722e49bc19d4706fc7f40000000a86a83cc51519805195818da82b745f75375fbfd5ddddc8deba0efe85b3bc22a71f471ef5c62c4f2215fb0c010a761df98bb76af9e1afc2d27f090216a1363c3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427563160" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0bdaba0ecd9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C987DA91-45DF-11EF-9297-6205450442D7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1668 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1668 iexplore.exe 1668 iexplore.exe 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE 1620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1620 1668 iexplore.exe 30 PID 1668 wrote to memory of 1620 1668 iexplore.exe 30 PID 1668 wrote to memory of 1620 1668 iexplore.exe 30 PID 1668 wrote to memory of 1620 1668 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c7216bfbc32647bbd99c57450d339c9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4ea5949081a70c184bb4bd61540f3cf
SHA1669a114ff56b5fc7fccc76907c4f5fe880af9564
SHA2568b7c79b69b0be987e17203ba2c58880ef24fa0e623cf089c0a3ff363721c0189
SHA512ef62a49785f95153ef24723dbd9bc132ef940612b4bd26111d088a876b7fe90036307f495180122370fc40d4037d3f4650466ed22e6c1f61d96e4a0ab217d277
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f05354722b01e9bb5176da316d215b2a
SHA1e78e436779bb5794a608d34d0110cc5b65c6e91c
SHA256280731b3701f0dd25560d89da49eafde8a168eeab859de2f786d9e6fab700bd2
SHA5121e62ec437dbb9fdee100fd7f1fef2d944ded271bacd0f2400052b44d8ce31d2421850101cf5c17de077574f4ce98c1407422e49bb8dd770316778b34c05a5103
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d3995627a540a767a89cebeacd842af
SHA14a3f4c32aa3691625b35aef78b91c30a5bee336f
SHA25691562bd776afb1be4faabe94208b7ec1964edff913da5c4eb1ef71b71625efb1
SHA512958207e72c721248d13f89ff1dcd1cd2f1b516d87e6d1d30422614b0f61d367e3b104525509ea8fb2757085945ac088df367238f625bc1a02986fdc12f42ba55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520a4f036d0cbc1e532a10eea6c4203d1
SHA10a3b823b0dec897d5151f1ea0dbb60631df7b58b
SHA25658430312cf4dcf4b91351bdd9da98483996f24ee3b1be63ec997efd89556e10c
SHA512dc42e466bad6a9d745f63ce1238653e1c466cd147988a1412e77e54dc517e0c56c2f280d859600b02cbff380070552e8d7b1c58a0ea931de35988ce4e3c3c935
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf387973d86df40488f7300a3a581c07
SHA1ac2f1daf0668b0ae4389f2a371982b46a3bfec11
SHA256db54865dea2d6ab575376e84279dd46e67fb7fe8b7ad1789707a285bca2a6bfb
SHA5121ffa0eafaa853660576d37897324f2a5ab63e0c8df31a6b8a53083f9ce694e664d1343d72169e150616c6b5d43849a5b0fd9838f7991bf89c12c683efc17d4f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f9ca36f59697a383ba2b864cb15a365
SHA1153c551a63ab1508b0606eeaac4af56a9bd41301
SHA25616cc7bfa707cf9f8f13f70df11bb3e6ea382955e0e370b322c03b5ba9cc30def
SHA512dfda8ca25b02eaef3b56d13e5e0503127af886f766c4dd610a8af763ef613c9aedbe7ca472ea6bec2c0f71a72fb1022a5c08ff8193d76fc7494c77e3e3c9cc9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595cd60416b234e9392d4d67753660623
SHA16ad5a82086fe72eec50ec40895ae30d7bba37374
SHA2566e887d23fc5acb1fcc7bf30d9c894de2240b004e6b145b33fe3ffba575aa3908
SHA512e29db1cec3e872c6c1affd48fa16ac5c20266aeb7eb2749d4a569eb5c4c30c1375e5ac022cdf256fcd2079a735fb771839d91da45776e93fc6205c14d0765794
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579f4f82e239d2c2e9e2c3737529af3eb
SHA1ea1bc6618d43700ce3fa00acb687339f2f413ff8
SHA256fe66d59f0d11a5b4c024088e84f7ee4abb52d3239ad44b2972c07ab9272d2b2a
SHA51203b546b89a16c6eb84dcf6be41b2c255c07c55ad8d3a5aa06b91d249b37ac504c80644260b954904a71e44a5af7850d7b1a6b65656b92c851e183dcaa2ec7982
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcfc9fda6486b96c46ea0bde334b3157
SHA12edbb2ff80260bc11c71dfc84385211be676647e
SHA256d1cdb06bdb7154ea0a45d22dba9734c600c2e423625e1e6b1e32c1249c82a8f6
SHA512a84d71a80203356765d4f9fabd0b19e1e66e5ca9180d4c4acd058aaa477688360eef9ff52da405b369d9e1edf76b97d23bad0529f60a51bc737fb94a0f8dc466
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2d0778f2fc7aa3104487942d80547dd
SHA1aa184bac65e7ba78709cfb9b936f7e71572272dd
SHA25677aa4b045547163a3750eafb1e31d499a8b4e8c70218afa3d9dbb63db45c4e18
SHA5120b215e37363f165b55470751fbd5e7931ee499477d29796a5b68061651c15d7206a1a64d11b6eac90ffca9d94dc3e88c184c9e9cff2047d8f6e0583a81da87e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56efd786fad04ea3c234eb19c67a164f0
SHA1045f16ace08e00d57f90eaec943f0c365bf04311
SHA256fe0dff912f36949258cf5fc045ad505dae05339682d28563a859d16ba2d3207a
SHA512c4ef473247264a7bb257b5032575b4cfb08b8ba8d00b2e73d405c6abd0c56c1221e4844d9b352597269baad1bc480f25b88eeb969d1e572a9649df14653e5c98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53defe5b6b69ecb9515709dd09195e030
SHA191121fb9961722bbe48340913efe513957ed2ff0
SHA256740391bc379dadc1fa534cbf098f82111d658a6b951235d3daddd736e3a5202b
SHA51207416133b2ee37ea25fcacc85510498bd70c03d461ccbec47a71c4b8162445888e2d3c16c7f60c4030c74287f8fc3255a2bcdcb69e4222cf35d8b158634b4825
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a67746ae3d405454f2f3f545f5661b43
SHA1656f12c08c000cc81a1196976ebe42c030f44f53
SHA256f8ab61bdbaea266f23c0dee1188fb6ba0a3e7efc26c1e6a22c04afb17747eb38
SHA5123d46af521f528c4c4ee343bc132fdbe821ec14efd553f8d40caccd7b3fcffa8190108d6b18a9dfe3111a72ea172becaf7e3755e51e093b5acaceaccd42bb2fad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e7a5a421fb505f25029dfafbcddddde
SHA1e887c52110ac98e60330298d23fc98bf4c14fa82
SHA256e22d5777b65ab9016ed35271e4aad6d03d6d88c2ab32ab3d1b7345beac80a512
SHA512f537d162e8f95faffd584bae457716844299a3df7732dc611429740f46f2c6afeb0fa51eb5607bdbfac8104c74f2d8ecdef4725a225b12bc8136a113e7102c75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d91f2f2bdbd67c8ecebfc3544e4e7673
SHA1faf5dfd3cb0587b9fb8ab1c0a537f837c13cf8c4
SHA2560afd7014a38dbab0554a268fc1d23e983c6912149d936e019a442fd7747b9b3b
SHA512e382b59dcb956b1dfaa1dad352619122bc582d549addc2cf38707a53cd0b03023e5e773d56eee076a488907e5cef1b5a915e29aab215bfb2fd2ec5016f17e809
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a43578b70f41478dd2db265afbe4969c
SHA130f6125a32d128632a812fb09bf5407cd37a62da
SHA25649884d47aca2c8f210f762d32b0d120e441476582c9cb9ba580c5946d38da23f
SHA51280b886bc14803e714c6a22e8a54b0f3f4cf124f351814ddae9dcf66800df6b219f2efd7d408e3c4cc36651eb417ec1b370a0c82ee38784209cbbe8b441400111
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55716dfbfc5c488dc315807e4a7d2e572
SHA1ab514be3776f4b8e4043d951ce41df1809687bab
SHA25637e5ec66d35d1d267a8b7fe425e1b0ba94e1f916aa03a570cf03239d193d03dc
SHA512628b8a8f2125e3eed376a6ddbb7b1df2c7db9e55b5325b4ff2109eec4d8750db38e875efc11254cbe703cb6db436be26f018c09aef80a74eec6e057f8d39cb04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527d197e98538cb4f81cafbad5577bf07
SHA13c7339e14fb309b6441efb5e4a4721bad42d3e70
SHA256e5a342e72a6e8c7f2c30321033795d63ee1fe66e9b97851ef64cb8d313198c2b
SHA512ab57e64026539ab07eee2676dc55a59ec31239adbff68d9b2fe408e425b36b44cc767f1448cc3b4d7221b8ca3e854f5b67d10ddcfc605df79739b25d677969ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d5f9c405023706d601955c0074acac4
SHA122eca8402389635d430699ee065814bf669a87db
SHA2565cabe6d5c3d9affc6f141063effc4391bc18f0f5260e77e9566f84375745b66c
SHA512bc457c80f2e1fe37f656c3c3b5245ecf9f988c65eb5823ca11c71feb847507fed5743322c45f61b753ef1b8e6eabb4e968886b654e50bd61bec17fd910fdd069
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b