Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
740bfa2556f60ab3a38f52553353ead3_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
740bfa2556f60ab3a38f52553353ead3_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
740bfa2556f60ab3a38f52553353ead3_JaffaCakes118.html
-
Size
21KB
-
MD5
740bfa2556f60ab3a38f52553353ead3
-
SHA1
267365a22386cf2cbf3762924d94bf611666472d
-
SHA256
a876cdac16bb8f44e7f2c97d19af985fe0b6b34135083b80d3adcd787e2fe26d
-
SHA512
8cbca9400c182d1e9324a7f45ac96689ecf5c775852aa7c90f9277e38876e8dacd2cb9e3a7bbbea17d8445320171f44a24258043eaed552e7eff3aeb8ee563e9
-
SSDEEP
384:sOpUpg8HQkCjnSwodBOp5Hjlo6KqHPWEfoPKXGbz4CWhzpO:sOpU+8HQ6ZOpFNVDoPYgz4Bhc
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{163933E1-4B4C-11EF-8CEC-EE5017308107} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000006927f97e1b37669605afb0d9a5d456ac6475fc0be08673a03ad0b0fbaf55eb4b000000000e8000000002000020000000ce3bc3fcf5f5c01c4bc56d8ad8c99318419b19885af7c5afce7399aa91cc136c20000000b16f546b58efbac399c198491511ff330eccbfbbf134c26c9c061c7c877885ab40000000f00e15aa0628fdbd0ebb8526ba8b157ad938419d9f85c2e50de89b9a59d2d395a30873fb0722072e5b75e739af8098f70324dde79549c7f98056a74357449825 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428159431" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30feccea58dfda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000d1d97ce761fba21065c4a33434663bd5f866990c713aef360c0b961c452a3d5a000000000e8000000002000020000000ef18b74eb7229a1da049dba20cede466efdb3044059d6db337650588dea6f72290000000c05c651b81053ee09e5c5ef0ac3b5b8db759a1520ffee44e0268ecc730a1f1fe7c4044743200e857a725fdd3c153b0814e763ce13ddcf507befe91f7bb56f4ea37a905d5e94f6d2c7c05d507522b59d5bba9a25dbf5fe60f5fa56d9536f157d20af738e7929159661c7acf76bae5d9f5dce513a0c1c3df7442295ed14eb6ef3bc6ca77702bc8f01e8fc3f733f9bf1289400000007370eb99787e021485c2ea1af142c4915550d793b256c92496c4178447ad3d382a9dc9904775ca7725dcdd30dcd79287213ddbc007f95c396e812c862cf245ff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2772 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2772 iexplore.exe 2772 iexplore.exe 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2812 2772 iexplore.exe 30 PID 2772 wrote to memory of 2812 2772 iexplore.exe 30 PID 2772 wrote to memory of 2812 2772 iexplore.exe 30 PID 2772 wrote to memory of 2812 2772 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\740bfa2556f60ab3a38f52553353ead3_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2812
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f9a2443edb35e856eec7e276d82c7b8
SHA1e30ce66de71bb4ca244a4caf30854297b1755063
SHA2567d19ef72cf907b40c7f0d8db7664c432c61972b7f10ed890df449ac89803ef36
SHA51232ce5cffdea968e73a65baa444bbfe5733c4fc6da56bdaaddfc7f20b19a454f944e556e48709487db143b65fc6daf0d66e92be133c69fa50cd66b7b6dafbdcf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f8ff591099519057a037f6405d402e0
SHA13338dd72397a53f44a4fcb005b3afc3a7dc93e84
SHA25651de2a9beb4ceb6cbdd884ea516cc4855de3cfef1fce480f701f288ebc3026b2
SHA512ef8e47454643095804c098a5d060bb8c4c33ee9afe84e6d6bf0f2a18691fda90dd32899f0ca0947134b3c45d976e5530e51b277a2a90f20ac11c9d655dd28ba3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56f48a80d63e99d305c18729980d0253e
SHA1ee27bad3658bb2165213a68648df7e6dc9f33d1b
SHA25689802a66149a4cac11bcd91dbb4490bbcb660d4c645e6a23ed31ac7db61e955d
SHA5122ec9bfb0bcb9713339fba2806abe2eec329b6bbd8ac62d15d2de29a1f3302ec6f17a794f604f7c51c7c9f9e6d55da4fb5ccfb8de141fefdfb6f87891c5f7bcef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7564ba1cf3883648f40ec9b56a6c9a9
SHA16250a4b149a733c6c36fc941f3777bc8c5ba73eb
SHA2567a881b974f202cd1101d75f70bb2eab74021acd457f719f7778ba1a08fed560c
SHA51217bc31484e7391b007bba734bbc288e86bfd4330a8729b9d36f842d4df1df8a23aafc4dd004d9c1d49a286d74b6073c6d92da3f75a796a722b2ea7579320a2ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56eafbbee2182d66c9ae741c8254681b0
SHA17b4559b960038764fed459d5c9950a926d74c9e0
SHA256d628d46baeb73b8e6a9ae47e6a12c99141ea24800881db89eb46f0743d7b4d55
SHA51208ca4026aa79d18e36607440a004c924239be40466e2b862b83c409fa8cf1d46f4fce504c87610d553341bcdbac0dc24cd57ec654fee810ae6be721d3e760b33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f8614ea5c09a90aacc5f4999368129be
SHA1b83222de87024d78ab6ea8f12f4b8091c48cc546
SHA256b06d29cb8e0a503ba268ec1770120e1bed927bfd4c0f9497393e72d4b91d986b
SHA5123698f67ad796a0474d4d57127c79d7031f850fd4266b9de266c707ee012a23d72c46a58504c07a3963e2c4d7b00f9e9244679bce93faf5bb7ed213fa73116ca1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562a63cb16f92a272a6eaf7aca8969271
SHA11f0f534158aada948b0078408b0fb56b544af3da
SHA256ee896a6426f03bd48f0b2f8f955836778da1e37bbc310f83433eb71404db2a78
SHA5127bd05af4f165cb83efd479e7bc1e6ce88a69643001219500727b6d59be8670471c1f84f665973cea3b0ebae25f2547f1f71f8d8051d05e8dbee17f02d81e0a58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c7e7fa97e49296efa937b6dad1a7bac
SHA10008aa88062133c1329e5fde9ea4c49e92c9ddd6
SHA25654b5c9234e5429fd3fee4edd349bbb1fe54862d55c15f0d2bbb95a5db6d51a88
SHA5121cf8bc8ba2bb26c5b246484126d034223a4a4d4005e110f8ee42b34b93481f51757fd749d974b837a6508263bee03e15c4a3fe9d3ca8e3e33d89a54ad13b5f59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c9f2c9b85718b45b67102476f545232
SHA16f626c376958de9d93d9091348bccc1ffd5e294c
SHA2569302696f077138460c3a5c1d735a4151def6f713fe50a30781fc27b741b50a29
SHA5126b7c0b6bf373a8520452e12b0d6c015d73168eac18016cbbd60a6c811ee4e60d582a8c1ebefeb605862100c5b35e9e3613d354094c9b004e9361a52d9ef0128d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac48d4fdc8e8f7464aae7337d7f4d222
SHA1e28d3a67020696e9b673ff8b2572f1550ee0ce90
SHA256587933fab9cc8c522fbb016c158a82823ff16bcda458921028cdc36402287847
SHA512b1c119c911562059e035da70a752b478a7ca54e44099569ccb679e5a8fe4043c4368eda76ce80db9221ea436eb89191dfc3d155d0fa0fefcd984ef4a09d06a75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514079ef7f9050016272a93fe05fbca02
SHA1230a117a9e87b04321adfa74eb6fec7e2374f5bc
SHA2567d1d43da02a5206e7eab5a657c5fda9b3abcf4876923b9e4a21cc18351a13a33
SHA5126e6579df13faf1065ca1720c589387ddd2142c34a15eae9fae226084fdffc2e7473863325b8e1403941cdfed61569261c04f4f402827bf094a174c308e9cb974
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1fae3d11ad8da679e67c95aa1b052f6
SHA1e008d846e33684be293ee517370523fe7d818cad
SHA2563ed1d409ab67cb0e3005814020880d0ca919c6ce477ebd7912d8b3f9f5779f3a
SHA51258f1b65c9a17f10d28115a91ed901610b6669770678f8b64b86c4ceaf50524053eb42a7331f341c9eacaec3425acf11811ffa747cced2348e091d525acf82cf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58722df1591b7ad58c6094261c6c00979
SHA1d5d6e57fc91f620ca7f27a622cad12916cf7b381
SHA2568172cd8f99975a578d3001ded95d5644309a915b4f2adf45ef01074639a26f94
SHA51236624794dcf1bab0d43d5854df2d3fad4e3890aaaae66e1b250615cfab43acd5570d32f488da0c9332cc5201487dea3ef4c6eba77466e28aed45e6566a1b31bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8e8a2bcf7116eaac1fffb123d01f389
SHA173963a6a6e61089983d7085c6fb5f3d8784c023d
SHA256f58c1264e056edc9c2be923fea9021fcd0cf144e4a11dead1b634d62c32a72ac
SHA51211cc05a36455b0cd8ff9c663450b2bec783155c19ba0f94d059fe17fbd1a2e1eafc0af9a31200ad2cca31d73c036d612b113d1810b5894d734afdda0695b85dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532f62826357f5b39ebe20ebed1b5ca21
SHA1d5f5df95c64a9067dc58ddbefeed7d6fef01c90c
SHA25699d1bb31b7e2776672f4521364c2b066268ac30074582a1c640ddb31b1a07624
SHA512bef30c37356e80cce3bd43927ea78dc133b8114e771167663aee7b9737035adaa0a5ac06f3fb36e9e2439fe5ad6175249cb2fbe55fe3c9417f52a0447bf43122
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506341e87578145f029326737c3324848
SHA180e2d5e16cd7b2df5978467df3b7ddf07a929658
SHA2563479200856d504bf80e02b70e1416cc81e2d29a07ce31b1a49a578372cb8ded2
SHA5127f452f713b575e0e39c90f1cb83f8aaa6138522e9c2aaec8ccfddf33a7a8f3829455d3e8de4a9b4c803c840691a6e400ac8bd5075fef45f7e3a1ec2971654f7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532a898f1711fd6c70cf8a20199952f1a
SHA16b2f4a80fad1e9665bbacd60f3b8e673c06ba73f
SHA2561532bbc73626b1b055b8a771268486475b4fb1a0a19c7b731081b8e1563f212c
SHA512dfd03c01ce74b2a2824c4e9f748817970027be19aee881c8ba13010ef6daeae19e93fe72cffe35aa1b5215c03b0c4947bb79e803c9b1a2a32180d25788d0bed3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6fb795307a9210b3e9c3451e598d0b5
SHA1cac02c2e90f8a4820f4eadaf66a670a45cfc6e75
SHA25629bef11421ccd9b92d0da35c22798ac1a566ec30ef4715f7c512a04d5209a97a
SHA5128f2839a5e1a791d3669824112841a8d554ed7cc40c25aac0f761d7cee2c5631d329d43236afce4ce9f6fc3cfe89a1de41708577be32e7ccfcb2c4a279e21451d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575f817cb3352ebc4f1c2667782f510fd
SHA15acfefa1cab3a876d99bfce6bed49d3a1754c5cb
SHA256b760eb4d155f825a8eb95cd12bb20799d91039702308c53c67ddc5681c8bb88e
SHA51251b76ec3e7de49ea353cba4bd48bcb83186d2da539c705752d56d85b61f774bf4308c4338ce4d914b81a421985f3d24c7abbb000c99388edc99ac69aac4bcd1a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b