Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
b5dab9eaf7638d7ff990460094aefb3e_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b5dab9eaf7638d7ff990460094aefb3e_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b5dab9eaf7638d7ff990460094aefb3e_JaffaCakes118.html
-
Size
28KB
-
MD5
b5dab9eaf7638d7ff990460094aefb3e
-
SHA1
28ed926db06e0389e1cc01442458a5f8831c1693
-
SHA256
c6176a663c700aa5f649889940433a49bdbdd38c3ec73d5289e7c1fc8159c1db
-
SHA512
628b6f929ceafa2398875aed188f8676b4e73fc5d00305eeacd8b6b21fcd8580c7a23a3372f0cb0615a437f8a2e8f4d5e4bb941e2da09e174d3481761a4c952b
-
SSDEEP
384:279h9iy2PfuUgtNvjCtrsj0f6gd+Fr71OF0xtReUcRWf7YOu:2Jey2ctNvjSrY0fzO1eOeH3
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000400bc91b36df05958b0bce06a0d234e035fb6f5fa5c081cfe758d9520e6611dc000000000e800000000200002000000014831519cd0f3beafb2119c3db43349ad04f5732c4939de7a1db224f2c49bf002000000044c8cad966bdcd8856a6f42da9f539024f8d9eb1b34c7dbc185785d1de13285340000000411295e761c27255468153096773bef535dadb6308ff841dee81e61438d843caa53697275a878f1d407866515b8b16911d1888a00ba7966b8a3f46047c98e1e2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000004ed37f74adb9712ed68aa904d3ba43ceeefd955db12da026d396b94abbec001b000000000e8000000002000020000000bdfefd0f20338fdd391cc12798613f00e72c925a1f602d12511b39b5ac5af59890000000e929c065d7c1e8ae25cd97c29a4fba29f4402eb9201d5f5077fc75a5089287976dc852e60fea2ea2022b358fab5aafdf85ac8c620086ac1d606e04103f1f359c702642b26fa30bbbb3f96154405b8554d6b49be70bc79c6ec38793098e2b98a6a0c97fd42b53765428697af53d45eb378f03b0fbfc67cb06cc3654bee267c63723b5de8519560207ef026cb732b2f4d24000000092f44f534c566e6c75ca4771e5cb555162d0e8652aa987a45082fb6d434fe04a883f3658535d8e77b3158cc90b3f334e9f0bb2280408e7b0ce0ca9fff09394df iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430452550" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5055900634f4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B90A711-6027-11EF-9988-DE81EF03C4D2} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2284 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2284 iexplore.exe 2284 iexplore.exe 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2284 wrote to memory of 3060 2284 iexplore.exe 30 PID 2284 wrote to memory of 3060 2284 iexplore.exe 30 PID 2284 wrote to memory of 3060 2284 iexplore.exe 30 PID 2284 wrote to memory of 3060 2284 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b5dab9eaf7638d7ff990460094aefb3e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab79d90990dd3c216e8a2b5e341c42a6
SHA12577dee156a73db80981718212b114f39e0a7dd8
SHA256e48b5ba91eb21c53e30591bd38eec6c7cfdfcf152d393303334f74a548859f18
SHA512397e140f353fb1bf2b15d5dbf1b26ef2579ec0355deb124aebf14820717527c3cfad7e9e02e3b8d2f1a44184a25004ed290f0a8a6a1448811c8a480340f38051
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cdf7f56b0dfd81ab6d6adbe2b8c06aae
SHA18143fb17a16a7e7e33bd37a897e2c963d2bc288a
SHA25686e5e18788bdee13bbd4eddca243591e2454fd673687f1c59897f4460a1f08ce
SHA512c25a68e1fa12033104687cc217ff5fdbb677e724e5d5b5317920c8c749a7d7a4b2ec9ed504d1af7a98ca9407dc581a578cb63cffdadfa44626503545ad681ef6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548500eea6b5f8a9c3c1554b923cfad44
SHA17d486ac0540c6c0c70b97af99c79eef136722111
SHA25694f91195f2538e8b9d466a3db4756f6a8619a9766c5eaeedf2643e9106926dab
SHA5124a49e776a6ea32c4b89439efcb3ad73fd321ade331c7ff8fb6c2503460528274e1ef982b9acc2c468f2acf07cf4d5d358def112192112ff9008a18e8eb8b7e97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a67148a23d5fc25fa9db666d4218caf0
SHA12dedb9b07a37b5863176fea5d206f2d815cef99e
SHA25619ff48ba42cf1a9581a43f8b3587d4c594ece929f3aa5d368882cebc66ddce9a
SHA5121daa5b17fd83c34ef6d6980c11b324f2d9fe68899bdc6514dd483a36e37bbaf771f4ad7165c12dfb6fc2127ecdbbba31d07fd484aea48a0607b49759d2dac9f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5672557dff5578e85759ee3b42613d185
SHA1e05b86324d1bb51008888cf1ff7ce772d66409e6
SHA2561cb29ecf8044a9de854740bad8493de597970d89e0f171db0e355eb3664a1cef
SHA5121a7c821ce4ab49e40db6e5847f254582083b9de93faf74c0e88b05a573a47ac13ca6e74c5c29df4757befb8333d50ba3fb32638348e2a3e2522376c610476628
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553a4348dd72a0d4ae2cdbc7ee2d9fc36
SHA183386e514ace1556410d43c2ec70290b64c8325f
SHA256f06f1de7b4c700d4dd7a09b6919585f33eff21ad3bbbc1967cffeeb8d2beffb3
SHA512715ffe3541db744c2b987989acd7e9dc0c92836fd41a4c62b11db667266a29621d22315402ae760488cdbe98f24164e205daf2a959a353c5306279cd50572dba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f997f87d130f5c4b67cb35b420052949
SHA1a65f9f9d705bee67dca57bd36a59c0db1c62b4b3
SHA25617c89da8a646baa9e4055307840206ad5b2604536612907c5d6162f1b96f4847
SHA512da52589b16604cf3532652e9de21a118f6b5d6f2bc40ccac2e0012e282c33cdc55f2c262b2cd050219078f904a49ec217a28cab996ba05f6c754f3707277b2ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533dee7eedaa231794930b1c2d51feac8
SHA1c1d18c465bafd7fda1aee4dceccc0e14330e3f4f
SHA2568e14f401f9dfe995ee8710d80fa716f11ebff5b7def46b2e14c7845d11b49a3d
SHA512a6c7acdab1dbaaf2539e14426691201afd27264e5cb2dbc75ba180a5aaf41349eeb2dd02db8dfa6120f5b56377f0ae49765eb0f59e8e4af37d5cb08ea61a08cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab480cc3947daef61bed4fe08c42730b
SHA15f0d411284e1b52e72b7bbeda103d7371f60317c
SHA2568a443d2f44803440e23d06a5554f405b2655e610ea1bc2809d87afbec1300454
SHA512f2bfaf54104ca5de9e141ff5b8f5d4d663e9dc010b2c39dfb45a1d47be5b488f67fc833c1f0bc19cc728babac6d03c544636fccc222b5ebedb8aab85858e26c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3f898d568531e4ba6dca6617abd78a0
SHA1347765b357eba3321418b9ef8a951a60853fc79d
SHA25676419ba6376e6ebcd81067d35c804c83880b3ccae607c535112df6018a3ba792
SHA512bb102af1a96a08d9ad72c9c1309b9375d9f65f1a027b41411886fb38ec1ee91d5e94e5c6d48c8b895cc8f588510debcc6211b43c37e48dbc42c2df308f25146a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524ff8f2a11f9b716d440ffc87176d00c
SHA1468783b74c314a83624e20377fcde7b80db9b7d0
SHA2568ccd7255cf98ef62a09e703d2a6129259e92c520a368a102063ea7f2e828e6fb
SHA51265a5307a4c16541d6af786aea51ef9fe411c67a6b708f4ed85d1b3afa2c59c601a8ac2308c854c83375da4fdda055613fe47605649eecb196758f60cee2e0e4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5522e3355c7a3c9db6a1f00341240833a
SHA13f2168c5f0651d05b1f8b8b44586ff57d2bd8f7a
SHA256c7621376eb5eed9fd0dc16df9c7b49c22cf9b725e0b7af596644fad3cd6a395e
SHA51250244c11cb9620f1cc8c3a57a75d2c1cab2bd6e27ed89dfbce0c29c29ef4a6112fcb65c4bf20eed72b50316e9dcfb702ecedd0420331898ec299da258be961ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5158c2dc1e7a5b9ddf97dd9bd3e41632c
SHA13eab1299f0fae2e00c5e7b03ae3ba5765a2b040c
SHA25619d3f183fb4ec00e909081e3351f0655fcc0fb69ac4caa28871496c8ed872d4d
SHA512ff47cf125333dd0e1105cc4165dbb76873d416ec9810459a7d2a3cc0eca9a1d7c1aaaaded77e8884a4468f39f0ee12c54a16f9e3473df0033320fbbbbbadb6e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55569afee4b0e175857366892ad33a523
SHA19d0b78861356792e4b584fb803ece154be950960
SHA256da001b38229532b13a7fbac2ab1cae73a9cdcf4bb0b4a0da8946ccb6eae701e8
SHA51277d5b1d953dfe35f0ff9b385f0fdca6cee40235c939dde1ec47708b14d3b430e08e2257bbc2f5740ed1d097cc835fe63125551781119086b1b56ad40bff16890
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD520fd4f286d5391b3da75b564e10c8fac
SHA15f26d04602bccdc6e8afb83510a671c1c8e9ec0c
SHA256ff0d54afcfbfc656b1e3b6b4a5b7c3c3bff790b321f0c1f6bfc158f6979aeb10
SHA51292861844ae3684f5752405444aac3dbc27c596fb3688d6bd05a9958ccba4fbe9aa59f1e2ae1f7944c6cf0c9dc7e263f2e225bf2f7c7c54bbe8534683fc53588d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd50f26f344228b0c8c6d866c86750c2
SHA1e3c29aabe6fe75125f6b82c60525cf2a28d9bbb0
SHA256c1d8a384c1263c2e2faa311262402d072f09f6589799ec3fa7dd64afe553e2ca
SHA512955eb2567b9009001f336e02567afccbc27afbb65ff4d67f0b5e8f3877bed4fa3d3996b9641d261a65d45dac7dd60cfb48ed3b4d95697f2b9de3ad356311df00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d429b11e9802b5621afd5d70aefb91d
SHA1a6ecc670b13a62ca7859075ee29e88de5c0def67
SHA256c434263eaa3bdf15a0afea20c29d4cba14d2a9f4ec741963effa66b66594d063
SHA5122ce97a9ed5c7e7c02fac125a1c876988ab45abd45b1f4f730ba6392e4a051e1ad5d5ab3d94ff8a3c807240f8e47e6f413defea02553f29b0fe656ca9992a470c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1cc67c696a28c5cf20db2c51793c6b5
SHA1b560847dfa7cfe28e12a4dd731add76e6a881d9a
SHA256f5ca636785a81e61e7a2d2ed86434cbe19858c287bb987ab402a993914f01903
SHA512378e9165b5a2ca090fb35db2a17014ea0cbf404b5861cc82347115699915b11c4fea9e8afaa9beec9dbf8f26b772b0dba78df74f552a80efb90470e5b8ab1e3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5994553b40a0d946d5c0127f00d84a994
SHA1832f8289d607f4109d1a87bcfb2f073cee87fb2f
SHA2567bf18633c05240afef199b382061c1f9a48ec84ecf03f3b2128886d1eede1879
SHA51208a01369f36c19388d7a145f2fcb146ff2ffe0d2a0f11c0027177385e536891fa9de74552be2efe99d5794b2f2408f8109d1760b1453827e5ee84166f35cf4f4
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b