Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 09:28
Static task
static1
Behavioral task
behavioral1
Sample
8043ec64dcda468388eff4e1caaedb94_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8043ec64dcda468388eff4e1caaedb94_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8043ec64dcda468388eff4e1caaedb94_JaffaCakes118.html
-
Size
4KB
-
MD5
8043ec64dcda468388eff4e1caaedb94
-
SHA1
5ad4c6c2fc47487ab76e7e7a44504405b0e3fd64
-
SHA256
6d34040e033014d8a4381cde0a30a5bcadb2255fa0dc453d6079af96f6a5947d
-
SHA512
5303590454fd343d179353a1ddeeb2c8fff9f7304c84d99d7584abba7284c72d4035cc16233a9e656e7ca4d4a86871bb3002e01005e046c4850965087653c009
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oWusxBzd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000351c8d647eff043adf8ff7ef0a07dd300000000020000000000106600000001000020000000a99b69c871fbecd0edaa71664866f892ff886027240634f3791bc81341b16d51000000000e800000000200002000000092700211d7a448d24b9b617842fa67bf88cbafc1fb1bb927c95246ad3f95c00990000000158d95b233b9f5961433399ffcc45e9e1b7a57753e3fa168ea8517d080207e1312040ad6581d07c5c2bdc992ff5548cbcb21f60586e96123d2f312c5090103a5d3ab1b667d79e700a4c18fa284f4bff1b796919f42af8738252f27147883539347ab610e811229a5f467bbdd8ee03a761b0953034455732207d9de5ed1bb7461a044b7aad581fbaa69744d5408b65547400000005c8ea783cb440b70b9bd3392ebd8a30b99ab94a05203a0040284c1c3b73b09484a7304a946d1b651443cfde02eb717e526ba087178ccfd22f37818c5de54ff62 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCD089E1-1D9D-11EF-917A-EA263619F6CB} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30725fb1aab1da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423136800" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000351c8d647eff043adf8ff7ef0a07dd300000000020000000000106600000001000020000000817a1f6af58f33e71576f592db5429fb444037ff1abd4dcb0371b4f04cb44b10000000000e80000000020000200000003031122a26d81b86a8cc0fabafd17356d50d57b00c711de407b95f1d264f1dd5200000002df77138ca9507e95b2a80fc0da1c6735bc46d00bd79e704b1f94a8ca1b2df07400000001f816fd26885579ae8cb727ba74a73fec1cec14f68835d3f9d671348b9aee245497e16b1da3338a24dc61deca4335b7e150629f1207bdd5f87724d83cda99cbb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2732 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2732 iexplore.exe 2732 iexplore.exe 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2776 2732 iexplore.exe 28 PID 2732 wrote to memory of 2776 2732 iexplore.exe 28 PID 2732 wrote to memory of 2776 2732 iexplore.exe 28 PID 2732 wrote to memory of 2776 2732 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8043ec64dcda468388eff4e1caaedb94_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5604401c2e3f42710d40e8c753ca9d7
SHA1e73db3716ec75873f5c8314af0078e93b629e73f
SHA256f304103133cd0b58cdbd5b9dbe05027e1ae04def924cbca0a8ad25ae9f233166
SHA51290e2b063ea1031ac0743730b98d45822146bbd25e5bc0a69c4edfb6de3d25d78ffa8f0bac5a71820345069f0c733958e9159464dcb66e35514b1b63feec24168
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b0a7e643d3663d501cdbb53af408f65
SHA1e4de27495d118a0abeab1d8efd3eb2b6e63ff5d7
SHA2568554640c2e642fad6d669b3b9eb2793ef7e48613d4a4de7a864000a063829d12
SHA512c84e0a1016942312ff8be1ed300e678f7a9f3fbbbb471ccf0842c410238381a6a4245d20398ff38a39ce9fc725d5686f060def9236b561c0eb514c56b073ab05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ccb22c57765a33eaf1538247563b8b4c
SHA16373c3b2e2f8d1b92508d68778bab86b3ececec3
SHA2567423b55e0c9b19a5770b57559f0c985f24f08d563861841c78d5e2a9cdbc721e
SHA5126c4b141958350384cffa2fa21f76004342fc6fddcbf9fa78d2a82376652b9ce65fa29c302a58010932074fa082c0c88ed8f630bdfd527b2a8999e91bf65b5728
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ad79b1af9a0dcf2dbaba7180cc21c05
SHA1d4ef5006f99ab48a35290eb666253334845d9b62
SHA2566d3c8274bdef8fa3775d5b48cbddc99608736b3731cf958f16be7962ae9277d4
SHA5123e1950718f1653319fa3783fe1421e244cfa5fde222ba588972f049b1e43e88ce0c66c6d40641fd50d192f9d6b9c9184ae649d4d44463636ba8d8fe9094c0f18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD530eb92fd53f1d042ab9e1a8de673af7a
SHA126942aebc2989599b5ce1628eab34e6fad089805
SHA256e54b5cd1d8280654e817e67d109a5822ae0cd635be2deb3d3f4ef165a4d8d499
SHA512100ab3cf58324e480db8e5fb740951717e2b2c8604c2a82180307369a44761e1160b93a90590d1ae896d0786379ad9f43c7752a00d2d3ebdcd664f1bda48c280
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53bcf6e3dcce40e210bfa3b9ad2d56078
SHA16df8d0c28ce9b0af3ab88c531c9d3bfdd99b1483
SHA256d916d193dda8e97da01741c3cc1009e7db8d030f2a0cf29100d9aaa2b71a2cd3
SHA512033c7341cffa4fef604e07210f04ee529cd1f3fedb03fa5c363de0b4f60349fb2262511a5e594ff02a5e739dca55661c77e7ed9579f47938091588f8f1f41cb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562218cc221fa88cd1a7ae1b52280cda6
SHA108bb0955ab7c9be11811ca926e8a68c1ceb85d6c
SHA256dd8aad390c85767d4757e4eb645ce76e7c791b41ec1482caa1c10fac2ca5f733
SHA51232424fa642459c92813d93cc48c01cf4624963544b8733d90b0aeb62c646e93a920c8a30fe1994a3a2acfb37e1ebdfcfce21e4607c269ae70657c3bb4c3c3e3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aabb4a782b35c25887947f8b30037556
SHA1b387167ec5f258ac1ed85c283cbc1671e1882b89
SHA256f7521fd93c37165c03c15506be23ee5270874c42910f173986a151edd96efb16
SHA5124ed65ffb84cc5193937722339243fb4a072eaab463d972b3f55c4529485f865a338cba861d0e4d3edcf95ec9f789315cff4a2105e8a3075a0f13b0e14b4b2ad6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5053a231f03eda450536aca129767d4e9
SHA1c28272f438e0b59351544683144b8ed7604ec86d
SHA2568a35914258f4c368a847f21a770db71560d13fb83879bd6b535c36ed239df9f7
SHA512f0cc4f242f4cbc251a36363c2d14ddd976fd1e7bc9490ef2067b3de2e8796aba373832c84191726e0cea9f058d9e10084ae79c1ca895f6a9c2f685ebdbbcad4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efb57c735fcdc94a0238988754a90597
SHA11f266206c9970612a859a54a5dccb0b2748b1e79
SHA256a138fd564c7a3cb89cf3b32dac3fbd11f6e48e783002d74a41aab42b6ffcae2d
SHA512f38b2f08237f60bd7865c65af91e48095132be98e9af8c79eea91f07a096347b1c03ff50c5db3e957e008a83089b717345dfa38898b4d0d04e80e9e42b8d5015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cc087ce6d50819c051a7a7bd227e200
SHA1e4202ddf69f3a9c848434ec530b39654c7888401
SHA256c78331e2445c1b23ae718f02af906918b1bc12f2c8da5bb8ea0fb61e456d1913
SHA5125a2d1442df698a5442b2ad36c9f1d1f64743f046ac276b14d2c2d2998e931e682361bf3301f04084a4874fc3c6b65aab3ec1a7af539a73b0dbbe3e6edb40c72b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afe037cb21010075a564ea7ac55521f2
SHA1bf58490006efbf59bb502a12ea6b0f61fd925b95
SHA256c49195fd3ee0adcbed85ff190b450604e23623c7559f17fdb4420a6ea71fabac
SHA5121e93cb1b8e895110dab98765e203ac51290d467cbd2e9bf479c62ae1a30f63935585bae4f4593e5f45d8eadee5b0fde154e9faf36dc2740ba9cf5de0085ad06b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50dfdabb9b3aabbb3a2f3a1f0220b7ce2
SHA16c512bc0683162dfdb14058aca656b5e12d031e3
SHA2564ad1825ffd57bc77eda1745f4dc87844e54b6188b1abda8ecbee24c274eefebc
SHA5121e0a559e8b59a052f79e11be15ecba946af3efbe22f7ef27b28bc5f11470e72771c94f6c69f10b75b662ae4a95f4e81bb93eafc44d54cebfe2996c3e3928d9c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d03ef12078be9732b5ff249750f22ee4
SHA133e4a9cb4a83b9b1b8f6c0e90dc52103f2f0b853
SHA256cdeddb86b48ef7b97f7029991f9993576046f82d35ab383ee866b1d0ebeb7256
SHA51294038eb9c965187c7af79a035a4c9fb90ac0032df28b72a705f830819e014cd3ec7000071d5db860050691b019fc09c22cfb10fdaefba425b1581f0b1a182492
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d4995ff42e78f41e813b0c57d10f0f2
SHA1d249f278bbb96ad3f0236a3c4903cb0cd106fdb3
SHA2567ae18ba3917ec707db38bb970f0b8d66d9702c957e51827aeb121d88b4649a7c
SHA5120ec1fc75004e9928e9996d29da564ef3f83ce2646b268cce78a4c939f554573b1a7448f53a3b507b522cb770867cbf34e78edc1e3248f2bcea7b9c3b1bf0e43e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b65df6eef6b0d3c07189afc1038e8024
SHA1d9e3ad9c9c203c265442dfc78cd751797e217d6a
SHA256fa0ca6719ecf54dd153c1d2339d8c78ab373d4139ad754bfcdbffbcc07085cc0
SHA512bb59f4f66ff2e226e375c370a5f007306025f9a140bd03eb3f2b1c63c2d8ff6b99251589372c38b32fb40a581ad1b3291f25214f1f01fdb857af1479a58ea997
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5236b0ce3ba306fec8c2f6dc9c6d640d0
SHA1702be7d91fedc51ae3475d0a7f4df4578249cf7b
SHA256bafcc368eef5a0f7b69890afb6475cf77174689941b439a64fa6db81f5766886
SHA512965669747cced74b29ebabb3abe8a3233b26dbdf87981f92f3a337f6ec75ef9483b7b1eeee93df13c4c12626c93d71ac584fdd26b9e1e7e32b2385a6fc54c299
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f3ec34e32747680d678ceb1cdbb6854
SHA1e8320051da0cda9934ec6519a52b93054e4d72b0
SHA256907730018f3d61bb6b53b591adecf404524b7c22ad494235d120cfd0bcf0f8cb
SHA512b69ffce3dc74c5ada8b3eb5754d813040a3e67dc403c5df575f67136146b81176e499fc1c168bd33617f69294d47ac32dc541940afc23097bc3e1c579a782f54
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b