Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 22:56
Static task
static1
Behavioral task
behavioral1
Sample
0fd6c4432870d210dbdaaee53e90587c_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0fd6c4432870d210dbdaaee53e90587c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
0fd6c4432870d210dbdaaee53e90587c_JaffaCakes118.html
-
Size
9KB
-
MD5
0fd6c4432870d210dbdaaee53e90587c
-
SHA1
05d778f5e644c18b666671cf355c60ca700d7151
-
SHA256
d51460f4c17d84866fbbbb2c01e1be2719bb03ccc33fd5ce118d0a4bb55cba5d
-
SHA512
95ec47c2cbb486f07c6f16a0d3a555f0eebbcd3bf367796275c69d1c1a529bae35f066d50738a71fee8e8cccd25f0c6b0e8f119f2606010df1ffacf4e9d5dddd
-
SSDEEP
96:uzVs+ux7peLLY1k9o84d12ef7CSTUjwGT/kPsipUlVHcEZ7ru7f:csz7peAYS/qgdUPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0a01b1053c7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3AACA131-3346-11EF-B489-E681C831DA43} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425518088" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000e354001ea718688eb90370dcc1be4a1ca72f13cb8b6ceb0068e9b55ce2d9d618000000000e80000000020000200000005d6018e61377b08856571be53f96535e2c9af49fc3250a043e8873654936fae5200000000b2f54e4858ac7a78c562c798202964c3b7156527c7eee8af901cf5c772c7c5d400000009a116a9b6a6faa4e993e6ab444e9f0fc1f269e123beb7076c1ffe96b5405732f22248ebba0620e3474a80e8cfc611b4c10c30b5cc51d162b977d25cd18e6d0ea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000b613bd99ae06936cf46f4cfce78f2b92ff96f3dd8b90bc170639be27676ec97b000000000e800000000200002000000026e6eb09f8eb32a31a19012af6d6750215fe13158f50f778771667cf65a4e2c6900000009fc71cbd52031b5ad5840779135979ada0dcd4f46a163e2265f10b4ca67e5f38e3ae5d7749ffcf9a067a67b1102ac02b6ac38dca312e6a8c611b385d175e8fc4f16f10f00efbd9cdece18e7f84f31deecb3416635beeee47d8448ceafe88b4e7954f78a510f14146ad2f37eed99a05d68014cb9d40893c04a36bea512a7191fe66ba41a5658493d2036e04d70ebc33c040000000fc85ad4f41e07a06d9a3fefc6a8cf14da79f824a8b15c5b3d7969ddacead9ec7000827d4aadf038aedbdef53b758e1121d1a9cce0e9b9ae2b885a25e385e23d3 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2264 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2264 iexplore.exe 2264 iexplore.exe 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2264 wrote to memory of 3048 2264 iexplore.exe 28 PID 2264 wrote to memory of 3048 2264 iexplore.exe 28 PID 2264 wrote to memory of 3048 2264 iexplore.exe 28 PID 2264 wrote to memory of 3048 2264 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0fd6c4432870d210dbdaaee53e90587c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58afbdf6cd1f316d49fdfe4188a0fdc96
SHA175f62e479d7d5c761b7d0e4b960db3ef9d0bf1e0
SHA2567b9911b436457b3a94bcfc365009211534a771e26efa173d0af702b59767ff16
SHA5122b2b052335a8ed8e8fa19f95c73b4e338d344b335a9180626f08f63cac20906e7ded9b4a669bbd770f9832002fd4f7ed57e922f3319e55112a10622c617e26cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d7ded42978d559f9ce8bafd9f6008f3d
SHA1d0109287614548564436e950c75585229f9eb61e
SHA256c99fca69da21463b497a51d147283e9b647e28455edf42b5ee5eb788d0b142c0
SHA5122c51410ff2043dcfddba6ff34edb51fbca93f71e6840a7689c3b1477250e3e346607b7c229060587fb7602cc008802005e1de4a9f0a4ef8f6ee89d751059f3b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f8c1910821a9ea2b5abae6042bd07ad
SHA154ad89d41b518153366ad4bb40dd7085a876ddb2
SHA256c1e247c22c4900e979b74c1da550d6e199e3dd195709cb91b6fe49f09719cf0d
SHA512054f8bd7b11c9798df7e9c1df8a91afdfec246b01088e0b41f10b1d7e7373458eb26718e5378386f0afe7003a78040751f852b23318816e8e2f2ccdba6885a80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c11272a43df3c5f55535bc36d4593636
SHA1a1a3a4759160d3b706ddda3ec56143affa44fc02
SHA256025f0a13b5de93ae15bd4db2917bd81c3ba46e4383bf2448d25d1d840c57bb32
SHA5122ae5265fea5a743bf9196613352ffdaf774819adff0110af758a8f8de38a804bb5c9d79110ca606982c27d54ec9733136701489bf145863b694eb4ec63469eea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5300a7bbd066621c28a76d06218d93fb1
SHA1360b7fa7a9f0cbcd31eb8d3b6b9d144e51263716
SHA256976475733dbe7c4c8fe643e58555b34047876a38740f2032c8ee486be72fc470
SHA512ba3d7296a884b4ee4227c811c4f278d08164ef7a89d72bc15f67c4b8096196f48d90c489b843d3bab76d70cfc812682fa1046c9495779d648d6e2dcbe28f9b85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54eda00ddaeec281126b281ef328b223b
SHA18d294757635ab787f95fc6b747003e082f0e1a36
SHA2569643f4a2c21e40052d212db4a608b6c6e226589f5ed12842174a7278584bfacb
SHA51264b692e0da5e5f89762c650b6e888eb144a3f479628bf04650150d1416d5dece08ea9d37f82372408e47105d9b8816d065b6a893a2c828083e3516ee90a0a057
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a5d6e3c3cadaf4525f909a5bc5ac2481
SHA1358441e25e004f2b5327e68b3a1c545fd4eacec2
SHA25641c66355c96860621ac0545ca0ee4cf5fa1c00f2a01e6b4ad75e763e00195442
SHA512a72f796b5d3f5492aeb08d7e7b0f5ccb42a320f158a5d7a57610e15bad37ab9a466766f3377ff0c3bfeb26365b27fdd823766041716d115690df7d6994a470e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8b1a9147dd76ca0bb464b597f632cc5
SHA1dadfdc5ea70db6d18f78c083bddb6d0393c5b95a
SHA256dc3f5a713ac889f200fb7be6264e1e308663c3dac58c333ed40ec51336f0389b
SHA512b89cf1a6cb1d95152d4d337e40fdd967a0143bd4400368ce6134d563fba1e07769dd03118a12c3321b44ff36ef2e90afd10e24f56ef0bc64a3598f93f180b6c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5769238c4d02571b1f0a1618addab362a
SHA1f3b90ec9d5ef770adfd5f6d1f7394ac77b59d5b2
SHA2569fbfc80ced7f6a041027a6d29cc8adbee6f15e9e682aacbaa0b9fdf367a9c9f8
SHA5127c5ea81012d5015ba9b81586519983501b353fd921f7d3c4501edfc13525510a9d5bf0aca2a7a8327e00ce17d80a11eec28fe4c4af74de8ca610989470860f1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d2f4faf50bcc4a4db468d19ebb0fda5b
SHA1ca2a55c55f0ed9ecf923a937e0d90ff57d754da6
SHA2569c2e72915bff3a9e260eadabe4699f30b526bad41cad3dfef0baf1ea9ca2be18
SHA51287d1eca7f9f9887f8cba5e174eb7becede2207ef94bf96416e69d2c0d684a7631a937c93f1867f7e93738228591259c92392857cb7431753e26fb7964090c897
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54757a0f922a4cd7a2ab595681932fd64
SHA1dbd7359bc348128ad8869f32f0cebc4afdcdbfd0
SHA256e170d5c5a0c35db874fd703510a9ac81451b3d30f55f090c4d0d244e65f9638d
SHA51236b468f2809ad2bf8b02d4a388077a7e6d8b60a58bca8608ffc4678df133360425f0955fea12aeb2076c0c82e9a89f6f0fd7731bdd45b5546ab86cc18fe41c32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f00c31719fd070eebb03744f329a078
SHA14b5dcb65ead43be0292520620d1abd809d07e2a6
SHA256565a2a88019ad5b036ee089e799e198b36cc7b03f5f490c79cd72b68d84dc373
SHA51228400cac57dc1ca9a2a7fc7cb253babea75de5165e0e57f7144d255f509d6f4307c103646ad81ab3ab360d8af36b7d84cde4f64a3837efc20f90bc60ea49e100
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f51604356f44f0dceef91c49f34bf2c4
SHA1014b09206ba5b087e8bb7f791a2bbb8fc9fa2a7e
SHA2568843ea5870a43aa5cb1c4068eea679503d73b28ee0eb83527469f674e27408ab
SHA512aeb4cb31bb61bf1d8628f64f02d33d5b65da32e3ed3025f8089b1ef00d3e7fa7eb5beee76b2d847ffa49f5dda52d0cccfba4e90064df727ea6e73c2f4e7be0f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c355758df0bf98f7d3d770a7ae89963e
SHA1a5c445652589220ec92165b5077b221f2baf0ded
SHA256ccefc75dc8975889033be51a2cdec14b759db383465233b9aab3fd8a2871b609
SHA5121a4ed64b03400c37975770bbdd1ab94520c868d3e8d28ce615d02a16ac350ef360d677179e18ef2dee6fc823daa6d9327f8ae154aebb23aa50fa9fb363f8f26d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532579b074d3bfce007f4cb289797bca4
SHA197c6a687cdc1367f8191a95e74e3d4f58c93c06f
SHA2560fa8db9adc58e44cbaecea084f327b5e21a4c1b1f62606314019b8020ddbd504
SHA512efb1530b9cef7f6257d27fef276fd2887caff3779145b4cfb71ed2d1949f4b599343f7d72cb827b3f9e49bfc565fd04993a0153cd60bdf787090b43e8c6664be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564c3b41eda7c62cf049914a515006ce9
SHA1fe379656834e5df75a24233ca62b0a1c7f4caa76
SHA256d08d02d5e8898f29fe4a3c0f9921f2bce9eeb332ca45d83a5d65374542e5ea54
SHA5120abb0d7de8642f4eb5a26ac287150e0bffca7addf9f9b762b27372546bbaa0e7a8c8d1167eafc523a8222fbdf269d4a4653cbd5789b3b16476ca9b52a567e68b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54b40d9a6da06a53f3ae4b4e91732e8a6
SHA1b6f55e62bda8c4d3aacae5b6bd2be04ec56ad2d5
SHA256ae687335bf2bf62804cea1ccc5aaa07d6768765b962ddfd18c30ccdbabcdeb35
SHA512abbc0ed5ef8716553d9dd5781f319bdf54d4f9d28657b8eb5c88cc89bbdb06f5434a7d8a514e3b4bc78e4495be1b383906be3a64eb26970b7b101dbe0110b490
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD542dcf8e07541e033dc5e15edd5015880
SHA12422627beac531d71a6e81d0ec65563e289c76de
SHA256c38b60222b5aae063089c1a2913e7f8ac53adec1da7d2f12b96226b7ba34e722
SHA5126291b3928fd5187b3a09006ed90bd17764d1a4db153752848a9fbc451f651d2dfbfd9eb701cb1ef62086a2ad8e74a5e1c1f71c694539d47c230f958d76e3236d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57edfd18e4735ce83e7b9f3a2fb921bf4
SHA1a5e2933806941db1da1fc87186016d11db71039c
SHA2565b85d0a78975b368a233e7c975d917bc23bd599a2557b98160619b73cbd24998
SHA5129514d3d9daeb87aa1989140ee3a06ca398b754527657ee2f082535a6b38e8e5910a52ce09e5512dc1fae55f2e6cad48f5159d5cceffc265b89de060193630ae3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b