Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12-07-2024 13:56
Static task
static1
Behavioral task
behavioral1
Sample
3da6bab4638da0362d6ab8b37c9e3791_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3da6bab4638da0362d6ab8b37c9e3791_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3da6bab4638da0362d6ab8b37c9e3791_JaffaCakes118.html
-
Size
6KB
-
MD5
3da6bab4638da0362d6ab8b37c9e3791
-
SHA1
59ddbb64774ae1dac9512b5a36a7a141f4d2d729
-
SHA256
694a884afd55d4809dda4fad0e33adec0c76edada357c3a8402f848fc2377f27
-
SHA512
c1541544351f76fa7f9a2eea3217468e3e4c45410a38c6682c16a3b67aa056fbff520227abe0bfc21359b45de8d8da67a989f20d46cc6925c55942c1d1dfc4bd
-
SSDEEP
96:uzVs+ux7riLLY1k9o84d12ef7CSTUBZcEZ7ru7f:csz7riAYS/8b76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0df785b63d4da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426954449" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000004655792410fac5857b5c2ec286b750e025d36a54354fd5d937e1e162c753b642000000000e800000000200002000000015b1582b8d78e5ad00ab9472d0fee4f7e70e52a49345e80a095f0c6a31d9d5a820000000fda5ce5d112c975d929fcf3f6df88c392be2c10fb37d8e12f9818aea1289ced3400000004759b13a1c499da5e00cbc0e1054998868dc02e0ae86ca71739629539b122692567c01d3f4b76a19fcb9acaded4a31e0107ac658797eba4a83c4437c288e741a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000fdd4b7174c4efe3899f832b9bad3e161df13700ff6f7949e65807d8310541d3d000000000e800000000200002000000012c5d07f39255a62af66817d53f0895c9dde427765aba02b8362220eab4ee71490000000340a8c9342366e66c1583705a7f0160e6e08dd735e6961b9a0f9e8c4df4ebda88d23d56259d0da0a6914e85e7c6751889238ad54103111f0bfa2dc62b575d1cf2d7dc0130b46d3f39da7317e9ecc315ece5912d53e9f71ead1540e3e9af44bc6a8117b2d03752dbb5118bb6901159ca57bc5998babbf90e7eb3f11c760d167a3f2ef7257125ba087c0e4019e2e994c09400000006b60d8dc2150e4fe8438034555dc8760b661fb2551512cebdfafefc4528b093511d00610a0a1119b6ad0950e2f7354de4ca2cb8ad247fadc56f9a2c14c9602df iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{84EAACC1-4056-11EF-8A22-66D8C57E4E43} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2408 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2408 iexplore.exe 2408 iexplore.exe 1268 IEXPLORE.EXE 1268 IEXPLORE.EXE 1268 IEXPLORE.EXE 1268 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2408 wrote to memory of 1268 2408 iexplore.exe 30 PID 2408 wrote to memory of 1268 2408 iexplore.exe 30 PID 2408 wrote to memory of 1268 2408 iexplore.exe 30 PID 2408 wrote to memory of 1268 2408 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3da6bab4638da0362d6ab8b37c9e3791_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1268
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5040a184d76a9fc030e70ff3e5b099053
SHA1f5cde64c2c6076362439522d24076ab3d8da7029
SHA256bceef91749471cee570a122860112a8534d26a51f3654a1834a833063f05a53a
SHA51288d5217e0ca131c35ca1434c570715c09e7ba0d6bec639e221a378740b07b6958a96f502cfe1d7cced90b3f2d297d7f56e1bf45fa2ec8e4fd63cba90b8bf08d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c7c481a26978be55e637f1aa2cc265b
SHA197db9a3ef12b0747b79a431251109c01df15df54
SHA256d3af6ece24e11f9ac9de4f33e88cc3562f3023a99a27277a6d5faeff1db3af88
SHA5125fdceb216b9f81c509f229aa0ffbdcaefb2c20652cd1284203ac80a3e45f141cdbb695e727807bb033434ee8a572d79ea083847c7f65cf5d4330ced66b04fefb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50287cb440450c4d02d4af92185d21d7b
SHA180d0ea733e9c58ed89fac21c0c05587c63d87bca
SHA25629d251964e2f32516430a442b7594bf02e86bee88e32b0537330f40f6e3d4a3e
SHA512beebc3016e7dc36580b57f4182db976fbf95a91a2f055d7b19358949787c0a4bc289d4e67709456c80b1c105f6b0263142309bfb637c7845af0b1c415c6323db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59051b6d4288385466f9d1d4f242affba
SHA1b4ff3d537aa978ac28d5f27c4550434635122f83
SHA256a7c21a98c03330d8fbce8e5d6280c9afa4422dca35b6622b17fb42195f5089f8
SHA51209f942a79fabf53201c3cb74f03b04fc38235c56e31bd602b7e08f5a6cc07c360ddfcb471eb58c2668d2df1965a80080982b022d2e0eb16405efc590e531b66f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508f0fbf69d8fb0cf4927ca736b49d59a
SHA1191b8d656aefc6d7db9715fdbc6700099365760d
SHA2566d299c2624b40fef36d7dda162c836d9ab845ece0c76e02f1741dc0975b7cbca
SHA512295e8bc53fe646f50d5beaf107c00946e04afb38c2734e17de349bd708c3e99f1f0be066e605aaeada6d55e0fab2efee68f38574daea12c1c884496ea5c0aa8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f3e836b370c7043381e58e7a9e154c0a
SHA16f8065adff4738630077a02bcb437ea356c9862a
SHA2567b9df4124f41a72030d07f9fb28857feb3416c9ec6ddd64f951a17a5ef509e74
SHA512904a9a8a8f0fe560a7aecb28acbcc03869736d56d531311c64275a94635bc2f663abf0ae376a125cdb3a71e850b252c909a0dff05c9490153b2227e782fafd5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58fff6d6cf1295a54e5ebc56c13919003
SHA17fbeec11a27a39296c3fc38572e0e47137e980b7
SHA256d5b63645e37d2cb8b69b85eb2a088bf0c77c02340684e24c41438a531870edc8
SHA5125bc06672399605e306f4b85e05e00acdfbfc14b5eb37b56d35f5c181014fef517cdb5d3f3e082524f99a7efc1e090edf9df1db7e4bc648fa3a5596af80c4e403
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bca3849d945ed6fe804c4e00c16cd9e2
SHA1fd7d1b0ec7b35abccbd4c680a868c2c82385ff16
SHA25611e114d6e1eb5797b8e35e09171f440b1871cc9a87c48f3ae2f73c822ae6af8e
SHA512dd1dbf959a706009d460bd570eaa2b3206303059049325ffc57b55fa5b1f3391301914215bdd47487d2828d96dd608875f44d35e63ae58aedd09e2aad0441018
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59590aa94b61b9088e8ff952c20cb6fe7
SHA1f70c6a44f45ebd88ed250fac481b62e5fec99fb9
SHA2562d1a0538d323cd8d30145f071b4d50fbdb4ce83358d5314395717309b9725e09
SHA5121f57a9f0789620f20e47f9f14f65c951b5afebe25e7ca0e6ab049fb90011dc1fb307c584b28113abb9d4b7f45ff621f8c195d435e4f2a6915e638376bc50aa5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e4cd7e04a109a8a13ae9aa05b61b1351
SHA1b16aa977608a7a196f5c1d9051e5fec03d7304ac
SHA256480b97525bc956f675095f1a992d04f5d348c0135fcf1f4e2a51a89bf473da01
SHA5122cbbcfc965b173e1b59369cd5e9aa1a7d796abd18eed1bf5d875aae9ea43b6d1971f3e4480ccfc8ddde3b57cf93471b3fbdcf7cccde9d3e0faf6079c8ce11d5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a9c5b80d2f3f387ed16e1111cbe2041
SHA1a6f62892d5ad225beb06b5169fbb6c4bbcb4e1eb
SHA2562f31987cec50e5f5064b04e69fd07f25ecbe75aca56a52d239d0cad74bab802a
SHA5126d7a492797857250f052cb286a23bd9d0b35bd1cb12214813b8bd50aa748db1b65b68e006c2bc94354fcc618e72436dd981c416db3a124b2caff5c8d21d40714
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ad431385f11454a28bc81ad6e404419
SHA135c8d6eb5022ab5ea629784a8bab6e188776fe02
SHA25621413c000a2e11709e92abaf4bf3855ab030a2a8dadb9ff476ec20a0eff4e426
SHA512c6d22aa7ae37c068fd916cef0f5fef6a3bdd6b4d16a9f3d7cc5dee5b0dce19feeac1c965a2616e4597beb2c1d5f61ac2eb69c6c4a7ca3532d11272d87312c626
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce7c26c9ab52e1a9529282dc73d92413
SHA1e14ae19071ab12d372b405785dad52f5cccfd7f6
SHA256078094cf85f143e6c5dbcf2c90c75f14a78571bb0b9d53f879e4e8e2a586e80d
SHA512dc8e5068abb7342695b454fa98567fcfe4871563673681a796b9d05ca8bcb4f5f40f9024392faf966325345798cc6cf2ba09e2f732546ac15bf1a77339a3b067
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537992657c23de42197bdd143cd9d5de6
SHA102dd6e710bbfedab373bce90c123fdbae8019f10
SHA256a26c2298ae2ff1eb277db185b956fa0f20e1d6da7166805ee046238704065686
SHA5125f8c7d94cf506bc7bbc8b92f1eb50bbe9a71531b1b8f697a3014f2061f233e5418619b2325310af7ceb1fc048d0d7b418cf1f07f3e268be2ce54d338e0c65f9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2bb174f30b938b09c39bcfd9d830abf
SHA1922050b64d5d5e2e0d6fd8dcf3eb71477ee87ec6
SHA25614f8e2892e1d97c5c28cfb5b64d9237aa136a5b994ff1e31c9b0732a8d0e5212
SHA51269463a38118ccb1118c9b31183c173592b4f4d8bfa183472bedc3a2f9f928357a89bdc52a3daf5bc9d522f93f42bd40bf58d5a6e4a683fc441baf57e3f444519
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564febf1a32bb368eab2a2de576226e5d
SHA187d581d44d7ee558a8ce0eb4075690cf64b69f19
SHA256fd30f07ed88566ee234178bb89b7c31dd2b65efa66527d71917016ab67109402
SHA512f615df9bff25ba177e7da4bfc83753437952100f6437d73b150faa304d6db4f6b1e09e30a0fca329faa416a6d1e687c2b396aeac730785656baa08169ea45417
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57dc1651c42cc9e0cc86490a05ed8b5e7
SHA18fe4ed32bc1f07147eb1ee17e27deea887b9e214
SHA2565b74314fdccee1b536d2d2af7b046459678da1a196e778b66a304524c436e36e
SHA512edeea20519e334d800bd148e7e3e5fff51283d8093957bcf73447a703801845f8c597298a80d6885aa3db8e7b587e8c8adfd31f5b71b6335c79a7bcf37df0449
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515f1934ae0dd6c007ea547b3875feb6d
SHA16966511a39a39807699c36648c8e4b820608a29e
SHA256f6a9bf4afb075b464e45b444db05c66a9bb9d3e124621a169247e99aa45f38c6
SHA5122bfcb0b1cc982aa412e0c489ea7fde9549c24967d201c489eaca4245d997372d12134f96cc9f033279e2f615cab999db0ffbbdfab8b6e2f26195306102a6e349
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD559288a604c0e87106ac0e263a221f2ec
SHA1f7ce31a129aab0ac1d6bb3147e52aa8e448aeceb
SHA25698683ae5e7942b5d9bf3d43db68231633c3e5c2d2f6dc92a06b8a1fe7876e49d
SHA5127b8bad2917953207d2cc59d9c27c536fa0881b6824aa90fb0a17427d2604f6809426b30223c5eb3fefc3ce268357cec1ca9593da1378450ed19056bfcae360cf
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b