Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 19:00
Static task
static1
Behavioral task
behavioral1
Sample
610c78338e4b500fb7cee7ba4574b470_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
610c78338e4b500fb7cee7ba4574b470_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
610c78338e4b500fb7cee7ba4574b470_JaffaCakes118.html
-
Size
53KB
-
MD5
610c78338e4b500fb7cee7ba4574b470
-
SHA1
5714c3c3115e5e395f6407a5f8d61419024c4d1d
-
SHA256
c8fc33fd9f063dc0e9c43ad454edb82b9e88c4edb39545934d56710b67347c60
-
SHA512
8b99e9921b166ddba3900dcb0016d248dd173e9ed540fb604797d4e46adb3761b733acf3f4581e11bdd502f82cf0adfb3c55c01123f49b17e08ef0e29461c5ce
-
SSDEEP
1536:CkgUiIakTqGivi+PyUnrunlYn63Nj+q5VyvR0w2AzTICbbLoM/t9M/dNwIUEDmDE:CkgUiIakTqGivi+PyUnrunlYn63Nj+qn
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e081404ba0dbda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427750269" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E993E21-4793-11EF-8A22-66D8C57E4E43} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000099cf4c4ac9bbdab6eeb0b20802be06fa39ef1af4cc8add85b57344a5b2830dee000000000e8000000002000020000000291ecef81f8687817783c7e8d174ad12fefa880460fa78b7d71b836d5098ca6f200000008945076323371f443cb401c285ee43a16998b0fb43121cca288dc96525a7fa1a40000000867d76154fd49ae05449efed83933579ef0927082de45e581621cfa54d02af8af2bf212808f8c2b3a89dbb7e1cb9a9388e89f0db00c0547665a6737136dfc731 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000fd287b3900bafc7c9d3f2fe4b3dd4622c923bb07e763835679c5af4d969742b4000000000e8000000002000020000000f212d48a2ab21ba2de7af9fe7f3bd54390d102bdf6728335be7bb413847846c490000000fcaab78bde9636d1b644fd561bf9dd38a75dbe4c5a84b8084a267d385babefa34161013efebe91c44e3645beb67988ef09b65684ae9d70578b102d12d28aa6181c4b6a76b83335f871083afbdd83f607191778f49f6a06d536498a5cfdad6681d609919687a2d9f37d28dac48cdf5363bd900681c80b8a25405185f7c9545b6de4a31a57bbc583475c94354bfe39b0684000000059ff675eb718934003a702b0fc20299f9a4e495443b45904bd8f1da2c39254565a771b14c459f379fffbf907526c87bf4b041b9b22c884de1dc30e7fa01fca96 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2408 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2408 iexplore.exe 2408 iexplore.exe 1252 IEXPLORE.EXE 1252 IEXPLORE.EXE 1252 IEXPLORE.EXE 1252 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2408 wrote to memory of 1252 2408 iexplore.exe 30 PID 2408 wrote to memory of 1252 2408 iexplore.exe 30 PID 2408 wrote to memory of 1252 2408 iexplore.exe 30 PID 2408 wrote to memory of 1252 2408 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\610c78338e4b500fb7cee7ba4574b470_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1252
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5657514be2f988a84f764c3e6f41df4cd
SHA1772a9b5092f943984f05c0be91325c8edf06f704
SHA25686c96714fa37bcabc4e500ca0902de2e8f351ee9604dc002ada767b8e8be9eb8
SHA512580c0e794609bf40df63cfe522587ec11f84fca15640821e69915a6e2bf5088835fcad6fed1d0c9ffcafa4404282730fb18dadd7709e919b44e66681b3ee7a8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f538a368092f9e3741cbd857ac2a7bff
SHA1a3e873f1f47e4b0742864df5c765c4561793e69d
SHA2565abf7af02750a144b218df7b11e59eedca4384c89246be62808acd7a0bc61558
SHA51236c520d9c80b9033da306e03193c33638cfcaffd32dd89f729b09b94b8a8c098b546c404763d35ba6ad08df74377f23fbc05116f2e473bedee0d88597d5adc72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c453ecb220e2213fb4d4aa59e193882
SHA1e70addc7135a08b988364d9213613d6d0ba0dc40
SHA256455a785ddebce2ed1d226851cc88b96ffe68d5935a9c6724e6f0d11caabee023
SHA5129b570f474757f1562d5c8120c8bc85823fa17387245d2a0acb060c428ea749ff800ea191f8398d5eedecea517ca75660571388b437ec9792f35771c8b88dd55d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD575afb7202f48f85d5a1ad3a115ce3680
SHA100398a4c1176ada105a8e3a8b308f40895a6523b
SHA2562c8a1f0d17473d9668f21254b705a700a61afcec8f5047a19c8001dc6d3d8ffa
SHA5124451606f13f53ff42563c3aa4f649489dbf0c55c813f67892ea2a959b496e21d7c9edc7ce68364d4be92b1006c5c5993ce6a6b9738117cd6215f1e60dc72799b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5050802f74a4235232a7c793e2a067f54
SHA100302b3b5fbb976c9b907b694fa2bced282bff44
SHA256347ebe2c46fcc69ae698081cf63150973cacf3ec29a7e2eae5263ff71c4092f1
SHA512c5c73a985ff02e0cda558b130894fab1585e1413274a748d731667d031a1413c17634c836790316c48ab1d2d91573041e7f26cdfe5d1350be01f33fb1e53710e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f80854bb382e0520749264a0f8217d0
SHA12f2ad6abffdff752b301cbac0c12ce0d48f141fe
SHA2562ad8f9589205ca224ed0ece96c9627294bc162ca7b3f94e8295fc1d3c2a440e2
SHA512988fac012a53a20504015dbfb513159325111379cce82dc72024b2d19a78c54429bfbb03d8845bb17c9e8fdc3f9e885d4aa68d02928f1970eafc267093efb671
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a2a1b73f09807fd34d678f8d64127e5c
SHA1d98a8778a94013ddcbe41a3d7b43074012347f10
SHA25629bac1492178db9f76d69774829eb941789e8214595347d4e1aaa5f51b921af0
SHA51268f7f2744d082f21feb433ffbbf6c33cec6dc5065bd04aee94d8e941ef2292e2c5a42575b8f065b1472204b26b477d48183bd8ce4826a0944145250e378cfd62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5410fcc249d072d594c6c379aaea995c2
SHA1cb0abf759bc89028a316e34f0de07c85a7f68b36
SHA25641a402de02e9dab5a6d01d4587f87fd948f5de407dca26f97ae4f56f8dacce15
SHA5125405e757ac892ef703862f6de7e1105db8941564b2f5e2c445e252075654d4d75b0754e9a8ca730fb38d57c006361f8878a55ffc54a7c48db56c0fe1cd6ef77f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599ccc7e5795582b3f74724d7fe2836fd
SHA1d3007c0b73d037af949bc3a827e4daaba6530a37
SHA256061349e9b1866a38cd5825431377ee40a3d9161b4f372aff20420fc7ae4c0863
SHA51222aa91bd7c19762293d35726b962653a4e08c029102543d67135414bcd8e6837ed8624e1c85e3f5a2ea74b32922ff276257618965dc457e31c41a96347113ec8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507846b82b50cf83e0970fd77e45ec38f
SHA1f916011bb20be2bc27b9d3965757df353cc81330
SHA2566840035c1aed93e8555649fda1f62e3c1ea2a1fce0ce70a4723e242c7caa57ee
SHA51242bbd140b54aee175b1cb6cbb9a3ba7445f9d9c5ab5462804ed80d3f9d9afd4a84991aa41b0af8d8bbad2539dda4fa50b26a14f12690f281b65d4988af419197
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c0c08284407e9ee28abe5c0c77a4e3f
SHA1d19eb52ba0c98aff78485aaa68981df814490082
SHA256d850fee988f2907b157a9fb1154d00996b5a88d8c8f10107e1f92df561aa6aee
SHA512a7f430da2dc9da35bae65bfdb51bd812999e5f914c1ff424e7529179d1a434492bbfecf290909c0368d524b44a340905069b2934eb3c48a28c6b17c8dc3cb471
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c1822a2da4dcb992ca9a0c8ba401c27
SHA162df29b2a6a8e38ec3b62e202e4de9dbbc1dbfd8
SHA256987c1e0c1bbe740dd048ed7004a65148f0a743458dc77efa78e62726eeb6874f
SHA51220681cc6622393bac1464b79816db604536a453b3f52a8e19ad7576672fb78f1f5ff878476ce32ead1149132b56f940c27ccade726ed895121a31137b3fd508a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9fecc64a3e4d82b8e761dd15b219130
SHA126690de20ad1c08021d647236f51c691495202b5
SHA25612bbd59a26a0e873c29d0f5c5f0ee8c6f0b87d88f7bf5a401dde91392c0d7361
SHA5129f6ffd0a2c25949e48c3dc529f636dd40686d10fd775de311c417f65c04256d00b254f5e9f98bf2a12361e37fb8536f424a1c5c43780c360f4152f804acf5c71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594a9c3ebfdc67ff534b57137ea283f6b
SHA1dfb8ed2de6d3079d44a01f94e86216eab4fb09f9
SHA256d5303aa3ce9f33c95561fee0e848f86d1b68bc40afb896c18dc80e0ba5a9cf94
SHA5126ce7b04fe7f8909fab75db31e8fc78a3f607ea43e28d782bf54b403cde1dde15f162a6ff11659389e6d234ad867724fc0c187841e7c47f30b81d7c83fecb92e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5952fe99324539cb916b3783d24ff57bd
SHA14d17c22812d0a34d04fa7bd45504c1214c4d7812
SHA256f664a98430f239999f60d0d7f5bac09e414fd1987a7fcc56adfe258d41d91818
SHA5126def4f62ce30bc4506bb3d40e55f24dc9b4d2cd3158630d1db4fa74e35a015f5acb31310aa4a046ea7be1440f162e64f4a788d728a679eadfec3b83ff9303487
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572fe687ed334be4beb6968ecdecbc985
SHA19f9e167ac56eea21c301f1cd314d199c8890ac6d
SHA256e4de5e4a9dcce7749ba2d2cd218d7b2d6af51f324142c0a9ece1ef816688f748
SHA512708b24dc22cb4393c89a4a453fa5f34596351abe85e5c2d5bafd85fbbe59db7e1f1f451cd5e070a6b2a7f0710721ae7350c15d19eee7c543d4b819d66e639487
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bbdccb54aa0025d3ec74e281d6b34bc
SHA1ee846d407e229674306805cde9046ad0e3f732aa
SHA2563c19783d7641fb20644ff23104fc0ee369b7a97353c1d3011e803da3f6b896ca
SHA512ca0045ca6b73a4cffe2003bef7d85c82ebcbc99f14be1f983b69a849cc6a442ba9797eebf521b7b3fef0d2762ea13a8d64431923e423fec21e0fbbb7a4d916d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb71d1b8602c0bd189cb6f90dd0a8d55
SHA1defa3063d9532297d9c6b4d5f28784eae63f91c8
SHA25608ac41d2d131a7003e542a5fa4bb971dbd64c6f23d0b1e439317207997b03592
SHA51294b49dd738a7e3a149459d319bcf85b944886f371e330588e078fc049373df04452eb9ed583f9e053ba2dcd20e976d4620a7a4c3cb349165d6c415699965664d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7GT0RRO\style[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b