Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 13:19
Static task
static1
Behavioral task
behavioral1
Sample
67bdc95028331fd312f33111a2999133_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
67bdc95028331fd312f33111a2999133_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
67bdc95028331fd312f33111a2999133_JaffaCakes118.html
-
Size
7KB
-
MD5
67bdc95028331fd312f33111a2999133
-
SHA1
f05ad49ab7399924e3bc01db9f97e5f12cef6b99
-
SHA256
1b1a0eb6cf40985569a06241ff5ee9b5bb285fb26d21bb16441c5473a2c30e66
-
SHA512
1cc6b89ed5e487236ec2d11b76823ed5f91ee61b06a5dd2520ec22e628fc3129958ba5b6f1fc416339ce3024cb1e7d9c440f7843cd60d4f030ecf6364e568d50
-
SSDEEP
96:uzVs+ux7AvLLY1k9o84d12ef7CSTUWzMcEZ7ru7f:csz7AvAYS/Yb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000291341ef16d03f6613729fc09131c0ae474d10641904b11875a1171c229dce97000000000e8000000002000020000000adee0c744c4e0d424673e8dced22aa7c4de993bf2f3e69ccd3746f00cbea4359900000007b236b7bf8c726f24872a00b0f7f6be9fdb7fe70c5054e5e2a5893b6c9f82c09f5d66b3e318b6c971dc93a20f0e181133e11e191b98476c8c5e3e183229431a32ead442439b538bbc71cf4fc4a49b593416599cd1af3d4a6e0b7c08b3a9c231d8fa022036496d1ffb6121c68abf8d75ebac9fbd7a6b78ee3d5548695170228def6c3e4087a5f73249f0c2bee6351e12140000000ffe78d612f65d724b6b4ac734899b6907e360de476e93627c223f93312e765ed24da59e446d7c5b1f56ff933343caf5a15a5cc8ce7900f5b049dea3680144102 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000e16725f8628876c3e28625b37cd403ca03e4374d470828f55454cc9d2b9fc978000000000e8000000002000020000000c519295e36f53e3190475b0def58e691740db3315fca050c177a218d29b826e020000000ffd376df092fcf44cbf4c05911947ab941928dd48fbb06d92208879de31956ad4000000094d1231add5d2aa0afc07962d61a00cdb196570c9423a059c1b6bab21b8267b7ea4bae89e8b97992beebd7b4dc49b24f855f64a1cf605d0a5a78233813f2bac1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427902637" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 602e850703ddda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{31007151-48F6-11EF-AC6D-CE9644F3BBBD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 576 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 576 iexplore.exe 576 iexplore.exe 1988 IEXPLORE.EXE 1988 IEXPLORE.EXE 1988 IEXPLORE.EXE 1988 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 576 wrote to memory of 1988 576 iexplore.exe 30 PID 576 wrote to memory of 1988 576 iexplore.exe 30 PID 576 wrote to memory of 1988 576 iexplore.exe 30 PID 576 wrote to memory of 1988 576 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67bdc95028331fd312f33111a2999133_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:576 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c05ae6496e8f77eb99c019dc19438e0e
SHA11945fa5c8e98b821a3731c66900fd9d0cd5e08e1
SHA2560df9908e9e8486b5d9386031e7347333913a2f572674aaef9efaf4f59795487f
SHA5123533c87fdee525fd801983a105166a7201e462d9ff050cbfce01802a8035fa7b57f6665ff4b267d07ea5600da4e05edf6f8aeb0afe19fb290126bcca37aa88c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5310b4625ee7ef0b36d54f5933e7bc532
SHA1b34e59ec06be39ce2f50412fa0e06d9dad0506ed
SHA256bfc94d5869ed00a96d0daaaa548c1d56684e71e72028d60efca65b18539b2ffd
SHA5124ede357da220ce62f27c47ad5aa34654850acc38396bf26e1ab131c9b2e1fe4f98e45296306c896e2908077a17fe9d0550e491d025bc57450befca58cbb4b5c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f23adc153a8ee0e56d59f23b131b99ca
SHA1a765cf60adbebdc477a27f68391f9a9c67a3bda1
SHA2560b1fd199eb68bbae87e4bcc2abf5167e6b508c78766e820e8509d80a76235cec
SHA5121fee41e155909d94dab6d914702837111686a97af2ecbf0ade7e4cf5a90103d6c8efee597f7d28300022df330f10954bbcd40b4ad51c9cd8742ca73eb4e9f75a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55ad3d88c3ef7fdee908fa50d744c08ae
SHA14b24e98b23df33ef8c8e619e5f134741294203b8
SHA256f5fa2ee87ddafc3be7fde2247ff7879760ebf129dbd061104131b8f2d2d8ce5b
SHA5122bc63ceb9cff8026f9f6d2c96a0e6de96ad7cb5fdd5438aa4eac446ad75c008986302e1f6268567f405690dda497d3ee0e39181bfb0ec0e04bfc0aca1ae0027e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56739c6a52c8d64dd0ac70df4b1f8057d
SHA178dac8781d80077abb18a7fb1d8c1e7795699ef2
SHA256d35b0ec5acc518c06fb7af8d6878c56b6d513d5f23128ec20fa0f85989970407
SHA512db07beb98dcc0f69668bcb8de5128de849591d1930fc39290e9b1595aa5e9ba03b7f35e2c6519f4b82220862fff6f6c497255093e31d5f8cc188a85bb9afe3e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541781904de46a338662e097395da2d98
SHA1f0940517fe680fbe806bb9c196551c622a6ebd7d
SHA256f6af1c8cf19d5ecafcfbc77532649f0c4d2ea850c04a6cbf392b4e891347d9cf
SHA51252b87f473d184469e507be5d406c5d22a019a4999415cdd6d92a0f91d3ac0046bc6cb399d042250dc7fee2e45c6230cd60d5cd16d653d6503426faf70d4694ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53d91e00c6a96ca41f5c5e09c59276120
SHA163ac2f29fb8414b2220fb4e76c1534741922cc86
SHA2561ecf54a62e22aaaaeb175412c6f43340ae08deeb536b4ee2d055507f77265a95
SHA512347e5313acd6f1df4b645593b347173944b28f5f9612edf9a4311063355e0e3262ea2364e15b2122f7bcefac01b037d6211c65d41f0c6789d5691feee731122c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56fdaf505a5a906dda2ca8c1330ec1d8c
SHA1f816599b0e2c86f5e21dce283b8858e6a6732eaa
SHA25670f32f617c5d34b055c06172f65003e0f491e46da20dbdae2cf8b0c884ff926c
SHA512ba93956490b58b70ffc2a2dbf5ed3269dfce0f9c4b5d8cb704b8d83a38f2458fddee16e3fb415e35d50fb4f7feefaabb4271b0d6514cc389e353d56a3d9f1421
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5441f85d00c43090986766e2816ea7316
SHA1b125923ef5572dedc003fe817afe44883f6d6b51
SHA25647ab56f40cbe5e23e00403b62e02deea639b8e642f9e1e61c33c9ba600d09b1e
SHA512cf85333e749dc0cd827a86e14418264eeeddf94ba3a292088522148b4c8377ce40c0289d64c7d2c0df1559313c93fd4ab93d7306a448c4e31bcdf364595b4fcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f59db51808f8d199fe17c5f701829f1c
SHA1dd5fe5fa783443c653905aea45778e3249564168
SHA256ad5abf4908c802adb083faef8ce6400a49f13361563effed4432d69de925ea68
SHA5121b4b398f2dfa9a6b03210b8558897f8a09cb987fbba77039e85b52094447cf0c442b24e06d6912c60e1006e217bdafe0501ff30e84f43c4380bf0bdcacbd1062
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5977dc3953cdae45919cd76d299305fad
SHA152abe60b7c816ebb6f77158c855bd72b5ac34a56
SHA2568f0fa3974391954a17b17ef9e928cc9545d03b2935a5e5ab7e921a9995dc92c0
SHA512270e6dd79a1ec00f84add961fe4ee03ad1e3c4b437e17dde96a798eb0b79d343642375068ba0b192e3d4088bfada705ca494dbcf4297876cac4f564c106699eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e56233b721b5b13d4af5ec63ea2e6648
SHA1476dce60f9bc9b0caa7375798d82039150e4b23a
SHA25682d1f1e5e53e993ba46db7f854e8293253860a4a4ce4b9658d260f1796babb84
SHA512f4519ca1fa44f1afbe61ecc8cfa5e141bd4a5f515689d506f936c34476820da728a109a08e1857be956ecaaafd04a38890f72e422edc60478f91576fa620f789
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2aa0dd8767f33a0fda75af4ba2a5708
SHA134bd72ad8a47513021a5d69189feb5d462594afd
SHA2567c17da688b7c5b876eb03876a37c5aca74855f2ac3e5ce430ada9743ae5ae9ba
SHA5121f2e7b4f6bab510ba2fad03ddabc9c90c24f94e45ed4fe571bf589874989cc8532413654dba180c9246f7096d5a7433d606cd91bcb651d281eda6d8352944df2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5107ec0fb412c4947b0623aa70c088a72
SHA1f34eeb423b4f0d709c81900fd8fc74300767aeef
SHA256ca5934cfbaea467d9245a91a1d2843d40880db774dd2cb2c3f4e220d6f997e63
SHA5124327aa6b9b02d33228c7041e2755c4efb5481d0bfc3fb5b166c6f660d00de781c335438df352ca0c42b44e116e0975251b36b6e050c74c4090ea2defee250f9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD543afc011d1ae0b9e47834174f9f614aa
SHA16e9e0c95387c19a26c08ad339a528af295add1a2
SHA256df05a2916fee06c752d38c936a1a264cdfbb472ca436b93034259b81f3fd2a87
SHA5129df02f3a59dbf120fb1e11967ec9d523fec072c454dc7fc934aae0666e255ecdbeb1cbb8fe5e1e5f4fca75b4957a50415d85ca047cdc7d198de27ca82d006816
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552fc9cf99f3c274d6a59dfebe98a09bc
SHA10ae253d332601c26f65b3ed2a273e10af91fb8ce
SHA256428706fb585162a1940053a21b4a88d32deed474441b205721f7d5fa6e3e3a6d
SHA512a5c7aae95bd9921bb466c35c175a7c5efc5b099175365864c05bf8bd0f7138ca1de51c17cfc04ba6d20680690fa5589a79b547355ec2629a1f7e56007a349039
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57042bb09a7aea576865fd932d656ffdd
SHA1eb3c8c4ecbf3f5b6c0f58cf8ac267225c1aebe39
SHA256f7c29c6701799c0303c87f9a33d6698b332c01373562726b0d8c12f13f0d6827
SHA5123c4b5a6041cf11db0fbf19bed0479a7ea2617e292df896e9f94c500665d26b46d42c3a77dbcc81aaebfe222728c91ef9b0857d42702e049144d544976e907a2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9c870238d984f24a43afe88a9a09b1c
SHA11c29024aaffa9a89eaef47de004ffe62090c3709
SHA256cd02081c5fa32f0120e01e2141aa415dc2d25c64374352199dea14c2309e3064
SHA51297d41f75ef8608989ecad941f2b72e8dd126fd83d5db6fcd350b6e00851cc0fc803186f65c2890515ef2dffc40b161ad1fbe7f4bd94843913e7a3fc3dc309671
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569e2b829d9706ff0cfaa8edc18ae350c
SHA19087bc68558a8675bb44b7f28d2ac681ae5c08c8
SHA256ae981bfd59df70d5fbc8870f2f71cb3bee98cff9a6d1ce4f176ac0b6a58f22e5
SHA512b7953aadd979834683bf581de79f246ae10ed0f6c2a149fdbd0ec2a3eb894b8bfc12f32534d640a1ef2626035eb4c4e260906f8ef7045ceecfcadd3be8ddf1aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b