Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 11:53
Static task
static1
Behavioral task
behavioral1
Sample
a0937a6f0fdb222abeccf2da53210669_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a0937a6f0fdb222abeccf2da53210669_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a0937a6f0fdb222abeccf2da53210669_JaffaCakes118.html
-
Size
461KB
-
MD5
a0937a6f0fdb222abeccf2da53210669
-
SHA1
54702c3487144ce3a7ec91407028bdd0fc3469d2
-
SHA256
d55d4f3913d266a3901850e490cf39c63c78614a708054bf08114c8a0222206d
-
SHA512
2376fbb9dfec01ae4aa12b882961e19cfe3e626044e8d54051752f837f245c0089804fd91d4320e9f3a6bc0c215b3140622221e94ef5f5fc00f6778c9a65ce8e
-
SSDEEP
6144:SkesMYod+X3oI+YHsMYod+X3oI+Y3sMYod+X3oI+YLsMYod+X3oI+YQ:65d+X3d5d+X3Z5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000061848c4f9008b022e59a3deffbd7f464a82f3c00fc34a17a5ffafcd852ce31f8000000000e800000000200002000000099451397be0f70d626415d5f10805b841bd1853e0e59d339c2c913966f67a22f20000000ebe975865da4ed0e677f69cf733dcee7be9d3832c9badb1bd4807106c06102ee40000000f54fb2038a44f05cde54efded5488e0ceec89e65782bc19b21ff665541378cc313f8d6aec39fb34f5f4fa9157721961af4101de36d0f880491459e270e75e453 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f071ae4bbfbcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424355105" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7327BAC1-28B2-11EF-AFF9-DA79F2D4D836} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000075fd91cf2075aea8d73459928f4e466b4efa3b86b62afaf7b403528167de53d5000000000e8000000002000020000000ae7afbecd68924271044f74bf27b6366d051b09696b29e50d09daf181c439b0790000000cc846f25ff812d9c35d1e78937eabcf518dc93957a44de6b25ab20590d80f6e6245d7ab19515a435269a7888fe1233bda91b7d217e7733055863259766d1c9bd68a85caf37c566fe5110337f2ad452f7b968542d0450287cc462431af66488d3af71d585cca63a58f440deacbfd64efebaa6ce48f44515ebacef34908c6f16517b682139f007a6b7fbdaca9c79d43040400000001946836fda91813d2613811284d97e3c3a895269a4c649605be5b09f115b4145ad5945409b0b77b3caa24c1531f80eb0b7cb02401be8ff094e02aeb5ff4bead0 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2020 iexplore.exe 2020 iexplore.exe 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2600 2020 iexplore.exe 28 PID 2020 wrote to memory of 2600 2020 iexplore.exe 28 PID 2020 wrote to memory of 2600 2020 iexplore.exe 28 PID 2020 wrote to memory of 2600 2020 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a0937a6f0fdb222abeccf2da53210669_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521a50d47ebf1a5cd8685492a82198415
SHA14f52c7251032078d7c3e30fa8e08007873112979
SHA2568acdcd07069690dd0fcd966fbe3a0038b6d15a7c7a52fb612b55248ccedc9320
SHA512cdfef78c86b945b64b47f41eefddf0bc19dea4dd75e2c52b8facfe0f847066cea5005d1061f65b4cec33fe5ddc2744a192fc2cf313a937054dc7c714b2ee40a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5309a343ffecdcf436f4c399fc74eb216
SHA1983e17238408f1d31ba4580025939c5ac17ba18e
SHA256d8cd8772358431169a028cccaeac8bee0750b7860e5f13f730102b673e043a69
SHA512c4789e07d4c85b2f40e5e3332e5f6ea5c00c7f77fb33dfea9fd71498346606b08b48825bf8a49dd68beeae302723a30cd1006d39ec505d653e0b3f3e72eca770
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570af3436147da0da87530dea422e192c
SHA124cf85ad067ac1af093a68c1d91942890a61eeff
SHA25658eea5f01f9bcfb4f8208b3b764e426cc1b9b6d1e11ef07ca5f685718990b4db
SHA512d210d8adc45f9436b6667fce123c5c18c6c6bf24413d315d0d248dc79f55152fdfb772c0d194de1192e272f8688620463a8ab1ba8f93d14c9237a2179b7e66f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54066cdce8817a367ef84e873849d9ea3
SHA1ad13080a44e1dc8c51c58c35e6b27aea6a8739a5
SHA256c0ddd689988acd7e946c9e01eab0c7c658a4fb5860ffbd0891117e75ab69a37a
SHA51202891deec8cef4358ecc42ddf1625003489a6ab720848fc3c9cccce423c9dc032e4a7288114e3d11bf57d77524bc229d938c53bc982dd39b48e3a7a0d4919e84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b71eaeac669b1af6c972a3df359f1a2c
SHA1b0583d0ffd67fa8cee611d1a6b019238aecefb65
SHA25684d53d86fa8d3feb2059e64ad2f3913530d887b5fdec9bc8ef3c58511ebccff1
SHA5120fbfbdee51c82cfd8a55e031f824055f3b68e2560ba07ad5c8574d3d14769515f120ca620514ceab42587971305b395060dfea9f3644e3e3735a1f3c011dcd2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f23ec825515e0a3bcb66d29a52d5a0a2
SHA13ac95e63c9ef865b6bfbe4f5a7c0ac726e78407d
SHA256da9d3c86b482348415245d85e456b23ce25263b49128a021661722269e4529e1
SHA512133065a5008476517e37d877956a4919f569665031196afd4294a0603bdfa978fd2db8e6113c143d428c41c1bf2b9a6d7d306ae85aa2a0273abdb2d0e84c93a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e96851b6045422c7317aae515d9007f
SHA184b10fb7e66030124fad98c35c7b50c477cbca26
SHA2567948b4ecd5ff9c42fb0cfb9e2f0b5cb9598e7cf4924ca981e3de9c2b32bebb5b
SHA5123fbd9279b83dcd8b05d280d398a1bb9121c70f185f8864fef72cfa72f088357e0d1f2387e9559f7b328c7a02bd02bca72df83f0b2453d8cefdcf5a4450bec55b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac33aaa38dbd07ba8e28075aa88349d3
SHA1cdc024e89f5cbaf7edfd8ec507cd61a9aba4a9f8
SHA25651d74c6f4ab7696ba019e154f9cd292cda282cc4a4b5b2e86a06739340fca51c
SHA512865a58c13dda1437a61648d24b54c1a5bca4eb540512eca03b07493daf70c47df53b5b58acee8c938a919f9f988069110fc83adff4335987bffff4f464f3c1ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0de6974d437058a22159790aa1221d0
SHA1c3e4972f97c37f004bb87da60f8cfbf8af5bc205
SHA2563854db07c026739de421fecf7dcb2fcfdf8ee33c0e640d8688d0caf044c094b0
SHA512a664a149425954961898befd450779af9342f0c7b7cd6bfe6db2e3203d5c648d5d258e86802be60fd7d1957337b3387a7634b70e13c283d91d1a91aaa7ae2f62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a8ac5d53f19445435885e66562e5d89
SHA1f4c1e39cda259f6c93948c1e032b95a97b87721e
SHA256982825347ce2318b61d05160ce67459b9237d2db93b8f47ac304477dc947d4ff
SHA5127bfc5605cd1928b363d5bb4762549f33b17e9682d225fb516642ba8be96c14bacac9dae2f4cde313bb511ec611e553e66f10d862ee71fbb2c6681c8917dddff7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ad36e33c2f5c894b454c7e7c587233e
SHA1c11bf42279cf3d8654166190c3f2da92c0252a59
SHA25664a6eb60f60de6a4ac21b9386bbf85601490d443cf475f754404be856565a350
SHA5120c0d9db50c88fda6c1cf5b916de64e7eab1772767b3d0c8e8d8bcd70c46e977660a29d8b52fdd5d3e41479d91975e90f4063374f95dcccadd76388f1285c5585
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc6d9eb724fc5321509d12669589f13c
SHA1a1556810316de30065d207c43bf785cce81f735d
SHA256696dc27ac664fa9599584e286e4c13ddfd9803685cfc076bd06b5df54133add7
SHA512c1fbc942d5dba18faa32d0e37cb8ff75d95c1d1182a2886476f67647814dca581a5565bd02ceb63068654d73e4cac06aefd4b4ccc256e1a77b416205df44d358
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526395cb9d84a10344c63e07ef1334ef8
SHA1b70506baba2d103aceb0b7bdfe04745956b13c1f
SHA2569b135839dc525422388ae9c33c7287ca8c70d651de3b9d73c7a29b92d92804d4
SHA512b90ef01c9956ec8efa782374ddd2d8046af8c03586e50ea24376c88c6ddcdee84f77e089658dffe0e0278e6f72505c6252d14c0d04a1faa50ae437831cba3c6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579378d796eb6753699d5e55c7677f5d5
SHA11af29c276d61ea6b018b7d47bd8c58d93ead6cdc
SHA256a012bad8b5697b9fd7e43f1e42ae321ea748544955dee2bbc75fb6bb1ff7cba3
SHA512f1fceb0651b6a07b9cd67ad001966ffeaacaba74b700781cdb2b4e896b3f55aedfb7bb4fb9097bce2bd553da79365ee4150f2196e86205739e438f0de3901626
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4b09462ee3d14ace960047a026e388c
SHA1f87ec2ad1f74e055a5fa8c4ced629f8045b03a14
SHA25665b1238799aab286f540779a53a6ec9e936913f8b5beb52262b4e4df37138308
SHA5120421870cbd14ac11d749b27fe6d7ffb80d2289c56eef2cbed574ec9a00ccef558ace2e98f757b8d36c32cb1bfecb2a4d9cd8c23bb5a4afb94975b4fe2ea0b4f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ae1991179648438e3c071515b6078fc
SHA1e8236fd20035b81c365a09055215c50d3167664d
SHA256531ceaf4f24f6b20be9685fd14a445f4effde121a90e10e47930e5ad28a3ed1d
SHA512958b2b907355558244ca5116a850c8f4db7cc2972b1cbab5754c16fa6591418fd63b1ee9c784dbd326c1b41bc790fa8c5c3d857a60a9498852ac62e3f45be6ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568fbe1438d10431b5ce1c86e95373f41
SHA128f29b3efd74cc42b7819156470ba2c255cfd41a
SHA256c4a659546a178e5417676fc5d33f67bfee178d495cf9a64943cba7550eb608d5
SHA5122db9270791a8daf2a9ce6b436c2ab8a1267101514b840c99fb4c98470b29008a03e2ade488729e8a0554cc44eacd83be903af0da11f81a2d0523a0ec1f285a94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD577584b9a95f3482507c9c665dbb74d42
SHA1b1c3f4ccf0351815a3e04b5e765a73e632edffc1
SHA2567cbd16c1a2390211e077f8534e0cab815bf14014906a91977ba32b14f65e53ec
SHA512c036bfa06623533fb1610d80f157b28a8ea863970a9afcd7228154ff325b04c5598956fb7ec4ec13b6ab15ee2e99c23fc7a1f2e6a99101263dfdb99afea8c3ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c98e7f1e1bf5358774d4191c4cc16719
SHA134e449598ced813cdd0be6ed6dce146bc86fb415
SHA2567ca37439d24e240016b3baaedc84221924a50c2c1ffb8f1ec003009715c535ef
SHA5128d04b95233194eb49a45ab150700819f2615edad0357f8a3719b1aa5a40116a4e9f73184a5dc062d8808ad22905ddcc6400f10e14d9c0ff9303dc9fda9990885
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b