Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 22:49
Static task
static1
Behavioral task
behavioral1
Sample
324b634ca712a5d4b5a648528469af0a_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
324b634ca712a5d4b5a648528469af0a_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
324b634ca712a5d4b5a648528469af0a_JaffaCakes118.html
-
Size
11KB
-
MD5
324b634ca712a5d4b5a648528469af0a
-
SHA1
b398926ca0974ae74abc36e86914cd3b91d15abb
-
SHA256
47022bf92c302d5afd25c617992a2e40899be6052d8bfbdbb7d07898bff046e7
-
SHA512
546aff434a2b496defa558cee3a8d1e477a5df8b8742493a5845d607d18938dcecbfeb9c82ce8f7bf075e528976093b565c96c9be0ea21c668de3629634e3b5c
-
SSDEEP
96:uzVs+ux7OpLLY1k9o84d12ef7CSTUJj3OlpKIoB9bRcEZ7ru7f:csz7OpAYS/hQzb76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000020754b3db970dbf9f7d589ec68319afa01d6057fd71554e60dc9390abf670b10000000000e800000000200002000000009a0ac6a20bd2ea7a75bf447b8c4615d5d53aeee2b7e7da3e30a71edef67bb822000000063e8b7e6b32f1bd95ebb88534c6938408bd00c2b0111c1c55a7b92316f7c75fa400000002ab872df7761ad055c4e68053d9ba8ffcdabddd92f53b71df1b10d89c22c1a317a27306f3fcfc23730d2d25e9e4b5486595a8d56fc417a9581e2808ae2f31a2e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d095096856d2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9152E3B1-3E49-11EF-B892-EE5017308107} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000034f0c872c78bd29a754149504f06f039ea6afca89c5924e5ebc3c9f19b8d591c000000000e800000000200002000000074d450da4302638209ac2b4d9b11a9c6b452ff134b8e8117f81d27453fcdaf23900000004954911dc02f3fdc402e87f888091f8c0dbd37cb1f510f246367220ef1b47668bba04a60a9e6a07ffd3ba1ff05a9518aa066a7ab9bc4a404012205dd5838a51f8b114dc9a647ee11c0851f1e087cd606e01ba5615df4af9f58c659dbb7d4c3abdb8764abb9a7e1642f795e1ca0bc6aac97b343070aa34a2837b9db6a46d502ee684542db33ee7752956030336820f11640000000cf9d9cd177189218025b61f43f3273f728c0b8bd600c365edad9a91e146a86bdad954d9c908b41519c3a0352c18ec997e61b68e7e89b969616b1428599465990 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426728984" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2676 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2676 iexplore.exe 2676 iexplore.exe 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2676 wrote to memory of 3056 2676 iexplore.exe 30 PID 2676 wrote to memory of 3056 2676 iexplore.exe 30 PID 2676 wrote to memory of 3056 2676 iexplore.exe 30 PID 2676 wrote to memory of 3056 2676 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\324b634ca712a5d4b5a648528469af0a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb66c707275816da6c2833127ee25d09
SHA107cf11117f5f70eb846e584646bd7fa2a0e4233e
SHA256d5dde920d962bd865f088cabf871c46b99603e5dbfebb5704d26a26887cc6fd8
SHA512bdfd67ba49aa94b9107e02afe3c8328d7d4e1b32f00ad3c657524b95f17cacfabbf00aca1644cba2cefa043d51d9ad20dd15e938fdd4907c4f141d625814cd1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f19121aa1ddac638178c3980d0e4621f
SHA1f77bce6af072ce3f77ed89e54eeadea330acd1b5
SHA256dc52687ad9faf88b7f64ebc40be1a2ae5a725c570c9eb1b13173210bfaa9cdc8
SHA512b43d471e4867bbe720b21d814aa7c3f484968156255891eb63aa90cb3bbc0f8da1ccfe4f17deb7278c57660affc7cd224c90400a21453cb25c166130ed075c0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544ef78f92645caaf9cfd3d78071a41f9
SHA1f20258bb3bf88ad3d745de3cfd4e3b135c233856
SHA25695350edc0400d8e4bf9103582826c36ebf40dcb44977ae5124bdc91a6e39bde8
SHA5128c6aa1a7a4ab3cb52ec35c534a7ec0d6df9b6e2792ba88e4f89883a9e751a25ba4964cdcbe3ba3a25e3e1afb6a155f30e53fe823cf0839ef6b461a18b504a469
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bde3e9d563015b20d1b3de29ae6089d0
SHA1335d2568d515a7c5c63788aad02ec484cdddb064
SHA256f79143ebbb680c715088a97ee1111e998027d320510337349630c0eaaba45adc
SHA512f404832438d645602f74183595d3cc9619d15af0887e63d713b696cf43cc5098b171f4f0bf1bcffb5fd50430893e723b44a858da469b4b6b24b735b1113d6f57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0e3ca061b4781e54dff5c1e07f6fae7
SHA1f0bb7c1a0a98c18fb6719b4a24eeef7ceeaba22c
SHA256968d73fc6b519a17d430e43cc39d241495928a08756871bcdb0ade6a2a33bf48
SHA512d42835499fb0f2fd32d06193c75698cef68009f0a6978a1bd9e11a77739011c55e7751bbddbf635265f8f66513bb9d9031b155b4e2dd979ac0cb2fd70082ee7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598d6c27d81600c38ede31f3824c7267b
SHA16fb3c77653198aa5e188d391c640158a169549f8
SHA25623a68e55116070dd497da18c3d279175c78cd6639a7912cf3888a8130f02e94f
SHA51273d08b66f76bc6218834756380026527a453db165f93eac3290c9c8750d0e91b70db3d14fdd2214a72ea2de669843fa0ffa177829cd4158881ef19feb2f945f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af3bc867ae767a967ac12a5217efe2c9
SHA12fc20e8392d677a541444877dc383aea50ec4dd6
SHA2564015cf9b100b19f301134a80a1e956c499332ac9f9e59cced972b5c8ab46a897
SHA5126f54b16ae1c4403b0d61ae42ad95c3588cba5bfcad15ea41ed46bd0d505f709e67e087e6903043f81489986095ec51c141416a5fe2f0380eb7db6ea816144552
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3321727ec1e8a051d8ae79ca09b6d3c
SHA1aa82d73d0c74c0ae6e9287e6183c2aa236cfe615
SHA256fc82cf35d05741a5278b00dc738903306e79042f2613cdf5b0870e0c2e28f324
SHA512bf3da0e8eaa01741244d2a4d8429e56e646faef0116576080e4ca3741a6f94e70e7b67c99a85cd83a28dfb27c011b7fbfbbdca9cfa376e7d3a16435555a1f320
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589d8a1d16c9aafd5b6fa5b30fb38647a
SHA106c2e11e13f65658795fe003c059857c35d30f6c
SHA256d684c30e5e72469e618710a38a12643f4a14e739de5990ce6e62dd88cc0c42cf
SHA512a426ca2aa0c6ba95f1a4f844c1849b9c3522e081afdb71f190764ee2496bf445d9b69d8ccc05a3d10a0b59d3e47beda043f85047ac3790460d0ca9f2f575b998
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f613bdb1a2004099dad4193416f7403e
SHA1947403170961cbbebbf112cf5451051abf255fe6
SHA2562856fc6d012c4d6e7ffc41de0551543a806729d8bb1d3217b94f1acd15f59c31
SHA512b7b6393dcc5fb7acce8f87eb8f0bf8342d69cf6aa451cce7109f11bd035a4aacc5403a857188c58a1334bc177ac701f64931c8b68d4d5e03c593ef1cbb17f8fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50c74b470d8f44cd3b8ea79ee798cdfa9
SHA1537431c70ba26ea6d167a8d67ac788f3309ffab6
SHA2568281d5cc92ada0ac8e2dfce81251b85cb6ce48fff8ec310fe3ccce89dca09cc5
SHA5129b00c76fc35ea55174092133ba1d7c87d874c0695bc09bdd38c29659f310bc703c68e874d33e59bea9fd8d0a30243f2413d810e20d495f84901486c6d662b788
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aaa64d4e26ed6b08b2855d1204fd8f43
SHA178d25f0dacbbd2b8306dc1a3618d08ddd14f1668
SHA256d14838c65c3c3327fe40ed4279e01edbeb13d73d26cfb3689e5300a5bf489f2b
SHA51229f4391544397430ae81b6dd967577ff4ad3ea8d69c34fec4880dc15c07d21c595fec1f0f2a33175fe41cca329c6ef21d39ac115ed3789a762d5673756860784
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58405008c362bab5b36588a85e9c4a7e2
SHA1cdeb00da34c86d8d4ceddb8f9735caac2ae175de
SHA256d132b384ada0d09a2691a650c795572ab5c6909d5ea568b25b610e6c0de0839f
SHA5128c2cb3e71bf10f659433ed46f6d86280124e387dfdfbbfe324ae72dc45dffd1926ba4e46da20a6739087bc0464d42e3770ebfd5100491e6a381617c967393aa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ffce78397c1e9368a566bb60637df82
SHA13638e9cc0ba612b712e5b63477726d3e2f4d8f5f
SHA256c6cd44a891e7bc291198921ea78d5bc1ced4e4f0056648e2d85e348d2ce6f9b1
SHA512dd62dc2d7fda05aff3cd165a138957c40d182dd126389bb27627258e9bc3eae445c91995dc5f87405e7fca9bad2e26210b5396ea3fe9d4ccfd71dcb0b040dc60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510f2b7a8653ad8495a35365fc3c798ce
SHA121ac15c7556a2b5353503c8c1d84bf99dd014f61
SHA25621264c275c5b83050e0613b5df145ff8b44a540cb32b53154e4f94866aeccfa3
SHA512c0fc7c8305a6b44eff7bd4f093882223085f4a5dac311daf0ff931ff491860e8537f1e7a7436b58ae0fb3dc09cb365c5edfd614a0c4928e9b47808d6df7a0426
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD569a656025f86dc1495f2a3b813fed972
SHA1cccbc8e16c98a46e7d88f2d3012c56d2b7671b1a
SHA256171b42455ad8ec2ff6b7f2d6a687616af5db5da8200e33a4548a4efde6b1ca45
SHA5123699304939737f5e8b9b81978c10ad09b24185678e7728fdeb5f7670a798758149cef6f7f1ae181f7e133f3c2b5cbba4e5bfed476a9ebc3f13df581ababf1f65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a6d68520ec4a52897d6c4c9adcf84548
SHA13bdf625fe5720d100ab8a7ad8175a8ccfa55ee74
SHA256b282a0a8970aa964ef8089c3e5739452c06afd06965d30dfdaabf7211fcbe6b1
SHA51259c530f1720694e89837004cbb1c67b48cfc5bd0a5945fab56810bca7fb93daa1d51b33695bad31e4271c9fa79313727d4d73c2303322226badd6883c3e086e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed3d0dea1eadde914b9d3b8caf4975b3
SHA1f3463e115bc865508ff390dfd868ad953cb946d2
SHA256bd2b07b88288ebad1b467c250880f0d580d987d6cb9960773304a3b47796672b
SHA512ee569e3e495af8a2c269ef583c15d30fd2534eda7de497eaaf556b8961a72cd739b06a483924ee2837ed1a0fb1467598e476c40274238a7b178e2a3a9efb2fc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510900025ec7549f7e032893710affccb
SHA1e706b0b1f5c6810166da7a75b2c2a19f6509c60c
SHA2566cc1c82c43ce73967e8d08bd128912af8456b99b519a33d37794c1549ab5269b
SHA512e468045908acfd811b4a8a363448235693fdd84b51cfe6c7a465948e103b25dc5b66ba06b9bbde72d23625ec003531dac065d1753326578353e125d51f73f591
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b