Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 00:44
Static task
static1
Behavioral task
behavioral1
Sample
32a71763fb3dadc0e9b9521a94893547_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
32a71763fb3dadc0e9b9521a94893547_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
32a71763fb3dadc0e9b9521a94893547_JaffaCakes118.html
-
Size
7KB
-
MD5
32a71763fb3dadc0e9b9521a94893547
-
SHA1
d6f23ddcb0d80ab2a955bca46b4fea91bf21f4d0
-
SHA256
fefce9dd952dcf7f151687c78884179a064985010dc7f8df05fdc1312941a4ec
-
SHA512
4a5eb659c74bcb5412cf43b5d7e9b571d9553f273c593cb168e5c5da5def2ca945a73a9cd3f0a3271573b5f56c46ab21f50d1621d054d29f9884f6bbc0e90bd8
-
SSDEEP
96:uzVs+ux7f5LLY1k9o84d12ef7CSTU3wzf+Ch92UccEZ7ru7f:csz7f5AYS/urjb76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400ac30363d2da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000ca4cd370029ca26e22ef923b7c1cf188463c9ac561f6d16cded3e4019e1997d6000000000e80000000020000200000005bb18fd83aa7d59e6041a825dde7741fe34b1f8b05ce980a181f48844cc4526190000000d052a161017457dd147f23bc9295d02160449967e8f416026a0783e2fa821362cccc77c119da95b04c5468f43e1cc3e82c997f6e0ae0e3c6b2cecedc5f0283adcf75289f78004fc02659f990ff449e449aef5c33bc690b463acc5f223eca065bbe1361fd685185a89947f951a29a31c4d33ac87637e04ff879eba89242efc2725cf07acd7d612dc86359cf7212c21bb940000000fbb187aa84a430ff2dbc0813c58ea70c15edd4f3f4f5af9bfd14836a59ecec8bad990c097a13bbcfcea47fb7f1c448bdca3a9a4cbf542921a987972a727e4df7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426734402" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E568391-3E56-11EF-9143-7699BFC84B14} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000356476e49711e9c154940ea1f594852d50529a6b8e8b282badb306c9a7a09b84000000000e8000000002000020000000b3edb0637ae7c906daf1931056b60266766e50b206e40232216b8219b849b2ab20000000569da185db1a5e857a3f83aa73025b82a9b96bb9b4f4844c856677e77e0d8b8f400000007cd043c1dfda85ef3149c32be2b8c228ae902cf4dc8b2859597b4c4d5cbae11f4496fe984f974c465f4082182d925cb4ea8596a6f079f01090f2888f013aac13 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2548 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2548 iexplore.exe 2548 iexplore.exe 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE 2724 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2724 2548 iexplore.exe 29 PID 2548 wrote to memory of 2724 2548 iexplore.exe 29 PID 2548 wrote to memory of 2724 2548 iexplore.exe 29 PID 2548 wrote to memory of 2724 2548 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32a71763fb3dadc0e9b9521a94893547_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521ba46c645dd6d4cf5a4f3433e462c58
SHA1da96630c1c7aaacd51e7eff5ef83b89fbae3c125
SHA256636a001676e82a3e4898e5582870a98d29e32c4cff390a849b21ecb24a0ae3b7
SHA5125a56708d269aa8489b123595aad075244575e4b32e1c63d2f2e5511bbfd953aa2bba3ec0a22a9fae4aa0e8f47730725b30f786d58bf6796ea23b3afe38588066
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5633b4d45c316f01cfa05781fbc207f52
SHA196e370dfe4d2d0dea1d1758c5c373bb2401b0973
SHA2568ea7ff37a5b01fd5493b57ce2c0d160d5219307c0f4263905da5a716e4afbd44
SHA512d4e4540b6d893041ff3d0bceaa1f916474e408b14d82ac2d5f500ab710e72162478ec8e9d34329057e629b57e49f2cb23963be31dae17f019fea997cd1a6d0ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD586f23afc4ff4f3749753d1e1fbb10a4c
SHA18393c15a3ec24c9a919ee017b0f91d819d04909d
SHA256ca4649c917eeb8e08ac0fc15d1f85a8f01397e863ace59dfbfe8dbc3d72020d4
SHA5124283d08ea6124656922a7a0b2dc84eadc38f0a39167a9fbe0e151b8ed212c092aa8df1cadaabf4f6abb4a37c18797d38e3ec7a5757d46efeb79666515dc345e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6beb1d0f1c8bc66a232305e6d722a2c
SHA1844bba874b3278713174b2dea87ca965ad369be3
SHA256b90cea423d43dc3245cb38c1543536fe1a8a96c79c131e5536586dd5d89fcea4
SHA5125c0adcbf0b11b52cc26532a3c8030619c83cb687429092d90ee453c378fd5c58a7e1a0748af3cae9604c872eb5f30f8354f9c93e7faf577679aa4fcb89944ae7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD591f395bf90da163a76d22e048a9250b4
SHA1a5300f67b9079e3a865ccb2e3f08bb2213fb2c3e
SHA256425d11d3a307b3e2b56e9a763193f12aab22da8cbf8c2c1671de33131e35f54c
SHA512626250d24493025b29f6dece60da37cba6d9c5b22918220bc724116995d2fd1413f4cb3d4f0be175b204ea89cbec206705c699381d5ceb8d21d289936b6b1750
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547111648a29b3aa6071971acc17fcd06
SHA1e301856c9aa7a71179c29ac55076897f26135e38
SHA25630662fd9e166692284cdfc2d2a621da7bd47f1207194f23ccff85543be8bfa35
SHA51298139642d78be95f5cabd066ec8b2027a6a95340499d973e32818eba7388df5ce5657fb6c3d26bf8cc329c876a4b1a6775bae27e535dac192f1dcf8454908fbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e0e2c68b3e34c8170c070f9d84742a64
SHA16b3c485d8b891966512c6a74f1c157060638331c
SHA2567d3ed2bb94bc19b28f5f8628cc6e97c6a6c811ef60a18ce61326c779415e9b02
SHA512f78dda492513256e6b8fc2f1f1cf7c1a6a814fac749095bf06e0b0dcab1c4ae9b9961524483666f74a8e0e6524304d9a99088c28089c245548ce05d390739fa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bdf1e19e2d432fdba4b826c00a8850d
SHA1c9a22070ae3c5e13c3cb053af6d1b20398a7b97a
SHA256d951ad15a14b59210528dda10a0f2b444ed0bc4abac0c2e612cde37346e95a27
SHA51282768f84ec001d53fa3ff3573844f08036eedd0d4bd7f060baa4c89c23c09821d95b98950ac86ce150968705d61add41415483e851de571d8ddd74450ba1aef7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5826ca3715961f7b18fe39422e06791c1
SHA1832a217d09526af773989e016b66e8db896ed0f5
SHA256e14bf4c9eaee84724596e3ade7873df509fbaf5fa76fc7f9e725441a3658b3ff
SHA5123d2ff0be10682fd03ebb4e275bed2a695071983c6c811eb8ca2bff70e785df88944f30beb214c24ab18084992e73c895ff16462db047663033360e5938993dc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff2d2bb8f046f9a60f6ae4cc93b4bdfc
SHA10f074d8ddf8ad208f4bfcad1f3290afffac16839
SHA256c36ab3b653722a951d0d3bb0d74e0b22a55561f3fd657a5ec54a001787a38cb2
SHA5128fe780b1c15d55d97ab3127ebf0bcf4bed7840945f98dc072052dece7c0877eb715824a310eb418019634f4c33303ff33dc355c24691b64957ca34d979805ad2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ffa4c2db6e0ba8500f2a89d0078cf07
SHA11e2e8ec7ea0e3344279ef4bb9cc61a5e24bd47d6
SHA256daf1808ae446bba5202eaf039368ea0c67ba8803270b36aa3b84a8de1877b289
SHA512fcb15cda19edc572350b477b4cb978ce7f92e699a90ac7146577d1458dc68c45cc64582f535d31c0d853844859bdf731bd4736393624b02b247e83619ac2f6e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf21079bb659b6af666398fe04dacfd8
SHA1d7dce8baf705f9303500c69abcea0168d4d24412
SHA256de5f85ec17c5899b16e3e6270b15e83c36504d819a1a049ec980a6c0fc2fe3c9
SHA512550b52bfcba5592fe63f01d2dd62c2b979ae86ef4736ba6bbf63646458b522f84ceacb066752dff76f544cec81130bb08c09c39dc8368359ba8eb29e8b9df477
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c1adc226013c4030b3206a56a42e03f
SHA19effbff3d5e380e02ca21e1436dd78d433fc11fb
SHA256f1c6031604fbcb3e090bd1a72210c441291628c73f95ee2a317f6feed042c0f3
SHA512dfb826ef4ac1ded314c720bb5167b2ac4b1d08a54fa2cfb7b2f1b945cdff8dcdf2d4f60e9cda13b8fcf16462760d17c2592588fa8e05662c8fcb1c38abbbe360
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c0bbe88d9d05b9b6985bcb9f257c20d
SHA1ab62a8de6a7a7663441ed3d3166188c9ea4bfbd9
SHA256592cab24662c10324208792374257ed14f897eae0258b8e91e9e42391a90eeef
SHA5122069b35ac2a23b522c1f54b30991d850c531d35be72e17c45e88b1be11ccc611afdef6373047fdb400fc72545f50ab75f6277ef841a5878902f6400ededfb9bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5077c883d71e8d4b579baa6c223299b25
SHA16839afd2e7f7fb4e2dfe8c3c2eedf04485867936
SHA256135d881920b834379738a9f768456ffd1d5bb4b5a4a451931c93cf34f37e8e83
SHA512e5911d50ad137f8c5aec2aa396fe7e615a609526f8c32fdc9af6950f6cbbc35390219a61da11a500e5f748427590c2ef5c93116a4e9c02cf32d4f983bea1334a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ec20bce1076f0662fe595a4a9257daf4
SHA19e76fb4179d724417f93124fd0151330b5ab1756
SHA25637df540c1e9aa1b2d3bbcb0fa36d41b88073e902768c57e54dfab2cfa369922f
SHA512a5a20de729e4f0014efb9d1ce64c2a25ae991267626922b8599794674536e986e3b51d5029f1f16ef82b49d5f41806fa63dd3a6b2bd7559bc0f7d5afa8dc6009
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1df3c43b056bf02e86613f1fa476b83
SHA1d3edf5f4f60f2c0056ea3f8449b4627991b5aad6
SHA2560e00e25bc0e7169fb1353507d8b5bf459c93ba9ebacacd571b99551f11ad631c
SHA512f29862416b9be93e4461f13085cdc3ba948dad26307c08d266100746ac884b486ff9c24aa49acd548ceba35fa1ec1e79d1692bec0614d98465498528c7de14d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5af4969a05c6af2a8ed24f8aac61462d1
SHA117576230494a434a206c51353f0969557b7cc680
SHA256227bba4780e7c27ee48e2a6ad4ccf2794af8e6a01a012daf6f05117b07680028
SHA512431d72c85b99a79e124bc70d4f2851895341e48f1795815d1f259f7195745ca779d77a920695e56908731fba6f5b02b9548f99261a6bef9096682fdf32b87698
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e24c13f8edeb2db69c67120582f45f8a
SHA128e52e9aa3598bc833856ad80619fd28a95267c6
SHA25657c57090bf75605520134a2489c8a93ecfdb015d6aaa938242cde8b5a448eb97
SHA5126acfe35285c513a8b4554e54c5730b074814917e9d3a3ee651021c59809b41592f3fb803d17c27cf5650e8f0d63bb2882b97a612a2da9e2d7380ce559d6d984b
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b