Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
68s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/07/2024, 14:42
Static task
static1
Behavioral task
behavioral1
Sample
46432ddf25c46a0575bd65480094e8f7_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
46432ddf25c46a0575bd65480094e8f7_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
46432ddf25c46a0575bd65480094e8f7_JaffaCakes118.html
-
Size
29KB
-
MD5
46432ddf25c46a0575bd65480094e8f7
-
SHA1
6a2c23556fe6dcd6bba9056587d34fc56b908225
-
SHA256
e242f16b4af1fb8217a346024ae0959912bc76d03054a6b9c19c7ba728122351
-
SHA512
f4c786ffa956f6af9d0b62a0841093454891ebbb761f7b71c0958558c4f7347944361e66581347e0cc1888bd6a96459c3884eb5117f8e5e8c17a798b4aaf3695
-
SSDEEP
768:88YCXUZRlbq7VL+kMir+GB6GMYJrIdQ2Q6:RM+56
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427130021" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90369522fcd5da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000cbf9a6437d5ba2835319d4db3528c6b96576bc59db9c55a88badae1e99556020000000000e80000000020000200000007810c98a9847807ce4b80a598dc91ec9b1c26558f68e0a21a19e430296f68aee900000001a9759aac8609ed772f052260baad92f7f5ef14fb258b64c8decfeed4d32279eac620a05fde494dc5ae1373ad4668bf0c55e6fdf50f8a3a5cf633c9748dd782c5937d63ede6f568b4e5969402b032170cbdff670939dddf1aa0e0fa21afe7292d2fe329be9ef6917b4743eae89679c99d3a6a5891dccc3fd00a793106719a792932fc3d55f173df9df3fe59361942253400000005c96c45d70ab2a4843d4c8c0a57e2d1b0cde9ac7ff379f4750bb1b856c459a2e14ef5d7b208a1999bc2ac993516e7815f2c667e6d18c50e18d314d09573d5554 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D6D4A61-41EF-11EF-BEE2-725FF0DF1EEB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000004cf14f60acedc63c1418b37a7eab270ce5735f4c9e13af16dc0124762a2d6592000000000e8000000002000020000000e1b61f05d5fbf02a3558fe160c5c53e62af49297582bb859914bbb089193a00620000000a467732f9ee73d723ff91c8ac06ef8407dfc02dc98dff1fa16625f4abdf3bbb9400000002b0ea379831d721285b55141f695ffa7efaa74b36c82cd3db440d19517937b14d3d2f27aa5d6cdad4c45fdcd0a2304d7565a8f1072b5ba82b8a7bd6bf2c58911 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1360 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1360 iexplore.exe 1360 iexplore.exe 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1360 wrote to memory of 2284 1360 iexplore.exe 29 PID 1360 wrote to memory of 2284 1360 iexplore.exe 29 PID 1360 wrote to memory of 2284 1360 iexplore.exe 29 PID 1360 wrote to memory of 2284 1360 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46432ddf25c46a0575bd65480094e8f7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1360 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54ff89e18065fc8af8c82455835306f36
SHA11f01c9cf88588708df4dea21beb136e283a35a76
SHA256706eea461b4393a6d7b232ee6517fe303fb7d1c3f5644cf2c841488924d4ee2c
SHA5127fdf7a1a3eadbd7a348dbb13744b22db4b68483ab356512b1d747171868cf7dc6beff8f1fd2aa6828cac0d7f6757e88ea33ddef971d4aaea64f8e0cddd5b6e11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a4d0bb656cb2e574991a1ad04cab4f1
SHA1a270d2961aae78c18b2d2c9365d5bc611d0f427b
SHA25619484945d0d9aa526d1c04b7454c88e1ea768519629b3a33387a95ebbc7cd917
SHA5127fae25dcef87f2e6611f0ccf97d89669cbc4a4ab295feb2b4c791bcd253856634ed17734b7fc6f73baac5ba0ac207b091a034f53fdd470ff5c6c5959bcd1cc3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD567ef6c55580a15d9b035931620622249
SHA110958fc82b42238fcab03fe53d185cd955f2bce8
SHA256852e183bb6c595138d07c578034f0acdcd25cfd044e950212b18cc784c39cbe2
SHA5125d6bb5867d97ec90633aa2c699f7b475cf04f74ad1adf6cee6adfd3a9815c6dfeb2dc72d3294ebd893e96c8e90e153fdc1ea604eb331b5f5f50710708bf9ac0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539304e3ed3fdfbe2ed0aacd1e8ebcfe4
SHA1663235598c92e84c13239c3928c8209609bdd2e5
SHA25609b64690596240d03a2d11bca9c5840e789073ad6dc7b04cbec7ec304494f90c
SHA512645724e568a9766a33ef9314ba70c063e1fbc9dca29398df1685876d30122eb9fd3125c93e30c0a7b4e4eaaa2f2e2b1bf11d0d4ad75223710f2e5f7d77623a7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5695c19c560169a49d89a49b2e9a903b8
SHA18817800d4f391faca15d23134b1f4e5b86de995e
SHA256c86e4b664ab3e7f298da48622375a847c6e6b68d54b62ec957c238c197f8d2bb
SHA512e45bea9c617975a1cca80886c856c0bc087467fc9101eeb70461db3f0a3219dc822ba50b3ea4eac72ee412e653c4a952cf8dceee74cea3f31f32b951cb22e2ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5361cc51056269e3b33200cd30bf38da1
SHA18cf3024a6172eb1c29e56ce9195685e7230828a7
SHA2569e53524ba394349808486ea23c4ca22adb87757e00a62a66045c0d849b73bc73
SHA512ed52e1b46583ca902b1ca57c1804477397e06061564b1dee7a4cc539c301a7c9366c7f25a54ab7e02e568949f73ca005532d2edb41c4b6077326f47288984b75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e3fdd569b3c458f21f2fb8e044a2650
SHA1f251517630a84b7a2850679f8bd2bc64540d5000
SHA256e6b10a88b5cb924541c64bb8dbf4c759866b5da3f78038226b7deddff6bf2397
SHA512476813682555ae8798d60c5d3c073b4776a32a82a36e41bdd557e4087cd4f42a274b82f81a89a5e6dea64d4d73a604062b6991045167c1e34089fd059388c917
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa269a58dfeceee7cc0b21e101980f39
SHA15ad6ae2c2f535e04b7294afcad7aef13420d7a10
SHA2562de5388d973decb276abe5a5494b6d39fb6cd178eb6c66106cb2fe0bc6196837
SHA5129e556a1473c8cd3c0f5f0597dd25ec1e09ea62e5f406240732a53ee7be3fe83079aee7dee88e4b6baa6b98ae673ee326e85c08bae37f3bb3993b7000f3c4c1e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540df82575bd6b485951a4576f3603d1f
SHA170d4dc90eded7954f2cd82172e4fb203c41d7fe4
SHA256fa90c6ac549bd1e05a46907bacc1651ce4e7fc246c6c4547c5a2b4ef7b0cca8b
SHA512bac8bdab7829b6b1f14536050536cf6e4d4786ea4de54e90d9eb73ba63b54387cea191fb00e1361a7614a5ead0823adad2ce7c844b922fd8882e1d0ee54ead7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f7b640bb6248b42468f730fd5d2237cd
SHA1b26940d85d52833515bbf40347743d0ba9b914f5
SHA256fa22b33426acabe64ed354df1808113556abfcb2dfeab446e5cc61ab113f708f
SHA5121e1785d184dc348bc4158066889ca76dd2a61df351cb3e46544f6e284470bef26612eb2a3e72f386e3620689f536fc058add34d8f20cf11429c200d2d4173951
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e37b75ba5e7f3952e883f17d9def379
SHA183fcc4dfc430a4648eb9f92220b03fa1b7a908c8
SHA256b35282cac3d7744317df6513e3468b59a6867caf213a5fbd1bf1c2eaa7bec549
SHA5128080de9970c48e109c779a48509aef202512ccc6f8610ea3c528f5b1b51d4d34d0286e30b607e925a6b6615c98a6f0f2c1e1fb128d6a125a6b1ee167295dcedc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50a8cd8e19d0b2c08e314f3d0da72318a
SHA182b70349d6db9789e3400b2b70f2c48f6346654c
SHA25696bb68098d82422935ff5c56736c4a94c7805d98044410afdb82076e06dd8fcc
SHA512da3c614262759372a526f27599dceeabeeca9920280adc181d0bdfba1cd86807f60c1d603f5081aa0a2eb9d4fe2e33e8aa171d30d6eb4c8d458043d400fb459b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ededd79fe8d6605dbeccb92062eae172
SHA193c6db6e60d3d797c0151479e486b5d69428ee48
SHA256523436036842c05766dc958456913a116b2706397ec083a8f206be98d92dd723
SHA5129574036fac07409f1f01661476bbc5ccf26038028034558cc9f1327f37d8e42b18053576209d2ec7d90ffc50d9aea3281e6e72eb27be46c3c3c3881895979fc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9e22524aa2405461ea3a6cbf27d79d6
SHA1669c5132503bcfcc835153c5658b054232457008
SHA256acb1c75b9b35753bf1941a4f33e3ee0cfea4f27284f9f10d497b234d80e47d9c
SHA51218fed14f1f2d418d2e3011492df853247fee9ad2872508f2d75a58165a4d315960a1b47c07012371ace7574ff540e4561a655438eef23a427958791f3f7d699b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588b5f9b08a8f26f8d4f692f4c65e47ef
SHA1e1b5d7dd198463df70e18b22375a0bdf02149a6f
SHA25688cdf89ed824d3b6c6c0e40621e9f7b1e72f00653a4c56776139386916d43576
SHA5120e250110954e6a9cef3c275ac981ed8956d2c06d1d2652c75923ca46cf90a6bf5070aa5d68fe961611ed2e954006cdf9221bea098cb2b143883c99ab3e61a0bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58425d71c1435fe5c7820fa27e1d9bbfc
SHA1a6e2b0b6b3c1d0e01d47b5ffe609389231e47557
SHA25623b8f1caaa2c353b0fb65df478a26a431db00431fd2df1f6e3d2e7428578ad65
SHA512c1fcbd747eecaba05d8cb0d41830517134598133f44a07a44a511538b6aa0ff1abf0898b069f62e12344f57ee0dd9db6dead7d87c3f034b6df5e18d6773487bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5b6dbb65405333da285905783dd6458
SHA1d86e37d33869bb61e288c1f2beba9bf9058cb5c2
SHA2561740263f946655cd9b6cc62eac0b886f8f1b67e9115c91c5ed8c2c46df0d4804
SHA512a42719298d48caa63bab9823adfac53b5ba1989a4c68175456ec064991f2abb4fbb7d02d5d2624fdc5554387e13121cd34c1160ba7f9e157cd04d0e7c06db405
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c45e3efcec20743c72e5d8c87e71e1a4
SHA1eaa6c9e9333a31d261f1b45ae05015b6fed1ea1f
SHA256548aa98dbe75e176465cfa058e32053a372773f48ec4f578d0626a124db7fbdd
SHA5124e1159a7a96475cab74b2217969ea9bd972031ba463b969f0cd15c7438096420e4e1d5e12a197baea68cfa312e45e51267775b3339dd5aa34e049f02280ddd8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c626344ce0f6f1d2ba11746bb34693d3
SHA147e5a1ab5968241ef6f08b7ed0698af2f07afea6
SHA256dcca604eed748681561f9aae3e56386dccffae9aa8f2736d206e79094888c2ad
SHA512946da863e60c82ab903ad140340496b9afd5d4a2de1fd77da86c10ea825774a505a3a0769bd2429fdabeb83a76ee8c315019e1ef1efd3eb208fe29f2e97a8df8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b