Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/07/2024, 14:05
Static task
static1
Behavioral task
behavioral1
Sample
5c41c7086ef197ae766cad0077f93285_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5c41c7086ef197ae766cad0077f93285_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5c41c7086ef197ae766cad0077f93285_JaffaCakes118.html
-
Size
12KB
-
MD5
5c41c7086ef197ae766cad0077f93285
-
SHA1
f3e8e9e08012c0f5b404139de8139acbc49de648
-
SHA256
80aa3a3a946d70239504f2c18dbb958cef56c77dfeb55b6ffe7374fee091f70d
-
SHA512
e56e1f83cbefcddd1c86005dea9ddd502721a3b1668a7f42483240c37b086ddbda48cf5ce2793cc6aa636a02cad5b5ec5281ce84a286cc0b624ede698245d498
-
SSDEEP
192:zsC7lFShyO22HN9FXPvDvNd/CkbBgXWvzxS54u7bdPmXQ:zEyOpN9F/vDv7/CkbBgXiwbb8XQ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427559801" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000057733289a12928e4a50af3886e4ff036573a12966e6b1547714292c4ecbd8887000000000e8000000002000020000000a1598fb3ddb3bbcc5816b82849732f0a2537f3bb64011af05eef53846f330e4290000000af8837c76603da90ae082b2e4ec51f912f64cbffbcf1197c889b9f4478a9cff953b56249c66eacda4bf5cb1503544a6e80ceea4e3fe493e55ba47a5284c1260f90bb3e968bd54a9014ae11932b5523c405feb006e61c44bf4b3c75626887b307269e691827b6082caebc781ccd4961786ca0205adb0dd143f1c967b195329daf86ffc40b7b23011c471c8e19586a03a740000000059ce11196bb2c47599507a6f3586c2332651b5d3426cfe9785237a0f2c5650314aed5b1961c88e756d9f7966fa577b2d7b92fe3d7360e53cbc7d1d3ec19f010 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000009ccefa0d7b84d052f559bcbbfbe7cf3af88a8d55761697dd59e87bc23d776cb1000000000e8000000002000020000000c9931287fce6c4704d25f09a87d2b4a0c4f660fc622daca9463c13c8802a2ad7200000009297e30ad548d0d7bf6a7e6cb0f41a8b643f5940dfc84d669f1478b268969d5f400000001cfdc36b18ead3150fd938fea97599b6e6bab272566e1c4bad4cd12aed90dd12423c6aabc93d88b7b002d49d6ebf8f6473cedee25f0f238da411f9b3be394102 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c8b7cfe4d9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6CF03F1-45D7-11EF-8EE0-F67F0CB12BFA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2568 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2568 iexplore.exe 2568 iexplore.exe 1100 IEXPLORE.EXE 1100 IEXPLORE.EXE 1100 IEXPLORE.EXE 1100 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2568 wrote to memory of 1100 2568 iexplore.exe 30 PID 2568 wrote to memory of 1100 2568 iexplore.exe 30 PID 2568 wrote to memory of 1100 2568 iexplore.exe 30 PID 2568 wrote to memory of 1100 2568 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c41c7086ef197ae766cad0077f93285_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c14c055b4dd77b0f54c09cceee76b4c7
SHA16a830379a6f10390f794b69308faff3d9a470d31
SHA2566ab2442acbb1f50932296297bffc38e57f68ab1aa876c8947f56c21db68a7cf3
SHA5122f42aaed377d862999df721cad6d222e12b7f8a1f1498e5f5aadf86d54f2e0f4649f52e34050296a060a0577fd17c42bc94291028e334edb628167a4183a227e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52346f13898506fa1e9e5e97950b43110
SHA1e1b1e0b336fae59927068e12fc92187c8cc7a3a4
SHA256bacea4f75f945baaef0bf012ca3e4642eb3730ff33a9279f37dc1f60a510b7c4
SHA512eb6a15fc2c5049266cc39fa59ad16c9658fef6eaaafadbb7dec68981ebb294cec48ddd8bd4b2e5f5eec45147270fbaf6a2d8612ceb3a14e57786b4af7b244d31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55763072a4b779ed125af599f91ebe6fc
SHA1c04e0e401d9d2f9e4187a8c3e6b57416d730dd13
SHA25629c4b06779838a3ccc0d14bd649167b4be4e3228d5a2299a2b357143dbfb5ed8
SHA512f25b798ddadcb2c43716a66961b379db4ecd40a46b425272ed15f57a643d70562ccb3f63db498d2bc88371ec5517ed6a48d5b0e94ee6024d69510fd26406f4b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d67e10ed30da1c058b2d9764464bdf46
SHA1015bce1793ddd0fbe789f807dd48cdcf888ca8a4
SHA256c6e9af45bb6759b1355399a23f80d6b16099f409d63d5efe6f26383afae120cb
SHA512c4df432ea34ca37fa8770844704cb3eb234b36655aeac2e5c5182414248e2350e5e9fddf900eca0653cc035b171c483dc3bda4974070c578a7e5e055a5b17b99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5be53b72c734752f534e6a214e1e9f1b3
SHA1834e1fcd5f8826576c76cf61cc884b1a1006384b
SHA2564a51f1371ce74b35dfea5e451fc2104438ba39ecb68d241b889019b2c22e0c3b
SHA51251545a25129e01148e8dff75ee87a4fa69373f2ab92114c2eb1bdc735427696f6441b31ff6560f649cb7a6520a2854c5a5312f61f19c2454da088c89126362e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c453b4cc695f7a90f1b30bb7ec87ad6a
SHA1d7c1c01fe7e5489604d835f5ba08b43a5f17f0a4
SHA256494b5b974e60f04dd676e123a0dd392f904b0b1abf9220455018a853c7874932
SHA512b3799f25d9153fdd5b1e21971e30d3f6132873a86d2fc1a7d6bac7761c02d51a2b1241b1ea59bd5d67e07cf20cd33e0c2f5c900d7fe5314c4609904f0146b5ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f54e0d179069b721dcb3feb2cd328d95
SHA188a1c1cd2caee0704abc214ee9e8618fcc9c27be
SHA25627159edbc1ef2f40fbb983d002e8d386d91182d6c1d0fb2ae99d06a1e93f30d8
SHA5126549c8c13c471608b65b38eaa0e567d67cb928e9a183951c3eed146328c0389d71c3aa5087a5e1e3daa8f49fb154670fba09e0396ee355da9faae3a340d6dc0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5586319f074a1c3ba8aaeaab16c8542cd
SHA1fc87f7a80da3e25af7d206d975e2d504bc3a96c3
SHA25674cb7ba40e90caff63778115953279a78babfbf2c156dcdc754d6af38f091be3
SHA5128d16fbfe980760aa269808f39f9519cb89dec8418bcd765cf463f7d44c8f9919c8aa6cb99c5e5c033aed0c6a4c2ac32223d6f7a2943639fa44538deea0575526
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5943577f3655f1540f2ca8586117bd879
SHA1109075a3a4a33c241c6b11a824ce70cfd57e8ebe
SHA2563af5ff62b58f61a0ba564139781abac70acef44ca9503c26ee943bfb2f6582d2
SHA512d52103a5aa68377e490f9792a58050d804f8332a2784a579b01674d9aa05f4c969f7f4835356fb2337c125803ef5de1af2df4c47da869e09d699093afd025f4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b4d1489134ad1a8991e8d70adb70f337
SHA14e1936ff8c9078932486ee0286cc20c4009a8b49
SHA25690f7830b8bb346bb79b7f0627d06612721c90c5ddd7eea13c484118283f27d2b
SHA51259c9282e4a2345996f1104b4a567979a892849949ee13465f1ac2b95be64d4ceeee6f288c1f0111ab98ee564d932e29529fa79454977ba516a083ba89b16894a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1b6bf46799ab4ec0cb5293150f9a81d
SHA1afd3e4b7f43cac139e6c79527eb0934562de7ed9
SHA256451a5ec92f77c598722c3d8593df3692563d5a941bcd4ebcee3bb10dc76089fc
SHA512ae1bbe908c15333bb92dd64f88da1f503834fe2054cad7a4b4775767d5e932731181c02f21062d79bc5b4c3023dcd692c1d35db6aea2af21daca17db02f56f91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a30fa0bc6e4fd0976b17a8ba8d014d29
SHA129aa5ef38ebc7f7e2a98e0e9336b5cd80aebf364
SHA2564ea61948cc98d555b3cf6f2176f8bac24b83dcc7ec3bb02f0f06355afd21e1d0
SHA51295015d3371bd683e2633c17fe0db268fa05b3c887f025e193b7f12a60c55d5e23b3fe4bc0d3e164175ec191673905807f869d6234ecca73deda404505504acc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac01a4337bb417cc3308accdda3c3cfc
SHA100a785d6d78eef233c211dd7a53df82140977268
SHA256490fe91a63a0250c0b20943ba741dee62e16f1d35b01d1178f62d65100eee78a
SHA5122301ef86e3eb13187e8623f0df934cb6d95de042423df1c774f3a729c3801e1c5d772b52497bf876f014404bb950ada862f7800b6b012b592c364406d4e07979
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56436375c075e0166e5a5cd8f74d82287
SHA17b1316dd7d547c987b13df1bdbfe0fcb246d17df
SHA256401644543d6e5d949325517adb0f585b2544ab4bc6f0e80f4cc99631f4379430
SHA5127c018830652cfd73a25d8d6770cfc7e6d516e47118065072a9cac02c98b11b9ba62c79da66ee5f1402318af1e3669ce977016d07ea50beb3768489892e9dea75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e2cc640f22aa33f18cc2281e6c74ceb
SHA1db7d8d87ae1702027424f92b7040a8010c578ff0
SHA256e8a64b91c2d91795b37b41e755e468c2698fb864002c6b1f91bd256ac49cc4a7
SHA51230d2ed9c6141aa2b6fcf5efa30da4b23938eb1b6d3713cc765f527ca4a95a7d9e304843802d7cbf3488d813ba4f780b41db41d128749d040a511a89ecc88c155
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcf5ba085e56338ddf1f191dcc93451c
SHA185f7a049c637c7eaf01a72cfe2a1528b40eceac5
SHA2566a696eea1afe8566d1598f5d17d0dbf5b9be023dd3863301d08214fd20a6bb22
SHA51284bd202c36005d4244ab576715f366eb49dfd521da6328f45dbb9f22b7146086adac1981980c6939665222aa29aed67e4b0f39cdfffe0b2097bc1fd07cceea44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5433312731068f04dfd6a565ec0927e10
SHA1551284d7a532b1a9c06e363700748838b1fa8c56
SHA256503e5f16ec3e35064b464b9429bae8a902bff92f66a2b9db39709f7aa2572bfe
SHA5126bdc96979de9161979203b646de26696d17c921576bb7200b8358c09104654fd5bf967497addcc589c496dc1c0a31a5c5796a5a1816c496bbe920cf57f41d0a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5afdaedcbfc3c31bab6e1943ea8d2746b
SHA1a005488baa8d6ff3269f5e8047446417bbaf7589
SHA256bfabf53784771f2aea4cd326620a8a9eadee45cface5ac92248e51930b27539e
SHA51266168596907a413995c00616a17de3e22fa5f9fc87c89dc2b07598f64635ce66a0638d8e2a6b82781c72c80fb1c769c5f39f8ed704ea213086973a614ab2199a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9736c93ece251129fc3eac981fd61af
SHA134700d862e04612755c840b375071a543cdd20b6
SHA256da8c99f972e130c51dbec12aeeddcd34aebdc59e500affc763b9e9dc384158be
SHA512b683a674def511be69ac68480ca974d98d68abea4a0fec6778779e185edec863d6eed74c08323022923aeeb17f250b3f0975d8ef04011e90288ee4c30555ebae
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b