Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 06:57
Static task
static1
Behavioral task
behavioral1
Sample
89ad5a46722b7b17a585f6e07cfea4b7_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
89ad5a46722b7b17a585f6e07cfea4b7_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
89ad5a46722b7b17a585f6e07cfea4b7_JaffaCakes118.html
-
Size
504KB
-
MD5
89ad5a46722b7b17a585f6e07cfea4b7
-
SHA1
18ab6d708a64040ac72554f34492e669af91301f
-
SHA256
b7957f13ed2149beee4bddba5646c537d14fc4ce81acbf19eea040c4324e5b38
-
SHA512
7a6a18341a86d1ee9313645b182d47e66177c8243322e12940328a3e07513251965eab536f49cb9374d9df1eb46ae395a3ffcc078af4ba3fe516420d139f8860
-
SSDEEP
3072:wl+IpBxYUV69zfs49PwVeL5AmPTmBcM2wqL1F8g:wl+IpBxn4tLT5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423386893" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2746B2E1-1FE4-11EF-AB07-4AE872E97954} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1996 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1996 iexplore.exe 1996 iexplore.exe 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1836 1996 iexplore.exe 28 PID 1996 wrote to memory of 1836 1996 iexplore.exe 28 PID 1996 wrote to memory of 1836 1996 iexplore.exe 28 PID 1996 wrote to memory of 1836 1996 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\89ad5a46722b7b17a585f6e07cfea4b7_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD559876821f662f273bcbb24b69a02b6a8
SHA18a1b53748aaf260a120ad49857200f2cc0ef27c0
SHA2562e77379200e7816a724ad6077c662276aefc2248bec2b62750060e8e8c6c8734
SHA512a8eeee4287545986bedacb03d391ef92bca7098c942ae0e9213e5a33a8127cbec986375202322d60b910c908b03fc4f4c8b98039b81c86a157da830ef0c108fb
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_827A2BD464611B5891D523F77B43FEB1
Filesize472B
MD5855a647df0450492089bc408c598c34d
SHA10f31663d59ae492178b070ffb9dde3d1598325cb
SHA256cf9b37d9a2dbe018b367a4447907faf843d713d0bd1dba370e209e9b141502ce
SHA5125cb026d5a8e3a9348a60cd33b94e1412dc5cfd24e370ff3f0d85ff14b2c02816ebf2a081692a5cd27680ccb984efec3c4c3e302ea36b773173de5e365779b954
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5af0032c872752f9dccafa88b253fec34
SHA1d206e38bfaa806f331a29bd9396dc399e951f2df
SHA256fe3e9d7d928b3f3a30cd9194ed8579edfa05b7406527d39808c99359399278fa
SHA5121dd4c6d97b9aaf8b6d8133ef5e50a85f0511886c48b782527deb05770c7ba71c4b0fed9c1d1086166ba1b77635105289fba7f918c3fa50e8e614ecfabec7285d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD56eefcfd42fd4fac001e8fdbe3352dd64
SHA14336955e471b5a52671ce62193ed7131944d4334
SHA256e83de2f7504f93d7a0b0b2e69fb38361efc3b63f5df58bea71b1744ad1465fc8
SHA512817908a3f3c1d445f9d766fc3fea4538f3d20caddc26d9b747ac9e37ed174b08e85d54460923350933a563873b3478e232c6e060d931ba3ab1e7563edfcef312
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab291dbd75c9c2492f3fb13b215b0a07
SHA18010f84d36344ff9cece2ca6299b440b97712d90
SHA256da8b6df0157a6c03fda002039af785d5b0dc19acce1e29835c8c43dc95578ac7
SHA512ac3f1735dea1f4f851f508c759adbaf01ea10930acbc0eaae6216712f06256374f8e5222d01bdd50d957b84c6c26ce4d6f8bb6acb33a06da8128e6f1b595faee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed0929ed5214ed2fe689d920eead3c02
SHA1c097324515ef3de64b8b17cbaee6290f85263a95
SHA256f9a9c31791231b12e5c4a63c914e4afcb7191e147bb0cee5ce8dac02986976c0
SHA51211858fbff96fa315f5042a5dedca7199d83ef691ebcb922ce26aee702bff1896327f2b6d95023b5ce6e57bffccbd10cd9abcbb6d0bea7c073174f8e4e483b5c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab0f4f323f1bec2a1c817900d78ebd16
SHA18eea9582fbf9f0cd0fa411f011879740c10f7f54
SHA256346d0db50689c83fb756e4a4f23e056fa8dd8f335a9be97b2a2f4849fb2b06b3
SHA512ce0b7961df6f9ec88874fe70598081d51208cb8f557b2b68fbec83914db91edf3d7768e8f6f49a3ee6269b37d600704aec3ce783be16bfc06864a8ca04d41dab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554a9e2da63ddeafd6e5ffa575ee776b2
SHA1de4b431e94963a47e6ca676f51ef179a04e40b2d
SHA256bc1badc691b8e6d5f268d9bceff70425b16cd5c1ba2e5586a8302fd011ec0d4b
SHA5129a91a5824212b45cfb4a4dc88fff6f9a55c3238e3748e2ce9455013794715be6bc770c2b49a4bb5f686a9c3e762a4a236753a3119f438095c5b0041a41a50b76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ced67f66329c9fbab0a80c68c1391b72
SHA1c5cf04dff48b83a8408927f7ae0b93a2ee7aca21
SHA256008149fcec11d2adaa84b7a93e9868fbd803b51053175e6bf4f62a429822e320
SHA512e5b5b1d78c20f47bac7d5a6b5e0d3a3263205508654eed79778ad76e2ce1ac67445101e41085c5b71eb4db23319c93ec86260381f9c6d1c13b56a7ef869b8eef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f7f216f7001b6e17c465d4d0581383b
SHA166ecf5de7e50e4230ec214c15409c16a9ff0a8d3
SHA25685ad84711f4e26fcce123e6937a752edb032a3311b05e6eb08de766a3a47b26a
SHA5122e96609113ace0df1000e2605272c2fcd42f5f9e1b97c1c034adb8f6d23f751f09d54308096cc4f7838351e1962a5d6e868bb18f2a94c8eb1648a6478de8a849
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5340ca4fd3a474ff90c251f2ac3bb1273
SHA1c6f756063785609200b0ecfd62f9b7e86bdef479
SHA256bde0af762a67e05d0d442597700862eb168bfade715d2758acd28a8b2f107136
SHA51265ddf67840b5925807820245d3059ca0811e21dd33feaec7c48a61271e604ae0349fb56945b7afd38a04184632d035616b9a04a0b324fc83df444b9dc03e3e3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f32b22bea8c6632b289e9e5f237ee7ec
SHA13c47f61e18b3321e28ae654a8e273fb1264a86ac
SHA2568c10abd3193a482e8fc67942a7f7d337537c2cbca004cdaa4c4475552db6b29b
SHA5121827437191b26782bfcaf41e6277709c80de04b775cdd40e2f26c13bb351e885018d0cc153d4810645c4ad49e5672688e4e9208d046266a356e1418c1b436f4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a752ccdc908a3191f6309fbecef53b5
SHA17f91f28ff35c6c6a64e5c039681784ddd4c9cd81
SHA2567cd0f73f4564202a70e12bce2eb8929293f59ba9e95d49d80a45a216e6efb185
SHA512de17b516984f129d66670de7644cff0cf12a71ae35e7c2dc039e03d6d73856297e42500f9c2e2dc8fbe0b48cd20d0b54a8a36a566e5e0082c6f63da8be679d90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d5ad543091d8f7b7d360dbeb3100d3c5
SHA1a548ff4e29682a75feb420fb024835532181dad3
SHA25624f0eb9513f754442cb5e1d5303a4770f8e61a9ca75efc91b8bf858f227f0d61
SHA512161e45c9e644c8f32f044ea9d48a8f3c08b2966bcbad834c511064e486a8bd3f90c22911476c61b471778ff62276c24c4b10a4fa625b02ade56b2886364e79df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579d2d83478574d4a79c7eb709ed924b1
SHA1d4502a14705b9de2ac65ee29de2f40ecefa5c15d
SHA256524e805a57cb722706a3eb542ba18b6254a488d8a723afd4bf66f4046977f941
SHA51249c9295a41d3af38df2bab3b85319e4f8f6b9839c2686e930884f66297e93d25b7901308cd3e625050c0ff68fa4cf534e38882e4cb3cee6321c9a95c7abb7561
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5341e55097e68f1fe840bf2f868e25be5
SHA143b8b468c99458deef588e699eae53ec4b6367f5
SHA25690a1866351625a6ec25cedb53e2e1a2d2f03ae4af2b22498ed937048ee2d4653
SHA5122e110a42be7bd6de6372c35b27af3d90117f1ac72f5a6d14204a89362de66459057b4c54332dd65bbc8d081fef6557feb71bf56a1b8147748a38291acdbdbd0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD585aea84b5c4dcc63881ee649e3801186
SHA1eea27461ac232110352e3998b1edda79257b4f45
SHA256b5aca7b4d8db0b363c4f9cc181544e59c4961f0cd56ddb9eea0853b982ddf004
SHA512057f297d63190505163625b0d0b3eb67f84e8a85c7ca7ecad7889dc91a2dea4e2b79d5822753d8fcd1aa7ec84db83d188afdf9aecf14627e91749c4d4aaee7c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_827A2BD464611B5891D523F77B43FEB1
Filesize406B
MD56a4d45e1bef83cdbd97cc096cdc50030
SHA1a1916b8e833999a0a90b268d66e669d785a1bd85
SHA25686f8902f0f4bbe101a96e92ad3dc7a4fab88b3c452a8d630fbbcd2b58000fc30
SHA5123c6eddcfcfe773c828dab19975dc002830564b463473bcd43a76196ce3fd2d69c4bf56a175524fefb1035d978ebf83d2201bd380b6c77c84ca8be66a2412e1eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD55365a23ab5327b3d805a594dd999b6d3
SHA1b3e25804b542a89c0d3abeb97e9f75dc0dd4f5d1
SHA256298df81af94735d32747de5ebc72a2b9898f208720aa0d62aa598f0d15e21a7d
SHA51273b02133c610c91aa5cdc893b726635d654a88af1c0af4fd7998a28a6622b3237a1f27649f087045e11cb394c4d4fb231fadd51a40d887224f12067a63097adf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4JZQ5QLK\cb=gapi[1].js
Filesize134KB
MD5f9255a0dec7524a9a3e867a9f878a68b
SHA1813943e6af4a8592f48aeb0d2ab88ead8d3b8c8b
SHA256d9acfd91940f52506ac7caeffea927d5d1ce0b483471fa771a3d4d78d59fda0d
SHA512d013be6bfc6bcf6da8e08ed6ff4963f6c60389baa3a33d15db97d081d3239635f48111db65e580937eb1ea9dc3b7fc6b4aecb012daeee3bf99cfebf84748177e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8ADCJI8Z\platform_gapi.iframes.style.common[1].js
Filesize54KB
MD5682c26af19b240f98d2cb951721fa54d
SHA118e58b652c7f82a55ab4b1910693686049e25d62
SHA25696428f0f585a874c185d560538ad83ebfad0365d760fcf9fcefe80add9e3c980
SHA512078aeef086271b7f9cf0f6e3a1e7908d7e38465a1a7a4de6f2a785147e9130551a2995e80600824da9341d58e5425d4505518e90eea9ffe1c64f4f41825a9660
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b