Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 01:11
Static task
static1
Behavioral task
behavioral1
Sample
a34efe970cca3e373839a6ec3d70360d_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a34efe970cca3e373839a6ec3d70360d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a34efe970cca3e373839a6ec3d70360d_JaffaCakes118.html
-
Size
6KB
-
MD5
a34efe970cca3e373839a6ec3d70360d
-
SHA1
8857586ab1688031fd1b13d1f969513a8aabd795
-
SHA256
4106240162881351be55c549742fae6fd3b5ff24b14afb46750da8ffd6beb600
-
SHA512
b79c5dd6442837bf9d4cb0f3983b3ac2ed60a73fc33c13cbfd61d65f1406497b0955416f6e2ecfff40960d0edfa24be8153d377a70b75f59bfefbb4aec4dfb7a
-
SSDEEP
192:0hM32yEY4lZXRUfDlM+GGUWotV+C/a02jOjoI:tG/KfOXGAEy
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000003887e133d5266de26525dcdc4d635d4673345fdc7ba97896c104c3e759e03581000000000e80000000020000200000000fb2ee7cff3627b5f59a652e5b691718473efd288f36cfac6f593491f40ea11020000000bf145dfdc09c056d43abf9cfac63de0df9091e062aeeafff017bc1f052d3330440000000a403d4cf3384315787be00ddb9c29a3aaaffe644d77825bb488baefa7a068a1f4e5be921f874ae412b342e6e82f197e3b618cdbd38b94088d3efc9a11650fa2c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000004c8931b1d4ca91a6644b163bc7dc4f5ca077dca0b9ec4d2be0454b9456037533000000000e80000000020000200000006b39e9a0223bb58e248229a0a094eb22ce15ef8c43ed10dccd6a188c625f295c9000000036ef363bc78e0caf9281c05c70028e1e59ab3c58cc123102d304a97505f53893ac08d46eab0738501e52eb7a58faaefd44483822a79e4edc827a80b81cb1afb72b530011221feeea2b38815d5a4ef848acb094a8040531bade01a369dcd895a0c85f63e325ed3e9cdcf93e9d1def563d63f1e00b29e56d13a9ecf4f94de54c6c4b3a90ef58b7f1bc9e25edbcc33114f940000000532d4ed648a18dd2f97127cbc25770154731ed5f38a036ac27eca7b0d2347b67eaaf576a7cd607cf1beef18dd58e0d5c3b2add4ce8bd5bc9c1ad4cdc2fa9d092 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424402950" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D99D50C1-2921-11EF-8132-FE0070C7CB2B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0811cae2ebdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1760 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1760 iexplore.exe 1760 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1760 wrote to memory of 2700 1760 iexplore.exe 28 PID 1760 wrote to memory of 2700 1760 iexplore.exe 28 PID 1760 wrote to memory of 2700 1760 iexplore.exe 28 PID 1760 wrote to memory of 2700 1760 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a34efe970cca3e373839a6ec3d70360d_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa56c893769daf680800803373b80ac1
SHA148e951371d05e5b4ee00ac069c829ff8e781b957
SHA2565f1303e5f03e3c1d31f09ca3dc0889439fe0d76998cee185f8b802d665db98bc
SHA512d4472feb4aee8afe143eb12fe46d7d80a050f0bfcd522ac1e3fa802103a6e68392eea817948f5e1baa60b10bb02f2bff8069dede58d9367db3df5de99bd8b6b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac083af4d49dca0652ebba4b8803739d
SHA1282bcdba731a71ebe3759b726657230dc106bac5
SHA256b884abfbcb34d4eb69e2a0bdf2da928fd846956447ae45d4f58890730e3aa333
SHA5126fa30b0950d4da93d226f9edb9edf337d33d291ca09babdb394aa1313caf4d2bd9b016e8e33d7de64cda2ebe2384f868a33129937314a3fa14efc78782a2396e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5355bfe72244e26fa6214c26eef859681
SHA1627608e2a6cb44f593a09c85e03b356da920d0af
SHA256d03a41dddaef69ea106719b172f8230f67986610e6756eb41e069cfeb6cc84db
SHA512e8a2caf1e9ba9bb3b6384fd5749f55b0be09a07263e7c9111c969db3d0aecdd91a007bc7feed6c7a83ff04c68238b3488ec484d7923a53680e7b181adc604b2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d31a29de8f9801e43d1e3d3b58a61264
SHA11a4fe9f7647fe01c4f8325203b792883e9d30c6d
SHA256c8fe321619deca3f823d739b5605d78449a8f351d39fca7e5b37415296215de0
SHA512a83558df34b2d384cef9d7c74a0e91e42e4b6b2d59cb80e11a967162e06c85fc024c88e8df29623ccc8da2829a4c63f791ccf5471e8e61f42d6caf3855257b88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51cdf75dcdc06086fc63731bb04c7c847
SHA170fef36b93c323db5cbedf4bdc10887ba7b5b638
SHA256889e02425adaf81504266eed78ff89a31bb7375c336236779570965ed5fcc230
SHA51286e8e24f35551182fd4e26c44d1639a5e3bef2ac9f246d7076d46fbe2693db066ce85dc23552960608852422dfce5b8fe6d1214d6ad9fe66e6f37eec4bebd4d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50bdce07b4875c4cff6e6e8f1f49cbae0
SHA1c1163c55e62a246905ea8b6961abdfed5aaa6cf8
SHA25635e48bbe674b3189a2084744b45e478b6a32ec9cb7217f42c465194d3179520e
SHA512cdfd34ec08fd5b463a7437a74cfea1b88a7829a1b1749073ffadedd10af001b770a53fc31552b2d7994df998768f0dc5124cd371a6d17e1867c53fd0351d3817
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528efaea090b2027c6f4f1ed640e89c66
SHA1bde16b6f3858693e7ae63b5ca33fbd31e0457889
SHA256f13ed2e06019c0531789996f64216679226269302634bd100ae2889ab6a48158
SHA51251632bd20ebc644b862ea16f07ed782a2c964441bfaddb5f859533790fdd2e469c630fc019d48bcbb7c780f0a9ff1d7f549bf2e2b773aa68cdf0e257ca4f5e56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aaa3b65d9d581eb507c840902641dfeb
SHA18aa6ea7b78c7ec9e60a8d767835c42593759f766
SHA2567f26f84fdd3e218a1a9aa07d5dd7187226ea394257747243c948143ecc17dc3a
SHA5120edce831b119a02cc9493b9335a7f537c347ed73e9e8a8c5bc2e23c647df7ca6a76c38a9eb85c6a18df4ebe45f4d79d0db984ab0d9f8f4b52c6bc85e19213a50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0dd397341d5d6b755c5b1fb1ee64e96
SHA1f1c1bc76b6cb69e261a89dc72b136afa5ba5900d
SHA25637e5e0172293f73382502d822f94c77abc315391e9541a945c277af6a3af0768
SHA5127d8c822593dd842d6d36441485ff7da0475715b61493675ca0d7f20d4179e6820019bf2d25349f1b365343d1504bb3ee5df09cd2635889d0d8ede884fbbd1d52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5171d88af61b68863188717adaa06cd30
SHA1ea20b3a797cc5129dcc18b2d60d55d736f4ea74c
SHA2569f8239b21141721a991191692061b127a6cc8638f248b913a52e2545f9bb66a3
SHA51251cf0cb793eab5cb749c4dce183c5ebba944ef95f93016bf7d06cc73925b38dabfa3aff3b1c8a7ffef12c0bb0dc3cf6248835953d25d1a3e982d5e2c816162d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54cac2688ccc5587f47a7e9f8632a37b5
SHA191c4efd453e91d219c5e55d0abf08b9620db41fd
SHA256bb62a0b0e617b942cbefbf6305d808c5174155d6cbf7dd8a42e720974893a7e0
SHA51217f6fbd8780323c2413918214163617aa9696a7f770db6ddf5fc6520ed6410cd4c659c3d761fb5ed021cb529df0b9af443215af1cc7ce4ea7fc235d0a1268a3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ea91354ad31455ececf2e8c42f0106bb
SHA18a7a142ab1b3548ca689aaedf96966fc68e4f082
SHA25653f414097cf3c2e4534ac7bb5eca7e3c29196b070b4ae4c8dbc79d8de3ab9479
SHA512c684156b9180abd423c59d26ff580e6a81a219c39a5fbb3dba403ae74707b83b73425438f7ed817b5fc3248d3c76e0d943fcbc2187733e7bd3fa04dd69496869
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e92071f6901d746305cd5eaa2e93889
SHA1f7fd9127a131dfdaec7987f0b20b6867feded972
SHA25631a792c7e3a2598314b9534dc7eb97a26cde95cc8f11e2c84409db7832a08f93
SHA51203f8b199240a71d3d0ce63d0715d23efc55aa30dae37e3de814ab8de5e363d5c3d225d9dc89dbea05f4b7bd089df10ddeca68f48b58d57b5c9032f3e7affdd47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f6aa141b6059cad59dd26efebfcd6d7
SHA1d52d1220ba26d5865b5f3e1388fcd116bebebb86
SHA25695ecc281c6400bcd698e9e3a7278cb51b6db314e8af40f67dd420dbf2398fc2d
SHA51220489fa820f2ec458ac1e0d83d1d3bcf97af3869d85495e0b74d8be8bf53cac9420c0925ac6d34f42ca1a455f012429d88cf17673338ef0065b3439e4618829e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7d876fef23934b3f0399c874edf2e19
SHA1b505e3031422c280d67dc86a0279a17d64c1ed14
SHA2563f507288cfe51cd830152f50a4999e44ad859ac1e9e623d4831dcaf21e8448c6
SHA5128772a823ca9fcf3d375636a442309380b044d19392bdccd56be184651a3b367364d2f15da3a57d0be3cb6de9c61a7c5b3244ffef29d22aa5e8cb4b4a2850f483
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD576550d0ff4b8dd001c2cea159beb731e
SHA1ad5ba7f03fdbd4c3768d0c55a2363b4d87af040d
SHA25610f9e466d551628b22484e4ac761f801a8b1a2a0fe61dab9b0ea2c955bdfdc19
SHA51266a91c1d2956a8e01f5fa516c6a8d6980ae78d6396f1d9c827ea964a5f5137dc807dbd59e12b933108c00dca75e692b1822ce154591f8ce4eac495f0447009d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce7057b4e9a03f6b1c2ba6e1cadb65a0
SHA1ca2d52498d286220097531e6e873d56fe04080b2
SHA256d7b7399c38d0ae325573ff19b56168a4c9bcedc7cc021444931e829164ee161a
SHA512c17e0cbe340153953cf7519e8ca9342c946aa5ebd05ba6fdff2e8b6e4e9013dd6d65e877b1bb377cab9a72c1514c935f556c5f4f06dd9dcac746341be246934d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd22625ab5cff2bbe6d606a57a46ad54
SHA1206de8fc00f8b12798370a6c8c23528cabebfc19
SHA2562f0988f82d9f09a18bb6dac7cd5b2c419c7d15cd05908c0838b8be38fc57c150
SHA512ff466a2ca8246c1b532411b709b28b695fa52430e244634d82525814ecf412b4c8005ee603fba2d254b0b48b5952818b55b92bbbb2fe7ba98e8b81e4af3bc009
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e105f86b1357aea06f16b49621b194a
SHA14737066a38fba2917a7c7d037b91d43f9fb76566
SHA2560937c0758fb90879cf3275595ec77221715b161aea57eb4789b8a7fe6203bdad
SHA512ab345594065e20f50e94281a93a142a92e8abd7a1bca15d344e75481f62b620b7f5f262e17cdb3fa4cdce434adcebec9eda7482b840531b7d23ea32057749403
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b