Analysis
-
max time kernel
135s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 03:35
Static task
static1
Behavioral task
behavioral1
Sample
27529dedfec858866ee509d8ffafcf56_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
27529dedfec858866ee509d8ffafcf56_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
27529dedfec858866ee509d8ffafcf56_JaffaCakes118.html
-
Size
28KB
-
MD5
27529dedfec858866ee509d8ffafcf56
-
SHA1
6924d46bafdb811d3d6c3593a294f58f64af62d1
-
SHA256
d67d8130e55b6ee4ac903a50a70bb63ff259ff3cb6276ffb792173b17445dfd3
-
SHA512
0eaf6ecfdbd72f1c674a8780e118710f3793c0256a73e90e077bfbac3834880ed40fed03036bd8d66e08a0537c24a8aaa2a192c78af6c5fe9994113da3a93c83
-
SSDEEP
384:Sj5Dd1eB7aPauJdPavana8GagVsQEa2JatVamlaoYPRfgfabTrGjxGk3abTFoVl0:Sgru6I9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6546AA1-3B4C-11EF-A533-F296DB73ED53} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07f14bc59cfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000d4d43b90fe385289281becf1e94492efe5ad6d0ea4f2bde06938a9bc38248973000000000e800000000200002000000061457e33b8b30919c322d672dea5b495ab9765e33817d05ab859f73b5844d6d5200000001a47ed891323f85003319e3b09af9885ca34c8ee83dc41aedd465428cc24d45a40000000910a6d3aea73ac80544043dc81a966f94d043a0a1cc9c86d483f932cb87d0c923896a369de87cefc9949397f365084317c968d001588625fcc2f85a401f5373d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426400562" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000004e171908ecc60524e5891fab25dc1323d3267ea18166ef4984a88d3addfca026000000000e80000000020000200000002c72555d07237b8b8d50a0b98ac5413f8cbbc2104aa01d3b80b635b3ef2e69d7900000005e7ba65b0bf32db03bba30adf82f759c0ca28666f1a4d6d3dc9cee5e06c978016b8479ebf2656773461dd7b2e381677258d695768e97254460ac645ac6b8f4e8f1247f40b98486294f78c651048fda0f70dcb3d1032222f04286711e15066c03d0494cecc939919194fc4c5f149eeee267faa50aa0e0e25663c4ece9cd2f9b2fa5c9011f6f6d58a1c1d5b1b08d4c5adf40000000f02380348fed639a44e4acfaa89643a5a835444245ba869dff93b1371dd215f976fab5c48a533e9e23e24463f8c6dacd43cfc0edb18c1d33ea0299dc7b7176ab iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2596 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2596 iexplore.exe 2596 iexplore.exe 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2748 2596 iexplore.exe 30 PID 2596 wrote to memory of 2748 2596 iexplore.exe 30 PID 2596 wrote to memory of 2748 2596 iexplore.exe 30 PID 2596 wrote to memory of 2748 2596 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27529dedfec858866ee509d8ffafcf56_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2596 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ba81ca783235d5f32ee26431c3b5896
SHA1b4049c6e70a36883f9c9134632df1e353a6fbb9e
SHA2567c9805b9c59636124481caf4ee268af8375423cd29c7bd8af90ddda906a33b2f
SHA512a85e71c5e2bba51ec34d408c851545972a939dd1f7dbf6f0571e916577f4831d28f00de710c3b3bdd401cb0d57c2f25ba626b7f11d59d1a5d08fd3601eaa44ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5074fcddc2a47ef9b6908da41b99825f4
SHA14f888fdf5af220caadd50e0441e6f39d17e7c796
SHA256f1fd46dbf1bdc92b0b484c6019b554b19ffb7f6dff0057ca65f550434c04b3f8
SHA5125922262e1cb7a7aa9314fec1f3fdc7a09368d1e3241a2db08cd6f584a5910f5ad47e9a6473af5389760c891ecb0fc5071ae8c11904927e116dc233f811d14d54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57186729692544aa3593e76c7feabf7f6
SHA153de80986d3e8b89f45446af28bb81156cb6fcbe
SHA256eb3fc543cb049faa74698f016586b011b0d754ef9ec7939f617f5ed348029a07
SHA51219a6c77617204977a0ca701ba9cea84aa16b70d3c6f113e2ca8b115c93f464b9a898ff95add8fcd3b0c30f18880a814b3a3b7e2a085018e0a26febbf4f1ec126
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD582711ed82355ae76100da4794fd53fff
SHA1840260358042bab0d26f4c6e2f9fbae9c26f9a99
SHA2562618e9b3dbfa08413d7b63b66bdb196e0b6c4615a087b2fe82e8207ca5d0d07b
SHA51270f42f50f9cde27a84eff121ca9fac5234919ff9b6bdee0b0d263a1c4c3346ef87e2afea4f55c85586208d9798ff949e27fa721351cd8810888e2b8a839a350a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f5cee5fb85bbf1d0406caa32b27f4da
SHA161dd94933d2365d6c1916e1170ee39f2ffadeb40
SHA2569be839deea6a160bc7c8b206191d62a2eee972b8bd27f8a5d9a5beff44a85615
SHA512aa8f0bb4249fc1ea96a322289d20d5ef596164c352763ace74f8cea940d9ff8f0389cd5ed9ae0841107f7c5e7f5a38657f5a107d43797c8d22e46243efe9c833
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ff000a37f06f4bed916a775cced0211f
SHA1a0383b9f468227ef59ac6585d57a5c30c6338544
SHA256b21b4ab9cb120c4643855a77c16a28be5e2e7f073ded24d867c26f3ee1ac29db
SHA512759157fc37c0653c5caf9cd491d6901900e16901bf8c8e31302e2dcde437821303aa53ed62989cebcf585209bc5ab48fb4ab8b1aef589b9cb0a0b0e199fcceee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598ed5388e5d8b82ea5ec8e7a2fc85e12
SHA153561c817d6edb06ec5e9d559f9f7c27e17888d6
SHA25687e8b726f066d054fec350414083b2f3f2e18a8f8da5bc929fcc0d114b955d3b
SHA512214c6ce0b6fe0bbfca675f6cdacd4a721e5c1ce1e41465e920351fb5182dbd1821e683fd56e2535ddf1367ac61bb03be437bd86f895889b89be2fbda227a1a45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580613fc968b7ceafd08a0d45ca4fa15a
SHA1c74ceb293fcf7c7773d6ca483686b26599b752aa
SHA25614c37cc25d47398d62c939d6e6fd3bf47be93091a7008a217b5ee6512f0bfc3a
SHA512acb1f1c3af0531b2fbd0b91ca30f19089c64099d8a142d5520bfbc802b642760c000db06dd8accf679e6cea8e32b49845be0228bdf2e8b4c44967a78b8248c1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f15acb02dad311d805e7670fb8852fcb
SHA16c0c1c127fdcae199abfcd081d1c9c0c9d09c97b
SHA2569418978e360d66ef4817079036476c5ffed9c945d3fe922b32d3dfed49a2dd65
SHA5121f56d9e6101cbad84084598b8cacb86c6253c989d0c256502df06b69d5d133feb50b7891ba8e37c5e0aa703872bbaa53ca4757038c24e3c425802c05aa152a7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffd128c2dd28e132b3aaccf91e3fef6f
SHA185857d2741e74683362b764bfe8eebf9c8b9a20f
SHA256a2fb9422887429892f83f8c77a250b6e4269d7c9f1e87cd0baabc8ea33bf8a52
SHA5120fa3b8489e01818048fcadd6c7dd8ab58b199570e5d53954b22c317019a45bd7d85d26b0443213e31a4fadd64c40fd644b58747289f1676aa2c2dbea17e68295
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c1823f1e919846fafa71672deae604a8
SHA1fd7dfa34d466d95c1e685142cbabaf29071a9461
SHA256ccad3c19f5ffd25e1d554cfe6b03bedb02c2d37585e410ada013ee8d5d589700
SHA51263ef88797ab4eafa46952c0ad3b38d2f6250b206ac1989e99af531cbd3b8c023bbf414e0d62934d19d7941c6259299acc693c40f87b5c60ff86c99f0b3f66329
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a36e07b5f1e18cd6d79ace13fcfd7e64
SHA1238b7cb7409fd25c80ad04b08d481cd71662f748
SHA256c4b8299031dc251a5a38eec3f926ecf6068eb84bd9b25f3e5f029aa6df6bbfb6
SHA512b995aa61466dcdf49f5b53da999977c5d35178036f8478af4c274d3f6192991728ea2c4d31bfedf3367340e28df18e88bfaafb4c6d8389bba320131f616fe27e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e962e672c211aff6858986633e11296d
SHA1326cbf55de8ccc547f9e62655c5cfc4be69e9809
SHA256ea3fb268c5e5fe619bd035fed8a36b082f132d881ca93885f6464bb88824f22f
SHA512530da5b1018ee64a16dc4e8d31adaf0e4881ad6967bfcf0591eb7038ba158f585ac134dc4b0a7563005ca759e8baddbd9227aba2695e3b7024546dc553b6d849
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5375fbf4f56fda02a098101112a376854
SHA141818ec9cd62ef973a1e6b84caf41a6a59cf485e
SHA256460ad7f880c4fab12833165f094ffc900558362603759a7d8d6ec2f564874199
SHA512fb68c40f7588b6e88b1054c2b2b3c7bb662578042e25f4f96ef6e3705d0ffe26629027f8fa9f6865aa5df8ca63a47622791cf610350a59b9375cb9a5ac6a78d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e61d241cfe822af1e530ea07d1fe923f
SHA13df880a502d75f107db0809ec7025ef3cdb68fa5
SHA256a49f45234e357ce11b28d29fbdcfbe346a8c691607f52d29961db5796b841f2f
SHA512cced1f6fef85e407ac7cd11d2593897348dc280dc3bcbae9dc21650c9938c032825a21605b60c967d47dfea382cf72e11bd23063c398b7896a30aea072755255
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5914447057d9632332f26d73f70ebc981
SHA1386e4aea5534f5406a4f832a46836acfc05752bd
SHA2563f000e5a72fda296c3c7d167650b4bac41a13aa895c3871c4cb1b35b8d7bc24b
SHA5123c309e978d734bf2be86eec82914f0c5f3d5d58f3488162026a23e3f92525d56fb584ee6f1019b6a178913b9b47b88eb2c5b415302cab6cc9ff399ebdb7956cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aa8d95652e8b2d10d7309e7b00fd60e0
SHA177a50796682619e671cee2e62e4d07aaca9fec46
SHA2564f7ec958efc67703e23b7167af89c5f07a82204a7e30bfb340f14a3970431b91
SHA51236e71674a22659448d7ea3be6f7c48326768becf9acce78f90b91c085218153b89eb7256eae2976a5c3c223777d8b17e512b4d4086d882b81e7276332be41a02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527b8ed9b8a9a60768d5c4e6984029343
SHA10acb4f8da7a25540c4d73beaa94c833cdb15404f
SHA2569b02fd69c6d07452d47321fd4a9e4b2bb4e457cfc3715655faba67846e5ec5e8
SHA512e6728ffc2b4f1c6f070d33f217a97575d556212f8eacb572c98f215d56f59f0cde4b3abb0c1b61afa78246660722d9c6bd85dd610b87876fcce6c02b2b1a3971
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5dec5335d578d906811df6a4081ec1d
SHA14ab48619cbf3f1c9a6b018252540d840479128e0
SHA256ec3ffaa0f29bfe5bc3a82696e3e7f11b4f839dd24defbe08c24dcc405b7290ad
SHA5124473e80403aedd1f45f40b0a2a5f72e06458e20ca1b8eae11fb3372640d7dbd5c1bf823eea4d4a19f3794e23ab8953df3717afbf5debb796a050b912ac88a6dc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b