Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08-07-2024 14:07
Static task
static1
Behavioral task
behavioral1
Sample
2ca421a35c589a3fcd9711f0bd2ae483_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2ca421a35c589a3fcd9711f0bd2ae483_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2ca421a35c589a3fcd9711f0bd2ae483_JaffaCakes118.html
-
Size
34KB
-
MD5
2ca421a35c589a3fcd9711f0bd2ae483
-
SHA1
7d03a516c93e49533d1559e4b9012354ce5c9581
-
SHA256
1d0ba71b4116d366b552fd2b928120a22873070029a6b8e840b5dfd63cc34cef
-
SHA512
f966d4b9f0190a38635d6dd7bafcaaa78c8a640d87d1e9cd3c5e1f6fb6158972574034f9f4ebc3fac68d147f030fecc07052c2e75231a41b373e7b7a51cf9264
-
SSDEEP
768:Zcd9QZBC7mOdMgBpC5I9nC4k1PIwMwYgwA8+qPd:gQZBCCOdR0IxCD1QwMwYgwH+qPd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000003706bc870d3f97c42db856de884df99218e6ab9c31b0abb21b89e9abce13f7ff000000000e80000000020000200000007175deef7ba6f795a1b3ac05579284c10b69340bd4e17e180cc41afd1cb7ceaf900000000a4b64c1531e67e6a7eaca21fe3496b9ca0b55e41e5e81de2f3865682e7fe4e219e80359adc82f6107d7779402fb1c180df42f511bb101d93a90d3b11de8b2da18aabab32b71f066922c777fe0ef33c981b026513421e23c1ce1e66a9f9351f856c680e51090b6ef60d7d4475f30fd6f3b14bae6c33ca129667374f2a07b69be6752f7f0ec8d5776b0fdabfdc9175b3140000000c7dfa3fef7cd0963fa3aa87c01d726384271e7a9dd250f3816a7c932eede437c2bbee7279095e15f919558721c5efe0ce6791bfb2b7438cdd4e4655d92336c78 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03b5b5284d1da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426638749" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{794208A1-3D77-11EF-B913-D2C9064578DD} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000030cda5964482b536fbcea589e1200a8c1979f0441df6e45614aeecb967cec36b000000000e800000000200002000000092e7903eaa08989195938853855ee6f440eee84f41fb236f4bca246713dceada2000000083e3c658a61a1fa86d226d2e855f9a2efa4e5667da108dc101c70bb5978c2e4040000000a2627fa594ddbe4a5288ea28ac03a96904c6cccbdf1854f5b6151ae9f4d4fbda2c694dca15582a643b20a80b6c22492bd7306b3b52c52620d11e554319d40143 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1620 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1620 iexplore.exe 1620 iexplore.exe 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE 1920 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1620 wrote to memory of 1920 1620 iexplore.exe 30 PID 1620 wrote to memory of 1920 1620 iexplore.exe 30 PID 1620 wrote to memory of 1920 1620 iexplore.exe 30 PID 1620 wrote to memory of 1920 1620 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ca421a35c589a3fcd9711f0bd2ae483_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1620 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534817cf5dc1b04ba2f1123b361723461
SHA1d5d0199da29d2c7faf791b1f15872c377be6a7d3
SHA25629078a2f3695cbe60dbb02fa1f07e7ca02c60e6876b060a157905fc281aae76b
SHA512d64719f3502c53baede2e26d87f7fec4b0a7d4b82098c66e72d949438169af7b37a3d5ec7dd808d9a8440c41d432d44ebcd2f0d867c3013dfd0d8af07111ae03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537431cc6c71a97126d6d219c9c450b66
SHA1555062ebe3f2b769fd8ed8d48129952bd83e4fd1
SHA256971164ac98fb3655eef5e4971cbf4e633028a7d6341584d3dcb616dbb33baf2c
SHA5124ccf0c968f5d259fff1c5eb418c06909ac26933678839cbd5bdb020dc48cde9cc62468d310bbc6cbc4799005ccf422e088d35cc3a95cbdbd37ae79a0cc433157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e19920ef7d371bd96a602ce3677cf48a
SHA15a96bbbb330b9af0486f893176d31ee805b54537
SHA256647bb8fae89adab2d01e09b8ca5262cab8003a1f77e40273824ffff857a998dd
SHA512dbf29989f0015ad08c1b0db8ce9dbdcb29d0658385d9cfa1fa7af0e58cea1553a12f2b6101226ed68a9b3bf1910642b805fb443787652f3e1bb689da5a09a1c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5668b8675ef3e10975962505bab6402aa
SHA1be3eb7b6a85b1afd86da8a62eee69f717ca6009e
SHA256e9bdf3b48e7ea7383221feea73baa3eac20535bb004b22fcc33fc1f1387c4ac2
SHA5129eb02582ad450ab799553fb64857c64aa814d69b5feefb6e653309c265357af1297507cb91a678c9ef94a4fa87f0167baa9592b018033cc1e0d6cd8f22307c94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d073f16049dd182e510aa47cc5ba6c12
SHA13c284a700720cf2d73f7ec4a79aec0209e72bd05
SHA25628f6f3eff24958d9347ea14ba51f1915d007823882d844025ebfc72f9a2d8188
SHA51255907771e2f91ff91156e90ec3c41083a61a5916f986a816b7a2bdc18120a65e0133ae9938268f0a23b2d516ab777c4830079091be551034814c7e70ac92e671
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe9503899ca1a1a882100da445b4a31f
SHA150215fd1a7bdd4262a12034d82350436294d03ad
SHA25680f33edd53ed4db294ba3fae51be95e451672e946c78b90a88b9c47260fec0c7
SHA512b51d203c6ee768e8c1aea702f8dca83086d9bd4d62f39e371fee3d999fec69a5c5e3de4fa44716d18f6418a95e44d2f59632fdc0077493848d99c732da69ac27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb1c1000205be3a48f434ef979087166
SHA1e0e994453aaf6bcb7b9be80b4907341780308561
SHA2565a32c082e95f37ea624a198108789921f61deffcb3fb91fce5bd68f7342f05c7
SHA5122b59e0e898c32b9985a6291b9d7d2ab50d73afb69a8e2ffb6030f21c72ebb16246444973aae4a1b949014dfd28ad821baeed0dbd1aa1423dd8936db90230f363
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5edd1df4efde5247ff1c65cceca9d4715
SHA17381b48a041e342f1da62c2ac0b5d3f39d793235
SHA2561a7ddf1d95046fa3afdceda9ac94bcfbe95e7ac4b79c9009a1d65bc7f9c35e85
SHA51207ba302f2cce4d543668a97948598b56cf77f6575b909a35d9344c9ff736ec57379b6554307fdd53036db187841167fa683c3d382b5ff784bd2c8a8bfe75dcbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aed666b307666c10d133ee624ba31ea4
SHA10ac0f91c3629e6a23007402e4d9aadbd5163d9db
SHA2565b75653a09ed2dfa6b75da9dae517fc9d02b207ce925c0d3ea8df14954b8ca86
SHA5129823eb514428ef2140d3551d8f38b25fc7aecaff538df5938a9f93edbd5000f3bd3f4671b51b822b9ad8de292214560a01c7a08b4662feba89d8a6ac24d736ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD593ec88411f9223910a37877a4afafba7
SHA1a48c86e5f3d9c2b7d8b0167f9870d4e31fa894c0
SHA2565c06194a51221e2573dcd96ab69e799058830ac0a98a0bc76325857a6102e24a
SHA5129f454cdc67a2e575b461cf2eb2361eae708e4ceeb72b9ca45598f94b394fcf9ff1c1b162289e08841957de9a5cd59cfb61ffaa0c72979a19c88512196ac95af5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f20093858cb3d914425c9d20999c63fb
SHA11d38877d329676ef0daa25cd761828b04470814f
SHA25662f6059fc25f13d46d87417cf436502f3b98a037160740feecbceb903d04a884
SHA5121a7c60fd31035b4bf59b394195cfcbdf4963868ecf857f144295ee225497c5865f5b924d0904d9b7ff7cd04126fdf61e8285c7d5786c53b9b14b4fe01a63fba9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58f0174ff6074f67196a4a15242658385
SHA19c9e2b00dc1f723504023e63bc04d733c8d09fba
SHA25683912fe45fc1ac6cff7ce48a799e7c8b25697ffb0c9ae7d3c3c0dad1ab02a2f8
SHA512c3b41907bb34e2f981cc1960fdb0b8b4a91d3d5a08c5092a923b3f10ab921720a841d76f70ef23edbca99dccccc13b082bfa62abc626d5ac733523eb9b74537c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9b90c07527ff1de8f8fb0b1c57c061e
SHA10e115afe52fe22c1b9cd428d19a63120c5046428
SHA25663e09fe8eb2b95f5cd67ae9f7a2763eec0beb5c089fbdb46dbdc316186c4a728
SHA51200503216cba1189f751e1999099e5ac751072a413afb1a6bff4369b15d2b5ea5adedc9798e9a18ffd7e36646f3a788555e5f98a49b8f207610cdda0edfc3307e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51668a0eb4655554c8d1c4b74eb36775e
SHA17ea5cb8c37c2598ce12912251302af03e004ba73
SHA256dae19fcc6457ff2c77c9d8a77ec78f21efd7bdb8f88a29ee5ee0999f2ab700cc
SHA512d7450cfafd6fd8cbf1f69e3b2ba51f3e36cdf7005f058852018dad76b1827abe6dcb826f9eeb69aeaa7e190ab372fed2c13676f9087109d2c94bbcb4f7f9473d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b16a7419991c1bdf3bb9b88b3b85bc33
SHA11b63fec7a27ce315405c2a00235ff538c0e5534a
SHA2561fe8d416435fc1172e3462c6635dbb7b267e9c9093464886fbb992fa51076899
SHA5125be7470641d17263df42af0cfbe7402a1322d94afae64827bff23518d4d7866b591c81cec26627ff639ed2648e3240e4e414cd66dae8be31d48c24e610cc7989
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0f5ba6c60df1912659e470a429d78b6
SHA1b202a5b30b9522d2f349199f4ed39467a355001e
SHA2564088cbfa11180b6d17a1e758e0d980f48dfe1cc1dfa60744c03cf9266f93bddb
SHA512195319bf4ac6203aa423ac12e4b6b9e0f373b16fcad6f2664307d59ab10a45eed8c727e7f0e38508f6c5438cc8b0354920f736d2e96dfb55c4e3a13c8b06f120
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531bec197a0a6fa77b1743c93eb361ced
SHA1c67e54c2efbe1942983188bd504e42caf5177584
SHA2564fd9bc197e4228746dc1534d7251890d9bb870de063213d8604ce786db688d8a
SHA51245caf5d2964a2d6fcb2037ae3668bd664798f741feb82d90e587e6070d8b6ac6e50e8f386904ffafcd4a155f7d5b0e8806689bc4cc9e041222482bf643bf68e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c94dd0c8aa9fef33c5646a216ab81282
SHA1941372257d43040895dbb35bf39639a0a0b413d2
SHA256b4bfc8322b5d44938de38707b925455e6badc972b624c642ac9cf900b1d42906
SHA512b28ec881de63a08edd5a9616e1b1299a2693139d453e3221e5ee8d696c2d720385d9afe44ac098a8965f719fa082ff233b39c43ed305419cb53eae023b6b78f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50b28a1efedac9c549cf11ad2d3c17b91
SHA15670521d868841d6f89082678b86162a98222c09
SHA256f80daeafafa46db25fdeb063a6bb6eee24fbe0eb457883edb50d3c724c909c6c
SHA5120cd619e6b6bd90c0c9e63392c57114d7054488b87b23f9e24ae680aec802bdcc4afcea659019f8cbfda03287b9403d41efc265ec26620babf9ab80d2ae3cd273
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b