Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 04:34
Static task
static1
Behavioral task
behavioral1
Sample
37b792aacfc4a36cdab46f95b1da7b42_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
37b792aacfc4a36cdab46f95b1da7b42_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
37b792aacfc4a36cdab46f95b1da7b42_JaffaCakes118.html
-
Size
53KB
-
MD5
37b792aacfc4a36cdab46f95b1da7b42
-
SHA1
eded1184c57c224e9f058d9c808aa4f0a71f4698
-
SHA256
4663671f7992b468c93efb62e2bba75000203591fba3f80c3a7ea3f51f04e2e9
-
SHA512
b007bb985f4385bd4c8f617e6bb60289fd74d66a7a3dc81bfdb3be385af01e61ede0703858815b730f4da438bf54a3773608779ef804db73b697659eb72a8dce
-
SSDEEP
1536:9kgUiIakTqGivi+PyUFrunlYC63Nj+q5VyvR0w2AzTICbbdoz/t9M/dNwIUTDmDy:9kgUiIakTqGivi+PyUFrunlYC63Nj+qL
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426834332" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 205218b14bd3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA30C431-3F3E-11EF-A0C5-EA829B7A1C2A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000ab403f06992a38d80c311d254eb940b21abdf0a327a85ad30ca057de26e2eb9c000000000e80000000020000200000007691f2e606378f4d94ad513194261feab51c9ef4060832120f0e13c72033aacb200000000364356145400088c6ffaedf3b6df131446cfb98f35ad6914b76b05bde9e2b1a400000006866782e83ae96eb068fe1c938485d10e87ea87a80f2d5d0e12c4355c74fcc5f8e979466c0ae610fc3974090da98058047ec69b7c70a0a62a1360cc72a43e840 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000760c576d352d9992272350eae64939dfef5952927f140f6fbe6c96e02e5fd822000000000e80000000020000200000003e23e847da35f3b990c4ba5f89910bc3e4628d86ca21a8692f4ad46dd8946dba9000000014b1dc5bf5f4cbcbfe6dea16e498096dcf2b1ef64952b069bf7cd4aa4a5b99a600cb247fb26b84e9f3bab84e226ff0670d9535f74a427521888f579544832e7d9ccbe2100ee0f9b0e06ec3391862a8992af675bb70e4868967a331814e56be15fb38979388b956ff4327e6b27df052ca83fdbf780aa7c2f19418a8763dd7eb92622e8da815ddb8e72dabdf76098d325040000000e54e257e5a54c1995178a57edf96387efaaea5cb8b102c3d9029847fa58b8c6d64af245bd8ba708b1e8988d47dccbafbee8aca566ee149f862de653fb9435486 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2552 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2552 iexplore.exe 2552 iexplore.exe 2396 IEXPLORE.EXE 2396 IEXPLORE.EXE 2396 IEXPLORE.EXE 2396 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2396 2552 iexplore.exe 30 PID 2552 wrote to memory of 2396 2552 iexplore.exe 30 PID 2552 wrote to memory of 2396 2552 iexplore.exe 30 PID 2552 wrote to memory of 2396 2552 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37b792aacfc4a36cdab46f95b1da7b42_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2552 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2396
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547718bdbe49ffb3bc03e7c410d265fe0
SHA13076f682a336af455ea0746ca0a125a8d09b6d09
SHA2564a885003d627695e43c09e0b8c4fea5ea593089d263cbc11c7c7b9b512d18d4f
SHA5129419db95771f2dadc9bc41a140747dc85b7fe9feff9424c0cccdbc869b24a9d6219f6d3e4c4b088f2c250f963d3df3e2e6514026fcdffdbd7a33a02640e2bf3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538081b4fc71c0ef3d997191fa3732f32
SHA1425c79b26d514b518af8ed3635b60c06dc048731
SHA2564857a81fcad02567fd9f2b241fdb04e2a617825e560a0c0e1479e21c5faa15b7
SHA5121eeed0c987fe74c2a1cf1f33f33c07399bb6a43c79bb9308f81e1b8236f012882f000ce9bd67fcc3314143fc29a4293b417ee320dc4a17fb41ab6dde05153eb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511810462555679b86b70e162c7914ec3
SHA1b9ef825212ee6e84f710db9f7811e3624a122e63
SHA25647ee6e94c9c3b0f00989355e4d942227c1963904c47221df3bdd7a5ff915b112
SHA512f15699fe4158cedcd4b41d55717590e55183e907d9b679e0eaa4af07402d4d8aa2071445ff113a260453713d9630fdd22dc9b33b830572b8e65e618a52231f83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4a2c0ba3f67f8e1ca8a5024439848fc
SHA1d388e1c38f84c46a6cb073d9561c9df8cddf70f6
SHA256f716137d1981d7a52b96094e088c367dcb4087b18221b1956cefe0a95e7500a0
SHA5129b620a73365058ba20bda5e0d2abf8dbfb91b71d163b025d0b14c9576a2f27c71420cb13b2009fe5085aae9961035a896fd9d4236c3359a781364c43ac57ff65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ba9bdd73c561e6d8e181b3e912ff6379
SHA117f2b68f4f2f628c1b8979dfc4d12d71af1189b6
SHA256e2abea005dd9bc4f89e324621adbc910b514a969a9b4152c6d7951467789a359
SHA512367081fd2c1a258293b3102734b317701542aba0996aa82ec0da8eb270a987fcf085ecee4cb0986c0a30115c21ce805400d94aa80e5c90053579d59a2e7f59cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e29dec3c43ac7e9b32a95d37fa924b3
SHA147b502fd89652a228036321fdc8e85844de77551
SHA25684246d7932496cdea3542f30f691d548077ec69a451b5c9086d4805a92fe7427
SHA512516a252b53d4955a49fc363a1b65d0c8dd9786ab0d46e5e941949bd2def933dd14f3b1c5fbeb97f19327428abf998406f7aa66470b374f90dc973aef2b445c29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD532a47bcb6ca5c3c855102027b8690903
SHA13b2e943c427a4d8de187af89b4f30614afe9da83
SHA256821cc586dea3cdbec19de7eb2ea20fc72aa4591489fbf198a190c95bef442eb1
SHA5122ae4c24769a2c3381fa9f4062a9ecded6a2a2310dd6ef8513a137261c0120aa48117af8dbe8b4ce933fbaeb1820b1b049beac747efce13e134aaa8c1a46595d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e766d00046e1bd973241f27cd283c497
SHA1f1351901c0dfcd8db42fbc63aeb3fdb2d40efcb9
SHA2568d2e362494aea407059505f766071205f6cb0e044408a3e54acd19003b222555
SHA512871a69b85b3fd7b14cf204874242d47f984b8791cbafb87d9e2036ff80d4746efa3c9cd10303057de389df2b7b49dc3675f2927613cddfb037b9c064a8273b03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50cbc22739799f24eabfadcddf5d22aaa
SHA1dc137eea68a824b7f0e0a8b972048dd925cc5238
SHA25654d871f3b4e5f42c405021e46aa581ffa9e3f0bc99c8215fd41df68e293751ef
SHA5121c8d6ae0caae8cd28b2055b9098a8ab19ebac026f9231f3b98cf2f1a6a23a547a06ddd34df322872bf79813f6ac13357a3425cbf61042858f5669b825f69a58f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD504033c94dc08d09d5b5e885c036c79c1
SHA10b0c8ee46fc60619e8e8bb60352b9050478750f4
SHA256b0af3feb043706122f6b28024fdea2fe59f5909c4e435470d63f125948a478a7
SHA512c65a19c583a45e45cf1c17e048a94adb6eba6a7650467b5cd72c75171d7abce6cc98ac5350696b6dd02eb61e2ea00af0f97d2c88d53bf7a13c3bfdacacfb9804
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD506985aaea3fad1841c4566c80e8d832a
SHA1d70a4c3f75dda13978e24ea7acf19944b1c09578
SHA25647d0e2bc6bc57e193ef549b956d4a542190161edc2f7cf24cefbcfdc68491089
SHA512f14dc4df4d0bd08bf10e04186ddae47a1023311a03c235e1a32e77be0d297b228d3297bbf2bee87242145cbe82ab21533fea6e8dd06865b338094f58737bd333
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540ea669e8b6247c665f07bfa78f103c8
SHA12f8fb4af270b4c4da2fdf1b6b59ea931ef697ecc
SHA256772aa56f8f76b9c3226ffadfe20e30dc0a6bb7afc05ede2a25fcbc30f3009799
SHA5127d267195d7b28545d7a094c7b26108de656ac5c1440147a316c1da823e9a2f128c32711150d5933fc2a106d01117e1c89c10f258bd731e8fde5e3c4953c11c50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a411462bd243136db9b61bacac8a8eb
SHA1a0ff79cb52fb727456a82a688baad96aebfff907
SHA2566dac0346a0b7f977ccebffe38b1af112e4460a3fdd6abf6f9746ec4517827671
SHA512105c919c476cf486222f318191b2bf512495b571c70dec55bfbfd050b241fdf71d64fb6ad4b212071db78ee14d6c5860bd46d3dc54694833e2eef280c362ab52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e15c856f435678a222b375cc6cbbea77
SHA1e6f4c055b393061f0089bd0c3bab32ed9f0f9dc1
SHA256577489857269457bc9217901a2b2b0e3b83b7fa20589854ba158378308f17c33
SHA5121465b72eb64e70f3b8576db8f03998ae0017cc091f2453c03d65d5e15feafe5ab8088455fd231a0013edbdd0307cb6250fd602efed80a977a182633a5287e00a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579b1f0d7821c585fe9caab0811fb52de
SHA1cc2d0f67e900328aabf2e7bdf0ca245dc939ee4f
SHA256b2a185195a06b3da4dde38d9ccb1a09a82d41ba0f9a925f667f301acf5bf6e76
SHA512bef0273f4d64a7fccdc8e55e6f017d81eca2d712e7377139f66c148f92f16cd5bfc016cc93e7e1c092a2cffc6d8555dfa4ba9c89f5008ec7e1b4798acef401d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eecb3cddd5d08e6344a0dee2d38f277d
SHA1f6928eb4cd9434b7de95bd2a1171a70742de1464
SHA256cfdeecf1e1f7b6809efc013cc3e7f061a4883ee5e84b53f6706f50684f895fb4
SHA512de79e5e7e68aea6e780ac88c5bea2b10a818c218306a0b247e53480aed186ceaac509115c7205e78b5061cc7e43211d0eb8de64ac319fe16008722d05a748d73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563620af3d0674e064f2ddaffbdf49a6d
SHA18a422c0d7bf411230bf13aca6e9d9f81069d88eb
SHA25644f424c3f40d32e39262658fbb61915a177fb71405e37f212d9357e8c2ec8858
SHA51237f15d2a80d9aae29c252635c7eb9842dba3d4838aa3c768af0dd66f40f25b2f599c398865b3e5be6c40379a25a16aebd8c9469a5ef20a5d07a2424abd483e13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5215a09d8ba3b9bace63278f16b2a4b48
SHA111476efd54cb786435521d3415615d57ab1aff21
SHA2564c247c0cb9122090a0eea8505732609eafbf4c7828836c481a45f5e9f8fbdff8
SHA5127fb5ff0e9988676b0366763915cc4f3fe9c81f199c6d5118105868985c11644bb0e14d5c78f9574c29f03273e8f71cb85c641fec3cbb80cd32186d1051a4e349
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNZH54VQ\print[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b