Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 18:56
Static task
static1
Behavioral task
behavioral1
Sample
6463f8f6987ae54cb77c63a93cab7cf9_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6463f8f6987ae54cb77c63a93cab7cf9_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6463f8f6987ae54cb77c63a93cab7cf9_JaffaCakes118.html
-
Size
57KB
-
MD5
6463f8f6987ae54cb77c63a93cab7cf9
-
SHA1
8343037f4e13f16a5e1709f20cef10c7f295f5b2
-
SHA256
5bfdc6f36441ba9090a29cf88f2c32f4049f180146f995e0f683b355e57ae0a2
-
SHA512
4094c14f0a6dd38bbc80b73604ab44750bb63cc12dce788ae19164d17b7113bf1564d14af351d0a15bd1acf96d409cac6f79cd1a98904d2f7ac6614b5a8d056d
-
SSDEEP
1536:gQZBCCOdN0IxC/rNBfffBfafYfBfzf4fcfLf9fSfqf6fEfHf4fWf8f4fqfMfYyfe:gk270IxqXZCgZrgUzF6yycPAOUwSUQyG
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000004bed3b3167436603dc89d107d41c3d55fe2578bfab39a48c30612c3a7d56cbf5000000000e8000000002000020000000f73a643dec60afc08f5539f58f78944034f93997ca8774bc66a4a4fac3d5ee3020000000ec4ef21465f2eda1218f36b52f3d025fff37d6b3714278466c4ab5aae472b9fb400000000141a905784adca0f1d96e0977c3c355c0b4db11b7e02738ef59e0b420d3c9cc428708df33a235773fba0aece7275f094389d4fa79099896325423cef64d2337 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427837933" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A63AD81-485F-11EF-A173-7667FF076EE4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003cc4616cdcda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000653d75fcace2a5a3fbe6e8b83d5f74060434736ba15683285f120a8adbe90698000000000e8000000002000020000000fe1452ee7b5f8feb7728f250f14dafa25689dc5b679a64ddde6971e70b98c68890000000fddfe3f7fd0c3950b642f064e4d26419e28f4c745d904b65dcbf745436e6e0e2e443dd0ca498d1b02bf26ffcb9d943010bc0ebdbb5a52f6245fe0c32ab4bc50daa1abb55c42345ce7202938d3b6eab99d14be58515bef0c6871d79ede1db7a585b5fd40c56fb889a795481363e4d28d6515fc5c4936d05b409ed2813baf0f63986eb964ebf1482e92be7992373aba7dd40000000d0826527f12ec1d10d3ad21029af9f6d9c6242ed86f956ddb184310202f7635da75a2cd71022f0ee3f71660526794bafdfde608c106b516c90b20e4314bc70f2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2120 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2120 iexplore.exe 2120 iexplore.exe 1824 IEXPLORE.EXE 1824 IEXPLORE.EXE 1824 IEXPLORE.EXE 1824 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2120 wrote to memory of 1824 2120 iexplore.exe 30 PID 2120 wrote to memory of 1824 2120 iexplore.exe 30 PID 2120 wrote to memory of 1824 2120 iexplore.exe 30 PID 2120 wrote to memory of 1824 2120 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6463f8f6987ae54cb77c63a93cab7cf9_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1824
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d8097eea957ca9ecbd320a9442a9a255
SHA1fd053d3f065b117a3cf512b1188e16baad56a293
SHA256dc9f5ed6d2883808f6101d6a741e4ef88868bf03177f2cd62c4ad420d0a975ff
SHA512bcff4e90ae7fb17c3d0d1f6a736fd92a3da491705bcf65afcf68727a105f39fc1a9321c19a289ae6553f909bd06d0b38530629a6b7f91bbf4299868e4bee90ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cf55f48bac8c02085f11a7b4c9f76018
SHA162555ace0aae31160518b0ccb7b73ed793d2cbfa
SHA256c988a377d0ca9a27efe240489f67d49e6a07eec018e720c979f34ebff2a772ca
SHA51285c95c780ba3351a6c5a62f0f1b21a8cefa372f871456b72641c3a85d114a8c071911107aba2a327d0435f0118ddcecb64b1968bf23ef8c9928509dbdb2e0abc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD519348f95c48e46087c90bbfda488eb54
SHA1abb5dd563bb07f3f980997a264b277a344b44105
SHA2560ffb0355a0fb903dabda1f01e3089b241b1fe30340f885b66120e896204502b4
SHA5129b34733782d851a388673eaf49dffa237367463d000156d95f3c9dafa4b0715267397b80a418f0218d782fa513b0e8a08bfba9485245d36dd3c9923ca8aadc48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5db2bdcce5ddf3d095a0e8067ca5e2784
SHA147daf0c223290af8fc0ba1cdd50f7e35e116b538
SHA256e34eac8a2047f442508d31e248fbb4b6d50ae80a0a519d5fed6abf6422bc6007
SHA512028d69fb47e324f9a458532833eab204737e3b32b74948e89407ecb97cb70fb4dd64b0b9bb1fb3b92b7d10c28bb8671e4a4c6846e9939e717eef6295eb95fb32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51e9d940960f9330b0947ba38b821d1f8
SHA1af51520968fc54c6d7cea00ce4919f7de45bad68
SHA25623187db50db70878e8e7f30f70d7a4c1f86a72c2efc053fa438ade4b5a6f9d78
SHA5124af5f06680c68ad08b21d5316d3b365385b90ba1890d55032dd769bc6b9446bdfcd5478ee9045631f67f4a58fbfc4b30eb93850796dec92c1dee1a053a6f6ad4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5232ff231c57f6411077551bab39d3144
SHA18ec7aea2d537b0fffce8f24c0a2fbaa570b4a81a
SHA25653934ae0ec8386687cc1247937c0c3fb394911f40635213279e7cf56155c709f
SHA512aab779d1006dad18ea85bb1055f5dd39f0b2032e758d80e653997e6b346f1a8356c7f2791bb536acf6cdeb8bd68a0de5a63b987730864e2db14787721c5f2a66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f1ce758028ab3bc1941ef211186b415e
SHA14e2b993029895e55cc4bc7c3fd3d9494a2449767
SHA25689c4477de4c451a43b2da00bc7ee4db62ac471242f04e743ddc72642408bde2a
SHA5120845abb9d5e282ce56bda9ce4ae6d4a29210735afc283782f80e5ff50cc2706497b0d6f4e11821323d29fb63b02f2d1046efe06bce5dda2fa50842130ee811cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD586407d263361adfb181c547e3ea51208
SHA18eca5dcba96a0bcfef1e6a231c72a00ceef3de61
SHA256bb66a6d89e3ba6bf8e12d6b42f4c91d10f0cb34650d26c6080d823145394129e
SHA512b94840bdbf2bdacb565ce6ffceac71c801c35b7365b625b188269ebdc7e2909244946bc8de38a4045997bc661fac341e9f25895037c6eaa5776cb8c7d95e1509
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ddc237155fbfa0e588bd9d9fd4a3b251
SHA1074f3ff94e0bfade01cb833eac49b16dd1f200c1
SHA256859ff71c226c284740b36061249fcb6681be10c1f50afda919ddda7e578abfeb
SHA51237c9813a6d5c322baa83bfb9b1097754a9859b7bf0225d3c168cc8b359aa35e3c0abe90dc91e28b82230965807b9ae18bc8a65b013919c15d84365aaddeb6529
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58d7927396bca5ecb91b3daded0dd3451
SHA13ae38068c35b78aeec010a2eee1cd180d1aca4e2
SHA256dbc305adf9f42045e1ff31f241cc3d58c610a3734a3297c61a0efefd9af1e0da
SHA512e65b8dfc1b015d2d6e408eb3731ec26c78dc84db9230e8e9ade5906a05b58ba3542c054b6298ab58c913bb7c3c07d7dc1dd36bc732ba685f91d9c24723e94a8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b2759210f338e4d12260ec59e6e9716c
SHA18b318014b34a60d3c94b18bdb4c4871639ff2f28
SHA2564cb1b06e9d14f69b554f8e30aedd83c3008e2a59cf8ed462ced4ae9deeec08ef
SHA512120dda9f75c466d97d0304fe002aea4afc00f17488ec94c4e6e5cc09803637a6956ab85c6c7f4c80292c22ad24d24e783ee46d28a19ff8b43579035215ecf396
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5db8d24ee29cd5e39987ac0239c9a1ca9
SHA1455bc4b57e05531df755f747759f861e482096c6
SHA2564c2d4f39cba3b54e185f61c953f2bd96db05de5afa4c39b44617ee8ca3af37fa
SHA51296a09d0d0e1b27e97c22ed978e7359d28ef26f73c594429947ab5101c45e75e57d7819eb90dca272adbe29ef11c3749231a4b23057e9a143cfdc98b1e2989c37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD574d13b2e639f9402653615f60a597c7c
SHA1d187c6f70767a87f387b1f4c036f86abd350eaae
SHA256201ce502b5e6d5fb811f9e11fd48c48b9722d525b0ca001b5f1119d434885874
SHA51270e672fb41f4c3d937e6fbe482b44e7ced055784f85ae366f5770e0fc3720700415e0a205c9f7045e5922974b6e647077d7afc50a6dcfa0c069acb16988dd4b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51638c1bd65b4f626d4380134917407ae
SHA14f719028640d62d373aee462242f6b5918a8748f
SHA256e0ed65da7bc79498899cbfe38ffc474d486c9c48b6db1164f6d4b8788d8ed762
SHA5122a0f78515f9c9cedb036ba476e40b6c2e16924cf1f00472fb3f7b73ebbb30a4d915ec61dccd805542077498677f9a111dc2628df065e2047ccf9a821e1600db5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53ab70ca5f97c40a583fdf1094fc6edfe
SHA197a065f490d2348941b36f3d92daac7c3e0b962f
SHA256344662a99ba20a0f6f903d553d1dc2b7c3b8e19b4e42e7b6d8f18cb0f37cbecc
SHA512a98b0491de32b91a2617a4ea8dc5661196d126ad75578198b0490b80458307a919a468263a96a5be958ea6e2d4a165d5a5ad14bc4cdbc32bd1c97a5fe284fdd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a74af8a43ad958097356520891584dd2
SHA1dfcb4e410af9d9c74c75d71e87a5b626c044daf9
SHA256a1b8332fc6fca27b16b074f4067a5e6853baffcc4c5a4c2b110fc2f84544b187
SHA51212b131e28860ef279d72c2155682aa5364fd499dafa8e3d348b3d2e76210fe9122dbfcd2546324d94dc934338cb49ad29d85171267fc4b33ed313c0f040224d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53723d8dc02a944c0b70c3d7a24d44043
SHA172ba69b040e27d6b83ee903bea3fe49f6112d30b
SHA256ddd47d81be06339d0c413677c95f518717017f6029d49575d6b1f433318bd2da
SHA512681f1239f0812855a3c6c5e62921761ed18ed32d8d6e75b7663498c387a6456c8c2eb6a8377c0da02e0cf3afe5c9f48d71f6e359bf9976014cc454b3401b1dfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59690011fa7b6735746656227f3947538
SHA1eed1a512fcc67aa0630c8bb3972943c89efdd668
SHA256fe680ecf5b5b8664f80a4a5bcfeadb6d1c18fbeb233bf1e8b45a9908c12940f4
SHA5120d84e2b53c41118b7bc033bba30f437b342a7fbb91960042a261008b98c49ce694ac15f0c9ec0f885ea582224f05eb5e0f9aac5add677c6a869b0a880d2fc081
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD574776797bb7f41c549b78dbfaad00d3e
SHA183027d6ba4aa420db924102830b74322d18226e0
SHA256dfc3eddcd55179412336d4452cab3db1460eff119821914127bc9e48bb1db9e6
SHA51216b0bac7fe26a0cd9ced038ea4bc59da0938155dd06cf645f63020e7f638ba7882d47712737311dcedcb465ddfb9ee1f433e63d71b60ea9b5608b367b594ece6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b