Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2023, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
.html
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
.html
Resource
win10v2004-20230220-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
.html
-
Size
175B
-
MD5
a7eca2913e9112121e5585480b1f7c82
-
SHA1
8202e28c75f97352c0545b1a05d2a902a1c5664b
-
SHA256
60bd258837c33a9abb899bc6d6393da70afe5bf2dfd9b560f47092a9c43ba43a
-
SHA512
f6ceabaa4f567fa98f6758e7605fdf473f4ae0f26b0be1c5d0ef8e456421c4a8b487ed7b6042469d81daf7142eee8cd382a8a169972ea7accf9eb079e62f9f46
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\IESettingSync iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url1 = "https://cpcalendars.mijn-ing.link/" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\TypedURLsTime iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31032160" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31032160" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2075913128" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c884d0db6b01394f84d012a5eedc1d2d00000000020000000000106600000001000020000000c16686e3a427a71d52c42a30c3337e4a4bfec0a0dd9ea1b3aae7cbbb67b3dea8000000000e80000000020000200000004d17bd98c6fd3bca9637673c12a1ec871aa2d4e9a3ffc0aaee7ae04a28b6107820000000289ee39016918f75a11d61900bcb54598fe4927df5e9c5cd469ef7d0a705acc440000000ef2944d5b0e4a3fd2d964938b824ed3694698ce5da0d1b2b65ef4e76cfe81763935c6bf8c741d59f85963632db1e61686169c22a22d5ce96cfec3ddc375abd14 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0fc38786083d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5088eb7c6083d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A62AE229-EF53-11ED-B7D7-660D1B6B73D3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c884d0db6b01394f84d012a5eedc1d2d000000000200000000001066000000010000200000005dd69e25dbb97213d0238a35140a91d551b37327ab9fa93ee52d93279a001f24000000000e80000000020000200000006cb29127fb2f1cd950c399107f0899800cb7dc776dff7ceef56807e432a2363920000000faf53e05506091780ab7b6b4c16880f715815426c9657c1975b00fba6f2b03cb400000001a7c6c0e1963bacd72ae56bf082a0195911cbb4e29fbf22bcca0f977d59c588513056d2b345a764d6670acad26f4ebcb3a08f8e0a7bf520a1616065e05880046 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "6" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c884d0db6b01394f84d012a5eedc1d2d000000000200000000001066000000010000200000007906f60503e94394d1dfdecd6bc286239a2c9a559bf41f24620adc404f7cc3d6000000000e80000000020000200000007ed8c45c6dbc0d0720a2dda389b7e6fbee004afd4b1b02b6edd200b2928bedee20000000e9aa1aeacf21dc9c79a7d6051ec3e85b1e99dcac947bda77924add2797512a77400000004ceecd0698767090a328bf8991c8e788fa03aed4007f4655d547a87dc0a37b6e548c899a2eee3f01a151bcbd1bab8782ea9c5ce059a01b4ae7a8ce94905999ea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\TypedURLs iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31032160" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2065444302" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2065444302" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4054087c6083d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url1 = 489710786083d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/" iexplore.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "173" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 1428 Process not Found 3928 Process not Found 1300 Process not Found 1500 Process not Found 1648 Process not Found 1652 Process not Found 2288 Process not Found 2824 Process not Found 3840 Process not Found 2324 Process not Found 2320 Process not Found 444 Process not Found 3484 Process not Found 4196 Process not Found 4624 Process not Found 3404 Process not Found 1216 Process not Found 1612 Process not Found 4864 Process not Found 4032 Process not Found 5088 Process not Found 4052 Process not Found 1900 Process not Found 2088 Process not Found 4040 Process not Found 2676 Process not Found 4992 Process not Found 4536 Process not Found 1008 Process not Found 4960 Process not Found 5016 Process not Found 4540 Process not Found 3052 Process not Found 4928 Process not Found 1492 Process not Found 1368 Process not Found 3836 Process not Found 4708 Process not Found 3308 Process not Found 2056 Process not Found 4500 Process not Found 2080 Process not Found 2424 Process not Found 4696 Process not Found 2636 Process not Found 1508 Process not Found 2244 Process not Found 3640 Process not Found 616 Process not Found 4428 Process not Found 3136 Process not Found 2188 Process not Found 4264 Process not Found 3672 Process not Found 1664 Process not Found 412 Process not Found 4628 Process not Found 4256 Process not Found 4280 Process not Found 2912 Process not Found 3224 Process not Found 4436 Process not Found 4636 Process not Found 4496 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2912 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2912 iexplore.exe 2912 iexplore.exe 3268 IEXPLORE.EXE 3268 IEXPLORE.EXE 3268 IEXPLORE.EXE 3268 IEXPLORE.EXE 2912 iexplore.exe 2800 LogonUI.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2912 wrote to memory of 3268 2912 iexplore.exe 84 PID 2912 wrote to memory of 3268 2912 iexplore.exe 84 PID 2912 wrote to memory of 3268 2912 iexplore.exe 84
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3268
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3992055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2800
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5c2867dca83f9950d9d908685b04ac381
SHA1327b04524be8ec87ae1823e26543e2043e9d91ac
SHA25606cff94afa14099cff01dab357180dd8496319afa462c870405e0609c4260940
SHA512a1e6454fc48a7430c8aee5b7849b76bc719483171df7a213cc98eb5fe3329906bc7e991a41d8dd7520cb10220c20e0ea3a865f6fdaa6412f20b6a99a6f044cf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD55bffa1b46f96f2f90e26388394069002
SHA10152e28239ac6da8e9d5eb43ef5d3a103bcbbbad
SHA25693dc316c626b691ed1782e230357760ce93df114512aa75ed2c00f83fdde9989
SHA512dd0f7817800014641d7cc18d918dba3369735906dee92db7a890b2460d21134e6e2103f90ee34ccb47ce05bd8ea321d11a53dd84f18a78a8d4d60888ca72a657
-
Filesize
177B
MD56fc7000b11be7a06162d2d91c214f99d
SHA17f6122cc98bda25db5c7e82a876b61ecee0f29fd
SHA256937940ae8b2d87e1ae2b7b3dfa44976266b91680c27d90282451a6f73269844d
SHA512144dbd444f04833ed228ead5ef56f5bbe52a4702db3bf15fee49def387cc190575816dd59910c86834be8694da02f88340403d345597a6e56a389f8abbf662a6
-
Filesize
43B
MD5ad4b0f606e0f8465bc4c4c170b37e1a3
SHA150b30fd5f87c85fe5cba2635cb83316ca71250d7
SHA256cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
SHA512ebfe0c0df4bcc167d5cb6ebdd379f9083df62bef63a23818e1c6adf0f64b65467ea58b7cd4d03cf0a1b1a2b07fb7b969bf35f25f1f8538cc65cf3eebdf8a0910
-
Filesize
601B
MD534a49e0183d1693daeb3c7dfc724c661
SHA12b44ba74ccc55ced7c1f82a47bffce886b29bc26
SHA256d7d9ec0d2f709c414c88f70addadf7f4060028cc8ecc62457c7022e410634875
SHA5123ddba1a61058c5989592da3d6c4652ea02190144dbd7c68d9ef9fd3a12e970928708571400679fbe3a9bf388f868ad31021d5a3fa18cffde6956d84fbb8d32cf
-
Filesize
632B
MD519f99c1980881709c60a5c9ca0417930
SHA103bdbd8ad98a9df6231bd4f416dbc87b860b27ad
SHA25649687e35ee463881aeed39d335d10ec15e1fa5add0322229a78a845164ccbbae
SHA512cea44338d8f9d32df728afa2d9f7b269b48d100fa86bd3613d6687a6e2f39dabf39da9c2936c80582752297e42a24fa01aff0b0a734ec2958cb46180a9405200
-
Filesize
633B
MD50faaeaa989e1dfa7ee3ad4dd1eac763d
SHA1e62f9c88f04124df2ab9f8d6ed14eb329cb911d4
SHA256a126d061ab5b21808d0413ac5d60589210d9f346f8c580320eb28756b1fc35a3
SHA512183d1d546be10a1921c61173f2dbf2b73120b5ced94b806148e46663fd1f2086f09d264aefd16fc4057c5eb0681c043a6650858d2f222c0c8ddba521f3046504
-
Filesize
609B
MD51fd5aa52306c001a4a8d2e7b3bbd3909
SHA1bd8cb2162ef48ca66fdd200d4983e2b97395a0f1
SHA25644914238d605a555957bb9a70f3dde29276fbad65c6cc9899005c9565105b739
SHA512440d4ec88da5f1b90fa4f7ba4153a85d2b741478123aea6743be2ae12f77d7602152e2e2d9d7bf43e505c75e2ff729827e812ba9f3f7021ef2b0dcba84fd231e
