Analysis

  • max time kernel
    80s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/06/2023, 01:53

General

  • Target

    sample.html

  • Size

    401KB

  • MD5

    c13d923e64f4cb25fcee89a4ed999ce2

  • SHA1

    dcfaa30caeb10c57189a80a288cb65f190fcd2e6

  • SHA256

    8e13011f21fc59f47e5d9fd852f7d37cc9a48ebbc7158d6039949867f4266676

  • SHA512

    f470fbb5ccf71ea45d6adc1918bb9a084c7f511dc2b8291c2c1daa709275a8cd5c1d12b8fb245de3af891fb16b3ecce8c5f655fc140eb95e904beaf2c63f43c0

  • SSDEEP

    3072:LZ2CwMzdDWjhfoOMKQRCErxy9Y6zcNPPeGMMZD+P2huDdOJV4gisN3bC:N2CwMWd11Y6zcofMZD+P2huDdp

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 40 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:64
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:64 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:3772

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          471B

          MD5

          6776a455f2fbdb44133158e334a7de52

          SHA1

          1541ec3ec2ca8ca3a5b20bb69e2679e039729335

          SHA256

          c6dfc43ed1702124201722fb4f06d6d394c9e6ac34f371a6d186e409fa7b4e07

          SHA512

          fdcad566b8d11ec78e395d0593c3525070e420191ee332e0ab348c3f584a01c9bd10ea8c9bf727cb0a8e2e7b4acae51e28e024bae72d66b50a9e1cce1b1dfb45

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          404B

          MD5

          44c1f9e4877d91ec33ea975bf0bdc6aa

          SHA1

          f4415c315b70e7fa164c331dadeaea944dec77be

          SHA256

          4a22641f01f5a94b6f122692ac1b2749a1e6352d038b558b541ffcba219cd4d6

          SHA512

          c7284886645b7f3be4243c4f43e86d55c4cfe29e04e234330b7b2b79fff901bc9c03a4a8adad78cc163baa9c28aec8a7f42de1e2df58b36966c6d93c16307727

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verDFB6.tmp

          Filesize

          15KB

          MD5

          1a545d0052b581fbb2ab4c52133846bc

          SHA1

          62f3266a9b9925cd6d98658b92adec673cbe3dd3

          SHA256

          557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

          SHA512

          bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\cz9baam\imagestore.dat

          Filesize

          887B

          MD5

          1ab98d1125f72c6499e7d0c40fba54ac

          SHA1

          1c5e963a03dc64323bb921be8e0085f7a23c0817

          SHA256

          b62dafa33c0f6c4c2c9c4aa1313755089d88376e2704e71b826c5ac727561625

          SHA512

          9abc58d1651e1f63e9289338e3a451da4ff5e55a2b527a3e392080869ab6df8ea60eb96700f2e33254cb4fe52770d733aff37cdea7123db00b789b22c569ff9e

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\akismet-frontend[1].js

          Filesize

          10KB

          MD5

          94bc4228bb5941670e191e40a6bc44bd

          SHA1

          ad06418894462185e7eecc1421310f552e1e5e36

          SHA256

          5734f1b66dcb622529d435aba20990813d43553f949bc0813719b4e7d1252527

          SHA512

          f358edb2cca8ea1166c2371213150d32369c30f4e6a6c29e64a41bfe46fe48d54cc09609f83fc37880f810e22a84d40c40de9d31f17236a6a57cd3d7762beb27

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\bootstrap.min[1].css

          Filesize

          215KB

          MD5

          5b42276b3039eaf18cc199cb4c8db7b8

          SHA1

          719956aa52db4c8afdc5c0cfb3cbdead6258b8a6

          SHA256

          932ea15108928991bcf0c0a46415fc652de5ffc0158c35205357b90c65eeb386

          SHA512

          ef639578068f795f27dc17598fb84e91a3d2124feec290e4686c8fe16da34b3002f2d7e23b82cc1035a82f7b85a7999c66efbc11e85be06859585c2faecb3af5

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\bootstrap.min[1].js

          Filesize

          78KB

          MD5

          e8890063e097beea88fd37621217af9c

          SHA1

          bff78dd9c02a5008ab43642948739ce58c761b21

          SHA256

          061f0b1ea79e6e2ca24f4603e55d3e909f7471ba0b279cdb6dea40554106c6a2

          SHA512

          49cb7f2c24df928aabeeea665fd559284cd7b9193962e945a034ee9c66a96097650b003e465e1186070f08b7fb6b04cd2e6215aeccd33cd505bb83127ac7a9e5

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\email-decode.min[1].js

          Filesize

          1KB

          MD5

          9e8f56e8e1806253ba01a95cfc3d392c

          SHA1

          a8af90d7482e1e99d03de6bf88fed2315c5dd728

          SHA256

          2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

          SHA512

          63f0f6f94fbabadc3f774ccaa6a401696e8a7651a074bc077d214f91da080b36714fd799eb40fed64154972008e34fc733d6ee314ac675727b37b58ffbebebee

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\index[1].js

          Filesize

          12KB

          MD5

          5bc2b1fa970f9cecb3c30c0c92c98271

          SHA1

          7c6bb87aaa24714b7b3b3c86dd932736a80270a9

          SHA256

          1060091178cbd6c843b802f516f230f1a3a1e85f1afbd6ef84d80e5430ba457e

          SHA512

          1b39c7152e6561c6108a36e5b89a635ce1ef883ef683b4fb4e58d32bf2a7f415fb1df4695562d2e8acd85a3bf5933071294d5a1d162993930a5dc7851b9a5ed3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\navigation[1].js

          Filesize

          1KB

          MD5

          6e26dcae5f37cd7dbc99443304d0d4b6

          SHA1

          1149f4a86285fb1cbf08f3748659368410be6892

          SHA256

          ee2142d2d84e169a6f92e80040206a8ec7e7cd466fa0f131aee972c4ff512a78

          SHA512

          d2bf7eced880963c5a72a77293658ae76eda39b246a55d703c4453738f42af333e740c829e27d42e4d707d33ba2801e9e785165810eeb0c43db3fb13a26ee77c

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\responsive[1].css

          Filesize

          245KB

          MD5

          0eb73b60b2c85f56c0eeaf18f6489e15

          SHA1

          576d70c00c54b3eff3104883c3e3c3d99892ef43

          SHA256

          ddc74d61d9824f19370ac6d480042f71a9b18b122f126a8fe923c4d00c018b5f

          SHA512

          abf09519868068950ea8798acf438712ff892ab7d52d520cf3b7fdbd76f9fcb37643cf486dc7bd92ce50b85a8a2ee677c0082afa0f5355e85ef9163932c29301

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\style[1].css

          Filesize

          13KB

          MD5

          906197b79e9ccd43cb36c8142e917320

          SHA1

          25d2b6a526e5cd0214e53dba768d514019376125

          SHA256

          1ad61a444f0e4830262101e299bfd0e64eb845afb98e4e88c1c894ad4102da73

          SHA512

          dd9828753d07a53b9d6a4b67e68349fd3226a1c7a41e375795387aeed3633d7696d1ec0574fbf477787e30f56f4065a6bbd5e648dd4a41c59b6a4bded73555ca

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\style[2].css

          Filesize

          328KB

          MD5

          8cb3bc5b034446080698ac1ab0bd1d7b

          SHA1

          33b21534599093049c9e3a433836a89b69043f3f

          SHA256

          c24fa9a608fdafd92321488a4462cecb809ec2d57e80b07219f1f590126dfb05

          SHA512

          38cd5fbf9b373ce7e1ce827b4425e818a6daddb141316c4e0107de23b35e10dbdc72424a24021826c49256bfb599dd081338d44976f4197848bd4849e3e975ad

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\styles[1].css

          Filesize

          2KB

          MD5

          0e4a098f3f6e3faede64db8b9da80ba2

          SHA1

          65b9b3c849f3fbdd783ddbfb183616ff55c7ee53

          SHA256

          ab21762c3f447aa08cbefd5ea3866165f925bd5058a9ae19e23721462de6fb60

          SHA512

          47cf04b377c4d5d512ee93439d17d21f6e0c5011e3cdc9ebe2835c91b6bfe7d5b3e4e23dd8c00017d7b235d08a8524a103edf3a199c8b1d5cb9a182d8d5eae73

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\api[1].js

          Filesize

          884B

          MD5

          5d0d3804c517349c3ba618dbbcbc8cf3

          SHA1

          0de59fcab1c008d7518fac6df9e54af32a88278d

          SHA256

          4406308fb6a284941f5f670437f13ad650fc6a9ddda47af8f9c3ac999e9e1a35

          SHA512

          1a42b8ae125ded66930dd54eb17b786596bacdf32c4bc8a878238c2d32ac23735905ac19b5010a8ace9997326ebafb0394eabdcdbff85e7163b174033109ff3f

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\gtm[1].js

          Filesize

          180KB

          MD5

          b336a70a42444082df81c909103c1ec9

          SHA1

          2907bc64b0e41f086be9a523e4b7a3b1acee0e03

          SHA256

          e6bbc0f3d508fd3c29e3b6a2483ec9c526c27affe539eff350869f3791e80b47

          SHA512

          8c067b3265f385ce56d6bea88015096fbd9f2f881c9016c90723591ae28362cbcaf99f1b587e59283fafcbf2ea21f45594f75652c69d324268dfbb14517d0abd

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\jquery-migrate.min[1].js

          Filesize

          13KB

          MD5

          5cfa2b481de6e87c2190a0e3538515d8

          SHA1

          0fccf3c8ab2c10b4dcc7970e64ce997ab1622f68

          SHA256

          9810aee7e6d57d8cceaa96322b88e6df46710194689ae12b284149148cabc2f3

          SHA512

          51c4c1dbaf330ea0f6852659cb0fe53434f6ed64460d6039921dd8e82f7a0663eebfb7377dc7e12827d77ff31a5afee964eea91da8c75fa942acf6d596ef430f

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\recaptcha__en[1].js

          Filesize

          407KB

          MD5

          ee07ba65373413be83ec0d45887c2a44

          SHA1

          13646acedb5d781fed2599c46634b4e58b8217db

          SHA256

          d946e8f3fb4fe90a5ae3027b91a76703106e2c5c1d762fc3fc230895db7b6048

          SHA512

          06dfc548a9cab952ee5596475ee9a8f9794564aa457c6504a34061599cb80d8fbbd02ba9b2ea6e36c1d285d99065aceae1083439f413739ff9179af5e0b24638

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\svg_animation[1].css

          Filesize

          18KB

          MD5

          0c252d51b9d5f7d3ca5c29e90a67e06b

          SHA1

          61f456a122664c21713a7901c77a9ae896f01585

          SHA256

          88565542d02185c70b75c808aa2e36f8ee016945895d2743901210969f40f0cf

          SHA512

          286cd5a5c150dd77b4bee1234b29cd783736e0139eaff89792d51fc01daa5ab36db48eb7b73880203ac8b3318ed68f7ac54e43c20b3da8daa3c643970ef79c40

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\css2[1].css

          Filesize

          1006B

          MD5

          c8a0e22f2cc6133483821d901e413cb3

          SHA1

          11cf62e9fc9c3ef830a472415e3d441d839ca241

          SHA256

          593608d10d6ee965a0673aaed40031e78635ca50db4cf225c0a948fe7ebc1e23

          SHA512

          b39dcd0741943e4689467165307a19da1087412ce00c6db86936ddf69e184c12aa5119ee1aa6d5baff7465096dc95287d917d9cc729c3d8e578915785af2aceb

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\index[1].js

          Filesize

          999B

          MD5

          6a0e8318d42803736d2fafcc12238026

          SHA1

          c955314a7e0a9a9871329b0f042c8f0b5df49a78

          SHA256

          2648a1333fa24d383fd73a6beaac17156ae78f4267ff7407ad60e05a788df44c

          SHA512

          cad30d4a715a90fbf19639cc5278db3012196cd77937cf3787d5afd3a2839dc839784bb611336f5696afb2859759435ddefa237e7d2f25716fc1ff3601aaca50

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\regenerator-runtime.min[1].js

          Filesize

          6KB

          MD5

          9a4f28a615173df36cb84be2b345816e

          SHA1

          f709263841708d9e40268f24a0072ff4fe811b35

          SHA256

          6974bfd8fa06b7831f05cb4b25860c851a5ad3f02a6699ebe688987dd7a6ebe6

          SHA512

          2685373f6522c039f17123683dbc4a2d6eaf572bca72b6019b7fcc9b15b2aa295cacab19b99a1161cc3e317d6bdfc3bdc2bffbfc87d9ea9086da58a013849910

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\wp-polyfill-inert.min[1].js

          Filesize

          7KB

          MD5

          dda652db133fddb9b80a05c6d1b5c540

          SHA1

          60c8514c57a5db2980c4b046b0dd479bd427357b

          SHA256

          c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4

          SHA512

          05cb3673448a79aa81887c60a82aba51f9a843dc13ab4fc39b3e6d8ae7d632732d9afefaf72fc3d197c2795a3364fdfd4f83c9b628644d98f1c9017bfd435e62

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\wp-polyfill.min[1].js

          Filesize

          17KB

          MD5

          e495a4709e3eae31c67f8263f25d2d39

          SHA1

          d43ba6a092e4823a71f3bff75d5ed279a481636b

          SHA256

          1c1fef6e6b4f9832603850b9b6562e74d9a6a3700ba836efe88facc577121e8b

          SHA512

          3c449fd32adf12ccd4a0435498ef9a5276cc73d1fd66e2faf9abea92a379cc8852341df18ceb7c7b3c3a96d16ce9f10a20e337025976c1cdc037ebe5410b1bee

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\classic-themes.min[1].css

          Filesize

          291B

          MD5

          1a0804b1a9d09705657f91fe7cad4c5a

          SHA1

          feeece6f0b3e0bcf090547c475329a2772f6b26b

          SHA256

          dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48

          SHA512

          9bc7a9fe6cb51765537f21a79f015d1de49aa8b1de2613e072c5e108d88ca1877df320c80842ee7c512bfcd29b9166bdc3c73919b267dd8a20c1962275fa1738

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\cropped-aglowid_icon-32x32[1].png

          Filesize

          665B

          MD5

          4dcaf0f25121d2cc455e5205a46c50b2

          SHA1

          63f2a92ee27a447fe8b9ad12a8216c795a871d7a

          SHA256

          1569a6f3f84f4edd0f28a18e2017fdf164986c8d85c137429e8bd9235f670b33

          SHA512

          e01646b911f5e196f76903632a925ae43d89ebe7677196306f69a8d40ed156c7ea83cca67e5bd260bd3c09648c0c8b86bcd6c3d665a300bb94ab2aa1c90813c7

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\css[1].css

          Filesize

          978B

          MD5

          a67e3870d12778038b65c667bc4aee7b

          SHA1

          71e5cdac3709bf47c15e5e895391e818f964abbd

          SHA256

          e8b148257108042544c86417ed8c6ecbab4bf8847a44d9e07e8783c9cc57db1c

          SHA512

          080f25f3f5cf5b00338d47406a67564a70948b0e19a23fe1143cfbbbb5ab6526d9ad7164e4ca975a17e864e924f34da71dbc5e16a3fcb6b34801f5f08ae05a71

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\index[1].js

          Filesize

          10KB

          MD5

          7be65ac27024c7b5686f9d7c49690799

          SHA1

          241ada4a86443adc5623d1a3a8018a96d9de6d5a

          SHA256

          52db930f81d97113dde679cac624cb5435b56d4ac486e91a0b6692d2cb615a84

          SHA512

          bbe6373705c81da5c7c3c132583338b875ca76cd5f963dfba95195bd8e2710e819b62924130f49b04fc0ea07e35677580924575d62e8cbce75d1644ce5f96d15

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\jquery.min[1].js

          Filesize

          87KB

          MD5

          0e850a69bc7fd0acc2e92ce6eee87959

          SHA1

          8be6d9e7f7a61ccf0b8eac8a8144d770b608a19c

          SHA256

          afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a

          SHA512

          0f8a4fb2ea15a93290778a55c701208c9245193d8c910f47f26bb245b0a3f6d6d91427a1857f98c3632bc3feec5c0b83517b46c1fa1817bc3bb33b5ccb9a11e3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\jquery[1].js

          Filesize

          94KB

          MD5

          0fca26b5a37a66d68d0f4406976be4b5

          SHA1

          ee000eb654b3bd37185665d3901e93b34ce1aa52

          SHA256

          8c2812ded6436715279f8fd8db58de307aa39ab0296fe3cf0e879067c51e9b18

          SHA512

          cf010995991a8f8b50cfb4b466d3b457b0a6addc4f2fd96c48c33d40ac251de400894828ccd99662b13fc9ca25c676ef0aee05faa4910530ff9996d03c411645

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\style.min[1].css

          Filesize

          95KB

          MD5

          47cdb0e81ea341ad27a1a0b0ba6b02d8

          SHA1

          6195a67b0b7f7919f07309e2c8ce71f3d4729d03

          SHA256

          aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4

          SHA512

          1b2523fcd9a315b111730717c88ef597081bca94601d9b5b7594d693b61293de6c1fe9d91e322daced1bcc611f78fb375d9f7caef603418d4a19769054248caf

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\suggestions[1].en-US

          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\swiper-bundle.min[1].css

          Filesize

          17KB

          MD5

          8fbdf4ce96211052d13dbe3c35baf3a9

          SHA1

          0f2792cfffd6ce65ea90e07336587c72ad309828

          SHA256

          55564d0504733b999d0cd481c189881f733b1a5b2984a4629af62d8cc495d895

          SHA512

          63573b2ac80c36d7fba4886b8ff525d8b86eb4898562bf93b029a307c986024f9c806d559bc53583bb6f7e646beb20f99ddb34dd081ce8c71bf3a3012aed4b96

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\swiper-bundle.min[1].js

          Filesize

          136KB

          MD5

          36d6a8a781e73f708975edfc2809913b

          SHA1

          152311d09dfab66646643fd1fd03364a9b4d4ad2

          SHA256

          2c6da2b8945cfae44eb209ac3de3e763d3405eecbdea8f749710050fe321721e

          SHA512

          fb3eba3ee30ffde79e98dd8c81184fbc8dc6d7914e05bb29e4d702241a2383a75904414bd19a22d0f1069218ee6c471017b3751294d7d792d9bdfbb0f848fde5