Analysis
-
max time kernel
145s -
max time network
186s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 02:42
Static task
static1
Behavioral task
behavioral1
Sample
4d7123ab2f33bba675e9825d4720fc47.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4d7123ab2f33bba675e9825d4720fc47.html
Resource
win10v2004-20231215-en
General
-
Target
4d7123ab2f33bba675e9825d4720fc47.html
-
Size
19KB
-
MD5
4d7123ab2f33bba675e9825d4720fc47
-
SHA1
8c0cd34711a39be5bc93726e178a29c5c64937d8
-
SHA256
e478164ef68930ee2942f5769d9eace31ab0590f81268fde86ccceba698db460
-
SHA512
70c4b1785f16189853b635ad02cb3fb591b6ab1d4f2d21e19fabdb2ac360a2c303efe3f6b51309e541e25baec313ab809dbdbe482d00585dab985f849dbdfc3d
-
SSDEEP
384:hQAcpuJLbiqhLko939f2VanNDgPzmJOO6ISL2V:hZcpu5bEoPIY1gP6EOF
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000004dec7b13c3d5d53745167d07f03476cd0a603a6c50255fcc464c6f638d218057000000000e800000000200002000000058ce9fa0159b22095e3cdecfdf13f693c9b52592cc44755eb41208fd966ceed020000000bfc9821ca74071a055e3491b2b3a2549af91997ba14378fdb94233eafb1798ac4000000009b09304be17cd7deb2602f4688256115d5adee8f11f1dffffd732938d809ea2b377b5c802bd959da59d8848721a3e0747ee45aff0d79e215f1d5050338bc9b3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409814485" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A664691-A473-11EE-87FB-DED0D00124D2} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000ecdd8f4fab39338cb00b71a62d719597337c5ce662007b022e01ba1587527123000000000e8000000002000020000000c45d1df42941e0d0913f5b9c0882223bc50c21c63b36d4d54ebd23a51751d168900000008561fee9a12032332ce002d371e2883bcbd9bb1562b200b696cffce529579167972fe9d59e05488aefd4c3256f17085c5c65cedd55cbd2e21436f76321ccc34a80204789b5c2eb64246537371c60e4b78704870e045282c625f65fa5c484010de89b44a9aa9051e37e1e0b5ae13696d12d288b02012f92e34aba32e08a528fecce36a7a2fc740e100833f142470c25354000000003dbf80e98f08d70856b77871a23cc05ad05fbca4b14243758680c7893781be9f12e49809d49f56ead97f8c24ef885e3314c27604159298c2ef569af69d970a8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d7c74e8038da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2404 2208 iexplore.exe 19 PID 2208 wrote to memory of 2404 2208 iexplore.exe 19 PID 2208 wrote to memory of 2404 2208 iexplore.exe 19 PID 2208 wrote to memory of 2404 2208 iexplore.exe 19
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d7123ab2f33bba675e9825d4720fc47.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ef399ecd5d54fee977c6427202c0ece
SHA15a84ecf4271f4787fc8be5ac561f9931a625909e
SHA256c96d8e7af9394291436acbf1cbf4b95ccc38b17823a031530aada616be32c45b
SHA512690b33e2e7c6da794eb958a5aef22a4c6441bc54068bbb10d967a7d01f02ba311d3fbd3c31d0fba8097eaa3b992e7561742d8c7050e0f9dea178a6d8fec69655
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2bed9ad75339e4daad5c43e9b33a0f4
SHA10c28ab20d4eb907be84842d16ee071224fc1b257
SHA256c0212bb97b55dea352323a38c3768b09a72e54a1b3929bb6c5cb5a036b0776d7
SHA5125faf5fb070577b2068a919043130c88814577a1ded30facb9f885d46d5bc51a60c1fced3db4fac97c2fe6608eb1d77ddf5768fb23d9d24bc9e836096fd98a060
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec89b081f959b25ba57f4fd970e602ec
SHA1d3599765219a833843c71ceb8c595e21cc31850e
SHA256a9fea0e6876856e23372b557cc37d052ab972b8df4478e6801520a5f865c6428
SHA51243b50fa2c306e118076594ddeafca3919966d5a6758af7b4cc2896c37e1f129382e75bfc7571e4e5855ed8d068e5f18b80c1ad07e5f5021b1897f758312df9b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a58a93ee82f78b7a09cedb1c53b3fc8
SHA19598d34f9061de90cd51fee539b556254d583a16
SHA2567312bb22fdd885c28992724ebb1eb363baaf8ed99f659bc167d22c1ed251f407
SHA5128102991bbc27e948582197b14356c55df9dbc4171793e9b275b48d5e20b27b48064df8a5918d6d3a4e180ca7015a90ebfd20dd03ae4c2c93db5d5d62d1a48362
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5309ded5120ba022b7e92bc0240cf93b9
SHA1bd6a349003d2f1f185b04dfd2c202a0991294423
SHA256947a375c29fb8b2581b73f387b8a7208bd85d2029780fda6c6fc62ddf9d8572c
SHA512d3ca5b4e1f2a3e088926dbee2c805487359c90d285ffb924642ccb9f15f0bca59bd78a921a6fa3f6571855269dfe5fe0b624245d3b3329ed5c17b46b62ca0dbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5103e81f593575ebe9ce8f4c57f5db5ab
SHA13ea30f101a2810e75c734a75273d247d1d53793a
SHA25620f90ec9cdd071600c2bfc8456ce97055c178e459b39b307811db01f95b7422c
SHA51238bfc0f94346cc11df2fe67dece4726cf853210c7462b754b94701ca2a47ca6a078ef7275c598166e571c97ea1eabd125274e25968050243b8f08c9879305433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c80547305405e0916b0a3f415d9470e6
SHA1f05b3e9d489d09d8e56c805c1431c7e1cde0dd80
SHA256c9d44915cde6745f2de05c97ac13ea24b65ae23f57817bb71834a3a3c045c03a
SHA512bc5bf5d9790505e7ad56aa4a61b32aaaab7e5bed3629462a6f53cb158ad56fe7602237ec0d06036e6d66dbffd457acf07684ce99109907494c840b9cf5bc09ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b4418a1c8e00255a18ba8128e2c4f2c
SHA1a5fa2da19b4cf0698fec193d3ae6727cb72eb2b8
SHA256e45edad9b12678f23f30dc889f4c20bcf707d22b1f5d4cb14f02bcda4d7c3feb
SHA51269365888e7da1c9193882b4f9749ad0f953af9bedb554a1fbaa150cc344015fc8571ee5e9733dbc905615ab534064d76b18c710389124b702d4f005560d65727
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52491179534ac7a9afb30e94abb0146fd
SHA193b505bacc006b9aeddade9873fe6f6c65c7b57a
SHA256f9312a6b5a96ae3454bae7dcae9d9814b1de3b595dab0e453469bb072e1635d7
SHA5125715d93c30af34d5338ff75518555d22dd8d54c20c7e38f637209982768bd5bc7b8fcd031bcf0b98f1bc36dcaec46eb936965daf9c196cf5c72d963a7aab2bb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557d90ad3bf24838b324e212fdc6a2291
SHA1084482da2e4cf95301937eff432d9a9ae7945efb
SHA256e3b864a940ea56204ed35098b95695849e85845fa1aaab0befe1aa121ae80f09
SHA512b63e2a02495c414fecff57c56c60946fab3a12518b226a882abdd36818b313b02fd1ec43c249ea8b8ba24ab61303af845dce6bbd6f2f49cca0140e7aa18184ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4d168b1e8f18c91dff4a70a074ed9e9
SHA1bef41ff2193e8277367d149d759a83abf805d74e
SHA256f5c296f368ce90eac8430b423f88e5e163265adecf322907d5e263ffa50be352
SHA5121f9069e6f6a3c5a570a656b7158e8f7f70cf189c8c7230a6b42f00fa4da6ce6eba557e1a25876490ebaf4ad50724e88c597f61c880acb35f9b1d38042dafbd5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e876f369a20a201182c80282727b953e
SHA1d3b539e1db502607028d1c2f9ac2a7ca5a92f6a0
SHA256976dda36a241e31970d645eb54685aac0de77cd3127a3fe33ff1460cde312019
SHA512bc47b662b7264ac2cccb07c7ebb1521c6b76a4b258c96c03817bde4353df54a03c5849c00d562e38d8fd5817a21c808445c5eca597af6dbe60b609f809186c31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aef7269e931d88dd73408160445cf3cc
SHA1ae89718bbbe931696616ed06ac7c893b1fe26e91
SHA2560a640a319fa17b8bd69120f8addc2bfe4c8d3a2eec16e2043ab69a3a17ad5dfd
SHA512009fa16d9e4500302cd563e326b4fab4d57cf1d3afb8e2624ec53263b1c8711c0d52160ec708bd890df3200effc76e7862859408d65ddb43f6789dfd9ab36ee8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e4734f4f3d5f1824bb198594df3c559
SHA1e3f9967f4a42211eff507c796e5dc3d6eadfdb32
SHA256b0921f718c81128df6847815884315ec01fe7b2feb6d4e5ff264b8b585200232
SHA512c6480dc70c7ff998a73e481dbae879676015fb6d640ebe69b1593ebea60578cd43b595eede49d6849b8ef83d30fd19e13bd062a7a2296203cbb3713987cdc719
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5725747c6295f33d5097d2122aaab0b1d
SHA14750d3697afb151b6fe98f8a2beb46f78e89289b
SHA25665f4a9a5012f1d9e2d47b285270bc63456c227bc4dc6836621abf32f089c2c96
SHA5127f3b27c9c132236ecc469be39bb11ae5196797a245fdf0def3384997d58ddc2eb307ea432d1acae30654423050edad1b81a625dc798dae18fb83dbef6fa72fe1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524340625e3b7f43122bfb25210543a12
SHA15536a39fe2498fdf7a32ec116f5fb38be4d77e99
SHA25650d3fcd32d4f091ece0c1b267e11aabbb2f0f568ddf8690b734b5b170dfd82de
SHA5123a5f6ea0d805a486edbcc25086a5fc02591807ce0b2ece8df0accdb10ead551d125957daabe9ce94e28b967600f90472caf68585d9f8af00785f16191b495e16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c584498301806f9c0e9c6841015851f8
SHA1ea5f17aed87d0e25a104955f7f2c394b3f5bd962
SHA256dfa564b57413a7904c487dd362d700815f340d2ca83675ea37b687f68059b7b1
SHA5122133ec6964c84ebf22c15baac31250807b12607dffee1c3882db2c256ffc102f13aa5802d22ed3bc0659152ea087dbc82ef9b2af7ec57af663dc456278c67ba9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1b6413a15a75ccd9660cf621c44294f
SHA1f68f14082394a2664fdbc3a233ba40cfa51c1171
SHA2561210ccde0d70d606fc28a831f795dd25ea9ac28321355f8f1d838b86e37668e4
SHA512369aa658e231213a94e46b463b849215eba3daf5bc9cac5520d155c9f8893594f267234728de4fd6eb95567b20d58ad0d6dde4f570a2818ed0e3a3985653162a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06