Analysis
-
max time kernel
119s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 04:09
Static task
static1
Behavioral task
behavioral1
Sample
2793a9db5b81262a448cb8ec86bae247.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2793a9db5b81262a448cb8ec86bae247.html
Resource
win10v2004-20231215-en
General
-
Target
2793a9db5b81262a448cb8ec86bae247.html
-
Size
3.5MB
-
MD5
2793a9db5b81262a448cb8ec86bae247
-
SHA1
c61e49af9865106d1f837b304a67796d30fd87cb
-
SHA256
b3b14e7247ea89ccf6e27c9cf4a6a537d852cdcc0d14e02a31a51a1475918468
-
SHA512
c0f02ba4e3d09735d81a8c1ce3454b3c0b9b2d6941044c8f368c931c119bf144b1550a32abf341b9e969b88939ced5f3ab921ef7c02fbe824298fca119fda001
-
SSDEEP
12288:jLZhBE6ffVfitmg11tmg1P16bf7axluxOT6NAm:jvQjte4tT62m
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10019f2bcc3fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000140c413779a966c251e27a9994d06e03b16b9eab2f855803d340477eb537cc33000000000e800000000200002000000095fd3ea047aa216cfc50194f67248e1e26d2e918ad406ced027bf3816de5bd5d9000000011a34fd758664dcd55e2c76fe0aa4dec5f1c1214d311f3d8a64364c7869729afcae92680b384761a379c496d47c2b5cf263af6aa3cff34eb6dc899bab78c347a725eb5fb555df28f4fcc52e827d4739535b933b0b60458f56c88acccc501bfbd645b9d21e96613ccfecc9874a02cb2158fb4be346e2cd23e27d1cf5f503709cef4aff4769da9e8837ca28b97a83c90214000000048ac76bdafdb99f057b187fde25fa5c8cbacef3cf3bade9e32882285e705992fdf39486d2608eb6d9f9d5292d7ce034d64d34587bffbe7f05520053b66651091 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39CBD921-ABBF-11EE-9317-F2B23B8A8DD7} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410616702" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000bc7e96ebd84d7229c8eca1d97863889ae0b2df9123d92354bc94990aff7c73a8000000000e8000000002000020000000146ded7536dfdc2f1bf72629a5a4e39249043432b892a2f6e0716921991d7ed620000000e5b4487580ea558382738d068b608c1b06b52dc7dba6377055abcb51c36bb0d040000000574b73a215750869904a71271132b7f4a67736c5ffe18ef692f1c834564858265e2740834a629a514802f986a1dbd6df201c7ebbc4dba9607a4480c3a49b5b6a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2636 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2636 iexplore.exe 2636 iexplore.exe 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2660 2636 iexplore.exe 28 PID 2636 wrote to memory of 2660 2636 iexplore.exe 28 PID 2636 wrote to memory of 2660 2636 iexplore.exe 28 PID 2636 wrote to memory of 2660 2636 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2793a9db5b81262a448cb8ec86bae247.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2636 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2660
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b348e13403b4d6fc7adb8319259b8274
SHA16952b7ffe8be2a3f394c1e2ab1d9c086149e500e
SHA25602ad1526b14aa6b26e7c2001feccd154e4f9700232c8ef0309933ebc4aa1f64b
SHA512e8ddfd5cb4eee448b0a35e073b31cdb7b5dae8abd69a9ac55b5627a17189f3bbcb84a5f150613e434c13b0ce3ddf022422c51ecd57c4379e82c194003cfa33ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5175f25684206fc6a04dd56d3ee2d5a2a
SHA1794db0c00e98680d9ef99fc7b6a482809d0b6b8f
SHA2566f3b2dead6da3b63d928b536d8741e8c989192b3b8b1ea3f366d862964826b34
SHA5126359b65869f23a1c57e5ef03a82d539d349462ec13844bd92be5a2f9e5128fc046dc2f7ddae39b8e2e5360dd0e3481cd98aa31520ae18dc3d8113e7502aa24a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fab19c0b94a1fc611346a52ba564b519
SHA1f886e2231977bc63bd4057d2cdda2956f2ef8e0e
SHA25632b0fe001736275a2017f631c044a8da45125a4bddec3c15b3e794ef478279c2
SHA512709eeccc21af0774368edd77d4c4a5f4c9696e4628c3d4848d164d11c775826d82aaf6b3bda273fb1e5eb6f7dc579c75846584096c0e4ac866332f1ae6952c26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59061ba31151ad2b2b3ed15bcca307022
SHA1e5d369e139cd722cd1a5fdd9d28189eb4d492294
SHA256560c09dd31dc5dfbb8e72e0a796d875c8d0a1a3d98f1c245132d6fa2da5f6b4f
SHA5126e51afbf8c8b57efbdf65a35ec7a82bf34f4a7f0412595c348ba3bd557cf9ae3b13bea1272364b34f912a8bab47c636bf9287b0b6e35d29a628647390a5c0beb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552ae7e6e6323e86dd6442c78c01ee56c
SHA1e1b700e8fde1412f196190973d3f34130c29bc6f
SHA2562ed98cebfb594ce2f1ffc5e346425dbd01c0e048f40e19ddca3f76e40a23d0a1
SHA512f3f2f5e9cb1baa0bb7020128ebe00672b63c1643d78b7af7ba113f32849527185bed63c475f1ee46fec7edc616d6137731b606ed69b2fe210ec242a68862d7bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4ee516eac5944d7f81a3f981b30aadd
SHA111496b23f7344b6df03f0e84ccc9860bb6c10683
SHA256af17d6d03563614087a0707e8c483da4a28ec71d44b650cecb8f9137c420ba5f
SHA5129ec49108fc9d965a072cf38b308749af52eb303a8ca90eaed094fee3649997c01ce5d082e26e047362fe38e8835cdd18a58a40002c9bcca11765ad49a56453ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a2823553acf321eea8596ce10af58ef
SHA11828caf227f4c5bb45b377183fa0da6330fa3d54
SHA256cce028882756d0782de41c5a1abb25b8b8ed6b7705d15fdef6d656572ca88406
SHA512e563382c4d6fcd8066b4897ca63431dd1e1990def11e736773fc634a24675942ea0cfa67821b7ad62bb0bed8465e647d090637db9789c9cd9edbf4f055fab46c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50801ec902fd7bfa3d770fd77c1004237
SHA166ad88cafaaf9cca8c8a9320aac80f1d11b94429
SHA256543f54f5c31359953f69a3d9f1a5c2e7839c7e9f1f0e3f50731103bec60a4bb9
SHA51236548eee87b4aacf82db94eadaef8e15ddcbc3428abb9bc0328d71a38d0e13832531f021253c0a243341988d261069204f2171b1f221aaab40b7717b91851b5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0b0e4afb2ef05936d5fea0990de1dde
SHA1878869c9905bae178794387c75a9471969b69d02
SHA2563017a025af0b89ae870e9c9908270a541a0837512b6192e9b64200c86bcf62a6
SHA512c2bae80a75403fb0177b5883721cf5ea5e0743a696545b53308354889bd1c087e4a2866acb5d84f9b801b2afce32377f8ca3482b99155828e95f4101be29c942
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549b8c7243681ad2fff955705bfc823e0
SHA12f04192ea131e4a15267b810c297ce01ab168fc0
SHA256d857bb5d83127a9b215143f5a5d8f678c9fe83383f7dde0cb78c0b3922ff7864
SHA512b7b8ece7a856ba28caad71fbd1e594ab38803141a8fe99dcac4174cfc49ec7eb0b12ebceb055e838d32732c5d9697fc4f8d658ae515d66edd99595b73671deec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549ac3aa969794df02edea70e94e164c9
SHA1766a84893d15204fc6cb07e0a27f77272f44ade4
SHA2561d899b32ee2457696be3dc97c998e10cad650c4220866f083ace6c0451604bf1
SHA512273ff9bfe20c6af3263d428c5c545837a68f921b55bc7cca170e91be79ad00b7d73c82a4b329255afe2dc440f4656431afef8ff0f7b9a307ff1f44a20e3afaf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597aca4f3c23ef73f7d1cd3edfeb39324
SHA1552ba69f97104b517f3906233e44967bcbaebba5
SHA256fc6b5cd2aa66ecb4e7868035dac2826f24d19242a2d40c06f35824c00ac0c5ca
SHA512a737c87693a2560485121e4d2896916af3d0a6f7f6020c238eba943cb156537ba90be2557409d33114fe9257db9066c770362fde818bab9f231ae64f86a428cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a2b5dbae88300555860484699cac4d3
SHA1c4b6109c2283b1465ae91b8436ff67147a5173d9
SHA256fe00f26ca815ceb5941abdd4c8bba4ee14c253f2e6dfbe4e029e3d2c57bc4c78
SHA512984b185f949b847a6186b17bfb1cb65b0ec4a61cec45e090ccd40bf9269618f2ba4e72efb6fd436a022477a0286ff15415e184aaffb4f939f7fc962033d7f56a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550b9e960712bf9f774a7adc6319bf6b7
SHA1a9f6fdb90907aac88415ff102c905ac1958df2e1
SHA2560bc7e978e76dce16d37907533de0abb67bc7d75220f6786ca3a4aa4c4a4f07df
SHA512a7c392f059131f4f7b9ff64592a11fa4b997f716d0728269d1b40fae65630a768dc5a384abf0026544a3ebbf1af9f7a302370ee8c1583c4af360b8997c9864b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df9a748754c4a8289f85ca47aeea083a
SHA14489fce2960f14b71319d13f4678f0b4db064f21
SHA25684be5b65d54ba2220e1efe811dd007360e26db2dfdb6646c85417be072db3df9
SHA512f19c5e9f6c7d2eb8375cdc2bdf82ac67acde429b77a96dcb1ce9ea07a765f47ac608799fbdb6f7b717aeb0ee52d5288d853b150d0d8159caaf8d8ab3e443dd6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5384ac0ef787aac5bc4c54e756814df08
SHA1923deeeb88d0bd8c36d6bb30a668fb1d9c611779
SHA25635953a7a9a2fd4a98b24a113987ab2f8b47916b7cc47564c3a234a4369547208
SHA512dbee251a6e827c415359a939b9a082188c76d73ae5ac554352b100ab85bc32e10f970856db7d6d72cb943292b154ed3f1a4e3342f68ab2f14c4ab73a9e763ce0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8e5d63eff32d18592b095019422ab22
SHA1e787d576872cda6d8a4009a289d31e1eaa27753a
SHA256496d3e71982cda400a82ee887d909b7f317ce657a19692316c172d765dc9a737
SHA5125c1c06ce2061db01fd78f7c2408aa9d47babaef189cb3d5d41c14e189006fe739052cc830d8f59b0c0da426aa94a85cd2df209f71635bd0f483b51648a7d23e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f27de1f058ca27ee20257f2c300afedb
SHA1a1887667816d57c0f01fdfb08d96bdb91b2e7aac
SHA256e53dd85547b6b3cf7999ebc7fce4ff7f95d6c15300a03c8900c82959f22e6f55
SHA512fb6f6c1a260b1d880ada3f8b3a124ffe106add00533f5341a2221a3e3acebbbf8786a005cd424629492edfaa491e22e2fea75e5c7c5b2a35f8dc679cabdbfda1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4K0WM73A\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SP6DRJYJ\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65