Analysis
-
max time kernel
136s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 18:40
Static task
static1
Behavioral task
behavioral1
Sample
99dbcc69ea8254591d749a51f1692ace.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
99dbcc69ea8254591d749a51f1692ace.html
Resource
win10v2004-20231215-en
General
-
Target
99dbcc69ea8254591d749a51f1692ace.html
-
Size
6KB
-
MD5
99dbcc69ea8254591d749a51f1692ace
-
SHA1
9f4d00a9f5b465c2e3737e86d99f92138f35bc92
-
SHA256
8270c4977054a7646191272381cc9a14a0bc50fad264d5b303085c7a9bce3be3
-
SHA512
00b40eb0cb9c5a6f201421df924133601dc436f1e548b4ec06096fdd1e589cf810b203a90c29a03350e943227f0b98541888a6297efee99ad7e9c0bf472d4b10
-
SSDEEP
192:sIJITwwDOn2O5ipvVWcrg3NZzgH8nc4p6aSpZP6:RJ4G5ipvVWcrg3NZzb7ic
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000008417cfd2f33d8e386056e9646701bcead77b9761d8030eaf5838a1647cc5e434000000000e8000000002000020000000aa6bd2456320428e0cd08dab96a0cd1cf6ba87dcec9c1937b931399f552a9c2820000000404534ad9001903a0817941a1a1afde5fb339c42e0192c2eeac91faa1b94614940000000593d88ec0d2866dc1fd2c44901165d81b8fb4c72b0fa4f2e7b51899a84d417ab741f2b7dcb4e4ab79577d2ed2c5031d8a6c0abff001de4114780f6ae611169bd iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7085072bac5eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5633C421-CA9F-11EE-995E-62DD1C0ECF51} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414011488" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000fcb7ac5977f0544f7aa2b7e4c0a1bf5092267b66c19ccc180bf4d4978bc7ea83000000000e8000000002000020000000c2c54dd5937d0be5c0b569de03d8378d178c3d8358a229005fbf42d692a11dc090000000cf207e5ad3464341a4cce26a860e071bed876f8fbb8b35ef2d5e894e6329dcbb35822cd0e52da033bd8aff59a155ec916f32893fd23f67f13d9e8c1cf8cb91847bf59f6f4712126084f7b3feb0a14481160bee9b37430770ae111e6da17e9c1c937c821ac1b1dc8fc2233b400c4d1f1cb1721dc9edf01d5e89d1d9aaa3ce51a3511026ca35b614a8528408043dc4cf4b40000000f8a692285cbfdf600d80c58fc23b9859f4e8f80cc28982356d1a44c675d7a27c38e36a76627701fb1e01e9a7729050dbc07cb5ea925a2ff7d4e111cf72d68581 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1180 iexplore.exe 1180 iexplore.exe 1768 IEXPLORE.EXE 1768 IEXPLORE.EXE 1768 IEXPLORE.EXE 1768 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1180 wrote to memory of 1768 1180 iexplore.exe 28 PID 1180 wrote to memory of 1768 1180 iexplore.exe 28 PID 1180 wrote to memory of 1768 1180 iexplore.exe 28 PID 1180 wrote to memory of 1768 1180 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\99dbcc69ea8254591d749a51f1692ace.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1180 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b0e495390c36d9cb8f331b8acb46b85
SHA16fc19c377d06934affccba0298356f0af485f6e4
SHA2563fecbc59f454572761f295e7c6eb6a15da8a43fa1c4348981d7bf6322f736cf1
SHA51220e7a01005fa90138a5c51d04ccc1853713ad5d9a429124da6567a1b9f08f54c0ab54f3f976254b332c91c8fbfaf8e30eb39e4e42bf19f6f6b41ccf9b226e5dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fabee0bb2fa4e6cefd680e97cfea948
SHA1032eaed977d137f183266109428fdc165b7aaf17
SHA25626eea1b2c57f6442a963b1d666a636c43de8e4b19545d75ae0822fa8dd71648b
SHA512188f71c55f3fd4c1fc4b29183e05ed5ad0e23908f154ff0e2b99916e504096096f6d43a17e2c2413c4289e1caf7436816bb7ab8b45a009d36dc3aca8078a8528
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58be62d37aed9c30c79e84b44accd38aa
SHA1cab760f85b4c7ba4b7576cfb059c58e4f174be2f
SHA256ad7924efeb915b121e2763881c633aefb65cd44fea6b23852d875df3f958352e
SHA5120d6f4fd3aed14e817f9c11b3e9325d7091246ec972cf13ed1352b351e060ddfb3d306e1b9a61cbddf63145867b0e853948d201d8fe9e5aa8b2a469dd7bbc008c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ebc3b633198ff232f27e234ec57971c
SHA1521e6b1b320f9d7cd33a531a1b01a5bc3452b04b
SHA256d05ea8112a7e2293d1ee51a68cc84c3ab24c5d7dd3db3e5fbe9be100cbabe0b8
SHA5126a7fa7420cc11ce7b7e09a4d53ea1651c5eae6090bcac9d84c5df4a6587378d82f167ca09eafa421873e06f2e30497667e00076261c4451621f8f243c0cbbcda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51af6ac325ab269561bdb012f9fc328f3
SHA139cda9a64e772bf20ec8104487ee64ab788316c5
SHA2567beea71e8b8d049179d67708c8424b5835242df8cf7b9f23fbcecfbd9d521e58
SHA512ccf4aada9e5b12815f179bf2a52f38c0a914cc0fe6fcbec931528cc07346a547035a42f1f1dd7ce7b8059f99208417a204c1b87605c48b2fba932fbd418371d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592a49308f86587ec6d3d40af1c073475
SHA1fbc20c26e68955ddd2feeec33fc12ccf84f592b1
SHA256ca905eb29dec6fe1a5022e707c84ceecc401ab8eaa462ba513db2569e99f9d25
SHA5129cea1682220b9dc1418def9b0a340d3a5819286a3ee180c3f187cd2c9fb396e6521cc2416ab3fd869cb7c102204dc0b1f53b896262b5bf0c8ae8cc3dab286785
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b67ece0d32d6e15afea3216be7be8a2e
SHA1d2af731ab0fcadcbae2cd7ccfe376658e4db2fe0
SHA2565e7a95c0b8cf6e366149f50fd1a4a3208e4a243084d955dcf7b88c3a8a33f5c4
SHA5123e4468da5a508155d3a2abc4ce716c30e25196cb321085d9b0e0f58f63c3a6d950c20a17fdfb470e7c9d0050055a7f3500ee5430e453acb37e8b928cdcfe1a8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f697500fb202fefe50d55f63645330cc
SHA11328b1207a2e2678d0e4e12e458d05a2c070b793
SHA2561cf13dd23bd683cd0e18480524e13d90173d492b8e30fdbdfc73709a335a6053
SHA5129b5f51d66eb836e80d84e6347d4a382ce6e965d8e2173434d8151ab9d726590b5ebb67fa343e6ec1496d35188d0331de3925cea8e6d8264b1a757f3f428da431
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f86aab9271725f4acae1db8fc617ec0d
SHA1414d8989c1807ba6290b7340ff3ca766d173a013
SHA256b7f8c7f829370402a7f28a2b3f4cdad4a9947a8332b3c267edda2ee0a0a63d28
SHA5121b390824142e6c007362cdf85ed8b09704d6468ac0e4ff80f8a0b0db82dd2b535f86f8e66e279d929cb111a5322a90929993bf4d17faec327a03360bb40a6201
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae32cb3d23bf7572ffd395fb3116809a
SHA1be2ddabb97d5776633b6a2c0cc0e7f006040bfce
SHA256cd42b1f4245de8dbb1e07a510fe833dad778cc5a54af93fb476c93a3d0921760
SHA51272c1d1d5e654924b9c98402fa780767512e9c987395522ed8b7c291971329c7284cf1f4118b535a3bd11ee4b56e0dc09901947f0fdafa3a479e3ec1888a9e6be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5096f441ee6f514c17a55aecb260c6af8
SHA1b470b79be483d8a85e9a73cc74264d2eaf1f8546
SHA2565f4d4232981864bd8d4e996f5ae51870ca5e8a9a532037fb9822164e203c36db
SHA5122d695b328ea82bc0151ff17f7b1365a857bf80b4881cc50edb80a1a839942ec38d55d7f61d799b8ff46f21d6d4bb92d65695e95d693fef8cc4293cb68ed949b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591db972cd41c5e284289a7e1dc73938e
SHA13abae45fa906ffd8a38fa8f0f445fb1d7f120cf9
SHA256e71ae1fb8562588c0264842bc7f8906d3b808fa5cef95fff969e989d5a5cde09
SHA51206c818d331beaaa5f0f6428d60d2d8df6df33cc77fee43d698297b3b4ff915e1ace057b851b79a63f984e6068e6f83a196e194efaaca7c284649450a6df31be7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5318f0265505b67b0aeb62c9b150ddb10
SHA1a179e95e7987b686b9913cee5f4d05d2530d070a
SHA25635670d5d649ceae9386098e8ce9534dcc1335d831f97e536f4f1069a0f5ee543
SHA5120e63288616495ec224120401001d793011910671d64fcc5bc7a9bd851676984d52d7bf247d48ce9edc7a4ea849999b906d128e422f061a5747a427c9951a90e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a86711462b9549388a1fdf7f93474bd
SHA1b4dc342ed2312a932d9daf736a4275fc39d7aa0f
SHA256bacf4708c96a6ae3d85df092fb93e55896c3a00c3cccc6ef1a4380ee2e8a95a4
SHA512c4314e0f1abce4deda2942f3af0cad575076a348085898561bd2bd1806ac52b2d13b006abf188fd2fe8bfe1786f9e95394a91fd66c671008a798936683c9411b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c233738438e1a860238325bcf014eb93
SHA1ec7c8cbb322314fc3c88b5ace4296708d71b0848
SHA256bc9acb042cbc9312525cc917c14636972129832cee6e6332648d4f13ef7d2dd8
SHA512aa3f96766a719c5a4bf051201f0c6ec59c2debefdee8263efb469119ea513c29747f4ea4a89571178583495f042ef3642af190bec7de56f0a91858371fb25fbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575b54e9665dff296fe9e1d7721334179
SHA1432928ffa8ccd6808bb532dc5ff9985e8f27303b
SHA256a0cddd2de4d88f9811099a4b048068644411d0c3b6c089539f45f6b751791a1e
SHA512a1195517236aae4b3c52ee910b0533fee67dc432590cff87d3689893247ca5f3af879eb93dbe181adfd6c70e6cdf395bae6a7a034543c23e070716325ac379f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e48d616d1ae6a1eaca6d72c7ef3055bd
SHA1d287ed64a1fe5765fab6e06b6b73449f53f2039b
SHA2562040408ffd7e0306ce6314ce46dfd621468aeba6225296a047e1b0cb614a799e
SHA512a37f635533c5ea0a688827cfa2662e33693be0262b4c07e67513b9d938881cf14ecaed130358e44e60a9f4b53f036975d4538087c4e70441b3f296ed46d6d0b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9eda96a9cb2fd45b7d38ff00c469f70
SHA1958ffa131131d04491e033b0f0251b30ce29a6f5
SHA25619d06081883393dc66d91fc277d681b7c5b4a0001aada9fe8122f1dd26766b86
SHA5122eca1eeebfcff306a4f464f797872668a3234eaa6b1e80ad1f52ad7ae08b699714d83d5774d59fd65ec2ec6687aaf616d1105735d90913fefb4a7dbde66f1a7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58021c7db1eec6bd6d0cc316a937209ab
SHA14b28058aa2dea0c1b30a1b5ad019c9e7f5e9a66d
SHA25658bc17073f187002275cd59393e4a410dd744372a738864c23a5b3221662c29d
SHA5121128e96b66a894ec99952808298ffa79f11fb3d5d69ad06a39a8f0046e89faa4e1760671247dcea0ddb2bc4d9f89c5b30df5a7b18b527e5c7e9b3ed0d2cd33d6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06