Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 17:49
Static task
static1
Behavioral task
behavioral1
Sample
b54bb9a8d8739f22ca55469200361384.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b54bb9a8d8739f22ca55469200361384.html
Resource
win10v2004-20240226-en
General
-
Target
b54bb9a8d8739f22ca55469200361384.html
-
Size
17KB
-
MD5
b54bb9a8d8739f22ca55469200361384
-
SHA1
88004636ae748addeaa8e0497b7c28dde3efeaa9
-
SHA256
bd7f957cf5d9d7bfa5dc269ee77b3d01e24e279203f4cd02fcacd1126660301b
-
SHA512
c804b35dad4f280d7c3d8f013ea4dab308795d9fe6f5ed92a015f25bfcfd3d9a24677fafff2f8af5b2905206aeeabcfd28446d18f394d926f690146cb9e4a790
-
SSDEEP
192:3FOq0CV0aRYo9Q9T4F3vBY6ax7TR+Z2HQ7W6i2BhXeyngsRKYx9Y7JxFJC:3MiV3R/eTg3ZwhHuXevsN8c
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000013a5f18d6b5d8b550fe91a666cd7133b7fa04648388b97e25cafe3876be2a801000000000e8000000002000020000000aee401cdcdad23f1f5ad00218388f6bc9c014e2e9fe6ba4a0ed8b6a62fffa86d2000000006a44fb04a48e2979360c0e49d58fd0d0383f4f5019d1d7d566dd17add12d8be4000000060c5b077a796871adf32f184471abd983511060c87c15c1812c201f1a931033c13287e9edad19a90c144d12d03ecabedde05ec97db5d45fb760204e1dd4a5e1a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7143381-DB18-11EE-8706-CEEE273A2359} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000047907bb74e9116114d40a877f08957e79ab843eaf8c912e0caefec82881a369a000000000e800000000200002000000020e27ac526cba19565fbb083653f8ea2fcc6ee01c9e4f885409750f66ac110a3900000008934c23dde3192625cb44c57db650ad31a8882a3f8be5008abb2e6d52c8d3482d585e8e586578bd4a401c2ec8ef1f459fa4e53092e9254c8791c8a33adc76e7a7aa24ac9b91000ba185165420b0ea58c0f6e1e14906cada43eecaf96f2b924e1086dc1467796b68d6893685b0fd93e995d6a9b29a9592581fe8c767d3f4ac44076775239fc4aa4351545d18f983633f4400000003e47d78cc700be6c03cb371f75d82aae719b6850576cd5ae91c0c5a654626e4515d5e148c2d160ce7e63b2cd188b65ad563f78e93ca7369f21ed5b450f0a2915 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415822868" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300e8aad256fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2168 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2168 iexplore.exe 2168 iexplore.exe 2232 IEXPLORE.EXE 2232 IEXPLORE.EXE 2232 IEXPLORE.EXE 2232 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2232 2168 iexplore.exe 28 PID 2168 wrote to memory of 2232 2168 iexplore.exe 28 PID 2168 wrote to memory of 2232 2168 iexplore.exe 28 PID 2168 wrote to memory of 2232 2168 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b54bb9a8d8739f22ca55469200361384.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2232
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58067a14fb424f7d5fe845809ccecd08f
SHA1b675b8800fd83d50879ddfed5dd1f20018af96f0
SHA25688876984a92ae30e0615de26c7335809ef6278c7cfb2e81ebddc050280b62bae
SHA5129fcbd622254fda3f689b47756a24a2bf34679d319baae1882ab16ec536b38122ab5f7c8ce80a46e458285ea4484bec6be13e9d5798b6b6e87da8058aaa6bdc28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500287adda8e077b9045069def8585d40
SHA16bbfecda1cbc81b3c6820c09df2b8695a50ad732
SHA2567e29b1a56aaf78db4ed0734211c907b595cfdfc8a35050e0fe5f2b081cbcf13f
SHA512b5cb08ecd9c4495ddc2fbe9efba7d725ce26d64ff0f9e226490d1a40f56473b82fb68e460fde7205345a8f69c79d6c45ea754ddef1e8a3fbf354e280f01a1256
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a959e85c756bff2f7034cb51691a97df
SHA17bddd8eb5fa9f4e527986926833897a4f124c585
SHA256b268cd92764d6809cda3ccaa3087ef2d09c41a4a9a2d4b47593b7b470c792675
SHA5122c8f1d2bd4eebe4f351b8b60915bcba4d85ed0ce022b3fcc886c8c743b4f238ee3b2293618dc1406b270d0f756601257db4fd5a1724bc1bf1ba51c26bcee2c67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57be6c88cdd52caa454a10a909a7cc7ce
SHA10733260b39659d5a263205270af7b997a9848c61
SHA25627d8a167030e495f487efd4bb49562a71b5cd19c52030b1a216a7fa0a1c3b96d
SHA512fde8de42fd8988c25b5f10f8dc4e8d2a3529a283e71678c9168f1540c1440dce20c5d607cce7c5693e8a8d3ff5adb2a21b5e6eaab9a3e74b50f2d9f35217f4ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514aed6c1ed9161fd5ccc4d92b96ca055
SHA12fefc7b1c92035ef83cbd742e277051b315d63ef
SHA25634d95890b764726a92680e758cbd8299f5a1a05a2d8db1893ef76889a6e97b15
SHA512b1714de46fa0ac28cc307ead81e31a792b28085ac4101554fe51f16f78abeab9f925a3ff5c08f582e9f1e24810dd0d84c8511506fc333fa39d4a8b40eb672d11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569d6f5b106f1721a0d2ef996c6aea140
SHA1b8a29bb35aa6da96ff37f8e42ac23a06bd1216a4
SHA256a49a5bd4dcc2a06658fce9448b7ec0102cdcdfdbdabeec2d0b52aa6ab14ee92a
SHA512b870d013ad3c014745fe35351a6ea5591be96cf487904eebedbfb3b08f2b6c6dda322f79c56b143b33397ce76a5852cc25d80a504f9a4f0cedf1a2b909d61d31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aceba604b6e428c387b91f6967065fdb
SHA1a458ceb54e5d5ab0c6bc0e682eb3e531fa8c9cee
SHA25697453d5515ba9271b0130b89a624af19375c33b0b64f7cda1bc48ba7bf68cf81
SHA5123e6452174b1d7a829725ce971add7040f7c3e4a8ba3999afe57dbffd46a35f74f32248f64f9b97441f849fba0d6ccdc47c2d1a53e7cfaf250df0f98aa4c7e114
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7484a55253d9d54e6f6c1c9173e8519
SHA1f890cae8420657c297ad24a0b09cfe82554a3329
SHA256a137ef2b204c1dfada98202f9a1f5d8d8e548aa7924e42c97d3159594dd01093
SHA512d33e3080d3b2376066e25bc857a9092455821f85cbc50111eb538561b4f5e40e7ba96eea866d6f82d2d433f7551e58654ec5b083899e6248745be7d5cbf20bb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f8f7b0340464e4d746b6c98c1e0cc66
SHA10750669ea8ae5b79bbeb27f1530b0d50e5739bdd
SHA2565ef115176737041e65a9e80b8df33670f42e92a413f343326fb88c8464b4e8e7
SHA51292b2b596470b34f2f4dad192db68b9d722b4c3bc8e8dd8462257fd5db1fed2aeefff8bcdd8e7f1c4098d6f2e29de53b2c24c944ee905d438c4d09a3a85c548de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5ea52e9f2c2e4b01c4029d55ee8890e
SHA1714883a7c6d0447cd289e8423e67dfc98805784a
SHA2565c146f7db09cf9d2a0960bec91ba19c465a34e0ef7d9fe8b24603d4683602a43
SHA5128c18243393a243e1d206a3ec510255aeeeaee54adb8994b3e1b89f1282cb5115ea7119b3c0843886d97742f2a03009f43c7bb6ec19160885846db69d1aeda416
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d3dad96b95af0707c4ff8c5bd7e3cab
SHA140be7207b0a64bc3640bbee8c7199ebf5bc2491a
SHA256f705d281527a50edc7616884939d4b31338eb58970f0b8c9b084f679ec1dce1f
SHA512aaea4ce9e38f78a838575efff08ca22ff0a6e6570c2a0aca8c023adee94a39050daa20466f3f19b5ef2b6bb823bb53f75d36007cf838ae0681b2cdf9e1ea37da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53011f5a2efa069c7d1d58404d58fe3c5
SHA1300c9655c21b36a32f9443d4ed69cc8bf9a30079
SHA2564d651e60c22902aac1c91e9b54b33a8d69929abe7c5aff85dfc80967c0ed9ebc
SHA51269760c33b97531cb974c43106a343ed588fa253f30e6822b13254166cd5bdd88e936e766f371b39b02db9cbf60ccf73a23c7f297ac0904dd9083f763e3dc7088
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b0f132ec06c71e51197144a127cc344
SHA1460f8efd9023da5b1d7411cfff92f2eb2059981c
SHA256421bf650d0df61c3ce273be3381708902413d89ba9cfc13da86dd7b8facf7b36
SHA5126d8837aaf5c91464dc61a0f041a3e20572993d83e24718df48db360b0040ddd736f93c5b380735a563310da4b19e9a53d189816f9773a567d715b63f532b12e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad90c2fa6fcbd5039f7b5ab0c89b0eb6
SHA11a623498f91809bc1c9612714eb9780e78ea6144
SHA256110b28320dd25cb5bf66b4518f5c99f9a9dd985b5d1f7808b303091655e70299
SHA512efd9d0948536e301275d10df4261af127f5f55954ad64e8a8ee2dd3297c52b4c12cabbd34fd196c7c3a4de6be3c2af93bcb08de4a43474ac0b9a44a22cb9af54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c93ad0f3c91479cbddc668f24056135
SHA175e0871e7baca1e82e8d7473d050a6d204f9b609
SHA2569d79246fc1bbc1ee3f2a6e8d04401426dee7c5f68ccff9929000df867687f7f3
SHA512f6005c4dc451537a981160cafff2ab429763da487b5cc422545c0c12fcb124c08068559a158803a514197102e436db798bfbfd3d655a623805be83d33633544c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7baf08df22a66f2dc91e8885dcf34a5
SHA11030fec18167749204220aacbfc7dbed1ec8ab8b
SHA256fdbf093396a99df0e9863605711f3811f265475d7a1b224dfccb798c5841a83f
SHA512f3cacb4525396d11effa17420dbc7bb1a76bc916280f98ae919da390e13c95ef8514f6057ec3324161d16110131416815a222d835e55b580aa03dde76b3dd10e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccaafe3f28e4f4b495f3a59712404546
SHA1e6628a336e0c600c97c970fcf18072009729e521
SHA2563602fc3078ef85580322b8f67fa9d23f96a64098195a1856ef4313f1580a5071
SHA51234267437eda436f3f08f138f94c2f0efd56d8bdf5ccf038d5713dc93ef1c9dfcd1c6181374aa5e02fa76dde91fbec918e6e33cf6182a0e9656fafc2dcc80db2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f86a7b0355b34480779bfd9196d45d97
SHA1181c91357ca0ba9d67325b78cc340703ddf1f1e9
SHA25688c8a414d6312459302742257ba5ba12e3e83ce455ee4833b01ec098ca991dde
SHA512b258d7870aca3f3053f38bb2b9caa05b1e290d432e825e094fbbad3ff02e9e7b1c6b9b6a4a82a5e8a6ea35f5e67e80126761c7140ed6552e99dc34ea9337fa30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f52936a8834924dc0d242bca27602981
SHA11a59e9fbdf5164e39e759df27e9d200cad8e7451
SHA256b937059045e4cd1b6e45db93e08691da55b1b393aa8d0127dc7be135cabfaf06
SHA512cdd78b3f93723c3ca823a1a81d036652085cf6c8ef2cc2cd92c306197a4dde537d7b41a1831c0395e2750fac05a86dc831acabd14239f66e34cce0cdbb167169
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63