Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-03-2024 19:18
Static task
static1
Behavioral task
behavioral1
Sample
c6aab80660a2d7b4ae39a2c4a7d5e820.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c6aab80660a2d7b4ae39a2c4a7d5e820.html
Resource
win10v2004-20240226-en
General
-
Target
c6aab80660a2d7b4ae39a2c4a7d5e820.html
-
Size
221KB
-
MD5
c6aab80660a2d7b4ae39a2c4a7d5e820
-
SHA1
85f484547b8d4cc73802ceb832d9e7ea37fe7354
-
SHA256
c0c5fc1b06bdeb6471bbf4f41f2439fb02bc99f8124d70db79686fa2f2d723cd
-
SHA512
536caa87f6bf9634630173e5b2514531fcef9153b7503a9f5728503dfcc7cfb252b7969aac18e7a0d1120118ed014e2f26b56d1dd89b69ff085126920c2f1b25
-
SSDEEP
6144:0Id2oKDK9tAA50t+0UHSeg+l90T5KJwTvd+b+ZS3KlwNO3IBiNyw/aJ8bmVCPzd8:0Id2bK9tj
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000bad95402e08010ed82ea3899d37d3d639756d841bfa95a7d107f64f4b93371ef000000000e80000000020000200000004931f26fe54521f31408fa61432ac90ee40d44d290feb23e9bcc881ae2aeeb5620000000468abab418eaa54c36e0aad9313fc5bd1ff0f6ff0b9f6455f7b38964a3571c6740000000934ddaaafab5ed78d08d2e44de9944c84991d3e8616be7d9b4a1f7403c34263cfa00a65e89ff5ea6cba0b3d10ec4557c1a66ee0cf212d6bb96acb4c22ac4f71b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0043f64e7b75da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416519373" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000003af567443b3fe7d65c95553372e409e5ac150794a3a4c5d4dbcc5f81c69919ac000000000e800000000200002000000046bea802677223190c38583299571ad01c2ff7cd8096140b3dc54089249cf13290000000475742442e5d35ae8e7139afdc119f8d28d6702c4c06a7a930b6030648900359098ba2904106b89548321af16d5ed7edffd445d937d1424eca20b8bd1e2355c7128bf4907a10c2af2f144c8278451e3b950d7c48c0764bf9339858e25c5763677bc9799756ec576e784bd9125da50cad80d8c16d2c9bae8a7e4838aea3bf92490e29b13096d757c2e249a4b73203139040000000a1c7141e0d06dc984ccd6f774e8f4a9ed973eba940d7c4fe112d65566f045ea08aec673800bca613d57f480791e20b40c344ad12d1f95139ed424cff8f85aaf1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{733E31A1-E16E-11EE-8C47-FA8378BF1C4A} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1928 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1928 iexplore.exe 1928 iexplore.exe 1784 IEXPLORE.EXE 1784 IEXPLORE.EXE 1784 IEXPLORE.EXE 1784 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1928 wrote to memory of 1784 1928 iexplore.exe 28 PID 1928 wrote to memory of 1784 1928 iexplore.exe 28 PID 1928 wrote to memory of 1784 1928 iexplore.exe 28 PID 1928 wrote to memory of 1784 1928 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c6aab80660a2d7b4ae39a2c4a7d5e820.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1784
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d4adb8068edb6f5b6c508f54160eb75
SHA159e80f7f83b6b4a89529de86fd2bf4d985d963ba
SHA256f5e9f80f4ba6d4d623c5c47a0028c1cb4d0bc8b67bc7b7238dcc56f62baaeed6
SHA512354ff62f370cdb9b0123d20198ceec028379c39c4d32644d42390031a29c6db2d585d64ef415cc17645d8745b8e991d59b37a235c2bb1e6b89318d8f4a935b3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537bcfe2841b42d1836a0e45a454d90bc
SHA1f960ded8e4d206e15884ce689fa450e5ad3ffc02
SHA256d904d5d53a0149c481fc8d86404d32c8fb19c7bc652aae743774f89da41c2aef
SHA51268d262b5db64e03ef1ebe39746aff9058c112e0a9eea7960d12fb2df2dab8f34c9b6ab977690b4d15c8acb25f54fb023b92546e46ccb80498dac36c214eb67bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5269b2e012fd026cbe463c16fd94e706b
SHA18497176395f562b8edf3645dab9c3bfe7d0b7109
SHA256238d60c241f35d15f5f646013d0e1e6f6855c3e97a29571a5faca5b788efb27d
SHA51297f299cf7e26d8bf6a654c2f117580621b601a61aecfe2e58b09b71fd0838b314e38c3972ac386f32be61214ab311db35824b773291e9390d6a4f3d04a695a1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5119325d985c1d47e0d37b810b42bf213
SHA15c43b96e0b8341b86247de302651588bddf2b03c
SHA2565e0bf58046a4d6069f85118acfe523dfe7caa0c30ebcb0a7be8b3e140b281497
SHA512007c11b292a82c4eb7e47163634aed376ba1a35ca3f22cdd6440e9718665226528ccee5c31455c8702ae356286d6b7b071d3b5d0083900889c95dcef4660347a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be72861fe176393687ad05528946bd48
SHA1da09c6fe6c220a4ee6c10cc159de2cb24755c004
SHA2560af8d94b4a70a665e24aa4a32e94343ee58ffb8206d75e29780cba116138682a
SHA5121547a343ace2737b72b7f333880ed119765140981295123d669c95b1b7bfabffb91a52de2cc846fac6640c08acdda7082be0b0ec57800e6f610e2068d6b402cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5459705e4b801cf04241439ca394485a8
SHA1ca20e2502979732308baf8a102aa7cebcbc8803d
SHA256b29b161aa14162dbf2b5fe66a009116735c91e0712bb439ab61901e496ed732b
SHA512aaa2fb23a8560c6c4af31b885438d3ccb3f7d88fb0340368c6c06132c9848b81fd1e5367cb162ecfa0974b32b39c3fba0b0b59bbcee61f0a3eb7e16b8fbc60e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f533857f5d5d2768d53cc56a2e8c2128
SHA1b4d24a4c7b7d032b222e28108c43093183968133
SHA256007b658ca11e358293587e3c8b086184b3fa8cf8332dbedb83275d686525fc3b
SHA512d8d7e8e50af7dc515281f4ffeebb5a0e2c02782804368bb9c7bdad597168bd339b77451f663faf7006cea0a9b7fe475daece2f47c94e7e38135d4f451fef9786
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559a8b1f2a1568422933a9f3ad359bf14
SHA1ee5866abf75cb2570edb6c28a264258643e0a361
SHA256b24663f81a5197cfab5385cfb1fd0912a217982cb8fe521a4cf7922f0b491dc8
SHA5121fbc776887f8cb57cf9e756ed6492f972d2eba995938dc353efc87b519ec9db8a4c14735b99451c78c295dc7f291bed3430e5ad2a759be6f2c095f48fd5346fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516e4b77ea60af34614c83558ffa9f57b
SHA121b2a1669be941b0a45b9ddc5d0a79b66ff78b37
SHA256324a97acf4bad902caf3b0564023b7385511a387788679585bd56c379c415e37
SHA512f2a3660fb2a1cf124555bfd67c1ccc616b0dc56dbd6fd9fd09402fa29767fba8267be9cd241c942cae9abd64504a05ddd5143cbc6054e7a7b301f2d76936d9bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581eaa45645c0e81d184243360aea0176
SHA1531e179c72110c9f59636a24e38850617ad96d97
SHA256306fab3d36f86bbdde5d4bedf103f891edb1d415f514d869bd7fa33ef1da28cd
SHA51253244e8ec76a9004ff59b33bc806fd18e20c2977166bdc1cb9ade862001e2dfd49e22b3fbb845ea630978a7e07a2e0d2595f642c1237a1a1cac4037a6e6ca5f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5925465bf53c9764dab5b13caf65ed32e
SHA1f6866a789db797375891496a044699891c765b38
SHA2565f4c8cbc1326814176a36feea72caf818d14fbce92f8072c5db260169c33d21c
SHA512b84abda23e2877f7147b962a951cfa2623251bfa37a2855d08a823ddd30e161eb67d13d2aed06d2dce008fd98ed4cf4fd151415e113a43e0ad9df3d7061efc31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f83dab2ea04fae2ef4df5b9907d401a9
SHA138a717c4cbd66da15ab60bd6a848cb69da6f7f53
SHA25652522912d01b720a4fdd5ccacf4b8797f6e84051be34ec65ba7b6241f08c1910
SHA51230241c2d055d2043e0d4cf69ce127c6ae698dd7476bdf0f9497d8c01b9db491507e130c5af83442eb60004c3e15e778bd7f4523d97468f8237dab09a28f245dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faec7f678fc5df8ddd75e3871bd35f34
SHA1754bf10473f62d220b036e438f6a267bee01d3e8
SHA2562f5f72e5c8d1ac76dafa7088075c8b07be0057d496ff4ed5927d38075d9ce430
SHA5127e4264b59d49b3e33c5733d259e9ce9c368952a828a578bfd1f6840b00cdc36e5568963fccb060674e47dd2db3c4980941386387766f27dc5ac72d6f791f1de3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7817cf9378a14a8bc773a1fcabee2f0
SHA1b44f35a791455b638ed604d3817b349948ca8f76
SHA25665b117bb15fe40da6fee9b27a3dafd604b1e15f29693f80f54de816cb3a9fdc2
SHA51215852e6593a4724e868504e7c8bfcf4bde8313c7c50001fac101731a2a2cda8df8fed9a332d436d7747f38d30e2672ad3913de76ac3541d482757919edca53ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5463c2cfc4ade50469ee368549af75a70
SHA12c318f409d17cac7360d78a09d3e8be721275fd5
SHA2567a15e3a004ada00730b04bf919ca2b5a53de464ef5da405ffcc52a9262688538
SHA51232435bc0e60c2390ebfa4bd90231b56425f56aece5e56b873fea1f8aba180cbfd4a114df87aeefdd6514749f438f01af6d2fd6a7722e60afc2742640eba0340f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a7e83511551dee2b6e046886e6ebccf
SHA17cec7efc3a55f4c19990fbca253cf507107b0627
SHA256ff7be1c00ae287b1e358eb9a2f7c62153552c51c345f5be8658eedfff676661a
SHA512e7d1faaf1c3c5a6dfce52bd68518df7b11e8c195bf0e95ac6a48ca375af34e9c4ab7c7b3bb5963ea3f58c87af49a7ba69583419878e4082f671c58573447f1f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8be37e902371797b03606d1ccc24810
SHA1e70a3286e28cacb1274403acb3b73df83056b1ca
SHA256797ff4383612baced512df333921bcb8e34934cf46ab1ad871a072a7f50a9e1a
SHA5124025c7b07fe3bf0243afcbaedb370b5991cf071ca052f0ebf1a734c3470e1385ad23195cf879b19b459de52c78e7d819e09e4463fa1d9aea34a7c133fd390441
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58274fe2bb9227d00cedd17ff7952118a
SHA16a27830165d1e96cbcaf9b42bdcc8328a676b0ba
SHA256ced9ac961886b764eb47b4faf8156cae338268e2642e44d7dbfa1eca9493fdb8
SHA512f701a7ac32dd8e7116c9a43e3772ccd4a56197b6add956df668c070b4e03d8e1cc965d9c6b9022980a28bcd98800a49f0b69453f8bc9d4221ab38edd7b4cb976
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63