Analysis
-
max time kernel
136s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 15:15
Static task
static1
Behavioral task
behavioral1
Sample
d66fd307fe392e11d9c06ddf2809e135.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d66fd307fe392e11d9c06ddf2809e135.html
Resource
win10v2004-20240226-en
General
-
Target
d66fd307fe392e11d9c06ddf2809e135.html
-
Size
25KB
-
MD5
d66fd307fe392e11d9c06ddf2809e135
-
SHA1
06d39a2dda5c85ee59772d37eef06dca0ecc6fd1
-
SHA256
1c9a848e7d129ec15f889164a384698ec5447d817176036828012436e7268379
-
SHA512
0ff49bb456eff65e6d5d25f0ef0a923f9755930a7038b3fb86b5375dca3deae91402d6b5061f5d3ee00f1707627aae9884e0e2837319fc0754b621519fe2d7a5
-
SSDEEP
384:SwgMDGfkA6o1bIDuQsQghaweBrYQOiMDp4vf8HJKf2OroT:SwG1bIAQJBR22oT
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000976667747bd54bc6281e1b3862f5ca73217c20aaaf5524cea30b67c0cfeb674e000000000e800000000200002000000022c9dfc74c80d224ffde34646ea09702c558f116308934bd05d58986993101309000000039156eeb1663a032a0549158650b7a1b945f74afadcec49f89bf2fa0898aa711102cc1355c4eedb7f645cafa52c3e13c5d88dc73103d9da94e1d0eb54bcdbed58773b3943ea1b573cdbb1d1766f1c8f1b0ea13443c8b4fe18735b78f52b0a475ee312b606088a2befd3de8f6cd92f2dd1a87f39eca6e9e61dbc4d827e963bb30c1e444ea91ef509c33cce3d166529e12400000004c0ec7c30a0c513c20b64cd3d503fe9c479624c5e7a9284017791004897459250791e6474a77ac9015287dcacbf58c35f40323001ebf3f2c33de00027bd500b8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C765421-E603-11EE-A3F8-62949D229D16} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417023184" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000983ad273edcc06a8ed6fa873b7aa3fe472b8dc15a3fa8d2bf9296709899e2152000000000e8000000002000020000000ecfc650c824091cae7ed01574256889fe1ee44a19794eb201e1f44df5d61835720000000f078c87cd473f44ffd68e020fdc74415939565e207ed17bb0e7c1da481f7c1c5400000009f3748ddc2699b481cf77c03d24a2316896209306c61f0385e650157556009611a579ccc3658ff76c18ae0cb9c3f23c6f5250d48ee49c9b65532c374ea3edc35 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0380a6e107ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1976 iexplore.exe 1976 iexplore.exe 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2888 1976 iexplore.exe 28 PID 1976 wrote to memory of 2888 1976 iexplore.exe 28 PID 1976 wrote to memory of 2888 1976 iexplore.exe 28 PID 1976 wrote to memory of 2888 1976 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d66fd307fe392e11d9c06ddf2809e135.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD51525b79baca5ff1c5a71c3fc05942280
SHA1582d3e0f2b25fa3bce385f3ebb74cd955fe124cb
SHA2564bf62b263b0d5e37827e8f11b2eb27052f7c05af48997b336c9163e60c1bb22b
SHA51275caa5cf1a06258cd34612c935811b4556ae7222b1f053902eac062b17558375bf060833c5f71dbe2f5753a98bf93b6ae300862f456be276e17c0e7e4238e4a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518e329bf62b1075075800431211221ac
SHA17b86f25f870c064e83d1823a95c768391dccf635
SHA256aae6343006951382b4c152590d3f19d08877fd650e7f846b04be413097410321
SHA512f4db2e9295624ee578141d9f6c3dafecfbc85266a9cebde3ca9d75bdb06fb07ed379e7db31b6a25227af93215921ce36419f44472639242fd6d7e2a166ee66e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd350a68db35966c9ef0e97a7f3b5571
SHA19a5e03062b903b28b19f83a2f219344a990085d1
SHA2563f890c78ef2a656fd2d66cf7f97d8c4bae4001978ffeb42964f435c89ae68415
SHA512448d10b8fa5747e5be770c1f09dd130bceb633272f2ee01709fcf1ccad073d0a7977f3b193c2598f23c12da06a9e03e30dc800de2b688df19b01f0e83703a1e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eeab634f073f5995cae28e344373200c
SHA1ce8e0e921be00b9119143f1d5471917958d98f47
SHA25689e7297087989c40f85c12326879115250627a3d3fece63d062596b0d5b2f504
SHA512b16ec5bd97c3af0aaad899d0bf5e4d25a0bd6a8485df7e9e14e7fdaf391b7077573317adb3670cbf7fdbfc6b89577bb501874bb42942fce9a85f714bb8f78f6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5086a866272fc6686a0cd14f3c6ff1e24
SHA1b7f28cb446d59a50342514f2dbcb739491489810
SHA25697c12529084c9fb452a6165ab21f0321fb6857811881b5fbdab4f01632be731f
SHA5122076c8053e1d9ea5139349789ef7d8bc176ace11c85a00762fedb14bd79b56ba4da64dc7c2f77828bee1531bac7c8668a7e536add10f879ff48daceda11234e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559a607d2c28a1a52ef0e65c19f7ac8bf
SHA159add5f87df248b10921882de76934a40db734f7
SHA2560d8a9575f3e080dafea051b295455234138e6a06d288fcfe194ee8e6e770b246
SHA512d6dda1b2bf2b50dae3f53552167c07a88b65ebc6e3217a545e9666b7e4fda5e09155d095e4bdf427dc3671f0dc0d3705c4504b6a66e35ae73c34bcb27435792f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1579262048000ee203a51545fa5412f
SHA11e4deeffa849db646adba5f82abb138e7651d86a
SHA256e303f8e9099ad74fe93b5d844e19ae0c7113b70da9fcc7216098ea6b595ee463
SHA512ea9f080c677618ee196e57a0d0071a28bbc4bce0c26d511b7d32795c7d27f8881e7a3e27a6819d1abc153e12955ee14f3810cb68bb099829cc4caf586bb28547
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f57fa643709dc94679e55062518ff93d
SHA14f6221fd51474fe0eebb10d73965dbd857b7cc20
SHA2566f001178e7cb248e8cb6262b1b1a021b5243e09540ab4e19aa50d35862466543
SHA512d82a271f056b2b22959eff1eafe0dac6c74be1f11148830339deef037b5dc563c718704d65bc1669f560969ae3ed776057b7f6959e3657707db3f2259c17530b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5092682e7674ab396c04bcdac993a832e
SHA11405818a2a4099c19ffd39fbf2cfba7107e0638f
SHA2566dc240796f13e61cfc81e7a409bae15348fdd6e70a41f4d90f273d49744f8f53
SHA512ee3dea493ab9cc73b2e11761778a0dcfb36cdc001623af6805788f4d73b56f71a61e4c04eec77430a401a55b5774ebff6185df6c49cc1ee9f88a7de4fa0ab10e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585526a0163ecd10c09e93aa4ae1e1c5d
SHA16b8c4174604e37bd9ce62d8f43979cef32755df7
SHA256f8bafdc980cda60808b72cc0340cc378787921d2112d98ca2e3b1c12cef3f8f5
SHA512e89d263c2a6a6078881915fe63f84e095fb994a6226b34cde98b97fa1b3001de07c94c182299e3b1bf2df57ee61b9600b77f19037d2385adb45ef265479f6c56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a6a798487f4be1389db3871711524e5
SHA17f63a60d875ef4354f2cb6faf9c34b6440d807a7
SHA256c133acf8a1de12eaedab3c9c78a12c6047c5f84b2be1704c702d57b5ec96d1bf
SHA512fb8ca7e8dea4cfd1279b5b320e8bfcc4ebed51f22eead220f93974cee64b6ef7f32be034db0cb3b670ee7ac0e66e9e8ef31761676d97e0223356e9e5c5618497
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544968a7def3c43b1c9983fd1024e826b
SHA1b0230e0086db554c402ceb09263f51b7694cee35
SHA256f906d7717f9d6c994546e744ab9504931e6d21a1b9e518e261e20955e94f8b30
SHA5129be4111bde3d34556376022b4ece6a911b5bcd459ce83c2a9f5ee86ddfa2d76a319d9e150e6fea5a8ccc1cdac0d734be8fe4ba936b73cf7a584dd28fd0176e91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56594948f404c918558c64a2790a5aad8
SHA133454179917ec074465b55a3c1223f8962f1aa70
SHA25678187870b08e8fd634501fa7efa5e2516ef5a1396a1b6427b37724f2b8154005
SHA5124a0f86cd7e5002495d78241e5a985bfc5a69a601d0ff40ec9ab34810c5243f69bc152fec7651f9ea5750666172d38a00545ca03e66ac7c3a550d211df9b6a499
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5df1877c5302bdae513b966d477db0ff9
SHA1cf79513f60a9594941194f5a9b9527f7c8617f02
SHA256d2b268ab3c46ce4445ca880aac68aa0953e36b828a37d234053f64e8a19cea62
SHA512e301a0636e0419672f6a3d1eb945370694d6d04a9ab9d8a6f2f2cd83a521adfa9609a8184b86be2f690ddeb1f1dd2cdc98357603cc3a4e083067048fb9605450
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63