Analysis
-
max time kernel
117s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 03:18
Static task
static1
Behavioral task
behavioral1
Sample
55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe
Resource
win10v2004-20240426-en
General
-
Target
55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe
-
Size
6.3MB
-
MD5
c981672af16f890e6ff080b71905a940
-
SHA1
089e55ea97390b3da6a8853aa7bff471598da66b
-
SHA256
55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43
-
SHA512
a2ead9c260d1721cd9d696c66159ba7cd54233637715adde1a9825a776d6c5367e6d3d0669b292d81568fd1616dfdb4d337cc5df733272e612bac1fe1e1a62ca
-
SSDEEP
98304:2/oz/g3xbrKsTS343sWk1bYcNFC+VU1JtknAx3JhBz10TkiXbmoXGg+UgCC46PyG:2/e25/cjCtkiloTW7UhCtn7JjFewv
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2916 FoQa.exe -
Loads dropped DLL 4 IoCs
pid Process 1704 55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe 1704 55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe 1704 55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe 1704 55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e040aada3fa7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04AEC0A1-1333-11EF-A4C2-6AD47596CE83} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000005df2bde4aaa7b81af7cf75152fa45b520c81f93b0c753a9c955e33fabe178c82000000000e8000000002000020000000ab29818c9b94c090a429241c52f298bd06c408cfb3978679e106d66f843c96ce900000001cb4fa166212ff15da6fe563af5c417836cebfa8cb3359e02c1a9bb2576a805b206fa4cbe11f036a255e619c14e3ce53aa5e83725276f6927c4cf23f01d1cb6e691c46c77785a10de111ae2eba6c33bca6b5252bfc7bcfa463851dc56303efb2d9f6ee5c7ee540e726624f3fb83ad69179ecd257b5183a81dfe81fe9b188a9647d0292c1389ae23e4782a7b71d3c1b0b40000000a87b75ddb672d8d562dd976db1b18589fc5aa2e9052efd6f0fe8c47637ee6c675e70cd900d9dc7e0a2e823db3de878b9be5ba7c23f97758e3d2489cbe8ecbdba iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421991400" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000d13df4c4f738016547d6f52d9b2c7a2b9160f9ff0a55b1e53743f97fd983ac4a000000000e80000000020000200000004a555cda2505b7b40c829b807212ce059c39d91e95b3d452282a329dec5d1cd520000000da01d8e5c8d47a3f60b73c708350983a6c00d45efc9a17171e86c34f98744fbd40000000cf0f8a36c047c3043f2582692c5639901514e2afb1596f6fd653e17902c47c0186ba964f12472b2c6657527aa402c33f56e2af68b4c350fe061c020e6cef45bb iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2556 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2556 iexplore.exe 2556 iexplore.exe 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2916 1704 55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe 28 PID 1704 wrote to memory of 2916 1704 55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe 28 PID 1704 wrote to memory of 2916 1704 55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe 28 PID 1704 wrote to memory of 2916 1704 55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe 28 PID 2916 wrote to memory of 2556 2916 FoQa.exe 29 PID 2916 wrote to memory of 2556 2916 FoQa.exe 29 PID 2916 wrote to memory of 2556 2916 FoQa.exe 29 PID 2916 wrote to memory of 2556 2916 FoQa.exe 29 PID 2556 wrote to memory of 2432 2556 iexplore.exe 31 PID 2556 wrote to memory of 2432 2556 iexplore.exe 31 PID 2556 wrote to memory of 2432 2556 iexplore.exe 31 PID 2556 wrote to memory of 2432 2556 iexplore.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe"C:\Users\Admin\AppData\Local\Temp\55902f61d32a655a5e27a336bd6efced4dad485e6dbd65e96d4836fc565cbd43.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\FoQa.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\FoQa.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win7-x86&apphost_version=6.0.10&gui=true3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2432
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587a3a295f52e8b4387afaba754b06c1d
SHA13b475d226bdfe2d9e7b1b48eb967eec5f1f12df2
SHA25697a9bc6b67fbc7911f11799f2f8955ff6ea8d1da9e239361f7734f7b0e386b4b
SHA5124f493223eab3aa246b5feec57cf0008a03b71b016e6850f2b68dd8be686525d46193d7f4b1da158dc00de35a05d28c1756ac5473631ee556af3aff5ea74733dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c884f3f35280b9f63c99b0dc20f3349c
SHA1e25791890ff1f96b57cf689a6c9c28226077bb16
SHA2563216150358448a56d505794e20329b12a194c5fe99ce28a8bc1944ede882f8db
SHA512c127c488099ce92a1e88451bff3cbd447c0a041d83a2b56a6685610241e8bfdbe7fec44eda9c0d56f9b7bddd79328a2ec9f3b93cec2c878ee12ef10f1156b170
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575c27dfc73975f239e03b5eae6a88a6e
SHA1fd3205d696ad8592ecb3b82bea7a3d93faa4a090
SHA256eea08d39b61a8cbeab9d00240a8516225198a806b0bda9719d62b32e876636c7
SHA512d85f08418bdd3387461c91b806d152b6d17538b4add8af4604bfd34ecb55d87be17fc5d383ba5d690f50af8f16413e7fc370ef287575d3ca666b8bfdc2791202
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f94da4c8244a4d836e77801391e2affc
SHA1cca9f380f1938e0c7b9f3031815bd5c8d0919e0c
SHA2568b6d53aea731eb23c207747307a94ab69093734de354a3a4b9a3765899b22ee2
SHA5128cfbca4785cc87d51063d86f64e29a87645d078e1b9a8c10b81c37ddecaab91cd4c37b4f7760ac99ee4b5dd2ddb6c9960dbc37daa112f4472c7cd464388fd77c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a0cf1aa988dbe7983901e5b3c31656d
SHA17cf7244e44c377766af8d9b4085919cfe6f7492c
SHA2566934b9d7e9b47ed65c4965d9178d0f5e0452a93787418152195067ad49e15f22
SHA512042ef31817fbb750002cb3121ace60b2110ed31e5341df6a1c458f99a3fd3ffa7a2ece7309f4895dfe9908744f8e429957957098e06cd65757251f848d0064de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e90fa015e8b5be1674925798b8f63c5e
SHA17bd9632ffcb3f4eb9a0e5be95a3c8406a65cf166
SHA256b9ee888c23cade4bc605936725806f2ad175fe8dcaae941edc60db818540032b
SHA512f7d23b22320559ca1c131a2ed34d9b69fecc772bf8175e098372d73bcfe026b1173fba0004c221f65fd4787f146b08308f36493dcce5a6b77fb93c3a1194f03f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ea4ca90fd20123a19ee0575daeb489b
SHA1e48cef6f3da9a393782c28355dc54475f7be0f0c
SHA25691139335d0bdfa1071412a0e7be1d0d16b2a16304361b8321e8443a97ceb85a8
SHA512caac6118b2fcd20303970d2ba986a7655dd17e7fe61d28958245f6b902ff1b3422d01b80a9dee9f0ad0a65e476747373f2e8184c277c864e6fec497cbaa543d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58724022ad7a5a0af13bd4f683f8cf314
SHA1cb31ac8cd89be84e6bddf717ed97a31fe68496f1
SHA2562e907671fc20f2bbada7567fa940e707991f6be0fcc9f72f4cf578031ef9a1cd
SHA5120f01a4c8887eab6986f575eb487ba0b2752d33d4f43654d2fc6e73dd229227dcb098072851beaab3092f5b824045f736d26542c4fdb04723f395824bf6f764fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e8d5339af0e51175e2ac14f48eec032
SHA1453610ae25cfd0977e95a8f7ae3faaff6497d689
SHA2565bac4c6dbbf3bfbf48174d84cbefe724f290a3e86192276bbdb98b03f031b500
SHA5120674c8f13e2f03722480a2a25b2830294f566c82f7934c88e7193ccb762cdc77f3345b2bdccac7fb760799e10193dea4e94b922c8256b4d5a0abd724b3d7ee16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559c5348077025e8cb6415090c5d0b7c5
SHA1203313971e295f27171adbef810c738eefb3a670
SHA256cd9fe34be810c372ba08a7a77ae77a6e2cd202be488ca9ff9d0d6abbbdc41436
SHA512bb9c2d0797de4c8949a3af20ade3b67e5d80ae87a4b71ddb7b4bda2fee907107ab46ff873b3e21e7af5350820f8c4d6cd702f0e731b26b150ae3367c4afb403b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59eb08091d573c998095a77b895b7f8c7
SHA15026012cc96c8a169bfab4cfb14065068813512e
SHA2565e6aad17fc175dff4492476858bbd087b4f4d513d328d2b56a6013ca68b05857
SHA5125f9f4c2eb63bebf30bd763f41f8dc89d000226d53c22f08bad8c0cc73254dafd3c4449416c9e2e6e77fa37925d2a165640422e279047baea7410ee3be4482231
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1f9478734d7d8610d548a2ebc00fe04
SHA167aa7678d4ddfff0c151c4f0f01ec6af3b77e176
SHA25605949a208c04e85867881c543c7fd04fb1eaf1d2f4f96b58ff0bdba7dd97b1a9
SHA51224a75f622b8e26d1b1f9c9aca2ca78ec1c556b041ca97a59243f5b605ad3b63d35f098b2bb94384f1728603fc9742cca318af46a232dd417198937025d8dd867
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594eca9937d74b94e770ec9cedd6c93d0
SHA1552386cfceb59ca3b65af870cede8170e4cca99c
SHA2565f3b497fd4b220e2165abfb59fe995bca0d659711d1e8784f17fec1c976b695d
SHA512c3013ff8ba35fe80a40cadc35011d7a42bfad7f10e3add1c6434cee85b0e4befaee69027117dcd1b141c79eb1cd5784bfd67f9df6f514087d7e083589d2a3325
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a12b36d5939755159e18347b2b2a028
SHA13533870484344ddb17f356879c90efcc3b7ef6f4
SHA256168eb04f0051ec4bd480372d5304d5e1d006dfb32c44188a2d64486b5554eaeb
SHA512545f877b45899ab5970e4a1994cb43edcf16a468d56f0b3f3fa1e33a4c2ad939b23c356e5184fcd5672688b656fbe44b406414308375bf55a131d9c3fde9a0f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e95a0be25f8f65067d37cda84ac4557
SHA1cbcf0fc7f60788a26811fbad8b8a5d428f1e86ae
SHA25611ae63d14bb139cae0d8cbc72887e26440955b99c1656617e53f4d436e88b4e8
SHA51243532b589ddbb1215bdbfa70b8dd5bb9179f7c9f0eabc283d68571246b1e52d6fb305e004c0a0dee8dde8950caf9d5a5a1b73b948bcc5a6e315ca0bf6086881b
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
178KB
MD51bc97d36bfb5b3af6deef85448454605
SHA18f0902f8afbc37a11b4f36d43011119ef1d973bd
SHA256f02a49b4c374303b75e4dda5b89a13e3221a214791bc3b96a7dd766b306cd2f5
SHA512e04b623a254051191cee6f1451693168c3200cb32491a71abb82d514af4fb86485ab4c549dd2555e141797c721eaa02cd984df67f6c7f0de3481f4af77b0d02d