Analysis
-
max time kernel
121s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 21:58
Static task
static1
Behavioral task
behavioral1
Sample
file.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
file.html
Resource
win10v2004-20240508-en
General
-
Target
file.html
-
Size
1005B
-
MD5
fd879317e803d0d934db5bcc5ff8fcc8
-
SHA1
21b7954728b3579bbccddde44255bd8173f96f64
-
SHA256
2ab315537510fc91d73825d0d6661e9f4b141799877e2f5159892886265f362e
-
SHA512
2b274bf9900fd88d8697f67fdd82db000d1c1c9447ef1d4fd6b0202ac74008142ada2e30beed8f3b3e6e5ea8931f35cb21d5f5294ac9721a366d0d675043731e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b091dcf1dcbdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000003a091c50a3992da25b67c290acee3a39bf67d4718c07767d73eed0ee9709ada7000000000e8000000002000020000000239b274fad12252729fa1a7e9551a57a38e118c32811387c9d68bd84f63aa7e920000000d01edca161f6ba6baeb4569838f6b8f09f08e577016030262388dbd94a91d861400000000af7ac1af76cc7e9410716c19cd4eef021bbc4ec32106258163335d1f4a2ebc72ba6ae47e3e54810bee9fc5562ab86620086b5967567297eb09d402491c95f84 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424477796" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000d261b2b4db8f9b7c6efd4a62b56505118b9dc66fdb3738fa37db4f63018f6858000000000e80000000020000200000000c2aa3d1b13716259f74b4db18f12c9510807ceed08070200ad0617ef919d441900000002afa2713a617261cb279c975d5afb8d43ffdebfb1b2652b44fb1b128a9cd3be86872bdde75093a8b5860c480d80ed306eccc52abced9e4fa327d47155ad99d80f924b0ff0a165c43271ec6f62b84b7ddd9a0bbee8db028965d12f4fc442c6a0d089999f3fd93b9541b9447e244272103b241e0a700b786cf662314c783bb19a7bccff5cb8ee00a5f5b6159f83c29fb9940000000d741a6e65237366a2d78e607a5c6bccaf09ee9a898704b82f6287aaf8bd77d6343a3563d50f743ff3104f1e0842c21c7ae5c460f8034ed6a62f23292676fd478 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1C500F81-29D0-11EF-BD87-DEB4B2C1951C} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2212 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2212 iexplore.exe 2212 iexplore.exe 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2012 2212 iexplore.exe 28 PID 2212 wrote to memory of 2012 2212 iexplore.exe 28 PID 2212 wrote to memory of 2012 2212 iexplore.exe 28 PID 2212 wrote to memory of 2012 2212 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\file.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD558281a97a6f355d6cc21dc7c875f0d29
SHA108f1249ceaa0451611d5a9b4206b53016f55ec60
SHA256d9848af3e3c8a0a3e7c65b5f9782c2434012d67fbd637a5fa7eefa0a19aa4d18
SHA5129d8fc13a73a29e32427fd572e00f254edd085d895391e91db28a1c0f3d6d436dcddd8140bd5e6a189a663004e75a13ad9014f02520e7ac7d614066291d8ae664
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52c7c2a9cdaabbf3e507bec6ceb0147dd
SHA15753203994fcb31c8300202e852a8a8934273b38
SHA25673316c21f9196814b26464ffb51608187b4a1e74da9c82f81dfcbcb1ebe8a96e
SHA5122a6bbfc32c8df25c28ccfe88ccd360242e80e72387ddc791005df87e351deb8b9f7e8c2c7b49067cf5ae9dcd21d5bdb35e97ab6f82dd0cfe994b256c9fc51b64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b2ad71f7e7e1372c3628b3ead0ce0e29
SHA1f011db61e55c08dea4df2354fa908180931f8a11
SHA256babba0fdc3ac9ea63c375847d5dd15832314097ee0c7e67ddab766974b072ccd
SHA512f4ac8493f08ab9d8a8b219e77f546d1cf7b43adcb3145f88256ef1b61810c50bae031c84e9fa4258597401d0e0715699d34539de28cacec8182b9e0570db1f3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516d9f1ef04ba8a71f48ed09d2fffb800
SHA18aaf2fb37645de67f743fefee075e87c4e9f2a00
SHA2562280ab8bfdc7cc48feee785f1e34b4adb474987fec93b9540787f201a5687af4
SHA512f1be52e488685aeaf2b99fb018c7faf901c297824e0fbfd72ca6df02368e56a976ddb682584535de87c6cca10df976fcb2dffb4d06f426989223a34a4c519970
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d85927f4f21e407071e24ec981a92ae
SHA19cbd0b228043ee6449636efb229434718b35f816
SHA2563c945cd4761346b2dbbc3fd81d450bbd6416312f4b477956c90b9d7dfe65bea2
SHA5126d44a4b1892f285d02fe980b8e6f62944d1686752d2ebdf6028d05515d01a0f4359d3f894407b7f48fd4bf0726a8b55000f01774b70ebf58ca491012bc1edd91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50673edb0b7389576b7aef657293630ac
SHA1b8b764baf9a149123b0ce8590b5901a3a2e4c41c
SHA2560d35765a71fb57fafa922e71e3fff892aec392de205bb2f27fb62d6354f18e2b
SHA512fe12cc3013023614e2db7717f4650312f7dd14e871108f5b93c99051bdf4389ba47e733e623fc8742acd39a541c38e66d3887d5d51e57b9ca9ca4fb456f4bef8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5467961bcad121691acfc4f767fd9f142
SHA164daccdd42b0ec633730b57e19538e211eb90e24
SHA256a6a51b92c5e1f72d4d7369509d3cb7884ee854ed2fed833bd636344357636757
SHA5126c42dd9665dac9b138b54e5072bf55508de4bf3ae5fbb3542e6d0670f665663b7947107978cbc8f2f0fedd29ac3d0358de80d91e6e4f046ff7da28cb0f85d307
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5de8001ac01f943502fcfcbb29eb84db3
SHA169d9effdaaa42af551dabacda84788f43b738273
SHA2563d827b8e57ee68fbff38715793c97316226f9bf7898eb0fd50d0bd50f2620af6
SHA512445ac6f1280feb1dfdaabf1c25b7f8e1639c9452ecae07c1739a5f5e5eb06bb406386d957586582f098ea1cbcb8a8662d1f2a837d79f85478cc29c9c5f87cec5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d9c3e97c697d6b24c50721b65045b134
SHA1f918bb13f1922e68971a5a1a362d435b48092a3f
SHA25672cc6023346c3c5298b6f6d5bcbe6fba9e8886cbd54b5a34f3a8c453cae3d0eb
SHA51284974e932ebc5132a578dcb48e761e7e9046c8f934eea8d5377d9d073a030d42bd3d5e35c4346990511cc7552051bd2ec8d95ade08813abf8c2679cfd632f91f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53e2fc3ee86510862def6c7ef28ddf30a
SHA11c14ea53e082f3cbba86b20c1b7cd8d747239bce
SHA2562e5a0f2fbd89122f2ba3b4d01ff392c457649889b9adb14e3beedb9915dac3e6
SHA512ea4b70692f413abe56a6229983c21c1225f8670de862b203ded1f0b8e5db46cc1a3ae8393b9dec728b12f61cfe816226f1c4f25f83ab72d8153e320743047a9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56cc9b659ccb3f08a00b59e93a9d8f0fb
SHA1350b4296376683c9f3f414eda532e832221689ac
SHA256947ba9a4c22e82b98acc2e7e8c57e0ff9c63419894bd2c81c83a3060db35a424
SHA5122c4a261e36436d4d81459d4f28358aed4f6a11c97fb6632c2d95548babf9eb4720257b2b37c9d286a01a152c33fc9f179fe2814f241f88b1be8107edd105c5f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d8cd7cadb63a9ad12657d39fdb9c6fc0
SHA16ddd3ed4c74adc6ba112627c27981065b96b8c6d
SHA2569d4f5227a128327408c7e878c9862ccc319443999d45fae79a75f19c2db8e66d
SHA512c854e3696bec77e8032c0a8ef97c302e993654adbd6253f41f6df8e0dd64fc2758d566ded8165c4402379201ea729858fccc448de4239a88bb27a4fad09bbade
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e57c565a824f218517b9d3b0b8f3a2a
SHA10554a9918096aa12afc04df9c8395fa0f8a439ee
SHA256964705c8b589b10b6dda368c7e70d03cf0ac550f14d9482a0536a1e870f2e7b7
SHA5128eaeb29b312c1cfa9eff39bb3c2f706d8afbd50d7038433e01ef8ac7214b560adfc949dc5baa4a975e89393454d8256bfa2899edb06cba1673f27d158fdb31f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525254d9fa1536a35fca8931acb1f654a
SHA173eeaabf20af2f92f3a89e93cc7a949b45cb2786
SHA256b9c0a4c7e2a2dbc96a268ed939f2cd64400fe7822ca4c602f9afa66930f52dd0
SHA5124df1a74a65f3c96a133d694d4a5b790132002934249009e448d5fbd1ee828ee58f38cc58f8790f211ee9397539aae0eb922572a5fccdc497b0fa09096c349df2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d59177e80dc365caa89159aef6b4b418
SHA17a6bee5d9b11f47dba3517bedf5b8981bd942cfa
SHA256815dba404df55cdc01dac8cedd9a71bcdfb56e2273347e37824ad384c580d63d
SHA5124ed9c02842c83b46fe792edab8fa11bd1e30c29a7125d2ba4b2c8a05d75209a2d480fbcb2a8e11ffe69179efcf2dbf2fb3d03d753e503651725d9ee578a76248
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d70a8f9cfabcbd21b93fff337a30c4f
SHA11c3dbabf2e8e02864f20cf277e8abdde9c49913e
SHA256ff5bc887c2424f1b3f85b20ae05d3f650826e7d137524dfc0d03b24a73ce9cb7
SHA5122091c007b8b7ef2675a9bb18138e40ea3ec21edccf08e7f612ef2a4c7854f840ac279982f6f61382f486189c592eb54aa6fd8f7462bfcea5d15294754a5b7ad3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524e90f438365a9b935c045d821885523
SHA120ef00fe2d96d86e715de75c8d89119d342af717
SHA256f811b2d45e67cfab0052b807e21741136d2c530af89b6a6543ff8b437aad2921
SHA5126ea5377f24d9b15acdfe4b2a9e50d29c637970f651e7b92c2c4063b70c8dd445a058f578e24e7721fa1f02296f297306c57531eebf38a585e3c56e505a9658ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ef5aa6f492de2dedcec9228f9783ecc7
SHA1c8b827942eb0a32580ad898a29146c9005f29a35
SHA2561fd581699a74d13ca868925c21fcf4c85aad5ec1251e2f25f69a9112c68c50a9
SHA512c5ffd9335c450b2df876e25eb044cdaa1004bd9d1ebfd49f13f64e0132b30b70c03b3fcb1988b4e92a647f57976ce76c8eab491a2b53457a9fb90dcc3b97a5e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538e0482e695edc067cd37ca000ba9337
SHA1744d65fe00c6114891f855897856e1a32710f6a0
SHA2565386b4608653980a37d59de2f719dcdab070ffdad94db87dbb02cf3763c64429
SHA51217e39c8943d792906f5387ceffae13c68ea19f035a56f687c4e1ee18f222f1a23cd9e30850b03571bf557d1f332b00e3f3db6d443b2977bfc8fb086249a8ad3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560315576d4f9a8364831619769d37cb4
SHA1073cc1fc993104b5cf8f839c634ffb124e1f19a7
SHA25697cebd10f810d1e638b60cd8f2c35ec837acb1f24c0743b9a162985d297b4c66
SHA5124ba6f56d3e5ea47c1ee281626c07a0b0ca29bf805353789a1bdcc5198ebb843a6d6735bb411c51738ad8107f5bcff7f338d03dc922be9d6983d8b485eaea2b07
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b