Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 19:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
35353effc63e85ea0557f1d53ddd4e20N.exe
Resource
win7-20240704-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
35353effc63e85ea0557f1d53ddd4e20N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
120 seconds
General
-
Target
35353effc63e85ea0557f1d53ddd4e20N.exe
-
Size
9.7MB
-
MD5
35353effc63e85ea0557f1d53ddd4e20
-
SHA1
d6fbfbe155f0385a3b19e3b5a961638112543220
-
SHA256
bb1a64c33268bab904cea9956cfa4cc8f1cc32e1600f2056961737aaa66c2d45
-
SHA512
7898e7648307405b29794321a444f6ccf5d746155735984d6581feef6f0440ff4d763a2fc76f725b6398a1eb3d7bbb88127bef9851862dae0cba16372fb6fa98
-
SSDEEP
196608:NuqnhgJuP3LAhCiVX5WvSEA1oMuWr45hrr2k:pS+LeVeJWGhrr2k
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2548 microsoftsistema6.1.7600.163857.0907131255.exe 2832 wordpadfiltersystem.exe 2120 updategoogle1.3.36.151.exe 1888 microsoftsistema6.1.7600.16385.exe -
Loads dropped DLL 16 IoCs
pid Process 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2548 microsoftsistema6.1.7600.163857.0907131255.exe 2548 microsoftsistema6.1.7600.163857.0907131255.exe 2548 microsoftsistema6.1.7600.163857.0907131255.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2832 wordpadfiltersystem.exe 2832 wordpadfiltersystem.exe 2832 wordpadfiltersystem.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2120 updategoogle1.3.36.151.exe 2120 updategoogle1.3.36.151.exe 2120 updategoogle1.3.36.151.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 1888 microsoftsistema6.1.7600.16385.exe 1888 microsoftsistema6.1.7600.16385.exe 1888 microsoftsistema6.1.7600.16385.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\EngineSource = "C:\\Users\\Admin\\AppData\\Local\\Temp\\35353effc63e85ea0557f1d53ddd4e20N.exe" 35353effc63e85ea0557f1d53ddd4e20N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\UpdateGoogle = "c:\\program files (x86)\\google\\update\\updategoogle1.3.36.151.exe" 35353effc63e85ea0557f1d53ddd4e20N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BCSSync = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices" 35353effc63e85ea0557f1d53ddd4e20N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msinfooperativo = "c:\\program files (x86)\\common files\\microsoft shared\\msinfo\\es-es\\msinfosistema6.1.7600.163857.0907131255.exe" 35353effc63e85ea0557f1d53ddd4e20N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\operativoWAB32res6.1.7600.163857.0907131255 = "c:\\program files (x86)\\common files\\system\\es-es\\microsoftsistema6.1.7600.16385.exe" 35353effc63e85ea0557f1d53ddd4e20N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\EngineOffice = "C:\\Users\\Admin\\AppData\\Local\\Temp\\35353effc63e85ea0557f1d53ddd4e20N.exe" 35353effc63e85ea0557f1d53ddd4e20N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\SistemaWindows = "c:\\program files (x86)\\common files\\microsoft shared\\msinfo\\it-it\\microsoftsistema6.1.7600.163857.0907131255.exe" 35353effc63e85ea0557f1d53ddd4e20N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SystemWordpadFilter = "c:\\program files (x86)\\windows nt\\accessories\\wordpadfiltersystem.exe" 35353effc63e85ea0557f1d53ddd4e20N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msader15Operating = "c:\\program files (x86)\\common files\\system\\ado\\fr-fr\\windowsmicrosoft.exe" 35353effc63e85ea0557f1d53ddd4e20N.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll updategoogle1.3.36.151.exe File created C:\Windows\SysWOW64\ntdll.dll.dll microsoftsistema6.1.7600.16385.exe File created C:\Windows\SysWOW64\ntdll.dll.dll 35353effc63e85ea0557f1d53ddd4e20N.exe File created C:\Windows\SysWOW64\ntdll.dll.dll microsoftsistema6.1.7600.163857.0907131255.exe File created C:\Windows\SysWOW64\ntdll.dll.dll wordpadfiltersystem.exe -
Drops file in Program Files directory 16 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows NT\Accessories\RCXCCC3.tmp 35353effc63e85ea0557f1d53ddd4e20N.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MicrosoftMSTTSLoc.exe 35353effc63e85ea0557f1d53ddd4e20N.exe File opened for modification C:\Program Files (x86)\Common Files\System\es-ES\RCXE2E4.tmp 35353effc63e85ea0557f1d53ddd4e20N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\msinfoSistema6.1.7600.163857.0907131255.exe 35353effc63e85ea0557f1d53ddd4e20N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\RCXE323.tmp 35353effc63e85ea0557f1d53ddd4e20N.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\MicrosoftSistema6.1.7600.163857.0907131255.exe 35353effc63e85ea0557f1d53ddd4e20N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\MicrosoftSistema6.1.7600.163857.0907131255.exe 35353effc63e85ea0557f1d53ddd4e20N.exe File opened for modification C:\Program Files (x86)\Google\Update\RCXCC55.tmp 35353effc63e85ea0557f1d53ddd4e20N.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\RCXCBF6.tmp 35353effc63e85ea0557f1d53ddd4e20N.exe File created C:\Program Files (x86)\Common Files\System\ado\fr-FR\WindowsMicrosoft.exe 35353effc63e85ea0557f1d53ddd4e20N.exe File created C:\Program Files (x86)\Common Files\System\es-ES\MicrosoftSistema6.1.7600.16385.exe 35353effc63e85ea0557f1d53ddd4e20N.exe File created C:\Program Files (x86)\Windows NT\Accessories\WordpadFilterSystem.exe 35353effc63e85ea0557f1d53ddd4e20N.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\fr-FR\RCXE295.tmp 35353effc63e85ea0557f1d53ddd4e20N.exe File created C:\Program Files (x86)\Google\Update\UpdateGoogle1.3.36.151.exe 35353effc63e85ea0557f1d53ddd4e20N.exe File opened for modification C:\Program Files (x86)\Google\Update\UpdateGoogle1.3.36.151.exe 35353effc63e85ea0557f1d53ddd4e20N.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\WordpadFilterSystem.exe 35353effc63e85ea0557f1d53ddd4e20N.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wordpadfiltersystem.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language updategoogle1.3.36.151.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoftsistema6.1.7600.16385.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35353effc63e85ea0557f1d53ddd4e20N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoftsistema6.1.7600.163857.0907131255.exe -
Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 microsoftsistema6.1.7600.163857.0907131255.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wordpadfiltersystem.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wordpadfiltersystem.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString updategoogle1.3.36.151.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString microsoftsistema6.1.7600.16385.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 35353effc63e85ea0557f1d53ddd4e20N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier microsoftsistema6.1.7600.163857.0907131255.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 35353effc63e85ea0557f1d53ddd4e20N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wordpadfiltersystem.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier updategoogle1.3.36.151.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 35353effc63e85ea0557f1d53ddd4e20N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString microsoftsistema6.1.7600.163857.0907131255.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 updategoogle1.3.36.151.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 microsoftsistema6.1.7600.16385.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier microsoftsistema6.1.7600.16385.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2548 microsoftsistema6.1.7600.163857.0907131255.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2832 wordpadfiltersystem.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2120 updategoogle1.3.36.151.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 1888 microsoftsistema6.1.7600.16385.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 2200 35353effc63e85ea0557f1d53ddd4e20N.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2200 wrote to memory of 2548 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 31 PID 2200 wrote to memory of 2548 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 31 PID 2200 wrote to memory of 2548 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 31 PID 2200 wrote to memory of 2548 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 31 PID 2200 wrote to memory of 2548 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 31 PID 2200 wrote to memory of 2548 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 31 PID 2200 wrote to memory of 2548 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 31 PID 2200 wrote to memory of 2832 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 32 PID 2200 wrote to memory of 2832 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 32 PID 2200 wrote to memory of 2832 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 32 PID 2200 wrote to memory of 2832 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 32 PID 2200 wrote to memory of 2832 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 32 PID 2200 wrote to memory of 2832 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 32 PID 2200 wrote to memory of 2832 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 32 PID 2200 wrote to memory of 2120 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 33 PID 2200 wrote to memory of 2120 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 33 PID 2200 wrote to memory of 2120 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 33 PID 2200 wrote to memory of 2120 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 33 PID 2200 wrote to memory of 2120 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 33 PID 2200 wrote to memory of 2120 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 33 PID 2200 wrote to memory of 2120 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 33 PID 2200 wrote to memory of 1888 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 34 PID 2200 wrote to memory of 1888 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 34 PID 2200 wrote to memory of 1888 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 34 PID 2200 wrote to memory of 1888 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 34 PID 2200 wrote to memory of 1888 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 34 PID 2200 wrote to memory of 1888 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 34 PID 2200 wrote to memory of 1888 2200 35353effc63e85ea0557f1d53ddd4e20N.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\35353effc63e85ea0557f1d53ddd4e20N.exe"C:\Users\Admin\AppData\Local\Temp\35353effc63e85ea0557f1d53ddd4e20N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\program files (x86)\common files\microsoft shared\msinfo\it-it\microsoftsistema6.1.7600.163857.0907131255.exe"c:\program files (x86)\common files\microsoft shared\msinfo\it-it\microsoftsistema6.1.7600.163857.0907131255.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2548
-
-
\??\c:\program files (x86)\windows nt\accessories\wordpadfiltersystem.exe"c:\program files (x86)\windows nt\accessories\wordpadfiltersystem.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2832
-
-
\??\c:\program files (x86)\google\update\updategoogle1.3.36.151.exe"c:\program files (x86)\google\update\updategoogle1.3.36.151.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2120
-
-
\??\c:\program files (x86)\common files\system\es-es\microsoftsistema6.1.7600.16385.exe"c:\program files (x86)\common files\system\es-es\microsoftsistema6.1.7600.16385.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.7MB
MD526652e5213c4edba59c3dc6b22c55616
SHA106d33a43ad52cd52e470af40cde4b26b245610f3
SHA2566a6f76bdf2a36f1a22499168c47550aae8b4b03f2161f0ae3370e7f9d95a1342
SHA512c39a1c395697e6b66bb79b905d8a950249e25b870cd17dd7d2e3443a34b72aabef19c0966c0caef29a1c8931895b17aad45deb63a18ea94a391b4b23bb20924d
-
C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\MicrosoftSistema6.1.7600.163857.0907131255.exe
Filesize9.7MB
MD535353effc63e85ea0557f1d53ddd4e20
SHA1d6fbfbe155f0385a3b19e3b5a961638112543220
SHA256bb1a64c33268bab904cea9956cfa4cc8f1cc32e1600f2056961737aaa66c2d45
SHA5127898e7648307405b29794321a444f6ccf5d746155735984d6581feef6f0440ff4d763a2fc76f725b6398a1eb3d7bbb88127bef9851862dae0cba16372fb6fa98
-
Filesize
9.6MB
MD5602a2e58c7a69c5bd2c76bfe164ee282
SHA1c43310242f3c3f116d545f70b91b4659fdc7211e
SHA256c9aef5f6febeadeeb0aa5e3c4c6e877f492c255e86d64708188a40493ccb6c0c
SHA512ca53f47ac83c5ddd71b0dda0a520f247ae556f1ace3461080e55ff67d0605f012e0014362872a96aabe6926833fab24aa52c535da7ec26912a44b1cfb32ad9e3