Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 00:30
Static task
static1
Behavioral task
behavioral1
Sample
c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe
Resource
win7-20240903-en
General
-
Target
c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe
-
Size
2.0MB
-
MD5
ffaa2795cdbb9b9a2fb8f64ae59ab785
-
SHA1
5ed394f8cce0ef5a915756e2990c314bb5d9aa84
-
SHA256
c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234
-
SHA512
a3d34b0bf5e4ff6ac4ca7a048b2520abbe9263bb26baaacb3e812372d4a15e072ef0718598d5d2b68deee408ce6dffe42f2754db151516d4c8d98fe996fbe6d3
-
SSDEEP
49152:o96NRteryADpCW2G7CqreesNLsaisNeX7hwgqXn8D4E0fhbLUOu:o4NRIpcGCq/sqaisG7Vr0fh8Ou
Malware Config
Signatures
-
Detect Neshta payload 14 IoCs
Processes:
resource yara_rule behavioral2/memory/1412-4-0x0000000000400000-0x000000000090A000-memory.dmp family_neshta behavioral2/memory/1412-5-0x0000000000400000-0x000000000090A000-memory.dmp family_neshta behavioral2/memory/1412-15-0x0000000000400000-0x000000000090A000-memory.dmp family_neshta behavioral2/memory/1412-26-0x0000000000400000-0x000000000090A000-memory.dmp family_neshta behavioral2/memory/1412-100-0x0000000000400000-0x000000000090A000-memory.dmp family_neshta behavioral2/memory/1412-101-0x0000000000400000-0x000000000090A000-memory.dmp family_neshta behavioral2/memory/1412-102-0x0000000000400000-0x000000000090A000-memory.dmp family_neshta behavioral2/memory/1412-103-0x0000000000400000-0x000000000090A000-memory.dmp family_neshta behavioral2/memory/1412-104-0x0000000000400000-0x000000000090A000-memory.dmp family_neshta behavioral2/memory/1412-105-0x0000000000400000-0x000000000090A000-memory.dmp family_neshta behavioral2/memory/1412-106-0x0000000000400000-0x000000000090A000-memory.dmp family_neshta behavioral2/memory/1412-107-0x0000000000400000-0x000000000090A000-memory.dmp family_neshta behavioral2/memory/1412-108-0x0000000000400000-0x000000000090A000-memory.dmp family_neshta behavioral2/memory/1412-110-0x0000000000400000-0x000000000090A000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exepid process 1412 c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe -
Drops file in Program Files directory 64 IoCs
Processes:
c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exedescription ioc process File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe -
Drops file in Windows directory 1 IoCs
Processes:
c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exedescription ioc process File opened for modification C:\Windows\svchost.com c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe -
Modifies registry class 1 IoCs
Processes:
c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exepid process 1412 c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe 1412 c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe"C:\Users\Admin\AppData\Local\Temp\c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1412
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5468b1af869cfcf42975c0ffacb91b550
SHA19908a27271ebf9a4a278bf12cb72d1d8cf5e6d75
SHA256d0abaa6204734bf39e7db0ab36dfb60a53d949e2637558e09df68fbb63b9db91
SHA512da6a0f79be4ba38b7fdb06f33428ba2d6f5a59648f58b175e96abb49b8a7d1bf0857de50f49689adc27566293d9ec2b43cc094a60dd85eda5ef5c6c4ee898619
-
C:\Users\Admin\AppData\Local\Temp\3582-490\c6b616f1e523cf0164abfdf61bed202e1b063ac7114966adb4e3dc6ff31f3234.exe
Filesize2.0MB
MD5008fafa51f1335786971cedc364e490f
SHA1e538b370738df1b92a88d844d96ebb920434cb01
SHA256d2eb3b22027600eebe88de9e8965ef498403caf5a99254bd59af24b6bf64af2c
SHA512e82ce304ad41ca228ac4193e6e4ee653a0db3e70b16ea6ce3024ddeb6b2f5389adb6340898b96a748c03df3b84337ff9a7241c5ca917bda47f7be686a346c9d1