Overview
overview
10Static
static
3131b47af99...32.exe
windows10-2004-x64
10227ab56ef5...eb.exe
windows10-2004-x64
104537f51b0d...4c.exe
windows10-2004-x64
104852dcede8...5b.exe
windows7-x64
104852dcede8...5b.exe
windows10-2004-x64
104d68d381e4...34.exe
windows10-2004-x64
1062d27d23e1...d0.exe
windows10-2004-x64
106f4e5c3b3a...2b.exe
windows10-2004-x64
10775b7a0479...3d.exe
windows10-2004-x64
1080a8dab579...f7.exe
windows10-2004-x64
10a28852a355...af.exe
windows10-2004-x64
7d02a87f385...3a.exe
windows10-2004-x64
10d0c1074be1...1f.exe
windows10-2004-x64
10d427832084...e1.exe
windows10-2004-x64
10d53f5a64de...d1.exe
windows10-2004-x64
10d62198c81d...0d.exe
windows10-2004-x64
10dd0f820c33...a3.exe
windows10-2004-x64
10e3c377dc6b...f7.exe
windows10-2004-x64
10e9172c1691...86.exe
windows10-2004-x64
10f6c86e8cbc...da.exe
windows10-2004-x64
10fbd8d72f7e...0c.exe
windows10-2004-x64
7Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 08:34
Static task
static1
Behavioral task
behavioral1
Sample
131b47af993204905e6dd4dd4ff06b43cb1a0fe2e2b140520d4962f73d4b6432.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
227ab56ef5937ce1494f5b0cd787a052c624e8a674162dba77f9c8d6aebfbceb.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
4537f51b0d234db42162223f94f6617d6df0e7eb077362a4b5249ab8da1e684c.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe
Resource
win7-20240221-en
Behavioral task
behavioral5
Sample
4852dcede8c2a79b77049fad052569e7900c43963519e55522590fd06b2c0e5b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
4d68d381e45f27176b76095693f986c42472611f4598e13b214a1c40acc89834.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
62d27d23e1f8603e95173890b3a03815aecbbbba3cc357aa36aba1f8374397d0.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
6f4e5c3b3a8de995cf390c778532164b570dcf1ea9c58ab8797a7cc16a674a2b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
775b7a04793f8621742cc362f51bef7b4d75b10169fa3493b7c9f713d38fa73d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
80a8dab5792d1a02e87ec84b22f15eb4bbac6d7635c605250fb1379296e8ccf7.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
a28852a355422f5e5dba04ddfb954e654687e210441a284402775d3dbb8392af.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
d02a87f385dee50b4399336265bbf8fe7f692201914bcb50c64ca95a35707f3a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
d0c1074be1d3cb22682be7bb947cb39668cb342942917997126020b102ea101f.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
d4278320848f0e71f678149e0b9ee4ecac3b5305400ae7d69a7131364d60cae1.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
d53f5a64de740270c801f8951781be9743b4ec40b8b353271cb0cbf0a4c8b8d1.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
d62198c81df0ae252c179f6cb6041efd2bb2aea225a387a06ee457bcd7d5930d.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
dd0f820c33b1cedd17049cf9b5cc18637676e9aa3cfaadbd8f19144e345b7da3.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral18
Sample
e3c377dc6b3cceb0b4ae2fa0504de53fe1dad61a6bb656af0994220dfea6bdf7.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
e9172c16918ce5309dd65e1af444189e955a30b3ccec8e619cf23b147ebfb586.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
f6c86e8cbc27556d873bb54eaa4778cf8529fe90df5c8b3070e8ed040254afda.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
fbd8d72f7e8046c650efa73c6d984945abfe9952bd8f67360b4658fc5138e70c.exe
Resource
win10v2004-20240508-en
General
-
Target
4537f51b0d234db42162223f94f6617d6df0e7eb077362a4b5249ab8da1e684c.exe
-
Size
918KB
-
MD5
b8365d87b8119c3374d71028fbe72382
-
SHA1
baa6b90ca7d0c8b3649819e5255c5523d7228740
-
SHA256
4537f51b0d234db42162223f94f6617d6df0e7eb077362a4b5249ab8da1e684c
-
SHA512
3d074a6e1fc5c1a37e75d656b21cb48fe384b287c007018f436e4e33d7f471703d884bb7f99931607a97885ecae0275b8e508e48bad56d26ef2cfff0480bc252
-
SSDEEP
24576:SyfJi0RO8s7j4giInc2xlkIYQ6F0M2kjStFS:5RfyjhnWzF0M2kjKF
Malware Config
Extracted
mystic
http://5.42.92.211/
Extracted
redline
breha
77.91.124.55:19071
Signatures
-
Detect Mystic stealer payload 3 IoCs
resource yara_rule behavioral3/memory/2036-25-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral3/memory/2036-26-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral3/memory/2036-28-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral3/memory/748-36-0x0000000000400000-0x000000000043E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 6 IoCs
pid Process 4992 OJ6zi77.exe 3964 mG8bw52.exe 2580 1Dj96gq6.exe 4560 2BO3621.exe 2452 3IA82ld.exe 1720 4zi119HN.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4537f51b0d234db42162223f94f6617d6df0e7eb077362a4b5249ab8da1e684c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" OJ6zi77.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" mG8bw52.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2580 set thread context of 4272 2580 1Dj96gq6.exe 94 PID 4560 set thread context of 2036 4560 2BO3621.exe 103 PID 2452 set thread context of 4616 2452 3IA82ld.exe 108 PID 1720 set thread context of 748 1720 4zi119HN.exe 116 -
Program crash 4 IoCs
pid pid_target Process procid_target 4768 2580 WerFault.exe 93 3364 4560 WerFault.exe 101 4932 2452 WerFault.exe 106 1028 1720 WerFault.exe 111 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4272 AppLaunch.exe 4272 AppLaunch.exe 4272 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4272 AppLaunch.exe -
Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 2904 wrote to memory of 4992 2904 4537f51b0d234db42162223f94f6617d6df0e7eb077362a4b5249ab8da1e684c.exe 91 PID 2904 wrote to memory of 4992 2904 4537f51b0d234db42162223f94f6617d6df0e7eb077362a4b5249ab8da1e684c.exe 91 PID 2904 wrote to memory of 4992 2904 4537f51b0d234db42162223f94f6617d6df0e7eb077362a4b5249ab8da1e684c.exe 91 PID 4992 wrote to memory of 3964 4992 OJ6zi77.exe 92 PID 4992 wrote to memory of 3964 4992 OJ6zi77.exe 92 PID 4992 wrote to memory of 3964 4992 OJ6zi77.exe 92 PID 3964 wrote to memory of 2580 3964 mG8bw52.exe 93 PID 3964 wrote to memory of 2580 3964 mG8bw52.exe 93 PID 3964 wrote to memory of 2580 3964 mG8bw52.exe 93 PID 2580 wrote to memory of 4272 2580 1Dj96gq6.exe 94 PID 2580 wrote to memory of 4272 2580 1Dj96gq6.exe 94 PID 2580 wrote to memory of 4272 2580 1Dj96gq6.exe 94 PID 2580 wrote to memory of 4272 2580 1Dj96gq6.exe 94 PID 2580 wrote to memory of 4272 2580 1Dj96gq6.exe 94 PID 2580 wrote to memory of 4272 2580 1Dj96gq6.exe 94 PID 2580 wrote to memory of 4272 2580 1Dj96gq6.exe 94 PID 2580 wrote to memory of 4272 2580 1Dj96gq6.exe 94 PID 3964 wrote to memory of 4560 3964 mG8bw52.exe 101 PID 3964 wrote to memory of 4560 3964 mG8bw52.exe 101 PID 3964 wrote to memory of 4560 3964 mG8bw52.exe 101 PID 4560 wrote to memory of 1848 4560 2BO3621.exe 102 PID 4560 wrote to memory of 1848 4560 2BO3621.exe 102 PID 4560 wrote to memory of 1848 4560 2BO3621.exe 102 PID 4560 wrote to memory of 2036 4560 2BO3621.exe 103 PID 4560 wrote to memory of 2036 4560 2BO3621.exe 103 PID 4560 wrote to memory of 2036 4560 2BO3621.exe 103 PID 4560 wrote to memory of 2036 4560 2BO3621.exe 103 PID 4560 wrote to memory of 2036 4560 2BO3621.exe 103 PID 4560 wrote to memory of 2036 4560 2BO3621.exe 103 PID 4560 wrote to memory of 2036 4560 2BO3621.exe 103 PID 4560 wrote to memory of 2036 4560 2BO3621.exe 103 PID 4560 wrote to memory of 2036 4560 2BO3621.exe 103 PID 4560 wrote to memory of 2036 4560 2BO3621.exe 103 PID 4992 wrote to memory of 2452 4992 OJ6zi77.exe 106 PID 4992 wrote to memory of 2452 4992 OJ6zi77.exe 106 PID 4992 wrote to memory of 2452 4992 OJ6zi77.exe 106 PID 2452 wrote to memory of 4616 2452 3IA82ld.exe 108 PID 2452 wrote to memory of 4616 2452 3IA82ld.exe 108 PID 2452 wrote to memory of 4616 2452 3IA82ld.exe 108 PID 2452 wrote to memory of 4616 2452 3IA82ld.exe 108 PID 2452 wrote to memory of 4616 2452 3IA82ld.exe 108 PID 2452 wrote to memory of 4616 2452 3IA82ld.exe 108 PID 2904 wrote to memory of 1720 2904 4537f51b0d234db42162223f94f6617d6df0e7eb077362a4b5249ab8da1e684c.exe 111 PID 2904 wrote to memory of 1720 2904 4537f51b0d234db42162223f94f6617d6df0e7eb077362a4b5249ab8da1e684c.exe 111 PID 2904 wrote to memory of 1720 2904 4537f51b0d234db42162223f94f6617d6df0e7eb077362a4b5249ab8da1e684c.exe 111 PID 1720 wrote to memory of 748 1720 4zi119HN.exe 116 PID 1720 wrote to memory of 748 1720 4zi119HN.exe 116 PID 1720 wrote to memory of 748 1720 4zi119HN.exe 116 PID 1720 wrote to memory of 748 1720 4zi119HN.exe 116 PID 1720 wrote to memory of 748 1720 4zi119HN.exe 116 PID 1720 wrote to memory of 748 1720 4zi119HN.exe 116 PID 1720 wrote to memory of 748 1720 4zi119HN.exe 116 PID 1720 wrote to memory of 748 1720 4zi119HN.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\4537f51b0d234db42162223f94f6617d6df0e7eb077362a4b5249ab8da1e684c.exe"C:\Users\Admin\AppData\Local\Temp\4537f51b0d234db42162223f94f6617d6df0e7eb077362a4b5249ab8da1e684c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OJ6zi77.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OJ6zi77.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mG8bw52.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mG8bw52.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Dj96gq6.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Dj96gq6.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 5645⤵
- Program crash
PID:4768
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2BO3621.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2BO3621.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵PID:1848
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵PID:2036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 5965⤵
- Program crash
PID:3364
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3IA82ld.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3IA82ld.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- Checks SCSI registry key(s)
PID:4616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 5644⤵
- Program crash
PID:4932
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4zi119HN.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4zi119HN.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵PID:748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 5643⤵
- Program crash
PID:1028
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2580 -ip 25801⤵PID:1628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4560 -ip 45601⤵PID:876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2452 -ip 24521⤵PID:1564
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1720 -ip 17201⤵PID:4836
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=996,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:81⤵PID:4444
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
449KB
MD5b20706a0ec04c57ed2b4a5e46913e7d9
SHA189650de60fddea0132a01e2733cbf9059c314b26
SHA256a034dbd97ab78040031f44e1d3d9518e5353dd066a0a31a0bccf8c7b7e56c2ff
SHA512177576faec6f08a1c26443c96991f2d4c1f6097ad0b1351a63369132cd5e7eb2a6add244ed446b13a7127026e980bcde26c2674e815493de41a6386e38c17dd6
-
Filesize
628KB
MD520467f7f123bb694478cd1efa17e7f19
SHA17ad523c5a4256229adfdfc56880fe973d3a91453
SHA25669878d00b6962523943b43ae4a14b09b0b90ca5ed819cc43ecf792bf06fbbde1
SHA512c52dde78e7c876b8b829a69bbb341a2e9ca73959bc91886aa4094e8d346d98810bac94eee6a436beaf716496dc6947fc8aa56bf6ae800dd2b5ee720224fa6dad
-
Filesize
258KB
MD5eb418b8fd4cbd92d1c114c2e20568818
SHA1edd8f650f0dabd4ac13644150d6f4742eff5b090
SHA256ed2e182a9df58e4562681a15c7723a618d07970a9af4288cc7dd87aae9b8f996
SHA51260d22123eac01fce3d4bff463bcdf1734c03f412fa55c6f9ab45f58f5265e8b5711b45a4957acab15aa7c52857b105f592473a7fdd146d943d2694e4c8b35027
-
Filesize
388KB
MD558e995e36dc0136677189ddd667574a9
SHA187681dbf9b043617531f040fba0703df318d1acb
SHA2561cc98dab453853fb2a1ed08d8eec4029387526c8c4f42e50dbf45e75e3e042cd
SHA51230afb08376b80d6aa052b5d603be4c3b49cc2c30bf62bfe1056b799b894d25990035da201ba2ead8a375aff2d992fb4d3d2290d08bbe99c77d88e4179f00c9a0
-
Filesize
232KB
MD53ff825411b1fe07e712a5dcae34f80eb
SHA1e3e4358cabfa74d6e36e26754b01ed78434a6877
SHA25669bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739
SHA512325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81
-
Filesize
410KB
MD5846849a0002c63dae41ebc306e0ad461
SHA1e2dd0e1d0c6ad149dce2b245bf7d93aa16738e64
SHA256e4dec70236439be082de61d6a386c6269529556989d4e9bac096c3804468fa33
SHA5120dc328f01efd3d68563288cf3d37b051542aa5eb0539f56d3e927072a9b30b4a510256c1d091a7322e1059e5ee8189ced979ad6726b32df1a98c647498a56951