Analysis
-
max time kernel
82s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240729-es -
resource tags
arch:x64arch:x86image:win7-20240729-eslocale:es-esos:windows7-x64systemwindows -
submitted
12-09-2024 18:41
Behavioral task
behavioral1
Sample
Solara/SolaraBootstrapper.exe
Resource
win7-20240729-es
Behavioral task
behavioral2
Sample
Solara/SolaraBootstrapper.exe
Resource
win10v2004-20240802-es
Behavioral task
behavioral3
Sample
Solara/bin/api.dll
Resource
win7-20240903-es
Behavioral task
behavioral4
Sample
Solara/bin/api.dll
Resource
win10v2004-20240802-es
General
-
Target
Solara/SolaraBootstrapper.exe
-
Size
309KB
-
MD5
becc7a2510958905e91572f6259079fc
-
SHA1
885ef041f4f6c37a68752f246fc70a7b440e4d64
-
SHA256
2b424e128aaaa7ea88e6076e72516d60e149a6cfe20e861191e261b4bcd743d9
-
SHA512
cbfa0892764a588d4837d7c1c37407c5999bcadc6770a0885e54493457fff8b256a19af2bd6e08e7e042f67bb6b1f3c63a21e71c47af33b463f1a7863725ad01
-
SSDEEP
6144:YTxVlfJeX2+LOO1EuN1o1j0v2fA9LnH9niSr5QR0ZyeIxYhH9XDQc4/Q:YTblfJemsOONOj03UO5y0ZUxu9
Malware Config
Extracted
redline
185.196.9.26:6302
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/936-13-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/936-7-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/936-10-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/936-6-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral1/memory/936-15-0x0000000000400000-0x0000000000452000-memory.dmp family_redline -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
SolaraBootstrapper.exedescription pid process target process PID 2340 set thread context of 936 2340 SolaraBootstrapper.exe RegAsm.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
SolaraBootstrapper.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SolaraBootstrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
RegAsm.exechrome.exepid process 936 RegAsm.exe 936 RegAsm.exe 936 RegAsm.exe 968 chrome.exe 968 chrome.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
Processes:
RegAsm.exechrome.exedescription pid process Token: SeDebugPrivilege 936 RegAsm.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
chrome.exepid process 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SolaraBootstrapper.exechrome.exedescription pid process target process PID 2340 wrote to memory of 936 2340 SolaraBootstrapper.exe RegAsm.exe PID 2340 wrote to memory of 936 2340 SolaraBootstrapper.exe RegAsm.exe PID 2340 wrote to memory of 936 2340 SolaraBootstrapper.exe RegAsm.exe PID 2340 wrote to memory of 936 2340 SolaraBootstrapper.exe RegAsm.exe PID 2340 wrote to memory of 936 2340 SolaraBootstrapper.exe RegAsm.exe PID 2340 wrote to memory of 936 2340 SolaraBootstrapper.exe RegAsm.exe PID 2340 wrote to memory of 936 2340 SolaraBootstrapper.exe RegAsm.exe PID 2340 wrote to memory of 936 2340 SolaraBootstrapper.exe RegAsm.exe PID 2340 wrote to memory of 936 2340 SolaraBootstrapper.exe RegAsm.exe PID 2340 wrote to memory of 936 2340 SolaraBootstrapper.exe RegAsm.exe PID 2340 wrote to memory of 936 2340 SolaraBootstrapper.exe RegAsm.exe PID 2340 wrote to memory of 936 2340 SolaraBootstrapper.exe RegAsm.exe PID 968 wrote to memory of 2264 968 chrome.exe chrome.exe PID 968 wrote to memory of 2264 968 chrome.exe chrome.exe PID 968 wrote to memory of 2264 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2552 968 chrome.exe chrome.exe PID 968 wrote to memory of 2324 968 chrome.exe chrome.exe PID 968 wrote to memory of 2324 968 chrome.exe chrome.exe PID 968 wrote to memory of 2324 968 chrome.exe chrome.exe PID 968 wrote to memory of 1508 968 chrome.exe chrome.exe PID 968 wrote to memory of 1508 968 chrome.exe chrome.exe PID 968 wrote to memory of 1508 968 chrome.exe chrome.exe PID 968 wrote to memory of 1508 968 chrome.exe chrome.exe PID 968 wrote to memory of 1508 968 chrome.exe chrome.exe PID 968 wrote to memory of 1508 968 chrome.exe chrome.exe PID 968 wrote to memory of 1508 968 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Solara\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Solara\SolaraBootstrapper.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2780
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4ed9758,0x7fef4ed9768,0x7fef4ed97782⤵PID:2264
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1208,i,2734499765969849822,7792548066277522936,131072 /prefetch:22⤵PID:2552
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1536 --field-trial-handle=1208,i,2734499765969849822,7792548066277522936,131072 /prefetch:82⤵PID:2324
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1640 --field-trial-handle=1208,i,2734499765969849822,7792548066277522936,131072 /prefetch:82⤵PID:1508
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2328 --field-trial-handle=1208,i,2734499765969849822,7792548066277522936,131072 /prefetch:12⤵PID:264
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2344 --field-trial-handle=1208,i,2734499765969849822,7792548066277522936,131072 /prefetch:12⤵PID:2904
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1412 --field-trial-handle=1208,i,2734499765969849822,7792548066277522936,131072 /prefetch:22⤵PID:2528
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1028 --field-trial-handle=1208,i,2734499765969849822,7792548066277522936,131072 /prefetch:12⤵PID:472
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3348 --field-trial-handle=1208,i,2734499765969849822,7792548066277522936,131072 /prefetch:82⤵PID:1552
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3376 --field-trial-handle=1208,i,2734499765969849822,7792548066277522936,131072 /prefetch:82⤵PID:2860
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3900 --field-trial-handle=1208,i,2734499765969849822,7792548066277522936,131072 /prefetch:82⤵PID:1604
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2804
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
5KB
MD5aa53afc71d3e46b7934545533763b0f8
SHA1530f33cc3ffd77f520db2d2ef0d881bf72910a88
SHA25658984215ab6b856f909e4955cb507e2f56d96f0298c6a61bd8b3e6f80ddf1064
SHA512e540999f47c23dd2d9c598d36aa748582e026eb9533efc2b36a19ff0eb79c940a2dbccf779ec90732da398db0c9f769de42fdae406ca4656eb9e950cb6d8e2a2
-
Filesize
5KB
MD5d04bef68e5f6df4e4751b57498d52801
SHA1f2959b13dcab4363d61825497105d24831671501
SHA256c4a701e626ff59bab33644b633e0c2469992adeef68fda4a2e94f75ecf74bb50
SHA51240648f1dd37e3841c9915a6b4640729990d5a60a9df0824620817e13fa6e10e64c3307e7abe6596b6f327a8ad2e3e6bbad6c943bfc084838f8c7103d53ef672f
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e