Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-11-2024 17:00
Static task
static1
Behavioral task
behavioral1
Sample
96e965e92237102b9f51aa2f7318bd46c0598232dbeca547dc1e78dcffd6ef35.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
96e965e92237102b9f51aa2f7318bd46c0598232dbeca547dc1e78dcffd6ef35.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
setup_installer.exe
Resource
win7-20240903-en
General
-
Target
setup_installer.exe
-
Size
9.5MB
-
MD5
e5debd90b07e67f9b1ae38e4412c86c4
-
SHA1
4b7e7161161709a25e5e655ee60f6eae3fa39c32
-
SHA256
c5c7eade46a64e20a9eae3757ec58a0c62f3d7e33971bacd7064a97588af39d8
-
SHA512
fb3bf8a363bac644f5ded4bd30ab779aa54d3e118b73893466ca93b738ad42f93ce0f3aafb7d1a1e0863f4a1506ac5faf588c344f4e812611e9c734157fe3113
-
SSDEEP
196608:xvlB860t1YFNDe2EuiwRBCpzp02nvIpO2XLrY1omCZHf8uXW8dDxQj:xvlBb0twDiuiLpnnMfHYebHUIHDO
Malware Config
Extracted
nullmixer
http://6246f7513680d.com/
Extracted
socelars
https://sa-us-bucket.s3.us-east-2.amazonaws.com/vsdh41/
Signatures
-
Nullmixer family
-
Socelars family
-
Socelars payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f7ae19ce0_Fri13a868de1.exe family_socelars -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS08841457\libcurlpp.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS08841457\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS08841457\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f7528c7e5_Fri13be9f3c6.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
setup_install.exepid process 2920 setup_install.exe -
Loads dropped DLL 11 IoCs
Processes:
setup_installer.exesetup_install.exepid process 2176 setup_installer.exe 2176 setup_installer.exe 2176 setup_installer.exe 2920 setup_install.exe 2920 setup_install.exe 2920 setup_install.exe 2920 setup_install.exe 2920 setup_install.exe 2920 setup_install.exe 2920 setup_install.exe 2920 setup_install.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f7a7a151d_Fri137e98926fc.exe vmprotect -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.execmd.execmd.execmd.execmd.execmd.exepowershell.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2928 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2928 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
setup_installer.exesetup_install.exedescription pid process target process PID 2176 wrote to memory of 2920 2176 setup_installer.exe setup_install.exe PID 2176 wrote to memory of 2920 2176 setup_installer.exe setup_install.exe PID 2176 wrote to memory of 2920 2176 setup_installer.exe setup_install.exe PID 2176 wrote to memory of 2920 2176 setup_installer.exe setup_install.exe PID 2176 wrote to memory of 2920 2176 setup_installer.exe setup_install.exe PID 2176 wrote to memory of 2920 2176 setup_installer.exe setup_install.exe PID 2176 wrote to memory of 2920 2176 setup_installer.exe setup_install.exe PID 2920 wrote to memory of 2540 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2540 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2540 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2540 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2540 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2540 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2540 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2488 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2488 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2488 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2488 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2488 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2488 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2488 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1260 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1260 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1260 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1260 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1260 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1260 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1260 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1276 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1276 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1276 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1276 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1276 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1276 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1276 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2340 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2340 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2340 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2340 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2340 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2340 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2340 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2124 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2124 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2124 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2124 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2124 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2124 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2124 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1848 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1848 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1848 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1848 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1848 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1848 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1848 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2872 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2872 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2872 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2872 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2872 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2872 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 2872 2920 setup_install.exe cmd.exe PID 2920 wrote to memory of 1808 2920 setup_install.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\7zS08841457\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS08841457\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- System Location Discovery: System Language Discovery
PID:2540 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 6246f7528c7e5_Fri13be9f3c6.exe3⤵
- System Location Discovery: System Language Discovery
PID:2488
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 6246f75363f77_Fri1366dac3a944.exe3⤵
- System Location Discovery: System Language Discovery
PID:1260
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 6246f75453fd2_Fri1347852ec.exe3⤵
- System Location Discovery: System Language Discovery
PID:1276
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 6246f76c1f60f_Fri1395d364.exe3⤵
- System Location Discovery: System Language Discovery
PID:2340
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 6246f76e6acbe_Fri134d8724752.exe3⤵
- System Location Discovery: System Language Discovery
PID:2124
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 6246f7710e6e4_Fri133f08d0114d.exe3⤵
- System Location Discovery: System Language Discovery
PID:1848
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 6246f7a522790_Fri130206254.exe /mixtwo3⤵
- System Location Discovery: System Language Discovery
PID:2872
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 6246f7a7a151d_Fri137e98926fc.exe3⤵
- System Location Discovery: System Language Discovery
PID:1808
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 6246f7a94bb5c_Fri136aafed62.exe3⤵
- System Location Discovery: System Language Discovery
PID:2976
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 6246f7aa4b416_Fri133529ec01f5.exe3⤵
- System Location Discovery: System Language Discovery
PID:2988
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 6246f7ab338f8_Fri13f726be9ff.exe3⤵
- System Location Discovery: System Language Discovery
PID:2536
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 6246f7ae19ce0_Fri13a868de1.exe3⤵
- System Location Discovery: System Language Discovery
PID:2672
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 6246f7af345ac_Fri13b7f06884.exe3⤵
- System Location Discovery: System Language Discovery
PID:2932
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD598c3385d313ae6d4cf1f192830f6b555
SHA131c572430094e9adbf5b7647c3621b2e8dfa7fe8
SHA2564b2e2adafc390f535254a650a90e6a559fb3613a9f13ce648a024c078fcf40be
SHA512fdd0406ef1abee43877c2ab2be9879e7232e773f7dac48f38a883b14306907c82110c712065a290bafac3cc8b0f4c0a13694847ad60a50a2b87e6aed2fd73aff
-
Filesize
152KB
MD5e0f600d0f15da0780b95105788201417
SHA19cc5b5d64157444815b101f8500c8535b36a4e62
SHA256938cbc262bfa2cdf449c75a47d92ef6a719f298ce96598057d42476b3098f5a4
SHA512a95aa09cd549ea32a1ddd1c78c6a1b90a2720f962f095377a321cf61af0fd5e22fafd40bf13c9d1135c5a71a1b82201c47680e8eedae20c1321d60186bb097cb
-
Filesize
312KB
MD5479ba7ea1f2fa2cd51a3ca59a9638010
SHA18992de6c918131fbe8821dd16cc0277951cd362c
SHA256d66c7fb807beccc1fa5a7d4162d3e8e2d553ba560653a404e1ce6de68ba8c801
SHA51270be353017f77f5b4fd82738700843bdc5848f175a39d07626dd9f4cb59b4d685dadf69de156f00c62dcc76f8fba233656df258ea103e1000ff038305580179f
-
Filesize
1.5MB
MD5aa1a33a40570d4fd2f17c569f4ab1170
SHA1fc9b9b6ef3235ea76c3b5fd5ded6b4554eaa01c2
SHA256e97a44529a5f1e223d471f68a1fe6bddb0754b4a4880067b6872154a781fd6a5
SHA512a1335b6b2c07ff9543634ffc3162facd8bac8d1bf24ed0a2a36246981994785838b5b1343c44bcf55ce771dfe5bcda44a18fc0bdd9cdee5f7f652065642bf115
-
Filesize
251KB
MD5c4753d4efda428971afd33ec13a00e9b
SHA18801c82e95d5d5ab2c87e81b6b7768142df957f3
SHA2568704c0b6842fd04928290c56a7cacb70e920c1af0ebad2bc981d5005345377b8
SHA512b651210962348faa03ec31874e37958c9294e58aa709199ffaa7f4e53d39e4100e2c2457f65bb0e72e5b8293ff07be0c421f8073f0d2b67a8923b5292f5300b0
-
Filesize
2.1MB
MD5d51275ff35e617742f06569fe0dc9cde
SHA1ec6f2e1ff8463c1f8d3cc4421af5815798e053f6
SHA2563d8077e64cf958be5a75783bba6c01719debd50a55b02d23d12e758ee7af5a8b
SHA512e2f37ccf8bf221ac779f53d20029f7caa85cdef56ade371b82a8ac366420bc6abdcf47b2d1f7f83ed70420752822a60b7026cba7e2372d49438c5e9949b8a71a
-
Filesize
371KB
MD56eced1a017445828224259a62a663478
SHA1e478e5e94d4fdb6d3f7c9bc1eb3a3faef7a27a8b
SHA2569caee013dc3b0158f883dd8926181e10993612769504be3884f0c5eb49c0a524
SHA512878892ba72658b67a78c1add2a5c0af900ed0d40a44664c89c993aa3a6b0733957d7f11317b8942e51c0139afea967f7ef3e9dc23ed0cc75f8553fd23d92fe64
-
Filesize
3.8MB
MD5a128f3490a3d62ec1f7c969771c9cb52
SHA173f71a45f68e317222ac704d30319fcbecdb8476
SHA2564040769cb6796be3af8bd8b2c9d4be701155760766fddbd015b0bcb2b4fca52a
SHA512ccf34b78a577bc12542e774574d21f3673710868705bf2c0ecdf6ce3414406ec63d5f65e3ff125f65e749a54d64e642492ee53d91a04d309228e2a73d7ab0a19
-
Filesize
252KB
MD58daa50a23acd7af738f176b2590e94c6
SHA12d58cb919ea524591bc6a08ff3fe77ae0db6221f
SHA2564d24517c0f7a7e07c07d3f4b819cd5f5165c7044bcc932e51ba39f082847d19a
SHA5123aca67a8d507d4029fb24b8f0b9a7aef57f70a16c833a9cfb2b51022fad4e54507edea21c2a4888843c6a9e4f6513ff49c0296dc09b45328d1c8300b9f90de87
-
Filesize
383KB
MD50a8d60731fe6e1dd5ab0e42ec68dd655
SHA15e0adf2c89c6dbf83f19e79d83b40402880884f9
SHA256e0c54390047af2d8491d9fd8032f3b2dec88cd34eb854aff8fb118ee7bd03ef3
SHA51258e96d65bf876d65372dd7c748933e2212676111e344ab749e4150dd3616eba140d2e128ef616aa8e0345c7db78e28c2157843c355e66cdc74c77f9c9e48a490
-
Filesize
1.6MB
MD579c79760259bd18332ca17a05dab283d
SHA1b9afed2134363447d014b85c37820c5a44f33722
SHA256e6eb127214bbef16c7372fbe85e1ba453f7aceee241398d2a8e0ec115c3625d3
SHA512a4270de42d09caa42280b1a7538dc4e0897f17421987927ac8b37fde7e44f77feb9ce1386ffd594fe6262ebb817c2df5a2c20a4adb4b0261eae5d0b6a007aa06
-
Filesize
1.7MB
MD59f2ba6cffd2e51c63f1f0bf153b87823
SHA1a00e56425d201225c41b13f22a09fb4562bc1cf4
SHA25630b2aac192d6bb77baf163dd16ee9c2b1e928d9ff62cbeee1ace6aa2d84d59e9
SHA512b97b73f356319e59d95010ce06b578db0f5a1f84c7863c066b1982a8106f6c86769b003e2ffde00941ce74b9f15bca8990fbffe6b350ff4a40166bc0bf416c7d
-
Filesize
315KB
MD584e9047be9d225a784b8855640a6d034
SHA1deadecb0340b58236fd4e6127b0a545c47e7393e
SHA25640fd6365f236050b75bd96ad7cab07c6b6875ce2c76016499bed58e5a27ef0de
SHA5128a721f423f61504bf0de5acedf37a5e48d8f8e7d74a547f1865904e168622a075d64f1bb7b2aa8f150a0eb0d1e035d342d5268b4ab460c18713ce6425330da50
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
2.1MB
MD5955a80af149655652530e472782aaf79
SHA1a581b2d53f8d2ca46458af201694789c0f501475
SHA256c50bf0b1a0313c72b557df6a60fa9937873772d105084f68c83e4f74fff8ca47
SHA512d610e8b64a445bf4306bcc980e6c3ead5ea898bbb8c03fa5f55202bf045042a28fdf15b9a8fd767131729f7b83c81c5b59a7a949a967d59370450b29e1268149