Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
24/12/2023, 18:24
231224-w112ksffdr 1024/12/2023, 18:21
231224-wzcycsfchm 1007/11/2023, 17:16
231107-vs31jadh73 10Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 18:21
Static task
static1
Behavioral task
behavioral1
Sample
95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe
Resource
win10v2004-20231215-en
General
-
Target
95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe
-
Size
765KB
-
MD5
52f22c2a5b2c339e75f176bf5bfcb3f3
-
SHA1
0a3b96aa59d5eda04c731bfb9c2ba7fef997d1b9
-
SHA256
95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4
-
SHA512
ec5f24367c46ff558110022ad8e1106fe5d1d9b9f94cf423b0cd1e1cd7d5ee3111e16cc12ccf3d6e65c5a5d5358691726172e33fb6338e1b7291be9566766da8
-
SSDEEP
12288:mokzmesNcOJCG4jm2E2SLZJsiXlg8XGB2P3yo1jaUPC4t56ha6DJof5:izk/QDo2SVJsylBXjVNPyvu
Malware Config
Extracted
djvu
http://zexeq.com/test1/get.php
-
extension
.jzeq
-
offline_id
4FMaMDK6uqPZOxJj64677pqiSGF54A1Dam9zfUt1
-
payload_url
http://colisumy.com/dl/build2.exe
http://zexeq.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-TAbs6oTGSU Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0821ASdw
Signatures
-
Detected Djvu ransomware 17 IoCs
resource yara_rule behavioral2/memory/2212-2-0x0000000002790000-0x00000000028AB000-memory.dmp family_djvu behavioral2/memory/2280-3-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2280-4-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2280-5-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2280-6-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2280-15-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/996-20-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/996-22-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/996-21-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/996-28-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/996-27-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/996-34-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/996-35-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/996-32-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/996-48-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/996-51-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4976-77-0x0000000000960000-0x0000000000A60000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe -
Executes dropped EXE 5 IoCs
pid Process 776 build3.exe 3388 build3.exe 4976 mstsca.exe 3248 mstsca.exe 3804 mstsca.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4052 icacls.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\234e9d17-043f-49e3-8365-014a2794f1ef\\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe\" --AutoStart" 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 api.2ip.ua 21 api.2ip.ua 35 api.2ip.ua -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2212 set thread context of 2280 2212 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 92 PID 4016 set thread context of 996 4016 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 96 PID 776 set thread context of 3388 776 build3.exe 110 PID 4976 set thread context of 3248 4976 mstsca.exe 118 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4324 schtasks.exe 3628 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2280 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 2280 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 996 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 996 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe -
Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2280 2212 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 92 PID 2212 wrote to memory of 2280 2212 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 92 PID 2212 wrote to memory of 2280 2212 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 92 PID 2212 wrote to memory of 2280 2212 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 92 PID 2212 wrote to memory of 2280 2212 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 92 PID 2212 wrote to memory of 2280 2212 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 92 PID 2212 wrote to memory of 2280 2212 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 92 PID 2212 wrote to memory of 2280 2212 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 92 PID 2212 wrote to memory of 2280 2212 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 92 PID 2212 wrote to memory of 2280 2212 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 92 PID 2280 wrote to memory of 4052 2280 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 93 PID 2280 wrote to memory of 4052 2280 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 93 PID 2280 wrote to memory of 4052 2280 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 93 PID 2280 wrote to memory of 4016 2280 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 95 PID 2280 wrote to memory of 4016 2280 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 95 PID 2280 wrote to memory of 4016 2280 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 95 PID 4016 wrote to memory of 996 4016 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 96 PID 4016 wrote to memory of 996 4016 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 96 PID 4016 wrote to memory of 996 4016 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 96 PID 4016 wrote to memory of 996 4016 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 96 PID 4016 wrote to memory of 996 4016 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 96 PID 4016 wrote to memory of 996 4016 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 96 PID 4016 wrote to memory of 996 4016 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 96 PID 4016 wrote to memory of 996 4016 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 96 PID 4016 wrote to memory of 996 4016 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 96 PID 4016 wrote to memory of 996 4016 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 96 PID 996 wrote to memory of 776 996 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 101 PID 996 wrote to memory of 776 996 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 101 PID 996 wrote to memory of 776 996 95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe 101 PID 776 wrote to memory of 3388 776 build3.exe 110 PID 776 wrote to memory of 3388 776 build3.exe 110 PID 776 wrote to memory of 3388 776 build3.exe 110 PID 776 wrote to memory of 3388 776 build3.exe 110 PID 776 wrote to memory of 3388 776 build3.exe 110 PID 776 wrote to memory of 3388 776 build3.exe 110 PID 776 wrote to memory of 3388 776 build3.exe 110 PID 776 wrote to memory of 3388 776 build3.exe 110 PID 776 wrote to memory of 3388 776 build3.exe 110 PID 3388 wrote to memory of 4324 3388 build3.exe 109 PID 3388 wrote to memory of 4324 3388 build3.exe 109 PID 3388 wrote to memory of 4324 3388 build3.exe 109 PID 4976 wrote to memory of 3248 4976 mstsca.exe 118 PID 4976 wrote to memory of 3248 4976 mstsca.exe 118 PID 4976 wrote to memory of 3248 4976 mstsca.exe 118 PID 4976 wrote to memory of 3248 4976 mstsca.exe 118 PID 4976 wrote to memory of 3248 4976 mstsca.exe 118 PID 4976 wrote to memory of 3248 4976 mstsca.exe 118 PID 4976 wrote to memory of 3248 4976 mstsca.exe 118 PID 4976 wrote to memory of 3248 4976 mstsca.exe 118 PID 4976 wrote to memory of 3248 4976 mstsca.exe 118 PID 3248 wrote to memory of 3628 3248 mstsca.exe 120 PID 3248 wrote to memory of 3628 3248 mstsca.exe 120 PID 3248 wrote to memory of 3628 3248 mstsca.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe"C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe"C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\234e9d17-043f-49e3-8365-014a2794f1ef" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:4052
-
-
C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe"C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe"C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\19cf3f99-ca3c-4c7c-866a-e2efd9729a89\build3.exe"C:\Users\Admin\AppData\Local\19cf3f99-ca3c-4c7c-866a-e2efd9729a89\build3.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\19cf3f99-ca3c-4c7c-866a-e2efd9729a89\build3.exe"C:\Users\Admin\AppData\Local\19cf3f99-ca3c-4c7c-866a-e2efd9729a89\build3.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"1⤵
- Creates scheduled task(s)
PID:4324
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"3⤵
- Creates scheduled task(s)
PID:3628
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
PID:3804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5ad1b831e6b39763c118dd6bf34d8641a
SHA143e23a3d91315736f59751521ade3224f45ece86
SHA256fe673f5da906667a2f5b08f086d292da711c854fce0268f8e4ed7d4d6e62d58a
SHA512cabe0d43a8bc792b9725af5bdb918a7edfe4e7542771cceb57d8686fab0c2c1a5201346f8e960ee31cfa46c1c291d59bcee04b867ff43dfea2520066c8da3fc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5d0348475d97cbf142823f89361bf1631
SHA1bb08be152141c14ad3701acca78fbadcd534750c
SHA256f99b15705d6c99e228d1fd844eb03e57283c509018e6fad558b6e9b08e8d4b9c
SHA51253d977be6ca52a93171f5da178316336afddf6a16e0f580d915a6378473ed66fb69b9275a7534733cd43ed6fdcd4f9118f535495e15627e2eedfe57b49fcb6e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize392B
MD5f188017dd83e83c8d10095c45c5e46dd
SHA1c245c973bf37a5413ce9dc8f9ff3338c5ea88e3b
SHA2569f7af5d37856852a54ec9f820532b55a4457f3ae16b0d5edc02e3d31131cd5e5
SHA5129ad8b3e9e78610ca8884b2bd0075fd6565e31eff076222732e24a240eb52b5961b48735fa1fb7a427ca96a3030443c1ff77c77e79fac90c97b0fd216f4615bfd
-
Filesize
123KB
MD5eccf76919c29ef71366b42f4c90c6eed
SHA1f290614fbadb8394195c6ca21b262eb443b4da70
SHA2569ace70192eba0778261d2850efe915d7c5dbd58b316629b3c6da8e87e4d9cf59
SHA51258e8b4dc3183841d2b6bb5dcbf4822d6c1a81e6c7d87653a7422ef8d26719ca6700430b703e55ce0f970415512a116156b0fee70efa3eeeb00ea7bf459d5cc17
-
Filesize
109KB
MD59b0a4e50f7a3759d0b0602d44f052721
SHA1ac52bcfce67c9415ba2057005f7d9137b99d575b
SHA256ca3b686e64ed6f43cfb32fc12a83cbeab9fcfc7712f88ad404f4497d9a4787bf
SHA512da3ceb7b4441cd32e879612d3044e101f2d5fb129896606965ed63001119cc4960c3abb9dbf5429d14fc4fa72d6700beaf865038dbb326dd36d3ac34c805a29a
-
Filesize
127KB
MD53fde9f5ea22bc162a08ac6d11b91fe47
SHA1e02cf18803a21bbd21cf70cbf3c5c62e480dbfe1
SHA2561ad4bbc9e8a76999ba10038c5c0925dda39bb480a58b4101d8e861026d4de208
SHA512b2238ab5c41f9f957e10841c8c23808c660f5440caee78eca03e214ca7db6ed86467ab7162b90b89c56c3f671e29d40fc1bd49fcbb80f766eba30a9fc133cbc1
-
Filesize
57KB
MD574ae9689cb04bde426e036319feeb49b
SHA1b932fd3571f6113cacf1e5eb2b3453a05887963c
SHA256b59f5c8dc70d0092f4257c3e13745f67e6324edeee709eff32336d3c93bca180
SHA512642d69ab7ef11418b9d97cfa8882ba38ba5c08fcec428a8a758b9de8ee1d576b4d1fe1a2ca93dc4f1f5e6a8eba8c21f7309975c0c43033350d51e5efe7fcafca
-
C:\Users\Admin\AppData\Local\234e9d17-043f-49e3-8365-014a2794f1ef\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe
Filesize65KB
MD5c37efeb4ac415ddb19de2bf576ce920b
SHA1a099cf9eefddea9c46c1a385055ea75ff0e6a254
SHA25603391acd52a3640f58172b539d705b671d68db4d627e08f9cc6ec2a2e2582f1e
SHA51254f1802269ed3e4c7f7358edc24375ac8828561b427549d41736d3abbae933afb680f9bc4bfb214d19b0c9cf42f2e3b205e47df2fdd6845786da4b3477f72f58
-
Filesize
299KB
MD541b883a061c95e9b9cb17d4ca50de770
SHA11daf96ec21d53d9a4699cea9b4db08cda6fbb5ad
SHA256fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
SHA512cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319