Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
libskins2_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
libskins2_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
Resource
win10v2004-20240412-en
General
-
Target
libskins2_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
-
Size
15.6MB
-
MD5
67a9225e3a5a2c367b950353e0c052e3
-
SHA1
8592ae20281b057d56de6945b7b712d8c7a3f79a
-
SHA256
68dc19a4e00817951a0328c88d18c3925332e3c37da50936dd3143df43f4ed92
-
SHA512
ed1581e82c5a03f60480c748eab033beeda1ba1488df42c8ec8a9a38ff48b8bdd2e66cb91a50b20c5cbcd61470777539e12e4148988e0f7fdad52f5be1644f70
-
SSDEEP
196608:NIy06k+L4MNEiRTSfKSARr3BlDvzmnMGhS8/s39Gzne/ehNwellqHpFxVRxZYHIH:PBsX+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000a2e8f329d44e1cd7182803f580932338059d4fd68d2b080f768b22b92e29d7cd000000000e80000000020000200000006440ca53cc17828e26771da445d9abbd588b6c59b0161c4dfcd48dd6af28a12220000000969f7432fed58853b45997f94d7b5403eee65a2b7ac89ec434ec3e7af92caee040000000d2fe48cb78548eb47983a93e4354543195e8ebaad88d828e4a5ee4711ad1307d47019b97ba7a4a51258334bf821b90ead0e8dde12e5e4b5024d89b1c61492b24 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7000c6a94792da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000ef594ae66261b86ca65508b5615bdff18dc79585c8a326a4780d3f4a0ca3f5ec000000000e8000000002000020000000df1a35c08924d530525aee6e48663dac47aeb9c157f3596cc51a6a898ad5c56990000000b8ecb6f66d1a06e36ade28bf3c4e7d157ee35d20a6ce0f8690ca184fd14114331213667613212e9de77c6b8ff390f03f1f6bc520a23ae27018be46e581efe5e2fb621da578796c0e8502ea58a18e25de9a290af721377a80a35a277f1c796c73b007dd077630c3a3db097c88fa80dad96dd9cf2522f1a020a2f4e1db893b6b8e03995afe3175e2305893351f48602408400000000128df51481ae48628a3b7d4b3f544ced2ebe6c03ad055d6414f0ce7b9784c15dc2ec77b1bc8e54609c556143fe81d35f96a3d66e4a9383a4394271ef8ab734a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D35CCA41-FE3A-11EE-A6AA-4E798A8644E3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419685777" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1804 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1804 iexplore.exe 1804 iexplore.exe 2752 IEXPLORE.EXE 2752 IEXPLORE.EXE 2752 IEXPLORE.EXE 2752 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1804 wrote to memory of 2752 1804 iexplore.exe 28 PID 1804 wrote to memory of 2752 1804 iexplore.exe 28 PID 1804 wrote to memory of 2752 1804 iexplore.exe 28 PID 1804 wrote to memory of 2752 1804 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libskins2_plugin.dll.svn-base_id=e3b43bd36fd50840467669364014ee53553872c1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1804 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a1ebbb0d655a829fd238cf66dab08b7
SHA18c1df745ebbabf84808037e352a70bb27a21acac
SHA256a484fe5f974817a7da0bc38c009f61d68a345b2610a04f296d3c55a730d0f1a2
SHA5127c66b84f6ec1b67850a6b252da9265ba5edd8fd3361c0502e36c8fbd1ed4e2ecccd5b9ba0e5b4bddb893b6cd7fea729c2ebb0ad896d2e901f4099d9ac1b2f677
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54236a630120a7f4adca5470f0b0affc4
SHA1b4299e6a2b79e5529ea83e2efa79d6611852c010
SHA256e8f42af5d0e4a972edd29ad0f547e851d6b10b7b5f4b5f523b57248a13a7afff
SHA51252a67e786867aa7b4a00c6cb10f88d67ead715df891acfcaf19fe3e368270794e5f828575f1e90ee590852d63aa097c1a6ea56235eec4a38967e68a9da13ede5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d41c01afe66017a99f917c218532c3fc
SHA12ffaac32f9ba1d0b107e58a6f6d3f8f91635121f
SHA25672a7909a6cb45c481ca33569bc122523ca8dac0597895e914323cf15b5e10645
SHA512eaf01319577b75158ca9bd06e2be5197f07a3332ecda435db90ae15afbeb3a3f4edfec7f7a6bc6ef183c148318ca9a0c3a7f5642a63159e13135c3354eb152b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539d16a4c482491c43c20740bae37cec8
SHA1726e3d3e0b8c71721dbc2dab1d8a2bede304e3be
SHA2569db679b5605482a6c3ab42c4b125fe516bdaaac24e77a1942473ac40d86e29dd
SHA51249d059fb95f90c603b972af4e4d1b0f3fd518841d172af375646d413f0aad733e613f7cfead650925ed1e52a0c5248ab5924dc91fc0e5d46be3ce61e9c3cd176
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52706798848c343ca01487379c793c3ec
SHA1923b989c06d75b31eeed4f48525ea41ab320078c
SHA256fae66fb6803247fff0007682abae86d479bc78b34ad5e420038c45072761b4f4
SHA51228516f629ed74020403b75f9191fe8a5e5cd205fc4a8baab80e916b3e5d2ffb4e36a3f6c3ae66732d1e555484a7a24f1567a8cf1c7fb158e06cf65d8b9830dbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5db9f1896a9fd601cfbfbbe5542188e
SHA1c8a3b7f3a47e4cda68819cf9698491728c62bdc3
SHA256d9178559ee4e84a4ed1dddbf3bc60d4d07dc9ff3d896e864c7ba28ddbc057ceb
SHA51286592607c101019d4edc2b6f8bb850041058fb45c12a7f6641d43922031118be9fb126333b6199711acdf5a1367d89868a178fd757760e8f7de487b4c1bb3028
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530ffe37252ca1b7ad3ea25fa69eb2e43
SHA15531b94cc8f98948da926cc24db6bb5d575a45e3
SHA25662c9eb75992629b910375eed792af1f262995cc093833ef303ae440268e33652
SHA5129a47bd0e9378fa9439fdfccab2a05f2cd8372c7560539d6eeeda21271c9c56832305bc4f1468b9e201c7f7bb30e14d0aa976811e2f9008f533bee4d9abf27ccf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55516ced0c608d2e7d8db33e33fd5b6ff
SHA1a1383b72bc7d151b662aecee7996a5a02e28c3d6
SHA2561f7b1f1ecfba5c8106024ed20ac6a1e1d0c94356f52d613c2f6107ecf60f865b
SHA512481973672c5c981fb01b26353a45a83db325452baf8f2ff87b259327b100ca5f9a11880815b6e2be8ea98b76d597d91e72742a1106889870d337367e4b80e04e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553bbf61db1d04aeae609cb0506b1c47c
SHA1c9066e58042418e556e3e9983b4c55b2c12e6461
SHA2563d389697d099bd65da10b07b445de2a13d4945cafb2ef4703dac97dfe54d34a6
SHA5120feeee92b1d9ad3e12a1f3c60936106dc9ca3aa1ddeac30a4c3c4395f88be3fc658114a4f757c7c23a77bec4be0ee1c7fb674d3058843c41da0c96171cfd83af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a87beb814129f7f33c48a6f0ef5bdc81
SHA149a5e3350408f512bebc1a0320b7e68116b34aa8
SHA25651b037bcdf927bdd2cb421e700bbdd1d54e54636eedac6f390f2c20b2dbb1dbf
SHA51217d21ad3cf94e0f75b33028b5d116f90cf00c6855bbf29fee20132ef6baf88b3c0b68fa8a7e2473b036c622ac8408da4ff007887f9e1eac5c837a694fb2259d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a956d145ca7a4102a82c41ca32d63384
SHA1b1019c829e35343209dc5524ed7f1f14fc1d09e0
SHA25693313196bb8887e05d3e44994c759a592f9c7703e456a78b7c392056dd5f51e8
SHA512edebc1e269072237ce1c3e6eacc9ba25e06020c5149187f5f70169e04f48c7e0f75477d21535e4525f5415ccd184aa5d39d87c4546011c1a2420ec659ce46454
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556f0a09f240262ced651a063ac81cd6f
SHA136d4b3f4c715c3bf7e2d25174d498b2b17f624dc
SHA2564df3ca3bf79210b7abe7c28ee24547a7b114cc15b9982827742947c9ddd870b4
SHA5127c585a52ba5d8fc22d75fd1818e2cac9d821a36adc658f84630f301cefd62909c338ff35d894db2d0cf4de7b0ff4247c0085ef009eb3926ee1b1f96f588c613c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512a120d8ed27745f9621b7a0ae3d3974
SHA1e8edbf6b6085826cb6ab91d8ba4ee28589b26d5a
SHA25607a8c74249c7d6dd8d1749aafca387c119d09920b58bd809b9f74d7ca973a11a
SHA5126cc9d53e0b0c925e61bca7020ff51997616ccefd4832667e5cf8e70885f101fac51a7bec5a7bdd350fbfa2e9256c63b55160232fc533b28cd150ff57116fa2c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54dfa2ef6800e1b57ecfffbc2af0b99d8
SHA13853323ffb7fab0b9d7716d65a1217bd39cd5a23
SHA25693eaa7f39d5ca2012d67facd52354894176c62cad41e1bc559d8cb351412fab8
SHA512a10be9a5145f27e99fe46e5dc2dbdb281ae6913b20451a771657a329468ed931a82d6e9b90f16b35ebe69e21884326bbc5e84c6aec2b25eefd91568464a583cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f6b869d9912792dffcf481f69735a32
SHA1b9bcee0bd1453e76d5fd0f081da054ee6787d031
SHA25677c949434e9c10676ff8b6b1bb1c9d400a1743101d899c4f5525aaa0a210bd98
SHA512cfd6a079b919a61b02f7e9bef23c346ad4334fd6bf932720dddb79a50a6e1ab5383d9620cdf3c7c38202c0735a8419d9c9811e1c8ac5847d76273c2d8ce9238f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584b1528c622d49d97b812e51fb93fcdd
SHA1430d186233de7f28e9afaa5d6cd73f887097ee84
SHA2564f77c8321cb1068b3d26d40eb31882ad0faaf7471e52b66e47fb78b73e8fbf33
SHA5121c0671a29317b4e1601bd12d16efb17a75f427fbcbe46767d51ff870b847eede431e277d0e4ab4f377b7c75a6a421b6ad67fe154c28065e93753098512e3d635
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4fd777ac9a766464c038aecc4ccdf2d
SHA1db42dbf6f6bda0aeb9dfba30873f88e45cd42256
SHA256e3f94ec03e65927021e30c18ec1e36fb9a8b47f4e5fb34eb3ac94c03a93d9633
SHA51215c67555f40e702881e714d30ce8c49804514eee338eda4fa01e501bc5d11e1e2e5a91ac98b6075aa4f781f2a9f96bc79f55e9b229b710e504fd415bf7352115
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b09f4b45aba386390c98b7a93fde4d2d
SHA1be0ca5d2cd8c3ac0515a77616c1a167e2686d9a3
SHA256f5cb9f9db24fa1f4fa6db733b4da2dbf57ba15d4d378f301691322d7ba6d8995
SHA5127430f62b56e5bf8521353091885c7011933416da60600fa3514563df38219816b05c42f48d5ad63a69d9270de8ffa717cf48c443fad551db9e41730069988b0b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a