Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/05/2024, 22:13
Static task
static1
Behavioral task
behavioral1
Sample
21f1cc6263f7864362b3242ad060c0c4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
21f1cc6263f7864362b3242ad060c0c4_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
21f1cc6263f7864362b3242ad060c0c4_JaffaCakes118.html
-
Size
162KB
-
MD5
21f1cc6263f7864362b3242ad060c0c4
-
SHA1
46c6c5f34b45012aab8235aad852ab16f5802417
-
SHA256
3b972bfb34097d5feaa698e24725b045fe357b262cdd4070ec2bbf2a279a2710
-
SHA512
83cfabf131ad9d22edb0503da33d9c473d80aa6c438435ef30edd2e49ac558e4ccf0917d831c7e8cbe7b30f3c4b8a30993072062b1df9cbda1290b44038ce3a9
-
SSDEEP
3072:SCKsrtmaoTQv41LBOMNy7O0XW3zWPsUA/OyqNccectuc38MH6NZtxtRtCpHRLJfg:SC5rtmaoTQv41LBOMNy7O0XW3zWPsUAv
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000092899d24abff8a00644e7fcff6b690a00af0a09e381543bda6c03ce8ce96e60c000000000e8000000002000020000000eba4e2bfc270d4adf795a5100ce0cee887e69281d49e3ffedfdaa9ffe036f8c92000000037174f0698822bd28616b39c0e769e808097d99dd8a5fbd209c0295c0e47fe1d4000000086cc0157c00257eb4450b8fabc429bb9f12c185c846f1786b48e6f77f864c491b39a57c7daaf5dcfb92db5440f23681fe4ed53f7ace1e6c7e0ab7a8f21279575 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0FA8DB51-0CBF-11EF-92D3-66DD11CD6629} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421281890" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60577a16cca0da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000bc0df46d99e84b3eb61725145c5b9dec9869d171defb052036ad4015083c2f2b000000000e800000000200002000000063ab5d28e28c1e35b3dfb58f2e67cc45fb660dcee78d18e1f969826c66d4d3949000000055a8350cfe44c79c18f0461e85b792dc30c891caef648fc20e59b496e6599c13940387ac47950baa12236017953864eb1e30b5c4b54e4c72a924e1814efcc9ebe6bf121e6d1d68f4f97c906c8bc5917b7ba349db67d2f4dc66666566229da6a651a5bfd6c9306c340e0f293967a5c855a71599bccbca069ef3816e0e9cbdb0110e3ad88c811c2f712f858fd1df0d2273400000009a64d74742fb051043f0e75472b6e827ff74298e677777d56157f75a6d16f2ac381dd36798cab015ce400b63a74b7dec80601d8ee831cdcdeab1d026f7ef4ca1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1420 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1420 iexplore.exe 1420 iexplore.exe 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1420 wrote to memory of 2916 1420 iexplore.exe 28 PID 1420 wrote to memory of 2916 1420 iexplore.exe 28 PID 1420 wrote to memory of 2916 1420 iexplore.exe 28 PID 1420 wrote to memory of 2916 1420 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21f1cc6263f7864362b3242ad060c0c4_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1420 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5948e91f1512d6daa01da01a12e43d335
SHA14bc60a47d536636d50d2bd5619092499987a704f
SHA2565e9e7858e21e916f571ee53ee55baf596b2210b079fbd984b026bdb4467b0d6a
SHA512f592c3d9894e9391b3cebc662a62a20ef2de6b99d407b2bd45d7f1c3786a46a96592c8f90bc86109b5d6736379c2d40b3beaf08ca0a04d0aa10e0029b93ba0d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0f43f605c57c931a34ac7f35e1cbdb4
SHA1daae446bef368b9e027b903e9dd9544215f31eb6
SHA256b617f76967527cf92fb1725133b8bb7b5cf2e739f9a31f03cb318fc9a090d276
SHA5128ad764affcf3a75612ef3824cf58cb8d86319c4db4e40b0c2b1d22b57c4828d54526e497cf859d2dba1127bf34e1c30a78868b3f9312163f0ed8b30a62c699ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a9d3fa61371a32f36914470ad44fbbc
SHA123fa374f5575a04fb3a2e7aa4bc666445b1c7a03
SHA256500bd2e308a2aa40f1f742818f5a070dd41500d7c4827aa658b2c4220cfe2387
SHA512c28cdb07958b5513854ec9b88635239f5abc34b3cf88ed8115a270d4f70f8955068d389b598765ac53a1aca75fb10e808fe2652a6a2854729e1f2b5e8f54b668
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c2b74bfe6ffa8daa0c133be6ff7e866
SHA1d1395b30e937d915fc54537ec77421def58fed74
SHA256b6f7368ba7b2f5aefbfd726d0b9491be035eceb5e4bcebcd6b96e2e4c7bc383c
SHA512c0813a3d10aecb842c722835e6a23e7589f11ccbcfe7aa1f65d8650671744075ae2b49e45666d4c2d9d01eec394ca4ec558ed8ac56e4a96a7be83b3a34f27447
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bd4b9ba10104471b0bf82ff1c066c2f
SHA13f88b0ab2c17cfd8fb5a11b93ccd66a77ccc7a89
SHA256bb7525c3010906336bc2eb109751dbd94febbc90433d9971713b1e5005025c81
SHA512caff69b86953751492b18041f6942ed1eb182238a6b2278ffd69a9b876953634b5933f208017cf2306da16edfa5b279452e0486ca974ef4fe9e677cc18da926d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523a98b8b9a6aafa832c4411ef838c4a4
SHA1db1bc5843cb80fdac6c040f9136457ed342e5a3f
SHA25624b00683fa583316393765d22e329d5b9bdd23f3c3c65c932c1a682867081b2a
SHA512f6eb5f0c71cbeec3830fbf167441c57186afe7f0c333d61e8a576bc91cfe2701c5da53375db0ace25175949403de74a0cdb5077386e5da0c624b482d1c0c98b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bffccf9e18cbb29929eb8f0b935acbc8
SHA1b110e2d5f92ba1ec1b67cfa6278f149f02c1f6c6
SHA256e4418b7b8a078775694fb7f4c57946c8bfc10e8bea5b252220b9e4c4cd510d0e
SHA5127ebf7833641b78f6dd49b6fbd2323fe9f12ac077faa78a1779f73824111365db2d7d174513bfc587044ffcb4221dce011e7794924696a58bfd43212183682ef8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0ff5c7313f53335316985ece9c533d9
SHA1ada0f9eae3263b385dc6f04588a5eeefbe1e0db3
SHA256b7cd5780cf4f00f4ac91af2659b321de66dfca203984c5ee3a58f2f9748b738d
SHA51278e455568b6207d0ad692a6339066719d6d23f50af128a1ebd67dee3fbd0e677e178dc50066e2de9e97c7d371cf661fdf04452e5eb4e9ab358d246bd29309f7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c711ac1c56c52c0cbf7216f531ee4e6
SHA15cadee2aa1a62e2befbc80a6498ff8e5f8a84983
SHA25606dfce2f31830e9f52d386c750aee7a64ead765db4db0ddee69923155be1cd28
SHA5126b0fa01549739d9abeb7b98e6fd2b7a8bad8fd3f0a03bcd7d447870ebc088d901733c081f4fae3d966133106aa57e05042bf59d0b6551056d933a3de0fcbd9d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578af912765daaaae97a3e1e259a20dd0
SHA1a56a70e361435b215f682cafae94f4bd76b7220c
SHA256e3392efb1d740b7b3f71e1bc33c56201696e8a0fd8d3410b2119cfa01d1dbced
SHA5124c686fcd1089e87dada5a18f4ac322723fe810f6f0145bc4a32ee7cfa02e4a5f9139b2a9e813cd263862c3cec9119784e4634502c7eb618e86128d1d4c93a81d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5653ad4671af73d498f9f48de36b56337
SHA11ffd25237152e080cc55d067332f928dde472a79
SHA25632cf42c0ca5df829567134d4a0eef81e705aea708ccf436bf8d0d316318d160e
SHA512a086273353d1854c2153b7ad904460bb91cc8e2cc08a03f279b2b7ebcdf350b005cdd9ec5a83340cb398293813f599440108cc9add9341458b66d9a9a5411084
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcf8dac33e96e98d530aed24bc53e3c2
SHA1c5850b0f88e879f6f4124412fb8f84e12df10190
SHA25615405ed089b4b4a0c83371a31b7150e23622455baa07a5abed17aef2f99f9c25
SHA512db5a6723b25fddec5d577c7743b359aed46ae36553141745e6d7753d745cb05247c4611b43644e56fee7b09243738ad97167eaf20affcc116ba3e2e63749bccb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530bbac7c19fb1f74a8f8cb31e4838952
SHA16ac4122d009d5b77274810a9674e7e86b87963af
SHA2562ac5db53e3c87bf2dd674e643382e6c00f3d4eb0e6a4a4e8e59f87342b3c327b
SHA51229553ba4edf1ed1a4006f04c4e64a8589804eb064501d6cd76b189212698d818e44d7943131988294fc36ce1d11c63ce55e5bbc94150e079b28bbbd0bc34e74d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a999844e57adf33f806a4627f4c62d9
SHA1c295a3189c0e6affe97c466a22c95f95593fbf0e
SHA256636e98ecf41a3a2f4555c0fc1e69a9716fafeb6d52d66283ca0e092fe950bc42
SHA512e3a6b48a625e5aa6db6ce700461d02513b10e512755e1c92f415a9568dba658b08903f95f15bd27bcfe0e0a276f88a6882f011822a09257140626303de2b1b3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51317da98879c5f6bd336c88f89683094
SHA1fafb75602edeb3dee0b0ec8a76c4c47557bc078e
SHA2567eea23ca4bb44a9b95f04b225f9583f993ca5447e2b1e5022a2d9d8a85fc240e
SHA51211d7a43d04159eb6742b5e53394639721b2eaa08e4ca235b2a72e7ca6d656acf1cec1cc9696fba660906a4597790c1a010ad2ade8fc33c36e0bff52058dc0de8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd01e27ab004a5df783b3a35e77a5132
SHA12e489f9df71a0435014bdbf4bf841afdfbdf5c21
SHA256b540ba850d5cfc78f8ce93b8067d7cff76bc146eb8d70770e6c3a06f6dd7b87d
SHA512569066f5a4a2601edc2688f25877506883ae49d1dccf93deecc39ad55bf0fad011fcd979c28d883e95433a3fe930e3cd5d775e0dbb183cf174a32b8b2c698d4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5612dbf758521830c2df553f2127b26ef
SHA10e6509025eb3e7065d342032d50a303c5795df2d
SHA256c2292f996e5c888254f761dc1862b168b01acacc6a0aee97ef516aea3e360517
SHA512113e7ae55fa0a136f33ae1c0f29124a0e3f9cfd9c0e1b028c43e6783978998a289ee3e541b804d3590ba1040c73b31394ac74d55927f0c0109f52099867c6112
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d43a352bdd79152cef9bf0ad9293e125
SHA1a88886b56c318f3ee740e9d365a5ba8ffdadd0b3
SHA256e6fe937cef224dd905a0bb0735540423d84f32cb9ee936c400d990b5ec5f48fa
SHA512362c5f595ce9cb85ae0820b707c50f97a94ab01cca99445618926b471a8ecce429e6ca87bd42f0a01677c021c14f4ae00fca966d9d2aed605cb0efac58e00189
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a