Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 08:21
Static task
static1
Behavioral task
behavioral1
Sample
74de68547864a419a5f956f3853aa0e6_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
74de68547864a419a5f956f3853aa0e6_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
74de68547864a419a5f956f3853aa0e6_JaffaCakes118.html
-
Size
25KB
-
MD5
74de68547864a419a5f956f3853aa0e6
-
SHA1
29d9a40e0be75c064834843b7e50043cdcfd296f
-
SHA256
eca2e20232eaa7189ba31b90134a8305c749893f22fcd2406d827803afe97352
-
SHA512
3d4e072bf518ca9821b2f1de940e95d39d9b85f3e36e1ac1d525fdce85a03f4cc791e72aedb3e6688ddb220ef30a970d7434ac85bb9994647fc851dc44063b35
-
SSDEEP
192:WLZLwKQqMUOX5UUdQ/uQe/gV4NBlTgV7B+r8Pi6bW1Th15WafW8OhaRxZ9Lp+4U0:fUU2/IozZE1T7xZfvEYP
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422873566" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000001e91f745a110d48a4db3992e9e030c3000000000200000000001066000000010000200000006568423ff39a872214852c969dfc3f584e5be7d09e4ee45a1db2aa331f3805e9000000000e800000000200002000000000492fc3b8c1e2c22b891fc5b185fae352eb079b6ceba72ce11942648eefd00b90000000be83e755f7c09f7f72b4a52eb99c2903f7f766b821125aeff372c08630280b20b5a688c3af902da884bf07b7d422f0748a3bb12fe2a0c0b1e4558678b0b0bc546295b080c9812f2968bf64b3a156aece338cd31291115df619804b53279d3fb193a971f722ee10f5e97634099dd2c613cbaa746b1cd9d3f80bdaa1c2b17f6b51335a4ee451f2e97a3d6bc32b5c56646c400000001e53de46c30c9d21ef145224a242d7b2e55d4cf970ec3ab277a8be1c0db4dbab07c58a606b4bf89487f1be59e534c3d5f860f0bb7130303e44389af17e442d9e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000001e91f745a110d48a4db3992e9e030c300000000020000000000106600000001000020000000cdd50678449b9a91e8d1dcebc3404cde784f253d1c003bf64e7e2c5851ae24cb000000000e80000000020000200000005650966de60153c5db0a9f4207a1f9f180bb33a7b09ec5a334a495259fc2941e20000000960d065ced3fe169d9fb53ecddb16b0c59ea469ef9ac3f07e39bd2bac1e7bcf340000000b4c4434dbdfaa09ecf8994a1cc59260a2950e3254d0e41c4cb3002fd4cd29e17a3861181463caaf2a0936f709e79064cec6a5b51125e7f63a37401c964feeb81 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0122dd045afda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F7C71A51-1B38-11EF-9667-569FD5A164C1} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1612 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2724 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2724 iexplore.exe 2724 iexplore.exe 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2724 wrote to memory of 1612 2724 iexplore.exe 28 PID 2724 wrote to memory of 1612 2724 iexplore.exe 28 PID 2724 wrote to memory of 1612 2724 iexplore.exe 28 PID 2724 wrote to memory of 1612 2724 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74de68547864a419a5f956f3853aa0e6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbc968a29b59f8b755478c7e67f85c57
SHA119276b0b06b0805d8fbbfe5b62c9898f6e49324c
SHA2566a13f901ba7e091ccaa80e6ae126e5df23ece2d68ce55c372c55671c1e7ac48d
SHA51229c5ecd915871e6c485892f5ba67b445560acabbe97578c2b7ec44d87938cd8c1a9b4be1b6b6686a287864fdacfa0cdbd52c066167f3a39cfdba89dd6fd169c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522e168e6cfc0ecd8ed6d054f6002792b
SHA1b2f4196f8d9650ffa72e98630347d0a4ccfa34fc
SHA25683cb4b1c7da1d327b2e17c69b4321ffe9c8db665a6960c6e16e140e1b17c0ba6
SHA51239bf42f45e2e33e41e63449909615c22eedae174118ffa18323f22b14518f527b9f7b41c2dcf8d35945246455a142cfeb1caa6696c77ff0243971ad0878e4ce1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d600e4fd1c70d3426361411cd55b06b5
SHA1a65526b6cb22a351c35050aa31e204dfb3799a4c
SHA2569534b32be9175ce4c62a1ee4e323fe518d0ffe59d6eb11eca1ec3ae39688ae38
SHA5127d5145372472337c68ead1480a07bb5263cf2dea73391db5b9909c8cef1cb65ec4c02e21f3bc08c53e5cc193b91ac86486dc7ae5085f8e4219b863811e07a81a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1925e18d6d2863a0142cf669673ce97
SHA1e0fdf64ecda5943a82065239e6d4209a952718b0
SHA25699844d800314c6fff9e3ceb14b4aa04ff7ec92bf2ee25061f80501df7fd2100e
SHA5120d33fad4d593fe7302c4d4dbd2d0275d6f0774787dfb285ba91b9929eb58cbb46b50b1d39da2af575b6664f684666d5cefa9f6d8e0eaa9b30706de0f0f60b8ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b504379f60c535687c5a608ee5fd5ff
SHA1f59dab608e22631f089a9ce7b1a7d42a1fbf0e6a
SHA256cf23f45020449072506f03a996a78cb10dbf910af44848bd965e2c5ba95117e5
SHA5126c02d0b7effa5354826c41a79048609aa4549fade662d1d427068f3a25bf568003d36a113458817010ac555cbc994ec99a1b8c6c8a7328b6f3c90836698df6c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58babaae3ea891bbd958fa4589f0bf80a
SHA12b19fb2b415c4bf8d2768a6805a74a518dd3e16c
SHA256fa603319b7797b8bbdd540eba3cbf1478924341819b1fc89362c399ed79685b1
SHA5123bc82ffc7a192ec54fb057fedc0b828ce100464425fb3469297a983772590bc84bc3081166d41bd7c74738be801006fa017e53f37876a966bf69db125d9cb913
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af801efe597cdeaceabe1852d2a5785a
SHA169da46c50cfe7cec581e81e800c3c596309245a1
SHA2567c724b23ca47b24deb8cb115938c9d17d90c740134059245ca611b614b62c032
SHA512eeb30517d23110c9f6f2076e4ed8c9b33368d1a05fb197f835e3b602c12a4a13843d880ba1cef90b2471ece700e6d92f894449158b06129b898059015aee81c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aeec883c6bf184e9c0d691cdd1abc727
SHA198ec83d0430656b6418f5cbac9e7f60ef0025dd8
SHA25693904529813e08f2269dbb34080d1da8f01eccee89267f22832066f2e6cf0020
SHA5124e860300432f738880ba6743c7065bdb0e0369c4c74f831fbc393db52fa57ee1098c77688d64bb2ec4001b7b4494502c364824b8cb7b93d56c14517e9f0296c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50aa36a25a142eb1ed0641ed8a818ccd0
SHA18905130a408327d99e0e3bf068f7c44189538e51
SHA2562c003821ab0dc768b6625fd095b550c387eafa37061936228ef1a73814e02de2
SHA5124ba9d909194c65210ef7fde7fb146a45292572ac9403892373590cf18416dca76570bf0bc8a5e4971814003d6811b6bfe0348e3e2b2a39a26fea757b0a1d7dec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e9aad9d52847e6626cbaa7e196d7141
SHA1a545a93b472ee8ca9d6762f43cd6e5c950a04c98
SHA2566ff42d00eafe53b2155fc8123f98e47f8ee06993cc9ef7f9fc6843641351bcd6
SHA512e25bcfb67765296c20b1fbceb5737382ee03b64eaa6a88b68e13243e6b587e39eff5d66af87ce03c73b2757fd7aaa2fa5717eea2bf3046c0f79d6446a6f0d532
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d14a305dc2d7581ef4c5cadd7e77d0f0
SHA10b749ae8a10590da1d4fec6b05c9edb64d778245
SHA256f13ad6f1bf5e84df11c0642e2f93302b3eff308f623afb8320565544ad896704
SHA5122b65e0f832f784763d03cf293d5226c63b949ae78c41980a978184609307e75e90e78fb34b90c2cf87dac0f1bc2143c26ba20c2f45822bc181849ad10155631e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5135b46eb221aa74bdeb6744ec24676e7
SHA1674ed5a901ec24b57a76f0e39d9e8c77630942b7
SHA2560611ae31ed7b0abc9aad34a65d3a33b22538eb5d1dbf878d223d5183a99ff12a
SHA512f1cc864f8b5ad47cd12e43b3fde2d2ff88dac2492e539a6b74ed027d588fea5ea523a846e956c5752af2f530e63f7bf8b69ad1a3d84d29f75c82db71b6df55d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8fe7b63fe71891864026492b4b3c908
SHA136b81f6fb69b0b180d40b4b2303d9f75518bac9e
SHA256a1b089b5227d0a982c100dd4422e6ecdd2e1de5a1b7734e9557b138b244406be
SHA512be2821662851759bdb198e1f6f60b618af3d714008c0533e2be1c23d9139afaecf9fc5cc43f16fe2b25780f599b9ecea1d805e686546c0f4b572cfc1d25d8217
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7ca1c94ed3aac5b93cd5a3c58f715dc
SHA1f63d72f93911e09aaf0e5be8de1e00ef891503ef
SHA256c04e41129ed88f648a5e46e87af13e094b730f59a125cc1ff3cea5a96f174ae6
SHA5128b1aa062c3d4920ddfe1f065b0c3c8b6e51af65085757713a958870ac908c08657d949729176ef697228d62a646b6033cd1fa7487cf6503bc09f5c1c9eb4204d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5006a01a958f101f82b9608a1baa09028
SHA11499a2d88b25ca6e4e6f6bde0cf099e09a141598
SHA2568f5aa1b40f57f73492dacd513f9d81b2238a642c04619b5fa4f3be2db74cd7dd
SHA512dc46810553a1555ed4742e4292b3f5c86a1f2ad6cb2644b1e7c77bdc1de9713ccdbdb86285f95d3143999f4c37fedb687c6c5beb93b452dd72d95592e912342a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be8dd5eea023bf5f37dbbf4b97da4a31
SHA1c30591b34fbe2fbdf2481b3321e96b3a52d2118c
SHA2566d2f8cab617b74d52beb94442dec413a72374608a38de83bbfb5f3c679d5c5d6
SHA512a2bf821b143da360f6975818d809d8e2d286841042b319fc6c2747a92b767932bc36004c53815c605a1f40c4e7521fe957007eb2831fc95e6fbaa74ba5b66ef0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53576545ac6a90dbc34582dbc36a41cd6
SHA17235fed1cf552738d95d5d8417969fec0f5741c6
SHA25616c45d01c0854944b350534b3510b5bdfa998aa4ed04becbee36d0db35140248
SHA512b41e6341bc58e09cf3e03c24c47fe2ffc503e5a4516f957a7f2411e1e7fc3d9e0d74f3fff45c65fa0e49630ce4182cfb95cf47770ed8ba2926f4d9c1428cbbfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea75fb90d66e57de2e51d134bb1d225e
SHA12ecfc0ba2a86ba5377306bcfdecbcb99f977aee7
SHA2568cb20e0a66ea89dcf38caac70fe3fb33707adcad1a80d3ef36cf0bbb7e1e16df
SHA512c80f221cbb40802eb3bc6b642529d0a2836310c4a2c8d690e27f50c390b3d23ccbc4a9248298fec539c063fd803b7feaedf96398d323dfd57d76f474cc6adc61
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a