Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 09:41
Static task
static1
Behavioral task
behavioral1
Sample
78b63d6d04e676fa536fd87cc6eb5ebb_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
78b63d6d04e676fa536fd87cc6eb5ebb_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
78b63d6d04e676fa536fd87cc6eb5ebb_JaffaCakes118.html
-
Size
18KB
-
MD5
78b63d6d04e676fa536fd87cc6eb5ebb
-
SHA1
108c1205f46bd065bc9c7ea9ccd5ff89ab11689b
-
SHA256
180f3dd6741cdade13630fc3b06a0f7d0a5021526a6b7ce0e9d726a19888d7d4
-
SHA512
2ede9f4e856952c5645822387345c11a7506485f113eb327952c0fae09df464570e1013cc6b01a432c86fb55f96c79f537121250547dc55b9bf5281d2bffb6f2
-
SSDEEP
384:SIGgBzojZhBeCqDr/X9wq7KgJU5exNhXiJMlXwwt2BCvdOReczKUIfZ0vqpZfqx:SPgBzXHXGer82IeLfGIxqx
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e73230de82258a896e3d0a6907c3d66a138c6c6ae0a5f5483b9dbab83039e8d8000000000e80000000020000200000002f63adaa7e36ccd2a31c0c107ca4d57df902f3f183ec4ffa00e32ab3daafa195900000007496ce7b52b9fb452049933916a451e203e6b30ee206adedb5ee69af59d2bf37997427566f28f58041868287c585cd4e622ee984e90fcb74c57c201aff575fa60e79f6e05852cafd63dbcf8a607921d16c15abac1670ada5f4cb21daecb12f0ce49ce6d58b4cfce1658725528ef45acbbcded16c0d79e9775e122e3ee865c95ac004ad78fbbd6365f89faefa76984de4400000006a3134d60a3f331c808dbb9f9b77dc147ead9ea3750294fa60beb982e0f0da69aa2a5f49ff17b921160854999fa7d293da6bec69538101fd50a6e130dfb4f011 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49FC41E1-1C0D-11EF-A04B-4EB079F7C2BA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40f557301ab0da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422964754" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000067526b87e02ff693740289f37f2d1b9df9fad1c8c44d772758ba0abb85e16708000000000e80000000020000200000002c7d0513da5daa86f9e2a060373ffb86803ae9ec4a777605f7a5c688f549abf820000000fc74e810f5b5cad5b492444538f3a360f2d30ce1c787e67ff98d53bcd2d263c14000000071a76955499c3ffdcca05092fa82833f2ddd9a7d60ba3d955fe2268eb85baad40c72fcd1b10e64eb44943b948e2f9b9c5db68ce05c0dd46189522b729840af8d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2084 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2084 iexplore.exe 2084 iexplore.exe 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2240 2084 iexplore.exe 28 PID 2084 wrote to memory of 2240 2084 iexplore.exe 28 PID 2084 wrote to memory of 2240 2084 iexplore.exe 28 PID 2084 wrote to memory of 2240 2084 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78b63d6d04e676fa536fd87cc6eb5ebb_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2240
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d017a0d7ee44875135cef46d1687810a
SHA1d7b504c0de28feb6f8243c1235a3645ec60bfb0b
SHA25697df9962e29ab1fa34bda1371ebdc5280783839de5bc71bf7b5defbb67b97bc3
SHA512218b754c4e5e84be8a5b3c6ddb64a9c007a4ccdec3e8a421474f3c11fd2689dee2f056532220971fe3a5296b687ddcfa8ff57b9f0e96e19bbcbad8101599b330
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5a56c30fe08d2c31b5a98632d808365
SHA1ba54bdbfeeae5e64ee4582e3920789005fffb7b7
SHA25656c57244dc4228f55697a7e78fc1cee962a4ce4ea95967b75e5bb376769d901c
SHA512b34335750abe007cba82dc0b8b8f908ed944131f60b668f4ded3aa5bd18277b53d46f4f97d6f9fdb6cca24b82eccf2f3150c824ff1652068e22544316f2117bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5589883f1310ea6796bbf5de5a34f910d
SHA196a9c5e2e2d291dda2ee14c6d0be0611349d0dd0
SHA256fc9ea9c126e366ba1dfe5bfa780879596b4269ee8b447b794afd3ff04382e728
SHA5123967a6b86c9034283485f8a1b87ec24993ed75500fdebef5f921f424042d8602919bbf7a3cb4c74d318c07bedf2807c3f9cf022b79978efdd7ae50dfb8a2504b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5518670867642d97d80db302b2f838930
SHA1a254474f90e6ab3e10a986f0253efd707e8d4f15
SHA256ca27a60149343861edf0ebe9600957b9b5e5015bc5783709dcbc79df63505c45
SHA512415c698ff3a40c36e1b91378e580ba876cbd8177796dab151da1050198764008412743da28dd61d0845f472f9b16833e9910a076f240b2ec8f76172ca6200f18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551c8cf96909bf823138f5768db5dc3af
SHA1b7a68ec5b0c8facf25d63b39474714497bbbea4c
SHA2562c0713f36b7faad1f759f411315cfc59f06538bfd1a592406e060984732f6d74
SHA512e97c47ff41c22c34d85bf72a939df1dbb6d1686e250eb1716e20d270e3bbd3f5b341f2e0158ae2bbbd22a96f452a8ae8b8bc595901d3a8eacbfb5b63c8fe23bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5395a42ac29e8be341ab21b73edbb7882
SHA152d0e2d17d2a476427ef389cb14152edad896d2d
SHA256b44d6254a622c6d5af07e5ef75f222d8f9873f43e65061521c80b0154d8d155f
SHA5123bf2065dd810c99a46852c7d57209d5b5c4e5a26cb0e8e22112ea133b20d35e43a1399bf50d9be1ad3553f5093eda08e24be543bc493e653fc0c9b826573e9b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5686393bc1ffaaba85db4212335c53baa
SHA1acde791a3b677dfbfe30a92f08c1624816e22f97
SHA2566fe433256dcc9e79bf0c8e9f3a5f22f54582fc4010e2de15722fce398f511456
SHA512ad07da8edca0637d27504630fc5a68937e5002f0811174bd0cf22959ebab0b045fb23ce903ab2ece00bba0fecc4ed3c9cbd035cb6e16beb74a977d24d9dcc513
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5337410a61199e10af454815dd83833cc
SHA1b4516a37c21976257ff36a6917a9964a59b9a785
SHA2569318ab1fa9c9f12d6ceb07d8a77fe4796c7c701effec6f72d0f58a263406eb9c
SHA5129dab790c586654721c6c377d7306a53b947e14ff45573e9f9d79458dfae3d03c810cf8092e15dcc31763f00e1ae72bd1c0fc3451062551d386d98e8a2a7dc815
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5379a584ad226a44ef20321744234ba3f
SHA139680f221029daa1cb667b49ed88efaefdee4705
SHA2568226a109aeca653e0eec5893811b853d1d135d89d1a116934281ba0ee0898a1d
SHA512e3c843d466b556533e0937bcd28d3592eaaa17e08c82caeec0d43796115685db25959acef56303b5a18f18494ff0abe0ec0537ee5b619a5d3746bd8c9ee54f72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51223a6e92b9c356d5f9e964aae8fcd0f
SHA10b49fbd8512c36a5c2d8a1a0c4945fd209eaa9ee
SHA25664d6fad84b4ee5c41bf5fb89621109e0d9cbfcce798cadbed8f423864ed6e5dc
SHA512257636e2c1772ab87347b62bdbeaba7d7cbb0ecde0fcb32e58b72821d628286c9043886a5ac0dce6aa7995ea77c7b0aa9172b49f026dcfd86d69a453acd172dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9a3c0f07bc6cc752db2a1ccd9d02644
SHA199066bf94195237fec051d005e5c34f5fbab3bac
SHA256aaec326d5321765ef7f8f6788d94dd642587d80e72c891971fbec0b66a3ab3e2
SHA5122574eca260e5dd8ac921012e8e39be75c185cf829a0de2899388855408c17878313ae2eb3e292adddde8a0773888c26660509a4df909636ee6c07d8b7c265727
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534fbd3e4ecb3a11b359e95ace2cfc621
SHA143c823b80338512f9868a4a02fc3d018b294baef
SHA2563ebaa16c75f7929d3fe4819dcf00e95e190b8f93d8b83b753a10a0051e4f6df5
SHA512b85145a4b39a7c613c0f1afd4a0ad4765b081785a597e588b9d75bc41193abbb9d69aabd05ee625366b27b3ee0683cb56a2e42ee2e3ea09c90f1e7e6103736c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59af6465269c81b9328b228e3358ff3cc
SHA15ff50905ef0104de73dd98dfe3f6c71e76cb05cc
SHA256e00f5fe8fef66c2a640d3695f0b2091e854ba22a82026d8036e7231851dbcb1e
SHA5129f50897c9cbee7063222e78c1ccdbca8e0fc08f75d0113a3db6423e44ba31cd6152b3859186e5373c5b2d95a144ed192d991a2030622646757545268a4dddeea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f2e274853719d0826ec7647a2013b73
SHA155d9623d8e2f2daf51355a204b90bc299278bd1a
SHA256fc7b8e3c147961e0852d169c8cc805c7092391fce33fca0fff75289c9aca2370
SHA512a5a9f381e7f9155ef7ff9f556777d95a73e2b5ce15ac8e6214dcc3f8147cf57c686ed9e604886c9f0ddc0cf31080b2c91b55278afbc2e3569747138672f8eb5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5b92d24a9919f399a413a20596980b6
SHA1596ffcf19b94cdb52045e554e447babe424e8c7e
SHA2567df488b970455527765e8db5e607bb937cb1e51668c1f50a0f917ac809f2cf86
SHA512964eca79767dadb59101bf48f936240a2fb4a4e412277863e1ab888632a3d6e27927087f1afa6189a20929386d39448b60c4cd1d82c02305388b8e95e534d10a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe9cd040fd93c40ff59dab790c869515
SHA1c5a4e57448d3a9d7d46ecf9b0ecca76a53cd3011
SHA2563adba0376b2345ee8722b3b23adb14a8ba27bed91af3ae068b0f8757b0ccefe5
SHA5122f130001e97178f41d8252645c440f374f27955a8f42f7a6614e6858e5b8f8c71475de415fcccc860c61699aa95ccd052ceca495d38a2c1e2f4a87d0e5d1d8a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a38113634227580c54ba10f9611b1ca2
SHA15b8c8b20384a5798de00a46a883c99f29880ae1b
SHA2563b027ec7bb0a542f662c0c631ece039d5f37d0262725f7edc2a1f2ea17a45283
SHA5120643afedd8a9bf9681319eb10817f74d2f6261ea0a6fab697d1dbf4e46c0d4097e3e4c40d95c7e9ca0caf4bbd1bb02b0abc84ef03a2637868825aa71353b806b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517ceeaa012d7ab63d828c78fd9da73c9
SHA195f870c56522b7bbb3fad3456768faf96378fc37
SHA2560e7c6d8db2f5563672f5e168fda226be1fb365466bd43f4244e54071e2c34fd5
SHA512b45f1b06273417d2c9fcd35c5d59778137543dfc44d0c48b51b5af1b6a29bc0cce9e187c3d527cfd52f971c926223173bf706a0cf7c77613ac18c0e9d204b37a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5430a0f420146814d10607dee7b054220
SHA1525448c669708b936fc9f515ccd0a579553bdbdb
SHA2564029ded5e6371c5f6b5cfaf2878755e4ed6bc492a168ee9fa675502309d5dfe9
SHA51218c1a311fa4bf53f32a748c1a0a0f6565cc5eb017145f848b3aafe5c550d7d2352c522482ba22ef614c264cf6e8755142af12f27df42f6b513caa7a65b948ff4
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a