Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 13:42
Static task
static1
Behavioral task
behavioral1
Sample
251b4f3610fdc038fcea7b4f0d2cd99c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
251b4f3610fdc038fcea7b4f0d2cd99c_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
251b4f3610fdc038fcea7b4f0d2cd99c_JaffaCakes118.html
-
Size
74KB
-
MD5
251b4f3610fdc038fcea7b4f0d2cd99c
-
SHA1
d63511ceefdf5fa9c2ba4909cb223a781e6e475a
-
SHA256
365083600eb074af2ee59b4317f1e8cfe566fbdd600542349d71de4234803f92
-
SHA512
09d230870bd93ce2625e5e06f7d10302bfd722c75b8613fa364593709589077fe2bfc3b21fd7969945ef9ab9ebd0b7b9d34656889bdc55dceee2cf452aac6e2d
-
SSDEEP
1536:X610iF08ByJtPi2Ju2+afc3bc357hkIOlUU:XA0iFlBQNHJX+afc3bc357i
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000008330fa721a6a4d2909c1dcc5b40d146cf3033dde3fbe0b4f3141877965c022b1000000000e8000000002000020000000102a383f90464701f312c785fff5214859ebe7ae976f344152ade448be0619452000000071690143666ea60ae3ffda1556af02d3d60add7f76e6226a3f35c635d0a6bde1400000005117c30eba1324967e4dfcb7aa22dbd989a4e9de68ea41a043780e03a1d7cb6624b4559ebcb4fbc2898983f6e1bec3492d7efb953c3483dddd96909be03ff23c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD0CB1E1-0D40-11EF-8706-CEEE273A2359} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03161ae4da1da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000003672b2e6fb8a375c933467476a0b5d33d83ebc2a8e553f979db4beee0b2e7d17000000000e80000000020000200000006ce8426ea7d03fbdd807e6c378efa94e4fdaa37f13239e53b30da268c692d0b4900000005650c37fc75b41eebd4e49ee60d09a3d692151fdc73148d099b91127f3ca677d3ff1d775e0ff6823d26f177c0a0b3e79afeae0f74747ff4b8ea37fcca748c8923bf61f2adc71fdf1bcce6abaceb25df7835d46c09adc88a0ec1ceb87bb56a6ffdbcc1dea1ae6a65ddb5ececc4143d9b70f8f12a4c58be09dfbe277c6e0f45b4cccf0cf955c7c358044eb6d239238f46740000000639a52c40952bcbc7b9693d8877d9a553c5e4f03b1d7f64a1dccb728c895c7391155c73097b33a4251c7f3395e35027980d86e49c147dc1f1924a5f8974b5355 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421337612" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2168 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2168 iexplore.exe 2168 iexplore.exe 2232 IEXPLORE.EXE 2232 IEXPLORE.EXE 2232 IEXPLORE.EXE 2232 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2232 2168 iexplore.exe 28 PID 2168 wrote to memory of 2232 2168 iexplore.exe 28 PID 2168 wrote to memory of 2232 2168 iexplore.exe 28 PID 2168 wrote to memory of 2232 2168 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\251b4f3610fdc038fcea7b4f0d2cd99c_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2232
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b53ef833f824203da810b883674f068
SHA1f92fd06933d6154dfb94922d2d6d4803b0ed8254
SHA25690ed959183afb9fd2d58477a0e9e47445cb8f00e75e857ce68e9dacc89a2e9cc
SHA5123695ee6c6cc0aa47caa28f256b5ef774ef6d64f6c1327176f3fcc6c49ef2faf669137ea595c24a79fb6c2143151454487b09581554926dc84b9362a2a5cbcb6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569eedf1ae207a45f4b4f000548b748d1
SHA1b5325b79845eb628bb0d4bf9f42a81092dd592cb
SHA2562e3ae52f62cce3f97a139317cfbb370a2506f872c672ea7ef57a1e74c2bdc6c9
SHA512392f971a82bd94144147d2e12db529bb4cb3377ebd5a596789eb429baf54a0045434bfd88660937dbae7cc9c9f5d744c0c671e0e04101bf32bfd15165ac8d698
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d1e57d0c73ed40b41322d9b37677f9b
SHA177fc98d607ecba4b9cedbc84cded3d1400d2210d
SHA25685e7b506b982cc0443431770f5478a32f288783e77c5ba528ddcce82f510808e
SHA512994dd173fcf57ea5a6aa5ac32ad78a98cebb8a826d6f96231db0d09d27fe983f202ee224fd649983fb783b605c05650f95993de45dc6b6a54d2477e59dd1fdac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc88adde45ef940a40b79f3726d4c83a
SHA1a460f9b6e2bcdfe7637e8c20676d26438f318bff
SHA25681c32a32b8bc29d59d3674ffc1806169e13f21f2959ffe268f754188fc96356a
SHA5128d77178a5a48a854367f0fa136c5abd65feb727735fe9d61afbfa1a676f322dfbf96dfde1e5a33fefdc7de996c1a6fe35b042100594c5bd430195d2ccb9b9f76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b70565b2c1b7a28cc9bdf74c27eda08e
SHA1247f7adb8149b224bc1b75e252b92c2ad80645ca
SHA2566e855ebd21ef3d804efec3c5309866f51910faed1e2987a19c31d66a1640815c
SHA51245f7a13e37581cc2fca411170ae5326262ae056a0caa270e9c5449ad5b10a3e666cb3b965507bd65a3445c6bb38392d34bb98c31edf2ae1dc9f6dcea1f244382
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2e669ce00d9f55c61551b839777ff79
SHA187e107fcacc5c8eaf0fc00fcab0dc7e32ee263b6
SHA25600a41e264ccce2379cef2f3e864ff6a6a6cbb88ea09db47e82332a07e46e7390
SHA51282598b670acaa7c66bf9dfb18ba8b5bef560f180ffe2f02660018489275d3a2186627afbcde762f5ca390ce608b8d3c739b9ceeeaca28233e43f269e52847aa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af61f5fca083991925c76416f1237748
SHA13837ab79e78a87046f0a137023ab049e6f12defb
SHA256061686a81f1f3ceff978125bfc1b3833b954fb2c5174378c8f7ad97be4b189d7
SHA5120cf511222e45df36a7b547567670ba5c631c5d071245a8aea0d53e256819c2bb36fe40d39f10885e4b28a0e1516bb44ace9da207bf8cdf48c201ce4b09438d52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505a65d35bb57e8918ee3f2ccd9dcc840
SHA15fc4b803af62c4e887b5535387c6fc619042c698
SHA256ec6ac32ece30f29f097a335e13e1a211dc2b015f21d61caf01a5ea9cbdd4c58f
SHA5122969fe134429c238372a692be519c88febff26a02ac2b32a3d9d3453deb9cee64297b5a1d8af85d078eabb2ee4da37af73c468eec78aaace8a4be6b2b819c1c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce65091b7c337c1a37d5612f08446b06
SHA1e1bad81124d5645e97afbdac05b444ea7786361f
SHA256dec3a8a89bea0336e55a0cbd35fa63e48dabb1fed34753ddcf16e17b9c387f8f
SHA512d8d95ecaf336f9f11c62df4650cf8913848f9eac12656bca46c76c3d147b95d6473d00290fc43f5253b2910aa99ece13b6f651acfd78636f81c1d25243583e6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5984a7c78f8d940cae756e753b34d2d99
SHA117a3194dc9832aea230ce9d6c044a7936538f855
SHA2567b0c66f5964177483ffb182d3ecc2d9d6b4d3f4c70032f481188163e10b0b57f
SHA512bf2a3f525c4847c68ed988057b115aa92c81547cef6ba2afc31adb526f376314ff81c0f8c228038e898b567c0150d954f64d581f4542e761a2a0c34eaec6c696
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ba08f7671fbec443d5451d9eb84bdfa
SHA1c248192de6a9e7792be3d71cdff0a2aae3b00c66
SHA25612170c041af4ccaa54afd73c95dc4e3f6f4439b4e690b145f8cec3d070ce49d0
SHA51270786892cd314b2e0f9ab7bbea0e34d1746f6b811efb9123868773610976726b5b1a809fa789fb5ff78da62040923bfa684480d893064ab43228cf76292f4843
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eef8be3ecf614d0554e5bd5c8caf4deb
SHA156953317907a745b72376c0ec90a451c064016ca
SHA25668ab471be9b9ea1a161cfce33e37a1580b2a1308c254a8481d4f71aa7d090f63
SHA512945c1b40d1bb2aa044863e0ec97456a34ba4a7a37a886689101622e5bcdaf2bf9378164041dabb7f48f09255c10c1e328ff788adae4463caea8a4e67002779eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55731cc5c0b503f956e9dddbb5863290c
SHA1d7e66c3f5961f1c0dddc0ebc194a2790dcbbddfd
SHA2560b46123e534d44988ec8fddc86d3855e4f7341d77c5d2c16281f31f54df25a9f
SHA5123b2bf7b66e7c5bb6127f0e39d5009723725a9e8b06f67812e2acbb16eaf11fe483b124c760c13bfda32eac660dde278a03d462dc4a79bbbf63c78a6ed64ea52e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5070f3ff2ebcd2865f573dead7cd6a610
SHA1d4dc8f6c3e790c69965e6e9e5469dd473f1f2b30
SHA256c784275acb72c70c86a4594c5f6442c23eeaaa5e578247bc893f5b51ebcf8166
SHA51227345e8731c609d0813a18cdba9110f8aaa70ffa87f709830ad108d4cb599adf06170e884c84c899002d38a25f354f4a40ae1306052d9fcd15aabc9efc2a36b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c2762ee0c30f7f1d9f4d26148f7820b
SHA1751e90379ce0bf98a181984c73c00c2a659060d0
SHA2564ca68aeeaadbeabf3d5b3298f4d68e6576ee5e98253bcf331aa299fa5ea47e70
SHA5122a7ae33411e10f4e68a03ea78af3301af62f5ee0f523d478e58ea56cac5fffb004b6cd1bb9cfc3fa37e14a4f51977dae22695490cb8448921c4ec8a8db9b9fed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dac76150dbc2bc79eee47e6b77b6b5e9
SHA18f8bfee7ac8eae2a741ae9896d3c2d0f1453031c
SHA2565e912591b7d5f7deb6f71f276fedddba49dd1d58ebffe2cd546d5fde938919f3
SHA512a626d9ae09ffea2ffff62ae26404f0ae8c517b93334a0af1f7e2d389a0daebff5a797648cfd9ee6cd55adf6fbdce19de4c79499ac1e9df6c76b475c486bb3ff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54518e14287532f9ed57618b4974933b0
SHA15e61a8750d92554fd19caad3ec1cc8ca6c0638b9
SHA2564901fd6a16d1c952e6628d747e330af6bf0c428ec3a937eb4a622bfaa51956a9
SHA512f792d53ac93ccf2d7bc357a013157bfc556e80b8672a9401a71614dd5f427c2566656b90ca549d1efc01e4b6553b28521f06996abb3c96d367f7241c6729a09b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518dd2f5eb7756472be57de1f15c5c53d
SHA1fa94b51784839cd2f60cee599940acd97a869e2c
SHA2565fc1371788392d0a0c4913a4cae150889992369c373fa74050ae19dc1cb40cd7
SHA512649945b82baa9b71fa3d01dd3cca4fa2b49d6b80c9592de89670220b0a4d1be1b13e76e05fa221c6d79ea3b1948dbcc1dbcfe08edec2ee6dff3365200fb7c28e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab3af008f017cae1ebd54794aabf86e0
SHA1d5de211d6d1a443925f86e3da62077623224175f
SHA2568b30b48acdc83dfbea78e02292f46ae9968f91b0cdd3b76641c46eca9777d26c
SHA51278287a8956eb3ed53cbc7afa311c07be357fc08f13b33cf0ccb76e1f929f01c1c8b7287ce77943defdab97fdcc0cb392ed8d8f0673022d6c04b64e2ac893550e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a