Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 02:29
Static task
static1
Behavioral task
behavioral1
Sample
37c77d4eec692d1ed1a5c4cba35ec104_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
37c77d4eec692d1ed1a5c4cba35ec104_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
37c77d4eec692d1ed1a5c4cba35ec104_JaffaCakes118.html
-
Size
461KB
-
MD5
37c77d4eec692d1ed1a5c4cba35ec104
-
SHA1
8aa11030dce07124dc99c70f6217a02944078709
-
SHA256
30e1ab3a15ae23ae66ee24813cf1de4181feab44ec9983ab0be5734c02d6bccb
-
SHA512
b6975d3ce29836779a6570ea5badb326f11302a70f7361cd98f99020a1da0c5c972f1a66c2f28ea3c8046fd598e196e813a9105502439dd38d439d34f39c520f
-
SSDEEP
6144:SgsMYod+X3oI+YisMYod+X3oI+Y7sMYod+X3oI+YLsMYod+X3oI+YQ:j5d+X3S5d+X3t5d+X315d+X3+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421642865" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 408c445f14a4da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86BFA201-1007-11EF-B04F-52AF0AAB4D51} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000007462408e6b67186128b98785d68b72d0f546b4a9681f17dab88eddddc11074bc000000000e8000000002000020000000d1557d18c61a554c1433336e1c8a6d0aec69f5550d091b6352c4309dfe41d34e20000000456a36b7a5395f81cdc37bc843ab91ff77d4e87c41baace8fc180e3891a77a9b4000000098d1d88e97d7485112ecd757055d02ffd8620e33e21227758a72d81526bdd2efeb6c32418451641b20199dcf068051c293737e85998825e07fd1cdb66d349467 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000047ec116f2baf3985fa0f395387a706e27b794544d1bc0fd24887cc0ea40216c6000000000e80000000020000200000008af0e1b04443756595110e91f37280b4144ae61c61c199d2d2d41bbab6d174949000000012b0c5e9c247ee64711b356f333dda34014a10c4f1bcae9abf6134d467c5a2346cde543c31ca52217f1499d6eee8be4f1f79922f2fe2e8e20565338cf6b77b018b14fb9e02a5acd5b8309d6f2e4f79b4ba0a114681fc71764c682c76de237bdf760fa4bbfe082bdbb1a5ad958874cac96f1c7d0a74c1f40407c0d729753f0cc64fab8ef6ce06fe18d312059002ba407640000000dba5d4d977ddd3bd18c7118fdcfe149f079b298bac7cb58ef4216324b138b9b859d972c77e38436035c006aa94b9d605826a818637a471957708c7d927c4f06e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1844 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1844 iexplore.exe 1844 iexplore.exe 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1844 wrote to memory of 2564 1844 iexplore.exe 28 PID 1844 wrote to memory of 2564 1844 iexplore.exe 28 PID 1844 wrote to memory of 2564 1844 iexplore.exe 28 PID 1844 wrote to memory of 2564 1844 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37c77d4eec692d1ed1a5c4cba35ec104_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfad9528b32970e5706e12c902ccf6f8
SHA1cfe9f3011372c9a42f6b2670ecc86a4438b6a8eb
SHA256f1c5525cf849b730b768dc50db491d149a9073c719b9311dbcc4e452f6410de3
SHA51295c82f0f12b305cab0c7544662452a7b8a67bac7d98970dae35d7d4135db381e0f3eda346cf6cfa07adaa8ac72d9d326d2956229342c91d5c45abafb291fdb52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e42d87dcf28bccd0b32fec302d7f6fef
SHA1044ae272f5dca3845c00156ed1bf0edd925e25a3
SHA256baa155f80af38bcad03d1296377a90424606a9d3cb1ecd3e7e1a7cb57192ce95
SHA5128130716181aa6247e7aca286ac27b0a46602ba3ab57c85307d99e9802c960c719e36b5e71568227d5ce4ecd0c14f2ff42f6fa3a5be712348f1826796aca1ccb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56df5da234804920d34fd88a8bb984edd
SHA1ee1dda33fefac469f0d4331003b316cf4670adc3
SHA25683640c7d3ef2617dcdc54f25133844b49e997d515a247dab51064837c7b51402
SHA512f3895090f223c01b3e3dc8f46788cf46c4990e1ca733103f6f36b53c79ec8d16a183561f1dacef67e55c58e20064166cc05f7dd081bbb30d76507b5c2143e1d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0de0bbbdd302aaa0710186efb00100e
SHA148dcf277fa0a64c7f9f79dde4c8c5780a4b9679e
SHA2568ac42b27422deffcb30a64bfa466b22eee54c45f63ea71334990fb618b9bebaa
SHA512605faf11af1488d84088ddbeca46ae1e3c91f318c3cb1a48663bb72b250a3e232cddb1438f6e3e6cb7252930487b8712d3cb081b3f49481b0f7e7182738e63aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c33c8e65b1bb396239a0aa36e8bae82
SHA1a0a5e7f74114d44ef25894caca9c057b4c83debb
SHA256eb80cc53a0f4a1b75c49db285c001359225387874def79cd9a63036bb174d054
SHA5121e5c537076486f4371de727e030e194a91c6cc464ffc9a5d9bf409719e61b341b2a043d19ba1c56d6801816e2bf886917e3da9b074eb2c99155d093480093cd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcd288447e43eabe051f9e1d8ae9224e
SHA18a460bbb79de837b9f08105562078684f6bcee16
SHA2562de905ece87c63d909408209ef98d45fef10830ae4720ce861bbcd538498f3ac
SHA512c9c4b08ff30361701476282fcd649a269bc00adc4d0f585e6decd8c93f4c5294547f49ace592f7ef1486004c9dc19d5ca707390faad38cd609b6367b5d520395
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5563eb63b1a967cc0ac3a86f69333c6b7
SHA16d0e76110b881c1e14266a65bf0013a842aea079
SHA256c566f9eee9ff80d3ba7726f2a436e7a1ac9c4a112b0589c8a1069db43c66fef8
SHA512c90fa4b7cfe5d5bf4ce475e2fb5a621cea147c0af56be6b973f7310d5fb294a8be6aa09a498474c04feef6b8ec63272402e52deb83ffc95212102e2b9085b8a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3703d7e5dea300db94fdf418e1185c4
SHA1dc90285589a0ed0f56caca951fbb3d7eda4aec4a
SHA256abc503f941e2150d0a8d57e7354fc85bbb53504863fa2274ba43f24e6de51d86
SHA512f1f0698f965cd8a731cab9295d60cd66f4c43f019d22c5f01e20d0465214ae1b89e3c883a0796a56cd8f1b583e006eef68844a28c495b3dc009803f8025b2edf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1b7844255ef78e823046dffd37ca101
SHA14b708493c9df7bb329f0bc694bb458e42005271b
SHA256e450eaa4f9146b4b8f0125f20cd92b9bd135ee19bc39db056603e721617a4f31
SHA51216d44a24a88f3316181eb845cce8022593025c98c6660880027fcb27299f947e51fc53af52d1a2ec81fff6af9f31334501a15383ca1a0a6877636456c70bfd9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc2e08c6317c0fa49d3a7a9c84243339
SHA16b90bf1ec2ddc6705151fa15659f1ad8b782dbdf
SHA256888251be456604cfd4c4cd85897be66e83be485c6e5080717debf4d75a470015
SHA512f47bcedd055737907da3ee14e37f9b0acd8e218b88cdd9ee4b7072294088b974fc3bd36a5f501a6d34c6a3d4d2131396d52e5cb0cda0472dc02b9e7a60f22a74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511e8622fbde3a0959118a8b15d9f8349
SHA1225905016b1e432a99cc881ba4e550c01704e6cb
SHA256abf4fab7942c66c08fa469b1d16ec5a96942947db56987fa09675a359b741b30
SHA5121c8dd29dd878e103a57f0531bc7721fc7a54413812f090402cb9f6176bc5d5fb11f41f0d0acf354978077659a9400e24a757082b6ba4aa497b762e4387461ac2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ff1815b20fed9aabd0087059f5dfef0
SHA18d7ba5c0504d4472a72d39544fb5482727b513ee
SHA256a72baefee3d5704cec958383b4e475b6e8f43e491ec1f2cf1b88941a1a8ca961
SHA51212a420fd31e3c0464ac987f4a24e35a0e3694e7d96afd83ffb96fdea0a4b0ef04deb92c7dc6cda11a3402cb060e18c3b9dc12c3a67d148b2351e563dbf163366
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5097ff584cc3473db5507dc30c5940ae6
SHA189e98ba81bf7db823c46d72192b5fb89ebf10592
SHA256862003e1babe5f6146b763f3b286ed56c0c19d22679a40f90dc116f056d5b2fc
SHA512fa04329bb691749e7058cb4779c5b5e55bec77f08522d8a4d851803475b1b151bdd403fd35da7020d5ac4000da5683e95024443035ff46e4eb950893142d41b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5704a06bf2b1dae0dc5f323575e30c916
SHA138428f4d8e0ae94c5b30b0e0c6c585dc78881c87
SHA256d93ce6a009047dd8bd6271be592318426c963cc3f65b8b2cdc0b9fe92604d0f8
SHA5121dca86f31de4fec33cda4cee71a95531390cdaa1a303a046d21a09fc08c2f95aa81de513b857b1cf6d7f4d31b1fc32c04f93494966198b1b6353f18e3ac0f987
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca44822cc775a6ea3075cceb3afbc01b
SHA161700cf22c1e5a350f04ae0c9d79dc4016772bb5
SHA25676567dffd06dee0253ac2ce543bbbd0b375e494271217154212be1155f09b7e8
SHA5123ebbe1d1ee59deab9f5f0da1c38cd343bfefefa74d5a3335fbb0fd7e9621873e064743d9a08841b23a445d0bcfd41d3159029d8d27c9b63ac80bb34f51dc2ccb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edf84825f3daca8fffe2ead5d174b48b
SHA12e88889b3a3d205dbd21f6ac6625e50d89e4cb9f
SHA256d27f3e0d8f8a2a63e48e2a358c599874e63175fe993ce295f39112faddc66662
SHA512f448d7db825e9bc8ce3f6cc848d328f5249a8cc3c45f3e1dcbc7ab7cc2f391e1a14fabc07c2cf031466a108b1f002c10ba8358fa257085aa51d6f61b850b734d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56941587deb81dbf61095ec2cd28f7c74
SHA1ef552e3921ff971332d1fe3c0854c35dc2cb222b
SHA256a9cf751799cd2ada8736d95d6ef77822ce0c7d45e31ecfe435e33ee58051ce99
SHA512e08067fec9d4fc2063b0f19a766b782011b3a5320b4bf296ff81477ca099ac1667e101c91cd46515a81e67e8a6fb0ff6b9df0a7dea605274bdd0c3f7b8b44280
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a88b40c3f3f6d216212e69e2f650733a
SHA14c3be7fc37eaf6e1907e448699f7f6c0f0b14dc6
SHA2565eb718b405cedc83a1c6dae1f4d89ffa0e574a80c8597c86033e72ebd19e9cd0
SHA512db514b8038bb93e82257863c4f79283f4289ed7bc7c0cdb223d4ce3b460176e37a81eab54aca38e317e242a9741145e7257b4afa19ff649896e09c761f2af23a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5618e3d05f2c0d96d5e5f14f8df63877e
SHA1fc5cfcc7ca1f82271f4486390a7656d2dc8171b8
SHA25635595e12fa3a3b3c009411451678b204760b6b9434b561eb4c3a56477ed99629
SHA5120f2ce2620b9e83e56d8682065fbd05f591f35d36cdadd4b9f9ad6805890177d5653289ec965d64aa2d61b183edab49d2a709594c6a211f818b59827761120a00
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a