Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 12:42
Static task
static1
Behavioral task
behavioral1
Sample
2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe
-
Size
58KB
-
MD5
2c62e2729912706b2db9b3c6707890d6
-
SHA1
8760f2de0c8421395f8e4f624d6ad37239214169
-
SHA256
cc4caa9b8e2cf9156ab4f78b7b6108bd35a15a84661d627860910eed6ea2b7c3
-
SHA512
8d9165228f2e6ac3cc51fd2a9a5cd374b52a425d7ee8fe75b0610a94cfb69fdcd50002e7b031ba84140b5f05c70c4745ce04c68fdd565bc804284fb4f4c370d8
-
SSDEEP
1536:BN+Tv73Rs2eSsWsBhlKH15v05KzsqL9oEcscXeSrlAPz:BN+/Rs2elWsBhoHTSKJripAPz
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1880 regsvr32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\msdtcs.exe 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msdtcs.exe 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\msdtcs.dll 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RCX416.tmp 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{287DC431-3D69-11EF-8A2B-F235D470040A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426632601" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3032 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1916 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1916 iexplore.exe 1916 iexplore.exe 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3032 wrote to memory of 1880 3032 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe 30 PID 3032 wrote to memory of 1880 3032 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe 30 PID 3032 wrote to memory of 1880 3032 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe 30 PID 3032 wrote to memory of 1880 3032 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe 30 PID 3032 wrote to memory of 1880 3032 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe 30 PID 3032 wrote to memory of 1880 3032 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe 30 PID 3032 wrote to memory of 1880 3032 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe 30 PID 3032 wrote to memory of 1916 3032 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe 31 PID 3032 wrote to memory of 1916 3032 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe 31 PID 3032 wrote to memory of 1916 3032 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe 31 PID 3032 wrote to memory of 1916 3032 2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe 31 PID 1916 wrote to memory of 2152 1916 iexplore.exe 32 PID 1916 wrote to memory of 2152 1916 iexplore.exe 32 PID 1916 wrote to memory of 2152 1916 iexplore.exe 32 PID 1916 wrote to memory of 2152 1916 iexplore.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2c62e2729912706b2db9b3c6707890d6_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /c C:\Windows\system32\msdtcs.dll2⤵
- Loads dropped DLL
PID:1880
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2152
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e055058298740b710a38df7525c1741
SHA1cfad1667cdab2e092a773f77e9ffb3c44e472346
SHA256776f3e83c3bdfecfd4b1e9026e0eca765ee6d73c41f620c50026d54f79c5d401
SHA512ba4c6e54d76f76d84ebce4e87508752e93279e6834e877c119c39ce8b0ff4fb1d061f513641fc5d228ee9dc684a34cc7827064c433314cc35c2a2bc6168c6f25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528b150ca2a3d5ec03da8b15695ef2944
SHA1579a8c8ff43a770dd2f1feea9c2e3e3dc57e73f5
SHA256b4aabdc7fb79ddf60b7d4796506b7bce0de69aebc05866853acfadb23d616916
SHA512ed33a1ac0bfe91a47adfa3874fad57851627e81ab49e97a114aab7efb44e8a07ffce054dddf32bc81813a0f92581386db534cc1d13cf92f26da64bc60c0e820e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cba2a908f1c4e29974d1ebd933968344
SHA1c7c965c9af91a71e12362dfea0c185a628061792
SHA25668ff08ca580caa6690a4e5038044e57d507cc0f15eacb7f23694ae06cb0c5af9
SHA512c08c2a98e7d1b775921042b6631f0d946e55a62a2849ac1b79bffcbe27f2c0d566c83e224588493c66ee410f355be2473bb25d8d6d1ed3e992b0f19e4ee1cae6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD518be8efe63e60e87d8cbc0e2f0133a2f
SHA1f86f2d8b5877c7dec449fe4e4ff17d6cb01f4ee1
SHA25664c6d735369ce2f68d8e42425e2cccc9a506ed00c892825b0d39570dbd37d0f4
SHA512114d0cb2cd64dcbe40e6de56f88c9981d0a14826497c3202f2f5f79ca78a842cf774f4f4cb152de182475a5824d7404117f84fc08035c5b790faac5195307864
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4fc8c046034bf5511be0013340e71a6
SHA1124178069b198b24d45848dd7d14e9777bb64b05
SHA2564e5d16ff51d8dea367f5f13e32798d2119241d41a96c5c6d20dd18c072e61402
SHA51264d4976ed86391b0ecf642beb2b9cae25916392c713efc9b2c6201860cfcb4e8cb3c5961ae211fa8052a039b0d8003a39779b899e62298e8939690d0009147e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57c7ea411090f0a4440573359e2e859ce
SHA1c122ceb91630b05a47de6e12f712c38f35f4276f
SHA256f93077400efee3cac759b74b27519067222daa4a8967fd1e6b4c71d771d62389
SHA5123c7fbbe88a2e951cbd766637cb483caa7a610d88133a693b1241e74f987866f4fb49424fa9cf2454ff2315e7ea93d4703b5feaf2b90a596272ae1ceeb889ba90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c4ef7072a339fc67ab48ad41badbb06
SHA1668b12e4da1c2c7b8420d848eb7761c9eb6fb1a4
SHA256b3993eb914854f9cc1d7853d0057d062f64e78437af751eeb0bbf4a8705739b6
SHA5122b64733c40b38e2325f7592bc7f5ef42edd3be17b838f81deb34b8c8b51b4271a1d65ba9b210f6999e6a754870e206528ed842bacd4dcfece42c0eacf1366c63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53be5d051f67d8356639518d868fb54d9
SHA1dba76746e2454ab59665894d3d46fc1638db7238
SHA256027690e785a5f69ac4e6f0d5b8963126a0892a3655b8a61a78d07277ec669ea8
SHA512e6f050888d8483a279cf92be136d97191ae3001c4b223c9e48641302af39695fb51a43f85fb4e158dd87734a7d90d081fe8cd5c100d58c2a395447e43340a968
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56cf83d78ee1ddf2643cd59bfd826917c
SHA15705a889cad4e75318c9b7bf4daf30edc5312074
SHA2563e17745b244de96dab92b5b1ddfbc678de253e41a7825c07d4db7edaf74a044c
SHA5125575d0dcba1669735451554a34005c60f375ebe1c7f7e1bc90df637c09e2a20607cccf5feb4619de4a43211dcdaf11a46a2cdbce5d7815422279faa6c4adfb78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dec437fad73b81aba3ec15e75a7afd61
SHA1644d85dc1c610c279d9e360e87f915889b0d6d9f
SHA2564e73060f80a73a3e6d49fa79cfe7b0828af9dc34bdaf6a9cdd2d38a79a385410
SHA5129234b03a271590078f58143a3a8e3ba76f34571bca5f5f8241db4fdb31de4db70f091149abeade7aff7a509c50995987653bb8d80b26a22f626408d09af9d911
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e0b0157a4447d3e742227892190732a
SHA113dd275dac84241a196e551b62d461f05e8e799d
SHA25618c142ca4ed93e762338aeb43d5eabae79f1d4b8c3473cb2dfc7245db9358fd6
SHA512f48a732df309b5e75d528911149f2d1cf252636e280501036a5ac8991c2b0e440fb0362b8eaf9145ac1c2dc56590d91a8716bedae9f74a0298d1f235d2886d24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD548dddf4532d531267f7c2a7bc814982d
SHA18a8ce086af309a872c769f29644a28f0b1187701
SHA256591d49fb8774cb6f64cf9e592d47d2439f6b41e60363957e7932a0c380e9aad6
SHA5123ae130df3b3a344a33cdcd1017c601a3d10b49050b150a938b728b6072b320e1a3df88280516e482e0f33f26f4a4faffda9f6e54e6f970e1dc250573b6c14498
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0231ac7a325ce0e184050da338895ac
SHA1a6b18cb63ba7df9ad55fed7d1612bbe9bcec5515
SHA256c1edcc95bec29b5bcfc28431eb5cb7a154a582cb5f2b9602cc8389b2a3655359
SHA51294998be4796f655b12f1cfb2ebb4f4e480a850ba00811687eec7c037aee7f79b8afbd42776522052f5e1e4a95d0263b475bdab41c87244628182cf00fd816f13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578fa61c456635235f71ec087bd51b917
SHA15e1ca1267ef8b6e9cb196f980ccffcd741b1fc84
SHA256348dfbd79fb7e2605360ceee34cce0c395c141c6c9016b35ec426ea097b04cca
SHA512eaab4e9a584602b03ca313eb50214f758ed7aafc43f83e0eb1a64de021c294c94777c994bef060715956fbd4c7e19ef5b03528e9cd95f5587aa1a06064fecd20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56406823b8d39d64ed79c8eadfcb4af77
SHA1e4c30d15c33cab6f6bef713a4d0c298b6ea6eb26
SHA256b55b15cb6a37b70164324fe1f130b9f7a03d4c95311ea038890457851c08bddf
SHA512835b9686577c27c85eb254451da872b0ad64c5dfdc2cee5ab1e7ef4bca627cd6a91189fb205c35d25ae2648c92a46046bbb5a61340df9487abac4b4f89f1a48c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54441adb8014b147dd686d957fbf008d4
SHA1f5fbf4b72cd79cbbcea7b8729f4c6d145a96039f
SHA256bc0e270a7ca6bb4b345676853d8f2390546e746c0bc48fd8bf914c6b0402fddb
SHA5129aa65298c7bed44b043a73a949a481914e245af3d63c97b937586b2d17227e1afd571e4bad90e8c3718f37956d3362b95960fb155b3fcb2b1bd14d6a565af42a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55e2ab690d5bd5556d37779bad023c1fb
SHA1dc84f06eb26e5e3cf6a5e02d1fc7b5b9eb8ac4b4
SHA256571f33b0b13f6fc8fceebe535f5bedf91b441572387f268106be533ed3ce17be
SHA5125d1628e23f9f26fdb0835ba3f764830d1d31441325aeea56e007deb6d607edc2b803202476bbec4a2f06d7fbc3cedc6b9564f38ee705f2208a3f542ef210d8ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c02ea19114f8d85b51c7ec54a7284fd7
SHA14cc845f1d9d22240a356e6c6e5193bf44d26ceda
SHA256e74409406f136383cbddc520f32a45aa1dc9268b11dd93cd2479d94410e15be9
SHA5121e19f6e8adf9040362fd4f38eba2c7d63778281ce328816acc33af8976e2d24b0560f3d8eea6e8c82949e20c6b5e9536194bdadeb8f5c641162b7978e92eb94f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb6b85cbd15b450cf84bc43e3b38ea7b
SHA17b40231788ce9d8f6565caeb0c66eb37af07706e
SHA256bafa541a185d13123b3bc446095f0e94e5116f5153dc2b43fbb3d52f71a3e227
SHA512de65d92efde8a3153e44715fda283dec356eb94cc4e933c9a62e316a909f262867d1c3e9d6f577ddc21e2c31e7fa3b2e9f3b3e708dbcef0b1be2e08d62781c71
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
78KB
MD5b400e2f5bfea3024b4007831920c66f5
SHA1bb272523249fc9d00acb08be8b85765891788a3e
SHA256cb5c27a1faf22e11d9e187aea87babd16c93d074dc386111d7b200b8bdc14790
SHA512364b8fb968624e9d7c665584b76a263d4673d47ea664c6d2a13716af72062b6b5d4a33f0bfb823df5e3373e27e329dadd05af2364b2fea6204a29053d3ac5ceb