Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 00:19
Static task
static1
Behavioral task
behavioral1
Sample
2343220820185117653724284721341YRWYRRRET56556U P1DF.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2343220820185117653724284721341YRWYRRRET56556U P1DF.exe
Resource
win10v2004-20240508-en
General
-
Target
2343220820185117653724284721341YRWYRRRET56556U P1DF.exe
-
Size
1.6MB
-
MD5
c199e8c1d6d78839bbe8c246fe1189fa
-
SHA1
2751846150be33e07814bffbb93f17cd75976067
-
SHA256
c98348acfaf93dc66a8b44cd00303670222fcdf59ad3eb1d3ab5ad1d3b1ef92a
-
SHA512
67ee203a202e1db3068a22839cf7f8ff1c932fb706a9baae6ce252d10fbe0e600647703ccbfe25b08710b14c96203f2d52f57e2310926ca96b8ef31fbbd307e9
-
SSDEEP
24576:CoI3PGDYjSaOdiSFQY8ncjr5yKg7VwmhXtqh2wQK:+pjaiao4XghZhPwQ
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 2343220820185117653724284721341YRWYRRRET56556U P1DF.exe -
Executes dropped EXE 1 IoCs
pid Process 2452 CrModMngr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CrModMngr = "C:\\Users\\Admin\\AppData\\Roaming\\CrModMngr.exe" 2343220820185117653724284721341YRWYRRRET56556U P1DF.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings 2343220820185117653724284721341YRWYRRRET56556U P1DF.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2452 CrModMngr.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2804 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe 2804 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 744 wrote to memory of 2452 744 2343220820185117653724284721341YRWYRRRET56556U P1DF.exe 93 PID 744 wrote to memory of 2452 744 2343220820185117653724284721341YRWYRRRET56556U P1DF.exe 93 PID 744 wrote to memory of 2452 744 2343220820185117653724284721341YRWYRRRET56556U P1DF.exe 93 PID 744 wrote to memory of 2804 744 2343220820185117653724284721341YRWYRRRET56556U P1DF.exe 94 PID 744 wrote to memory of 2804 744 2343220820185117653724284721341YRWYRRRET56556U P1DF.exe 94 PID 744 wrote to memory of 2804 744 2343220820185117653724284721341YRWYRRRET56556U P1DF.exe 94 PID 2804 wrote to memory of 4236 2804 AcroRd32.exe 96 PID 2804 wrote to memory of 4236 2804 AcroRd32.exe 96 PID 2804 wrote to memory of 4236 2804 AcroRd32.exe 96 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 3516 4236 RdrCEF.exe 97 PID 4236 wrote to memory of 4412 4236 RdrCEF.exe 98 PID 4236 wrote to memory of 4412 4236 RdrCEF.exe 98 PID 4236 wrote to memory of 4412 4236 RdrCEF.exe 98 PID 4236 wrote to memory of 4412 4236 RdrCEF.exe 98 PID 4236 wrote to memory of 4412 4236 RdrCEF.exe 98 PID 4236 wrote to memory of 4412 4236 RdrCEF.exe 98 PID 4236 wrote to memory of 4412 4236 RdrCEF.exe 98 PID 4236 wrote to memory of 4412 4236 RdrCEF.exe 98 PID 4236 wrote to memory of 4412 4236 RdrCEF.exe 98 PID 4236 wrote to memory of 4412 4236 RdrCEF.exe 98 PID 4236 wrote to memory of 4412 4236 RdrCEF.exe 98 PID 4236 wrote to memory of 4412 4236 RdrCEF.exe 98 PID 4236 wrote to memory of 4412 4236 RdrCEF.exe 98 PID 4236 wrote to memory of 4412 4236 RdrCEF.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2343220820185117653724284721341YRWYRRRET56556U P1DF.exe"C:\Users\Admin\AppData\Local\Temp\2343220820185117653724284721341YRWYRRRET56556U P1DF.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Roaming\CrModMngr.exe"C:\Users\Admin\AppData\Roaming\CrModMngr.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\doc13454.pdf"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1C85DD0DFC1D664FB296D61274D8E7D7 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3516
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0D1DFF912F749CD86C65DBF358B92A6F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0D1DFF912F749CD86C65DBF358B92A6F --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:14⤵PID:4412
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=330F8FE678E48D8EE989380FA1061711 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:2616
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5100B0DC79576BCC41143A04FD3D9AFC --mojo-platform-channel-handle=1852 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:1884
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B5B6F6B601FA89D58593567FA167DE3E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B5B6F6B601FA89D58593567FA167DE3E --renderer-client-id=6 --mojo-platform-channel-handle=1932 --allow-no-sandbox-job /prefetch:14⤵PID:1788
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A1EA5BC310E734448D9F778C13D93A00 --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:2712
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD538d1155e26f9055172d0850f73ab7305
SHA119a83647b728e3dbdea3a17a5def614ab5c2a9c0
SHA2565ab1d7356c66e11614fe26aa4987eab8840d49e9e2d7fee0555da1b334a3d04b
SHA51227731f6cd3a31942de727b7acd003ca3a977bdb9edb004d33d02c540e7b49dec2ed519375de29bfd04c5d83589859e3a33b0ca51dc75ebd667f63e63ff217f4b
-
Filesize
64KB
MD586201c77ce9e159b41cf57c0aa1447fa
SHA1484ba1225fa779d9a1ad33c9421eebd4f117d73d
SHA256f0c86bd10de47b6de2d4f43f9a73f1d873acf46f2e76da1e3b83a538b342267e
SHA512b5f23939263ce773df9dd92ea1a40d44a73de33b93327f3c9dd4bc3e919f3ddf226a0aaf9d39bee8fa4debdf40dd03e935d14d7d23fb928407fab1cde03acd4d
-
Filesize
1.1MB
MD54ff6f320cd7b6f9b2633fb97f5a2ba62
SHA1ba9050f1fe08126120b94ec2db038ab2d4668566
SHA2561dd3ad0675c2f336d32adf71ad78656292d6f260c311d76c365a656c7d2fac02
SHA512b74339777306d5cd5d3bbb1a1ab49fa67789145851a9261f0b47710edda2bae699425bf28b1def01955ef8ef0feed719c80f7d537837c1236aca64090362cdff
-
Filesize
45KB
MD578a4cb6670178725b4c5c226a2f7202d
SHA1cc79240cdaf864f64caec599f72244c307957dfa
SHA25694696530bb898d9e0990eb837e3e4809c57e170e5973d1d2889b7ef9283c2ffb
SHA5126b2c35d7caffb6a2c20ce9fe863c07029498dd9c1cfbe4556266449490b669242008ec274e24de397b5488e4c51e7c369e70aecdf1df268cabcd0cc7c5ab7028