Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-03-2024 21:51
Behavioral task
behavioral1
Sample
b5bec1b7be6f7e4635e801dbccbff6b6.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b5bec1b7be6f7e4635e801dbccbff6b6.pdf
Resource
win10v2004-20240226-en
General
-
Target
b5bec1b7be6f7e4635e801dbccbff6b6.pdf
-
Size
90KB
-
MD5
b5bec1b7be6f7e4635e801dbccbff6b6
-
SHA1
2b91c22591d2a73c762499bb31b5a284ff5040da
-
SHA256
9cafef79f65dce2ac5520fd62b4c5c73aa50e5be6d4fe9d48db94cc1a2d6d548
-
SHA512
105df7cf8689c7b097040fdb0e9e8f07fe84b90a2eba50add1402c90fe519f9dd951f5c0f62df4e21c9a5731b960541418aa5b393940e9f5bcd78a464975e7a3
-
SSDEEP
1536:memj5zR6RNxKNWX04zEBt8aefdwOW0ROV9jY3sYW6pOu2Z7YyF6Ca:XCzYRSNWvor8aKdnahu26ia
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4688 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4688 AcroRd32.exe 4688 AcroRd32.exe 4688 AcroRd32.exe 4688 AcroRd32.exe 4688 AcroRd32.exe 4688 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4688 wrote to memory of 2224 4688 AcroRd32.exe 96 PID 4688 wrote to memory of 2224 4688 AcroRd32.exe 96 PID 4688 wrote to memory of 2224 4688 AcroRd32.exe 96 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4664 2224 RdrCEF.exe 98 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99 PID 2224 wrote to memory of 4168 2224 RdrCEF.exe 99
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b5bec1b7be6f7e4635e801dbccbff6b6.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=459B689051FB7C4CC6EBC92A4ED52EAA --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4664
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E7E0AD936280BB7F59D70F8E07298D54 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E7E0AD936280BB7F59D70F8E07298D54 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:13⤵PID:4168
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=536A3666E9FBF72AE5CFB27BAB0F9613 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=536A3666E9FBF72AE5CFB27BAB0F9613 --renderer-client-id=4 --mojo-platform-channel-handle=2156 --allow-no-sandbox-job /prefetch:13⤵PID:548
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=81AA366CCEAFC1D2774EB5DDC815B0D2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=81AA366CCEAFC1D2774EB5DDC815B0D2 --renderer-client-id=5 --mojo-platform-channel-handle=2280 --allow-no-sandbox-job /prefetch:13⤵PID:3304
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=71E5DE6CBA49E9CFC86D3F5C65CE98E4 --mojo-platform-channel-handle=2796 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4764
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0563E6554A7E454090A5DC0BD14DEBFB --mojo-platform-channel-handle=1908 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2132
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4293C7C5C3A87C919D9F58232795A492 --mojo-platform-channel-handle=3044 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4444
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD527adf089cb1fb7de9e50c9ffd7b53665
SHA1304f9c6a7d38b8a4cd2a917f65b897fbe85aa283
SHA256dfa45e6c5bb066711b5298a5aa27bf7ba4c4209969eb62e18c78d1f214ccb8f8
SHA5128cbe7844a54901172ccf9463c03df223ae25d23ce087131cf8ad1a67a1bb0c4beb5638392275030c1529749f97bdb676672d4936672af65584ecb42b30311321
-
Filesize
64KB
MD555632411dc7f98ea6261c42e77fc0000
SHA19a30762e4cf47c12d8176de5ae5f7037b13db487
SHA2561f72f2d4e7e0e9c278dc5103744ac2fece3921703663bebcb50326fa0d24db7c
SHA51231044373b5792994dc195c223e43c66d54b4aa8d10528b6f4d5dbea64b9ece1b3e415084ae102584fb4a1abd138d7ccb95646b9a19d10fa7f6db1c49e34b8533