Analysis
-
max time kernel
93s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 00:49
Behavioral task
behavioral1
Sample
418aee5689377167311cb24988d2d250_NeikiAnalytics.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
418aee5689377167311cb24988d2d250_NeikiAnalytics.pdf
Resource
win10v2004-20240508-en
General
-
Target
418aee5689377167311cb24988d2d250_NeikiAnalytics.pdf
-
Size
420KB
-
MD5
418aee5689377167311cb24988d2d250
-
SHA1
5561397a92b7f399e641b9bcc03212a4a7a814c8
-
SHA256
92b7cd9259a65e37de2f7348f400b6e4102fbd3ef7c40849decccebece7abde1
-
SHA512
724877944c1430d4197595987d316f536036594444f784c9eae44e5dd164a28e345a69f38ca0d13976a8bb50035d32bf8a0df7ec331fcc172aee11701ec1325d
-
SSDEEP
6144:Wnp/pfJB7qd8xP6c8ib467xqN5ynKxd5m+euQzV/g962EyDyqHifuaVYqB4NqJ6y:WRVPlLb44+5WKxHmDbIHDzmSqybra
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4824 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4824 AcroRd32.exe 4824 AcroRd32.exe 4824 AcroRd32.exe 4824 AcroRd32.exe 4824 AcroRd32.exe 4824 AcroRd32.exe 4824 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4824 wrote to memory of 3460 4824 AcroRd32.exe 87 PID 4824 wrote to memory of 3460 4824 AcroRd32.exe 87 PID 4824 wrote to memory of 3460 4824 AcroRd32.exe 87 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4368 3460 RdrCEF.exe 88 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89 PID 3460 wrote to memory of 4244 3460 RdrCEF.exe 89
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\418aee5689377167311cb24988d2d250_NeikiAnalytics.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7D541F55DAEDAF06A6E314F110081EDC --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4368
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5F24C6900AA303E39B4C3128B0E025BD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5F24C6900AA303E39B4C3128B0E025BD --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:13⤵PID:4244
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A9699441D2DDC36540A88545EBAE4FAC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A9699441D2DDC36540A88545EBAE4FAC --renderer-client-id=4 --mojo-platform-channel-handle=2184 --allow-no-sandbox-job /prefetch:13⤵PID:4944
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=344E57A877B455606045BC2E73FEA43E --mojo-platform-channel-handle=2564 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:728
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C2B070D07FB60F6F2586E9AF3783ABE7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C2B070D07FB60F6F2586E9AF3783ABE7 --renderer-client-id=6 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job /prefetch:13⤵PID:4424
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=05F66BA802CE36AC34C038B7085A9CCD --mojo-platform-channel-handle=1832 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4964
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F7105BCD465390C6B3A08688314CA987 --mojo-platform-channel-handle=3028 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4116
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD56b47ca954323f545158e8da968b3cb3c
SHA1991e1c995385c445b8d2a710f6a66d2fb7444157
SHA256ffc6cbc82de74387e6b9f9d4f421ff964304e80ffbdbe90ef921daa691739ad6
SHA51243cebc92e9b4d416a1d58bbf3006599f6875524ce7c7b23b4221c0009b19b5a656d2dfdd2f2cc4875ce548734a9d15ecfd3449bf69674bf5621174d9482ecfb7
-
Filesize
64KB
MD5258f196bfb465e4c97562c09f91aa97a
SHA1e9672f8eee17843c7537e857c00431294653bc17
SHA2569f1edaf9b02a367429c8c9e2cbe227938d6856a4b7cb9d69fc1020ceea5ee513
SHA5123f368b2b2d4dbe1a19135fcd7155b4cf934f13ce52ff0ca6e5c91a62ff08238eb35b7b235c5ea3a1ce1e4877a90aa71577726f55690ad3be564a7e9f7b4abe61