Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 09:28
Behavioral task
behavioral1
Sample
d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe
-
Size
829KB
-
MD5
d46e2f5007e8af971c34a17bafe544d0
-
SHA1
3fa71c422597d24af29bf942bc3e7dfba404f6dd
-
SHA256
eaa9a6674a2c49762574bd10294cfe737e37c7793f4c88d0ba3700db73e15b55
-
SHA512
03d1e1ec5cff82c2fe61732d08f98d5bb8c263c081008be1ecc1bd8d359787460762773034906a52e933daf25e0ac07f9a82a1f9721e2e824e354e90100e35ef
-
SSDEEP
12288:lCFCcYc/Cg2QGAtikngWn3IgPZA9H7id2naI+:l9cYc/IOikngWnYnH7id2ng
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3040 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1200 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3036 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2124 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2100 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3288 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 544 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4216 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2864 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2664 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2440 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2080 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5008 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2040 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4064 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2108 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4260 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3532 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2152 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2428 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2760 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4828 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3068 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3956 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3180 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3048 1444 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3868 1444 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/3684-1-0x0000000000D60000-0x0000000000E36000-memory.dmp dcrat C:\Recovery\WindowsRE\backgroundTaskHost.exe dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe -
Executes dropped EXE 1 IoCs
Processes:
d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exepid process 2292 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe -
Drops file in Program Files directory 6 IoCs
Processes:
d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exedescription ioc process File created C:\Program Files (x86)\Windows Defender\fr-FR\taskhostw.exe d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe File created C:\Program Files (x86)\Windows Defender\fr-FR\ea9f0e6c9e2dcd d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe File created C:\Program Files (x86)\Google\Temp\upfc.exe d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe File created C:\Program Files (x86)\Google\Temp\ea1d8f6d871115 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\backgroundTaskHost.exe d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\eddb19405b7ce1 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe -
Drops file in Windows directory 3 IoCs
Processes:
d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exedescription ioc process File created C:\Windows\Migration\WTR\System.exe d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe File created C:\Windows\Migration\WTR\27d1bcfc3c54e0 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe File created C:\Windows\servicing\FodMetadata\metadata\taskhostw.exe d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2124 schtasks.exe 2100 schtasks.exe 2760 schtasks.exe 4828 schtasks.exe 3068 schtasks.exe 2152 schtasks.exe 3048 schtasks.exe 544 schtasks.exe 2440 schtasks.exe 5008 schtasks.exe 3956 schtasks.exe 2864 schtasks.exe 2664 schtasks.exe 2040 schtasks.exe 2428 schtasks.exe 3040 schtasks.exe 1200 schtasks.exe 3036 schtasks.exe 2080 schtasks.exe 4064 schtasks.exe 2108 schtasks.exe 4260 schtasks.exe 3532 schtasks.exe 3180 schtasks.exe 3288 schtasks.exe 4216 schtasks.exe 3868 schtasks.exe -
Modifies registry class 1 IoCs
Processes:
d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exed46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exepid process 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe 2292 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exed46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe Token: SeDebugPrivilege 2292 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.execmd.exedescription pid process target process PID 3684 wrote to memory of 1688 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe cmd.exe PID 3684 wrote to memory of 1688 3684 d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe cmd.exe PID 1688 wrote to memory of 3628 1688 cmd.exe w32tm.exe PID 1688 wrote to memory of 3628 1688 cmd.exe w32tm.exe PID 1688 wrote to memory of 2292 1688 cmd.exe d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe PID 1688 wrote to memory of 2292 1688 cmd.exe d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bF0M1fvQ1b.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:3628
-
C:\Users\Default\Music\d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe"C:\Users\Default\Music\d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2292
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1200
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2100
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "d46e2f5007e8af971c34a17bafe544d0_NeikiAnalyticsd" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Music\d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics" /sc ONLOGON /tr "'C:\Users\Default\Music\d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "d46e2f5007e8af971c34a17bafe544d0_NeikiAnalyticsd" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Music\d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\Migration\WTR\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2664
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2440
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Windows\Migration\WTR\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4260
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\Temp\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Temp\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
829KB
MD5d46e2f5007e8af971c34a17bafe544d0
SHA13fa71c422597d24af29bf942bc3e7dfba404f6dd
SHA256eaa9a6674a2c49762574bd10294cfe737e37c7793f4c88d0ba3700db73e15b55
SHA51203d1e1ec5cff82c2fe61732d08f98d5bb8c263c081008be1ecc1bd8d359787460762773034906a52e933daf25e0ac07f9a82a1f9721e2e824e354e90100e35ef
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\d46e2f5007e8af971c34a17bafe544d0_NeikiAnalytics.exe.log
Filesize1KB
MD57f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA5128a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
-
Filesize
239B
MD585b9d88acf4c90a067739f99f18fbecb
SHA1ffa2f545d03113cada7fd64165a91e5d591b4461
SHA2563603c21cebe0ae3ea2eb21bcb7038b66290d8f19f7a5048d1b547ab26269c71e
SHA51243433dc0e7ccaaa12ab2f3fd0d7b0215f4f75e64b3e6405df3264011660b47835116d87a8b298c92c391a9530f3cb5b89fead5c18528758b50cc475f22204726