Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 02:20
Static task
static1
Behavioral task
behavioral1
Sample
568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe
-
Size
184KB
-
MD5
568bf56401b9e825d69a6250faddf780
-
SHA1
8bedcecd2874419d4405105887410a309d88386a
-
SHA256
65203f321df0003cd978cdc9a5697b87b09f74aea0ff915ddf9c835bbb4b0f79
-
SHA512
242381356c9cba85c868a09738a72b8d0dbca7c65744f4c8ce03084c1feaff1d8528845d5c912452013c444ee64e2c6ba4016f3fa40f06877b800ff03c25226c
-
SSDEEP
3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXaKe7WpMaxeb0CYJ97lEYNR73e+eKZ0VXM:RqKvb0CYJ973e+eKZ0VOqKvb0CYJ973J
Malware Config
Signatures
-
Renames multiple (4029) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
Processes:
_Remove-VisualStudioComponent.ps1.exeZombie.exepid process 1736 _Remove-VisualStudioComponent.ps1.exe 2224 Zombie.exe -
Loads dropped DLL 4 IoCs
Processes:
568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exepid process 2512 568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe 2512 568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe 2512 568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe 2512 568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
Processes:
568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exedescription ioc process File created C:\Windows\SysWOW64\Zombie.exe 568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Zombie.exe_Remove-VisualStudioComponent.ps1.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar.exe.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll.tmp Zombie.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.bmp.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\settings.html.tmp Zombie.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_ja_4.4.0.v20140623020002.jar.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.exe.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.tmp Zombie.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT.tmp _Remove-VisualStudioComponent.ps1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.tmp Zombie.exe File created C:\Program Files\Windows Defender\en-US\MpEvMsg.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.bat.exe.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+1.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-api.xml.exe.tmp _Remove-VisualStudioComponent.ps1.exe File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.properties.src.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp _Remove-VisualStudioComponent.ps1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jawt.dll.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-settings.jar.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp Zombie.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.exe.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.tmp Zombie.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Asuncion.tmp Zombie.exe File created C:\Program Files\Mozilla Firefox\Accessible.tlb.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.tmp Zombie.exe File created C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4.tmp Zombie.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\MST7MDT.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libhqdn3d_plugin.dll.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.tmp Zombie.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\liboldmovie_plugin.dll.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_ja_4.4.0.v20140623020002.jar.tmp Zombie.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp _Remove-VisualStudioComponent.ps1.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exedescription pid process target process PID 2512 wrote to memory of 1736 2512 568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe _Remove-VisualStudioComponent.ps1.exe PID 2512 wrote to memory of 1736 2512 568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe _Remove-VisualStudioComponent.ps1.exe PID 2512 wrote to memory of 1736 2512 568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe _Remove-VisualStudioComponent.ps1.exe PID 2512 wrote to memory of 1736 2512 568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe _Remove-VisualStudioComponent.ps1.exe PID 2512 wrote to memory of 2224 2512 568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe Zombie.exe PID 2512 wrote to memory of 2224 2512 568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe Zombie.exe PID 2512 wrote to memory of 2224 2512 568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe Zombie.exe PID 2512 wrote to memory of 2224 2512 568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe Zombie.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\568bf56401b9e825d69a6250faddf780_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_Remove-VisualStudioComponent.ps1.exe"_Remove-VisualStudioComponent.ps1.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.exe.tmpFilesize
184KB
MD5c1fee18bd2f430eadcd56252137dc179
SHA1e11ba074fdadbca5f3ebcb926c93a34e2e2cb16b
SHA25662f1724d61dd30ff1d9927cf422dfa318517730fe050b75318ffd46bb1634e61
SHA5121206717ebeb0c8a97fd7b09c5de0c012437cc7e867888042d38bf87a48ae7541c20c29236d7591898cf07b61c783214bd6610f8aa0e85e83fca828bec751a425
-
C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmpFilesize
93KB
MD5a206e92dc9dc11f0d6b6e773514fb1be
SHA14b8e3f7f39c90c1f5c401a03275ce81edf34e6e9
SHA256620b889e64b92d2678006abdc494073d02de6f8ab4a69e3be817faeaaddede84
SHA51281fec972aa0e628c58a828cc40fbfd98d8413caa669717129686a3ce192a0bb1968c397730340224872efe58cae44265569dd3e388f855afbe3cfe6687ebd01d
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.tmpFilesize
22.9MB
MD5210186062cd0f743fdab61c1f5bccbed
SHA177c02b8e0511d9852a5d987fbcc60e5a83614847
SHA256a0ece15b105d188565533e01ace7cac0d7c83a1b9db51a31946b656e4d2b9156
SHA5121d3f2dc0604b28e96328b9ef684adf2d431f7bca3c52f5472c600e93c28b655318b68c28ffba1c2200ef4360289baf9f7e105984badceb978e722db01947034c
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.tmpFilesize
22.9MB
MD513fba7b41802569d340acd1911201f1a
SHA16b10eeae623a54e971a4bd7fa6590ae244179e8a
SHA256aa614037485cb5a5bdde054f30fc2866ce1147d7b76a3b0f16e7141c532c1239
SHA51293a91aa245e16fd6a06ab2b7b7770efd02e54ceaddeb900d0b6c1055fb90390d14491aa9749ab89990310bd1832a5c23639be0c8ed2c89a65178c82f6cf287c5
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.tmpFilesize
3.0MB
MD53cefe7e9dc147a8b598a6a62ece6a3e9
SHA145e2cd2fe89a6d231c22660609937a1ba386b053
SHA25676b8e3a179eb9303461981ec33d1e2614ed70aef98f8856d019ab8fc89e13a41
SHA512f862f7ee12ef5cf117e95cc717e86c1c8ef82f565702fa57f2302807f830cf5eff0b6243828688264a39e8f7c0cc3748dae79110ac3069e720f224e496f87dda
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmpFilesize
100KB
MD5a0fe95526d1ac2d56b8cfdf25f50ea57
SHA1b7ff6cb9b31b61d6d33f7e277592efe6af7d9769
SHA256f9ba8d68b974a0e83a29ed49f7feb38381f569fa55d8c908c77d5e43e15052b2
SHA5121d9cdc1d9df150f27c7ba7da7078381b330633202099e174535ef22b2c6e5b51168506bec0d39884151616bf1c955dc03844cc582b41e2f474c163b3f3288017
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll.tmpFilesize
1.3MB
MD5d4151478261192aeaa4420033a37fc99
SHA1f5167c394e0f3453c202efa0410b662d59bac334
SHA256f19c3c34c2c6db8be2b5eb0d8bd08a0d702816a30a8dd09abf378a778710e6ed
SHA5125cde5cded2d0f9c430e4a0b3b63346c4422396957c0c36d7b0613ebc81223a06f86aff1dcbb9994d078aa5ea42014e411d015a7087a0c0dd3e45a115e15bda0b
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.tmpFilesize
18.5MB
MD5adc9c9970da8503d3ab95de6e4987d48
SHA13f7f348cd391016c623ff2f070e5342d50a62c96
SHA25648ed388a0df71f33555c1f427e9836ddb77556e8fe80448e0bd82e30c435d50f
SHA512727ad0905610f495daedad9a6447a89d77eb8d71f463d4fb754f7fa6a1ddd033295327e4595184f1c40780d88e85dfa9c0ecaa9a35e10f2008767dd79ed37ee8
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exeFilesize
236KB
MD5322fb0ddc21c59e70d98dd3ed4c2c316
SHA1bdc91bce377f9860cda29da09407994d0c0639c9
SHA2561d260c80ae576b403d89c4323b09e9330c59806dab7b298fbcfd99d989b042fe
SHA512db272ec67859ea8eb0cdfa0d1f2fc0154b421a80b8b2fde45856641a51a70c7ca1d09758c2de51c1f0556e18089576973083e755f556b57abcc4d2931f41df72
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.tmpFilesize
5.6MB
MD510afab898ee0b72fbd5549b14ad1ba84
SHA1ac34309db702d3889ddc5b20574d1d526849824a
SHA256d414a0a80ed91cc6e4ce84896e9e1305018fcdce7ee814357463f8ecdca5bb3b
SHA5127a0b9f456e9c2acd4d77f508227498cc8ca12755129f86d5651328d5418279f800cd215cc88d8fdbc4ead0bf216f19fd500100429076ab329e586aa342eb2cf3
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.tmpFilesize
792KB
MD53ed261ebe219a271cd8b984cb4888f0d
SHA1c4fa8dfe380bcbb4f429f237100d16520e74cd75
SHA25647433203a3592ca5a459f176e975d32a73f5f39f17d04aa83cb5e52837b761b1
SHA512206e969136297e75c94e186537dcb77e37d459638a231f041315008ebd3431f32decec2c24bbf4501b57affb703c5b2bee21bcb6d93cb0c0bdcf4454f79f0aa4
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exeFilesize
1.1MB
MD54cf706e5ab2b60f2ba01d4e7656ec89f
SHA1a626c45acf1742ae73c18a606e7998e14ff33ca7
SHA25670af72a3f765d329cd5c45a9f6c64f0774c4a7823ab53f23b72c0e7743c86a3c
SHA51237a57536658149057738c6074d86f9f644617299af1f40b2b5b545a475b9cdf0b236305ec6f1fb6264acbf9623d16f957b7cf1d37f0e82299b85442ebea0911d
-
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.tmpFilesize
16.2MB
MD5c171cc8262d99cf7e2e56b660c77277a
SHA1ca33c780fcc4591c64c853d6401b6d0f443b60c5
SHA256c8e2c23d08c33086d86edb205ed47905bf5dc5e6eb6c4968cfdf06778a35994a
SHA51234fb60ae4ea65f00b1c5a7da6ac69af25743495723b706ebf3da08a1624b1fb29c1adcc0f3a77f9577027d80cf7a9438834f939306156d5883207098928ba2ef
-
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.exeFilesize
1.8MB
MD5f310cf353527ee08cee2e2f47e960fe8
SHA1ca75e6f9dd8980ca40f3b84a1f48d1968e18da36
SHA256c6029a84104fc3848dc88158592249b04d450c16b4a3369a0875d75a2a65b3a4
SHA5129781d4a94d4b0e5a3e25e18b28edae0d0b81f8c489b9e03b4f26a08e0ab99582d2d23601e47c70f940bd392d3e3b1c46e9d1576da1c0b79222fd4122bffca23b
-
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml.exeFilesize
94KB
MD518ab2b47b64fbb6a38baf01a288d8c36
SHA1febd814171c750f6d90419e4c48afd9d3b56ecd2
SHA256db5991a5caa14e74fcfb9f0678cb14df55dbb1aa4b14ef3474cdb8a83b433bc5
SHA512031d8c3f4de7f94da35202cffb0f581dc61c33b454eba9ae6bf0a00248fd9725bfd1ce0e8e811768c4d8645c7870b02db17e70a1b5f065425930597ba7a0ea20
-
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.exeFilesize
94KB
MD58223bf18ed000cda5b9b5fd56432f55c
SHA1ffdf559d50b36aee5ced25011d45f341024eac02
SHA2565661b352fadd03b87173922d3759a8139a73093d4ee19b338343de5eb1bab454
SHA51222b5255dcc14ae6f0921350658e540b33b163e57d5e372420e9a1666d7195f2a5711b9a55fcdd87c8f8e48a93965d263f8839e18975db75ef272a0827275cdce
-
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.tmpFilesize
9.6MB
MD5f7251b53687992f9299442bb00fb117d
SHA1486ba16e6549236d18800fe14671659c444fad46
SHA256092f6e41bb3330f97a5995e7480e5dce242dedc611e1935a57a42845a29e245a
SHA512874719107d0f0739e2d73e115c0498b26dd94481d2d3f3e0bcabe4b0497abafc95bc416629058c760c9e80dcf7d62397871e92e960ff33ef9f836ede6d164df9
-
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.tmpFilesize
1.8MB
MD5b5301311445560d578abbc45cd3673f6
SHA1f6e282aed12fd2e644525f0d3957b23093beacd0
SHA25684921cadfe370ff55d7dace876ad0338342ce9adc0efaae0240319ae7e0b4613
SHA512ea99b6438d3cfba8791941d71515d9bd5d208d23196eca75058753ae5d74302b2b5b810b4aa77991242f044f268b780b4f8587f9461dd773e336a1e4ae7fdd20
-
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.tmpFilesize
14.2MB
MD5c7fd5b7c2cd8ae15c8b6f5f2ecb32180
SHA1534171cc4d77438b829f0b92d79343d9ce9ed5a0
SHA2569ea3fac79a0ccfea963b64944fd9316c3c1142de3af39758e9160f428f4dbafc
SHA512a2bd49118be99761f8569d55aa60d39638dea84fdcb2146bbe503f2f071308cc683902266a415be127004f61dc26c07b8b21901b079cc942999854c3b050320e
-
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.exeFilesize
95KB
MD5932848eeff3cf4d025cdb70b7046f67a
SHA13a371bf4d8185da22a1bf2051a6dac6e3dbb2dc4
SHA2566b82e175764e51e2309e70930ef580a313502171cc71deef76663144968a8a0e
SHA5120bb59d7d86678aa07ab136bf6dc8905c153c94ba78081fced577c177f6b23b38a1c6dc6d045e5bd8da5bf39ee52ddef3176022c7bc3730b79543f04f510d0b56
-
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.exeFilesize
1.8MB
MD53f767476115c17e2952b64ebb5322dbb
SHA1a1a5a617d179901515ef74a2652e9a4958047892
SHA256869c984cc2825e786040b615ea9746654aceae6fcc2b531af0ae65f9638ceee6
SHA512e888f35da0e155bfcfd17744caff95ef1ba882825888514af72051a04bc524a6872d284580a031e05e50f9fc4324553fe3727e7fd3e36457963fdee3fded4ec0
-
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml.exeFilesize
94KB
MD5cf4756ee426db1cbc4c9c81c87e85849
SHA1f4901b4a21b58e118c0b85a2375cc8b1f1f6716d
SHA25649a10a395fd30ee1954c0c910aa3450373d47abb3a34746f3bdd56e4bb258898
SHA5123beb24223399b36265ee9fd4f814547befa7f0032a9ca6cffb46b200b6e3f75b36975593ba046f387979757085b8d95f9a6a18c55c235b28586e7484a08a03f6
-
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.tmpFilesize
10.5MB
MD5b0f89f5da00389020676115056644a9f
SHA128bd0628af905ff8735f4ca9b35fb49eb03e074c
SHA256f62ff1939fba7a5dd1111192e1636d1957e3509e4b1af31d2e5108faa24e1338
SHA51297d65c7d26b91adcd8dbd431fbcdc1d25344ccff1adae84b4d6a560575e7a7d34b20bca2d12cf49fb9e8ddf402168365f35dd0f286bc3d91497af85a14e1884c
-
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.tmpFilesize
10.7MB
MD5133fc8b87f81739a017717bf9aa43854
SHA1ce9fa87f4404079e4540c9f09481208bec96c804
SHA256e90e781634bece7d2a89bf767609bdf3880b10c02a6f2361b0386ce97c1c4cf6
SHA512c0152965ea5a4200d7cbb8b68634dd4cc3c84c897a9a555067b666994aa9bc726e0fc75ffc2267aa26ac5a908cfa08c67f5b4805e6abe3fb501e5d8573c3904a
-
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.tmpFilesize
19.6MB
MD58b64906d7c0cfbb76adfa2a02d3bfa91
SHA15ceac1006e6d58c82fef85f79529cd4bf7b165d0
SHA256582173509cec3a54f6565e6c02e4a7469e969f3a7fbd8029a1ddd867e801fd54
SHA51215b29f9322450221a5fcb9dbc71b5726d02a05a8a22fed5cf3bb870df507660a884df875ca7de16dabd925e4e9fd4f2b6745fc62fb499e84a0a0bd1e355acb53
-
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmpFilesize
15.1MB
MD548ca910b06963a0038d6b31f9d105feb
SHA1212b4a006e2381131de5c3207872a630503d2bc4
SHA2566da0270f06d43c729e662f1daf683abd186066ed55c2c7c34ad871af76d90564
SHA51218068d1e5d86728de8ed1b21338972a05b7dc2d1549ce279f0dcef8e0069349a6278ce0ffd7d0493ea999c2fb6991e35c68b4fcc745c31830595d734deb583f9
-
C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\Setup.xml.tmpFilesize
94KB
MD57ce9018734960dff4a1e9df983a10da2
SHA147000569e1105d3c35c51365b8935892d4f87c82
SHA256f0027aef2643429c06c42234259fd2b732b1603606bc96e8248b9fc65e6c5150
SHA512890f7281cdf86ee04c1dd17f0b836d09f1fa117355c639b3601c5f532724431066a39a951dabfa5361c3ee83372ce97a520cd2c0f571e9673e2e8e8ced279557
-
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.tmpFilesize
1.8MB
MD519879430e0ab6c18e8249fad9f9674b1
SHA120ccea2cbfb97c62cbe487b9a02371fbe0f475de
SHA2564b4ae0ca4753272a576e82b2a02c2d037b200e50e101c34c5dd9be6f18e686ab
SHA51295b5bc06cbf943402c6b8e36e7a37e1ed4909a16e3c309adb82a9b94a8c979da0bb593fb88b636c833138541934e6eb74eed7c1c3ef6bed81d29eea127b38ef5
-
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.tmpFilesize
1.8MB
MD50dca1a8632cc0c68b9f2e9b753812411
SHA10780080cab84983722896768cd88cbb89d216ad6
SHA256e4f4f80e74efbbe43354963cba95aa7160e268bb26b12544ade970067474ac97
SHA51236ac594991ca5b89930b39e83508fa38382c2716e94234987c71a6abcf0ce79d8300ac76d175e2680ef400a734fa72cf9e6b61ba1f3d9b7d913cbb9fd8f2a99b
-
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml.tmpFilesize
94KB
MD5b15f26419c708268f596d7c0e006f9f3
SHA1f1a9b4da4400ff249b13ffcb21da5605090266af
SHA256acd0c343b0eae9475b5f3330fdcffcc28f7087284f0ca65199d298f7de288721
SHA512ef00f4aa5558334e3681494074264593768adfd53c60381cf3d624c5c44ae8fb98478feb10dc0b4a00ea53dc117d518973cac485f90b09fd23b893a581c0de7b
-
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab.tmpFilesize
2.0MB
MD58275aa90a3864ccf9c8804b6af671690
SHA1909c9d3c06ce69ce821da34029b4037b850db44b
SHA25650b344c192f957350a5eecad3378422bba3c9d96652b21ce8dfa112d256b2c47
SHA51260d19c5666a1ac5f7f833530b3e8416ce69092f146908d9815d9445ec80a2b5f6b0a04c263f4e3bcfa2009e19ca83a99a1cecaad91157b2828c6f59f07f7ba05
-
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab.tmpFilesize
16.7MB
MD50af10646e249a4e50f2f0dca9b201055
SHA196b639b835e6eeab9cfac4f4e8e0235be53b342a
SHA2566f32e1ae2de2170ec5ec91206258f0a784e6ebe37c9bbc5c027a4aa02180eb65
SHA51264e06a6fd7b289da167d36a6d6712cd5534738836c37398ace5c37687655d2fd35dced92f7338be8dea230056e4e276d7bc89975917c275400c31ecdaa7ceb82
-
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml.tmpFilesize
94KB
MD54ee7f545e5837be609df68bd6fbb64ae
SHA12122ba87a4eda6da09984262435b2e69ccff3686
SHA2569316e1801b92bee3ddef6bfe7e33b2ec5500bcbeca42333d8a390c958a18cb4a
SHA512b2ca64bf4de69317e1cf400db13285c82dc6e97f6962fc820e2bc11a186c6325bb2d4a2701ae49fcb3e15de5f0dd421835a2d363b57776c0a01a1e7ed678ea5c
-
C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.tmpFilesize
4.0MB
MD50aaeffa96e5a8fa85ed6dd3111b45eb4
SHA1c3c61be21914954346181e2482049adaa600fc28
SHA2562c005ac1381c227b74046527a700f8b313b6221b13ea2406154edbac1e498d6d
SHA51230286dd284852f786b02945a820b6e6be51f312d448670883dc00c714f2f36ffdc5a3dfc7ab0c12b4c477a745476633a887f04004903f5df4a732e06df544357
-
C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi.tmpFilesize
1.8MB
MD55baeda1c1a35707ae104614b1a0b06b4
SHA1991586415b624193c1db7395fcbef3ef724bc7a4
SHA2566ba2352f7226df93d6ad9566236e2af03510ffb11eb556f99611017668ebf8f5
SHA51242afe6c9a18d7556f98b48c941788e0bcebc84ab9f07158eab9bcbbeef59b88b6dd9b07c0308dc20023480f8b741375a3b05adff111fbea960b04988ce4cb358
-
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll.exeFilesize
196KB
MD58c25d73a88571525ab50926f0593f34b
SHA1f6940530b254e04deaccce333550e4781ad4e605
SHA2560b486e5604c1a0b0740459cc57353da125fa1efa13dc8db8c42b24a6bcad3869
SHA5129c84a8f6e424ae47eed3137e63cda8295e374fef1a3c89cf7e58f19915e314ca7dc7620de80cc2855f3138a569f2cf1beec03206fed4a1c027e4efd8d9df7fd4
-
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE.tmpFilesize
909KB
MD5105ed62d607c920d3385767cd13673dc
SHA16d8fde8e65b3e9652798197ebaf1188714690177
SHA256a259564186512a5fc13f66ef762f4fcb3b2fca183cda628ad516ceef8acb106e
SHA51250357fb978054fddf5dff074b11229de9f04c0e233ea45c156c8b712e833dd7a01c788811962b5587ccee25c4c99d6f38aa59b8b72d33b503b2e8bcfe2886a1c
-
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab.tmpMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi.tmpFilesize
2.8MB
MD5c2b9ead0925b8bbbad26d46030d2126d
SHA191555cb7e76b36546a004e1d0d0a81dd041d350a
SHA256531c8f24c56c5b6d1d1c54de3b03650177ba56cbac165295d96ff4b503a214bd
SHA51246da421d19e1dc9daca34df198882ac60cb7c753d37ce80f82d2ef31be594aaab8ac3a75cfc216f596ea579df1c09425f1fea58f8e740ad4d644928da4cd6bd8
-
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml.exeFilesize
673KB
MD5223207de569aef5c90db94893a32d104
SHA17e269ea836d5281fc83ddbe86db2f20d23a47f59
SHA256e05b47869d8bc140b9228bd5d9db2d3f47bdc4f0335e2178af007f0611e6f554
SHA512a4333980d9ed65c142fe52306657829268d43ad5581c1531d62a14bc2fd43974619113eb07c2c224c4b8f15cdda4c78773d2d639ce6d0798d282a386c3d0cfa3
-
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe.tmpFilesize
598KB
MD5e2a767de0012ade62e0d1b06ad8f7797
SHA105a8cf4918c3aef0e5c67b68569f0c7167c69c38
SHA256edce936df82ba1b628d4f4c9481c3037a63dbe3e34560a68748dc3dcd0338c71
SHA512937bfd1950848bb32156fa8998eb9f2a53b06ffe33c623b803f02250c2dec0fa7baf27f9e6cfd41fe7325eb693f95a48d6ac9b90d2aebdb8643a9a7ff094efff
-
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll.tmpFilesize
733KB
MD5b350107c4047bc94377f575a63345746
SHA19caee156a3ad91c877b66a4d8e60af4fd52425de
SHA256fd3e4bcba81f09a7422b249a2c1409ea325b306e5f83f7e46eec42ab764e06b3
SHA512d79151b7e41f8f2107e4e77ad75089c39e6c0f6947119396cb21a3ac7755744cb5242b5dc61edd3b7e79a5b449adaa9d8b13d8d3b0fb5ecccc5534abbf54efec
-
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm.tmpFilesize
92KB
MD537b95148c1edfe14b8aaea8fe1759727
SHA151bdbcc598e0d99d9ac308402ab32a1e71e2d46b
SHA2568f1b3da9906581fe09d6ca7549e7026fb8ab548b4d8069397d3f7f2fb583f0ea
SHA512a62c7c65c247af5ed87b80133ae624d5841ceca135d974a9850936f1c40972d3abc9a94148c7bd140e903595ece994f76c878a7a705d372ba1a429f7c3f463e8
-
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm.tmpFilesize
92KB
MD5d9d781b535af44dd86fcf58c169d0c67
SHA10e8186898d8c6ce335c25e7a0575237f6032aceb
SHA25633175c7c47795c405e38834d0689e133fc80618bc0c3c722170b8e7a8ad5dea7
SHA51253ecb9a6cc514c9cd4985621e6499484d2872ad332a900282d9c8818aeb5ab30002d03656e62a12996660189c679a0c7ae66dcf7f2074889ccf686012fed82ba
-
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\OWOW64LR.cab.tmpFilesize
1.2MB
MD503699b0febfa4c311fd28ed9285b9b6c
SHA1a81c4be98073cf7035209df992fe3e45aa0e38cd
SHA256ae5eb6af5cd3d238d1735bf43d353ff9fffe82d921d4b5b861c9fbd7b370c6fd
SHA512b01c52aacdac14ee1b739f167e1b43cbed739aa43d66a1ab693cc0a45e4654f925d094af7179a21f760400d64200fdae7acbf86d8c49b2cd29b7ba44ed231d93
-
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.msi.tmpFilesize
92KB
MD5d680816e8a5178cf834062b2c849eacd
SHA15f10f617c3b4fdd4479ee951a2e55e8352f994d8
SHA256f7d78678d0c6332f0f6df29e8061dae4fbab0ec400f080892c961947010c9dfe
SHA512c80e632b9702b4b27d0b9031941ee0a7cc1550abf7191737a9011b3f6d8328a0d37a6f6975074c04a21fb67805f6fb953a1fbb59855ec65fffbd3a36138414a1
-
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.msi.tmpFilesize
731KB
MD591842dcc6af71bd92c2a08a035673239
SHA16999632641b62cdf7902ac3a2ebbea4dfb4856c1
SHA2560855d4d1141f99aa4dc40de39e897233ac250fcf0ee525ff4c29e74e5c00a6af
SHA512be6d2a64d2fbddfd84e6b391691d162f3ee37778cfb519c13cb77fbb6b396d9ee3add66c572aaf5947f7e72179232926cbb01f32074c0a264134726c6fdc925f
-
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.xml.tmpFilesize
93KB
MD53131d47142c2217bafce9cb1feb94784
SHA1b5ec26eec1b23a52cfe974998f72e6c1c8b4fbfc
SHA2564f4e41a3b811d6d6d4ea25e9c5d873e765109a7d472bd5cc2eebc16882292471
SHA51271fccebf6f3a432d43eaafa00fc537eb74a1003d32a0c49de39f394ea52ee9ac5550a9c93289ba3953d735a0424e6cb11c91726f7226def783d36275e6aa9fa7
-
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUISet.msi.tmpFilesize
276KB
MD5481f3309a44af0f4a893a80dd6b01942
SHA19f235fef967dc3f5ac8c55c3c1cc60737f6efa60
SHA256efeb55866aa40f5449451ac61a879f5160739829345c32731bf7537936820eb4
SHA512a15e1739ec9194f1de370234edac22758a2d2e834d36b4082c4098ed06a0d98ff9a8781cae4c7307b96e4598246ad53cba73a6c481e0d3dce8f856f3844ce85b
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab.tmpFilesize
2.4MB
MD507764cc7cea741adde17345f7445a0a6
SHA18ef2687d72f0cf4d6b8d8a6e64ce8fac2be66d26
SHA2566981a6ccd0aa12eb4904955deaeaddab26d96ed0ff813b1cdccb8e0e267fc6f5
SHA51239bebee34387c6a86bf9fe5ea72442276117e839694979a33f51c6963b3f4faff0fb29dda131bf388f53e613ed32c55d78d996a15030fbd2f023f7769efe4547
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccLR.cab.tmpFilesize
26.8MB
MD5e41b258e2f2dbe5784ac9cfeb251d4c6
SHA1c8aeee992b26c472e681278f1c6487c834855874
SHA256ab1d9e9870a62276d0a9bc5ba179f96a800abbe05f472c6da9dc3bd8a7f317e3
SHA51256e4e6a7b7aea14d8f26f5c87a819d55de82140264fb5c354cae05604f836bfd37a141de2ebd87f21167c972315461497bd73af9405f8e07a95944c32a28f5fe
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi.tmpFilesize
1.8MB
MD527ec43bc4b9a1da5215ebfeb1d74848f
SHA1035e48b02b2262607218f8cd3751534cbfe446cb
SHA25675b5b9d9584bc78772b36cbe634eb2ce00fb17b0f816888e6f21fd5673b8a19f
SHA51227592151e60f163f6335fa4651845e59c0a119317d8a825ed57ed88363d220bbc67ae4794bd39f772d9d52436e899d7fd2a5dd78f61d50ac995769806b096d4a
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\branding.xml.tmpFilesize
675KB
MD5b715b882df7a9e8910d88bef63fb44a0
SHA1a0bb685908f81861a14e9b7931dc35f83f9cdd31
SHA2567e6ab08625349f48071d9f34100bf1e4127df6f0ae31f8249233b40c4cd0247d
SHA512d6c659ed835ca58b1a07965c51e3c60999953ae50b7b972d4adc9afb982ebd7f8b32709a4955eee766816331ba5f862b9f71c77f257714bae7f207ca62367d5b
-
C:\Program Files\VideoLAN\VLC\lua\intf\modules\host.luac.tmpFilesize
103KB
MD582666091db5e843f11dc9ee6e0d62222
SHA1d3e4d945a0bce42d160b65e7c71b989ce33a5d48
SHA2562f258bfc3c7567d36e97a0d3f05036f37c092aa86ea9295ad63939a53a70b1d1
SHA5129866e69993a2e731c98565cb3f92ff5411f41162d0a360585e8536b86b2039cecfa6db71fec29ac52e95bb4e8ee14ef8b7ca71222e24edc7b24bb54a5614faa0
-
\Users\Admin\AppData\Local\Temp\_Remove-VisualStudioComponent.ps1.exeFilesize
93KB
MD577be92bb751f28e5d74dc99e281bcddf
SHA17ca7fbdf84b9eff21d4342b1e282857d1a3ef5ea
SHA256d1ef922f7d60442d6ceb3c040badf0e916d7bf6c0ffa5fd085e6e817ca9450d9
SHA512bdc75cdd2c69ab3467e229d0935d19a98a6df49d5b0876ebcae0e5b289e40eb339cedaba3cd8c0320fe51e3df66741da1f8506c52825569ff48e7f23eb2de9c5
-
\Windows\SysWOW64\Zombie.exeFilesize
90KB
MD5f052d15f1b566107764a2774908b6af1
SHA19e1028843bff7fdffbef8a8a41d0f96811c6316d
SHA256f85dab0872df5adbdf677222092b0856a1838d56cae16021d069f293b4b34b61
SHA51240ec41f35a125c28196e16365bd2b8b480edcd6d19c0132f248b3b32f04f22fa49efe1c7bc5acb9106215e1630475f4e3ba562d77b2d707b6dd1bc1562c798bd