Analysis Overview
SHA256
4ed00456b34885f50552463f7f8e17d1fbf9d5253bfb2b5cf9dc7b0cb4cc9ab8
Threat Level: Known bad
The file 63986f9844639649fe3b8aedb2c6a466_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Modifies WinLogon for persistence
Renames multiple (91) files with added filename extension
Executes dropped EXE
Loads dropped DLL
ASPack v2.12-2.42
Drops startup file
Enumerates connected drives
Drops file in System32 directory
Drops autorun.inf file
Drops file in Program Files directory
Unsigned PE
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-20 18:03
Signatures
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-20 18:03
Reported
2024-10-20 18:06
Platform
win7-20240903-en
Max time kernel
145s
Max time network
122s
Command Line
Signatures
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" | C:\Windows\SysWOW64\HelpMe.exe | N/A |
Renames multiple (91) files with added filename extension
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk | C:\Windows\SysWOW64\HelpMe.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\HelpMe.exe | N/A |
Loads dropped DLL
Enumerates connected drives
Drops autorun.inf file
| Description | Indicator | Process | Target |
| File opened for modification | F:\AUTORUN.INF | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | N/A |
| File opened for modification | C:\AUTORUN.INF | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | N/A |
| File opened for modification | F:\AUTORUN.INF | C:\Windows\SysWOW64\HelpMe.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\HelpMe.exe | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | N/A |
| File created | C:\Windows\SysWOW64\HelpMe.exe | C:\Windows\SysWOW64\HelpMe.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\HelpMe.exe | C:\Windows\SysWOW64\HelpMe.exe | N/A |
| File created | C:\Windows\SysWOW64\notepad.exe.exe | C:\Windows\SysWOW64\HelpMe.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe | C:\Windows\SysWOW64\HelpMe.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\HelpMe.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\HelpMe.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2072 wrote to memory of 2368 | N/A | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | C:\Windows\SysWOW64\HelpMe.exe |
| PID 2072 wrote to memory of 2368 | N/A | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | C:\Windows\SysWOW64\HelpMe.exe |
| PID 2072 wrote to memory of 2368 | N/A | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | C:\Windows\SysWOW64\HelpMe.exe |
| PID 2072 wrote to memory of 2368 | N/A | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | C:\Windows\SysWOW64\HelpMe.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe"
C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\system32\HelpMe.exe
Network
Files
memory/2072-0-0x0000000000220000-0x0000000000221000-memory.dmp
\Windows\SysWOW64\HelpMe.exe
| MD5 | 9ca00da4f166cc3f32000512ba53888e |
| SHA1 | 98f9c727ea90d29ce719f1092560cb70692f7592 |
| SHA256 | 93a712d6ba624755e9df2caadee155d2d5deb35e3b3b15691bd01c68085c8080 |
| SHA512 | 069e17925811575f2bc50a9df6366213409fd586003d82c30af3b67113a0f5a6d6390b9d6464db4f2aad8dca9a284d672dea0e4ba28367f213756b7606b35d91 |
memory/2368-9-0x0000000000220000-0x0000000000221000-memory.dmp
F:\AUTORUN.INF
| MD5 | ca13857b2fd3895a39f09d9dde3cca97 |
| SHA1 | 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0 |
| SHA256 | cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae |
| SHA512 | 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47 |
C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.exe
| MD5 | fe2fe21699ccf6ecc05107277ed91c25 |
| SHA1 | ba9f5fccf0385dd2124b01ffe9bcc6b87b64f834 |
| SHA256 | 1a396a2801a3e4292b42a62052ab78785f309580145d500b39f3a87cd87521e9 |
| SHA512 | e47ac5c49a06a4216bd0fc31c94ccb59b115c90c15f6a8b7885138bd14b27075c925bfe97a5b1c4db76da94995f1a101b8a7e4102c0d3fee3c9e737569006613 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
F:\AutoRun.exe
| MD5 | 63986f9844639649fe3b8aedb2c6a466 |
| SHA1 | c49522657ada1b0185de2fff9474ef7051cd1e45 |
| SHA256 | 4ed00456b34885f50552463f7f8e17d1fbf9d5253bfb2b5cf9dc7b0cb4cc9ab8 |
| SHA512 | 3c1c020c569f27e588a056420492f00a70fab1409730d7f39cbecc9897c8182431645e68dcd98c95e59e26f7df221d46c642af53ba18c0a6c00338e48eaf0912 |
memory/2072-229-0x0000000000220000-0x0000000000221000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 459f2ed9dabdf0481ff1a62e468ebbbb |
| SHA1 | 1ddb281a5403219da6b4e74bdaa7f265b6b914ed |
| SHA256 | 1cf9c49e703647bd4ce3ccb0717ab3838aec765edded9796c10d968d6e1a6261 |
| SHA512 | 912676b843d451ddb2991c039585a97aea1aee288d7bb7c2d7bf4a54a724e26445ea43c473db977bfd63975626181bc884716b211952cfe264d06a321a18568b |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 9290b22604851e29e3d66a61d3c0e5ca |
| SHA1 | d3def3350a8e8193d626dd2ab3427326c1892d0a |
| SHA256 | 1d80690350838a304e880e5fc16e71b6a7cb414e235fe2da927e550ec4b8cdda |
| SHA512 | 33d710834b43594780833f661bdd0d1427474d2ec1a6bcca929fdef6f8ebf485fb9328f10fc937dbf97e699418a59b198cc1537526a2322d496ed704dafa1f3f |
memory/2368-237-0x0000000000220000-0x0000000000221000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-20 18:03
Reported
2024-10-20 18:06
Platform
win10v2004-20241007-en
Max time kernel
145s
Max time network
123s
Command Line
Signatures
Modifies WinLogon for persistence
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" | C:\Windows\SysWOW64\HelpMe.exe | N/A |
ASPack v2.12-2.42
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | N/A |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk | C:\Windows\SysWOW64\HelpMe.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\HelpMe.exe | N/A |
Enumerates connected drives
Drops autorun.inf file
| Description | Indicator | Process | Target |
| File opened for modification | F:\AUTORUN.INF | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | N/A |
| File opened for modification | C:\AUTORUN.INF | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | N/A |
| File opened for modification | F:\AUTORUN.INF | C:\Windows\SysWOW64\HelpMe.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\HelpMe.exe | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | N/A |
| File created | C:\Windows\SysWOW64\HelpMe.exe | C:\Windows\SysWOW64\HelpMe.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\HelpMe.exe | C:\Windows\SysWOW64\HelpMe.exe | N/A |
| File created | C:\Windows\SysWOW64\notepad.exe.exe | C:\Windows\SysWOW64\HelpMe.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe | C:\Windows\SysWOW64\HelpMe.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\HelpMe.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\HelpMe.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\HelpMe.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 5080 wrote to memory of 492 | N/A | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | C:\Windows\SysWOW64\HelpMe.exe |
| PID 5080 wrote to memory of 492 | N/A | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | C:\Windows\SysWOW64\HelpMe.exe |
| PID 5080 wrote to memory of 492 | N/A | C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe | C:\Windows\SysWOW64\HelpMe.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63986f9844639649fe3b8aedb2c6a466_JaffaCakes118.exe"
C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\system32\HelpMe.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.27.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
Files
memory/5080-0-0x0000000002210000-0x0000000002211000-memory.dmp
C:\Windows\SysWOW64\HelpMe.exe
| MD5 | 9ca00da4f166cc3f32000512ba53888e |
| SHA1 | 98f9c727ea90d29ce719f1092560cb70692f7592 |
| SHA256 | 93a712d6ba624755e9df2caadee155d2d5deb35e3b3b15691bd01c68085c8080 |
| SHA512 | 069e17925811575f2bc50a9df6366213409fd586003d82c30af3b67113a0f5a6d6390b9d6464db4f2aad8dca9a284d672dea0e4ba28367f213756b7606b35d91 |
memory/492-5-0x0000000000640000-0x0000000000641000-memory.dmp
C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe
| MD5 | 969a7e37fe46a3c0003ddf796b17ec15 |
| SHA1 | 9604b81355b2195604c4887411d63f5683eda019 |
| SHA256 | 65565303483c353df6561a0d30557069a59277e04f7286b67aed2609b6a90bfa |
| SHA512 | abcfe9b61b11e6dd4e633055bb21a7247f196719e21585fe1ad2dfd0430aaa9488c8dcca8329aba279ca7cec5ab473e4decb088d150e2f970b37ce772b77d7cb |
F:\AUTORUN.INF
| MD5 | ca13857b2fd3895a39f09d9dde3cca97 |
| SHA1 | 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0 |
| SHA256 | cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae |
| SHA512 | 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47 |
C:\$Recycle.Bin\S-1-5-21-2045521122-590294423-3465680274-1000\desktop.ini.exe
| MD5 | 1398f108ac61d9cfac3f4622bd9fa6c6 |
| SHA1 | 38bdc3550ab0aa02467e393932ae3fca5acb6263 |
| SHA256 | 6302aef8dd4cdaa8e7ae67b1aeace3e8734d1ee81d2540d70c83e47493fd7037 |
| SHA512 | 4e8073f33390f5cabf09522c990db5477c6969294819ea0cdcd594a2cbd25d0a6852538c89cfdaed90e8692d9c296457ca685563d1102aa67c0b5bfa4d1eb575 |
F:\AutoRun.exe
| MD5 | 63986f9844639649fe3b8aedb2c6a466 |
| SHA1 | c49522657ada1b0185de2fff9474ef7051cd1e45 |
| SHA256 | 4ed00456b34885f50552463f7f8e17d1fbf9d5253bfb2b5cf9dc7b0cb4cc9ab8 |
| SHA512 | 3c1c020c569f27e588a056420492f00a70fab1409730d7f39cbecc9897c8182431645e68dcd98c95e59e26f7df221d46c642af53ba18c0a6c00338e48eaf0912 |
memory/5080-48-0x0000000002210000-0x0000000002211000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | cf8fd524ce1aeb480ed79dc0177298f6 |
| SHA1 | 198b356134c3801ce9e4388625acffaf4af37e35 |
| SHA256 | ba40af0ef9922181df9b7d8ce40dfe70a73a2419ea93b05cb4a88d853f870e50 |
| SHA512 | c9968ec06d0ccca0194679575e0bc30ad5ff749597f83ef1dfd9fa6a072c4fe43080d226d87c09b63961b22678864ab42be5aa82062298e13479b28b7c3a9d5e |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | e27a5274d120c432d79a59638fe80e1b |
| SHA1 | 618f0c3309114ffcbb3b962f362878aae1191216 |
| SHA256 | ee327c632532f3def3ead7620b11663fcd7e4ad89546c41f9955d1824c5e937c |
| SHA512 | 82e6b036014dab038d0a0cdc79dc812c20be82aa3dc87be167a6979422c551cb7d76d3a6609b752b3585e6746481c7701f057e8d6de0afd36b4be07602b79bfd |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | ad69f8950851b168be788e5c37aeb525 |
| SHA1 | 52e296427c244927b941b9f0b38da5098f76aba2 |
| SHA256 | 56621d46dcc48459c0624f5373cbd989f1d0ce52a618c4c6755d677d0e6d7ddf |
| SHA512 | a97077a0f209b631baf496bbccfb87030fcd410e20285fd4fa93ca5c169256baad5583a7fb5a0a82c1a7f0fb4070fcae987f0bf0f64872bfb6c6cc27090b33a3 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 164d78d7375aaf52f36a1f5283137041 |
| SHA1 | 10c34f7913353d343700c30d38c87546ce653b5c |
| SHA256 | ef0430ea845b1dedf7efb3a0b419da89a2a5abba16a6df2898601fb4fce3fa7d |
| SHA512 | af39834afa52a4703b40014498f1593fb645a0b115c88f22ba93d12d0f768e0fcd1108975e550cbb5d349441b63f230c5c4b94cd55bd9b7565f69694171ba304 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 138711447a6b0b9a365e1213782266ca |
| SHA1 | aafb6a86879f3e7e63bc36d8f8f0c411da567f61 |
| SHA256 | 2caff9dca9668bf4082cb73965b5446584f8aaa549b63b73ab6c41d224d9d360 |
| SHA512 | 9572d5f0471e4018823507d265d297f25a4f2ff43897acb7864c01ef2487607e1651fc9cc813b44b8ca2bec381f1caaa51be5d1659c00a745af0be344a6ef769 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | e96b7e737d5cef74ba69097b4a5fc519 |
| SHA1 | 9826d06387560e7b38b9f6949a8e35010900a5e7 |
| SHA256 | 607346e1b7cfc61997f98a6202fe629794ed8df112dd1b87cbcf38dcdf9340ea |
| SHA512 | fa5c40644ab1e146a70857d2e918f8b7a7f5399602f48bd604ca01140df3234bb8063cb7d2fc179905622ed65fa0b29f2e791f95bd878661f681c4340319a0b8 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 301c87cf26cbe0d2621b211ade7316af |
| SHA1 | f63be43ac4439c099f47292276b0d7e30cecc7d9 |
| SHA256 | c52c3b1453a40c0a7443166d5ea6967ad9d4f7aa15232791de86e1ab6f28a5d2 |
| SHA512 | b36cdd6698f8d6ca5cd6214897ce24bcc534ce6d5b48dbde7cf7a66c821580d0d74e274b75b05330da865d7d347af4908d0a4e2fc9e1d6dfd8ca42acf00443f1 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | c91ea067024d443cf8d8eea5892e0588 |
| SHA1 | 8b6824301c26569f3a59a016ce9a194c745b12e6 |
| SHA256 | 379af435759056881876426fa949ddc19f46992b776cfd43409600460833eb50 |
| SHA512 | b7ba1af4f41030fea9f976cfd4dff9b5c239aada2e2de15c48fa647dfde87e7c36b54f9919fb4d1a5962c5f22bb0e1f094ffdc6006394524ffbf84fe9eee48e2 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | fd0af691f46204d80aceff5e3b506cfa |
| SHA1 | 63367464f331a7e29de68142bad3fec9bf98d455 |
| SHA256 | 5adf4e330d0b9dd9a62d7a82b3b64aa734a3beb3c1790d2f277377be23475ad3 |
| SHA512 | 733591dc5f77a8958f2645bb79a44d35c29ed57f5b3d85aaf92456263c608de4272754691dff3f335bcae526814b24767964c0f8d8a543011abc3b3d93853ca4 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | cbe91b6d1a82ad1893ddd75e50f610cd |
| SHA1 | 31e671a93645b6df4b6e2bc06be8aae1f472dc4d |
| SHA256 | fbf0633616a5f6730f3a7299c5b85f7a0cdbeec7edf2515f02a0b84925feecc8 |
| SHA512 | 705d0946a265a7d6cf42e49e3e4db2a7c526d28b7dab6ca38e2319c0d4c8d763aa97857aafec4b9cd655630399303e712a14e67db210ed9561788c29926fe0f5 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | ca57991045770d39672c1aeb4d83b39e |
| SHA1 | 03b3216c765e51764ed865d6999869ba29ff7ba1 |
| SHA256 | 359e36a9edf9aac335df3c970e0541487e342c17edcec26b6b845e030d673518 |
| SHA512 | 0d6a16fb50ecefabda8ff48d625a25162430effdc684c9678fbcb6c2fa7fe6b0935a4bc94d40a298c53242e76e432f6550b7cc84a22299729561318bc3315345 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | f30e891b169f01c50b63c3afc8a3a2c3 |
| SHA1 | 26bafe2e8f5636af6c9b6bdbe004f996800605c5 |
| SHA256 | 02ce29c276463eab17d964fac5ad4e1eb5d17064286b4b38baa136813c05d848 |
| SHA512 | a8313ccb3666fcf5e0977817e27d810572c800ae90b6bb80934cdddde43ec65da4c9d52b0b1538d851395c1e4a39a4170675674bfacaf7a3259574ad2e6d691e |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 944248919e684c78ff7a7be57d5bda70 |
| SHA1 | a7fff9950d95e7090d83515b77b5d4a63e53a13c |
| SHA256 | 521d66a6a3869edafcd0ba5f4245062afcfc3935693bc4bbad6b77d365ba9b75 |
| SHA512 | 1371397fe603779b08b21fcc762297a3898a60987c5aa4e76e02b04b225c1e6a4d922c4f3ad09a51ef77c53f3754bf4b9f68919eec6fce3a7a39030e3b94c19c |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | ca9e3759a368ba1f3b4ad7a652f43365 |
| SHA1 | ad3d7c3947341d23f0f8b2b389c32da1c5cbaf6a |
| SHA256 | 3f38a8c571b978acd91d64dd44d9b12a8ab476f712eb0676478c91f2341f17be |
| SHA512 | 61dac24e6038e8dd1dcca464b0c2cb186c9eea6ad012b422504740f47bfafe273555eff94adb6dffa2eae1004918dfe763daa58370f9077c410df0033a41e278 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 3ba4b837d1e1b314ebbaa09bcec3edd5 |
| SHA1 | 43bf00b0bbf5ca9534e0cc9ffb8a4ca80b757e1e |
| SHA256 | f365f7c23e032d7f2f7a41642c50e77db3397379d6e975510c361e86a9947992 |
| SHA512 | 7c853d2430794d0580a68aeb782096c32bb3f06c6c6537311818916d76168143a929c4168663cd454809452ee481d832ff99d30c99e52b7322e07b25f776deac |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | e03596969ed376718e9b0a9f88df1762 |
| SHA1 | e980992e82b23565bda4fa343456694ddb1fd213 |
| SHA256 | 44807031daa417ed3fe44b7eccb09cb4239a4b69fcd034de1e35803d448faa84 |
| SHA512 | 33262122fdf6014abc9f389bd775ef3cfd58350c4876a481fdbf36d51b69e867ae239effc37f84217a76d1b7ac92b9695ee7ec4a62021f73552fee002336a848 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 235125c3e3e2b6a38adc5ce6bd0e004e |
| SHA1 | 86c35b895eabdc033c433ae86481c762a29a4317 |
| SHA256 | b214a80a0ba6993a083e0488d392d68e9921b14ffa6a531dfc448af1dc26edbf |
| SHA512 | 8aa6e46b1d8549573ec01cfb388a8abfb5facd6cfd2d943b64ee301bbd856399fd8eb0e1a129f219793ee40f9062c0a2dd35acbb1937f3f1340342f436ac346f |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | c34d0b65e7adaab67420c32a5d387519 |
| SHA1 | 11c6d1e5396b5a4774c70e7b0d56b78ebf97ce2b |
| SHA256 | fccbf4df6c04226e983bccd3dfaf23ec7674268c8b0e85ae0ec4720c5cf97f09 |
| SHA512 | 03d6e6866fe6d591a3f139da0a68a16b14a2168ea87767cf50fdc0776ab9372bc26d441561fce4bbd0cfcdb1a7d0ccc9c04f6724f3a850fd25147dbebf6d4fc5 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 1f4d9f03e0481db3e6a0b6d839ee5570 |
| SHA1 | c3825e712bced9e7ffb51417921add8d7a943716 |
| SHA256 | e453b074036fb6d6cc39b36dc1deae700fecb163bcad160bb0b20e3cb7822ed9 |
| SHA512 | fc427bdfdead23034d6bf41bc6ce36bf2488ee18befe2ccc2524482053a3ec54e613c9f232def648f7199ea63cf5e04320a4f7e82a61b3d231c625637d21f051 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 1010f1d5faebd03b6238735308ffd01c |
| SHA1 | 02fb94dc6d5c40ac347c565f4e7b30820fd008aa |
| SHA256 | a684975701abe39930cdcb0bfe3e08b9d3082d3ab48df4bcc1cd50130f0f5c11 |
| SHA512 | 4676df93f6305a61c2e6b0c789dd7628336cd843990c3b67025c75b066013a8196b93928796a2159261082d4483a49dd2d27c7dbcdf6ad93e18cdbc0e4ed57c7 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 9af3834c8047bec8904aafd9a525f040 |
| SHA1 | 664cf0cd6e80d2050ca73551d05a8142930ce56b |
| SHA256 | 9602f61603f9de484426359863095b73e0ba8fd29344929b2732b60ebc6d618d |
| SHA512 | fad969d140d447d974073b3f75664ab20735d03971ad443cb3f4e1569c60a85bad7141ee38cce5cde0d11df3f9a1f369a77d1332cecf2c86e6ef908c28d93bb0 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 4af8a1008d2289fdaedf042a05793001 |
| SHA1 | ad4e8be4b910e87318d864a387839cf07b81bc9a |
| SHA256 | 2f81f81f9f616712f67d22265fcf977d2f15f5e3b953ff920b6b591aba695c4c |
| SHA512 | 9b9dadcd41cb0b5b9a2e30d7a266a2bdcbcb394f13dadb459f99a9ff17643bd7e757d899d60a5388d4cb4196e5e7440152307e4d3009e8cad75b02711f835306 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 57f7f6a872e8f97c6ea979a4dbfc2941 |
| SHA1 | 340d16938569e0f9ce65b71ba9284d0bc82d281b |
| SHA256 | 9d477e97051990ab68cabc7b338ee6d4359677c47a90dedae949e0ed92891da1 |
| SHA512 | 801f48db0a3c2572bb5277c91c261fc160a0783fb0021ad4ca7ea3444b1c607eb2c431fed2c5641c5bbe5cd48b1970bfd4e95ca72e41ae409e8c85cead6ad154 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 8f12b7af0e23defef5074cc59ab0137c |
| SHA1 | 4c52dfdbd14fd008a96b84c6a58ca606cd927aec |
| SHA256 | 1bbaa7116ed813fe454de48364eb30097313567d2c6f69371ab0038ad8016aeb |
| SHA512 | ba25d1917102fe3dda11cd76b6eb1b1061e66cf3fc019f1f0a5e3f6a073455b42990c72e40f1d1104ed8a4d5fd42a1cf0c97cd62d8bf1492b53c0b1519a30931 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | c8fb93d862800094d7b0a5e5bb6d3467 |
| SHA1 | 8eb769ca961134c279c510fb8151c37c0f986065 |
| SHA256 | 3b2509d2bfb8d4b3275e6e4ce7dd5e9e5ad37ac1fbd6248ec8f2e1bd5539e744 |
| SHA512 | 1739308ec3c8fe399dcb3fd9989e6f4a2b547c6106cff5e0d4bdeacbf54cc21eb6e9972c4ce87ccbe68ec28e589a9d802161252145b9305fce376ba2378a7b6b |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 447f1d19cb82725ec6d98de4dd2eb88f |
| SHA1 | aeeb4b71d8c1330d80c0699c1242106a7d16230c |
| SHA256 | 1140ad3350ad2ed107ebf8eeedc48a49294ab8b2d5f361be57c32846e1863681 |
| SHA512 | ab962d729ee624fc24f48e0d657e329bb57ed9ffe99adcc978daaeb614532a1783ee546a981a2f47f4052cc05f7d58cbff89b24abbef459f8001ee2904f5f30e |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 1beee8373ca0c3ba57cfe04104bf2db7 |
| SHA1 | 09190777271afaafe9ff21e43864037f15327031 |
| SHA256 | 38d0d2a8e580a37b8c764542e40993f109b55f49922db57e2bc2d93746ef036c |
| SHA512 | af1fed9bb57709757e6126350e3b796dd788473f9bf98b378998510aef79987f05cc45f45def71e15edb742c770c725e3a4a117c9f863fe9391707a495bdc793 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 83e9056921aa81995f87dca9c9ebc01b |
| SHA1 | 8601f1a9f2446edf3b203a9fec9ae3d97609bd51 |
| SHA256 | d5ae34fa8c499af3b85b19297506e29ed8a34bc8a932fc493883c1ee65abce19 |
| SHA512 | 87c2a8d00676d4965113ec9f2a437fad74e580e9a9f6c95f47c92d42ee0622cf41089bed06da19431efa714078e9aabc2b4cf7494771a483cd7e53c271abf447 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 1beed4f5917941510de25011316c1881 |
| SHA1 | d50501a531d28b2f4046c5362349474e294a2ed5 |
| SHA256 | 46bec99fa294894b96d42d9d00e5a299bf504482b46adf4ad88d53b57f10f429 |
| SHA512 | 11d6e2a656fb4111bcd59cf802d7ee33001bd96e500060243c5533e39d22118eafd42b891e42327f0d92f3436087ce2678ed4453876272261b0a3886be4de3a4 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 36392e1bc18b818286182729383e80c0 |
| SHA1 | 43f830b810f8302d92d1a45e499da68afda46def |
| SHA256 | 3148981ac15b370ab9a4563d199f79d6a3fdd7004baba28c6d4197f311ab94dd |
| SHA512 | f92b1e7916460cb36c2846cdb373440fe5d9f384fbb9a9b57de8e67737724a4c0462b9d14408db421ff5631ee252e7b73395b909d7fccc711fac230ff26c94fb |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | c91d2bbd5751599472b128107940fb81 |
| SHA1 | e40a93f753d0f569ea6d9fd96d6920d91371d34a |
| SHA256 | 722772ecc67ae470acb4587a411b1e6815b22dc5ed8abadc927eab149e762fd8 |
| SHA512 | 63f39d4b4a2f05118fe9b07f09b9313bfafb106e1b56054e3685f0572b3bda7c0e560d795d1d66fa8b8b2518a4d2515f1a878243d5985c2d3d4090eb407a609c |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 5735c05bc11dfd656b794fe65e939aea |
| SHA1 | a13e23fada4ace42b32cd6d1eec94d7e096acbee |
| SHA256 | c9b9dd54cc691432d8e5da54ed8f4e25715a00b6034b7b29c0367ee0bbfe869a |
| SHA512 | 5704176cd193d767c8b61f93a059fd40bdf96368f7e77199e003b3023d1f1113b07a07a36239e7772faabe65aec8dcdb59fd8b36014fe592872ade1b9f3c3e50 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | b957145a67434707a3210f85234a5d2e |
| SHA1 | 1a4c128159063777de9c2c2c6140045bd9ce95ff |
| SHA256 | 46f7150a7584102db0df23976f6e800b7f183dd37478859e7329682d65911a68 |
| SHA512 | 040344f195ad5e79004e2789caf4c74b9ae945b0f996dfe537d57145dbe8e4ac10e704bfdbe5895d9880f6f3bc323a109c78b930e35fb7b227d0e2ebc1370a40 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 65d92ebabf20392d986e29634cf09733 |
| SHA1 | 5b17c985a78a86997da618b3694afc38ce59989f |
| SHA256 | f509b7f0fe84480b9b2e58db5d5f13d7de946c723f7e4e41e4215e49fd1a3517 |
| SHA512 | e881d44603d97534b67ff5cd654eb11137ae77c03310c5932758a0f4e81efcb73f20de5c9a3a923a197d183093f162ac2a6950a60fcedb5e06a04f42691c6f66 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 8aae2a4424b578623933e2889a640914 |
| SHA1 | 9a0a00c8dfc3be8124697b0ce2251b0198d206b2 |
| SHA256 | da37f9ec83c55a993535a000b75af80f5975c376f3867fe4ac32066bdc92ca39 |
| SHA512 | 9f9df7e3aa7e833db314e66f55655fd57ef525fc79d4626046023a40b377b05e63f09ad94e43affc2bea8302f5266263d92760a5905cdc18f6144cb7813d6fd6 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 54fce6e858f43a62ca929cd36e612fb5 |
| SHA1 | 0411edd23f01a79ee448c3c176308a7311ede802 |
| SHA256 | 6794ce1c8857503d8fd3aa7fd755a9d638dd55ad1649b065d3a9036e00df511b |
| SHA512 | 8c203502c68a697b89b4aab54646859e550ae541569d905e50c525d37e8b7443f9dad456ac1c8b72e65f6500644ae4e0e370dd4b1d065c3da2b545bab2a4d0e7 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 4f00193b1e6144e3d48875e28ad45f11 |
| SHA1 | 6bb459e30fcf911e3edc26f681b90ef9909a23c0 |
| SHA256 | ac3b4807d02291932eba2c7ea997e527f094f7a7b90385e2196e047640fb81af |
| SHA512 | 0fb29bde66ec88187872c5c4ae0a50d00a542dc2f8f690cdd602e788ca064fb18e119c0ba2190aca33e33abc5ce659582be1653fd450e4b8de6a4904d50d8afc |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | ba50ce5b18076599cdc7b76b3fe066e7 |
| SHA1 | 28f02af465c8c43f7f1df1df3ea8f2fbdf4803c5 |
| SHA256 | e5845e561752588355597dc7d9689295295fc546c12844e773066b9089664caf |
| SHA512 | bf464f231538975be0694ac14f6159183d41b5871beaf4c4ddbdac0d7624793ace7fd77cfa771189a4324170827ce37f43053b17884ded05568d21b1b9215c68 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | b31c823f122f7ec5b28ac0ff17f1d557 |
| SHA1 | 09241f883b445606e3b2bd9336d4555e918835ec |
| SHA256 | 1cebf1d7342d7ee7ba55428ff8169151e81d65047b1d356c3f867bc8bada4072 |
| SHA512 | 25a74820462dcc465211baba36f8de7fb8ac769557754c7b5bc01f1a72f72bb30b664110e63ef0fb1e0701f9f0d1cf6e82987ea5ba4c554565ea9a2f7235018f |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 7821b7362d10c6af2a0a8860533b0e57 |
| SHA1 | e461c4e7f10b539b02512d58a3d215550d9f20ae |
| SHA256 | 85a1bdcf975afc44806aac300796e5ec053ac8a15b0d6335a624f6768aaacecb |
| SHA512 | a08d0ad37096c0ff4f36dc56f885127914f3831f516d800645fbafbec5a1b7bd2ac128364a55a8944f022349d03049ddeba7fe017a1845c9c09c3abd47dd89bc |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | f185c5d815919fc11795293ac6c743d6 |
| SHA1 | 49a0c47370afb310a0230bedadc4f7c541d99180 |
| SHA256 | 20c8fb66f4895200bb1f1e8c42f8d19463dc352802257ee8a2c8b3ac47c9ecf0 |
| SHA512 | 03c8d16067b4dff6d93eee42f4d3699b37ac1e6a0b3f382257cba42e8c437612a569be8401e5a1b6ead1e7bec07e04dba30d2ac5c20445dd691d9bb9b563f0a2 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 54f9a9b4f6fd1f77fc1dc7080db4dc23 |
| SHA1 | 6ae504ae8b94906f83f8a85779e9c6df088dccb5 |
| SHA256 | 4d28f46412ef608ebcd74b849c890f47c7e541b695a26d2392c53006ac1a93cb |
| SHA512 | 4ab396fe624d16fdcf33b5f0558fbe4723b163b58d6f5f67d04c6320ff96251cfa03337d8f57ab6bea5b437744d4aaba1d48391444d4964d97902add402d3442 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
| MD5 | 26e0d7aaba2122fc08d20c2a52c98f48 |
| SHA1 | ecae08d5f2c6fdf713b50c251208bbf05b9e1e64 |
| SHA256 | 02d8029e19e88db44cf6d0b0731f05798c7131fc24a3200715e68a4614f2a66b |
| SHA512 | 1284b54c597cc5d6e3eaf10c9d0d9ede009f61eb808bc05dab42994a8904dffe39c7b59950faed7eba296b9b5c9aa6edadb5fe473ecdbce9056f6cac695d7a40 |