Malware Analysis Report

2025-01-03 08:32

Sample ID 240610-23gcvavdlj
Target 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe
SHA256 57170610adc9ca5811f1b0a04a8847302ade656a1be5a187db0cc776862e7b4d
Tags
upx ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

57170610adc9ca5811f1b0a04a8847302ade656a1be5a187db0cc776862e7b4d

Threat Level: Likely malicious

The file 1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe was found to be: Likely malicious.

Malicious Activity Summary

upx ransomware

Renames multiple (4540) files with added filename extension

Renames multiple (5060) files with added filename extension

UPX packed file

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-10 23:06

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 23:06

Reported

2024-06-10 23:08

Platform

win7-20240215-en

Max time kernel

150s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe"

Signatures

Renames multiple (4540) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Zombie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar.exe.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\service.js.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\DisableMeasure.midi.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Windows Mail\wab.exe.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.jpg.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\QuickTime.mpp.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Windows NT\TableTextService\fr-FR\TableTextService.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\vi.txt.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile16.png.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Windows NT\Accessories\WordpadFilter.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar.exe.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\VideoLAN\VLC\skins\winamp2.xml.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_down.png.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.exe.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\library.js.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\7-Zip\Lang\fa.txt.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Halifax.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\skins\skin.dtd.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.exe.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Windows Journal\es-ES\PDIALOG.exe.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\libdcp_plugin.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Internet Explorer\en-US\DiagnosticsTap.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Windows Mail\msoe.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\gadget.xml.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Windows Sidebar\wlsrvc.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_snow.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre7\lib\ext\access-bridge-64.jar.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\library.js.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe

"_Desktop.ini.exe"

Network

N/A

Files

memory/2256-0-0x0000000000400000-0x000000000040B000-memory.dmp

\Windows\SysWOW64\Zombie.exe

MD5 5829fa8dc997f814aec5aab48c031cf2
SHA1 bfcb09138d6f55824c5ccb1f3c3efa7c4b0ec180
SHA256 7b61abab5027b6452db8e8405e64b902d9f83aa6f65854a7055f48daad8ef6b2
SHA512 c61def35c728dadfbbf097cc0c06aa4f5de1663ad17003b0339c6d0d591cb1ef3adcf6eb9cf7555e5de3e0c942e514e55139dc1dee68084b399e7fdc3a782774

\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe

MD5 100b44c673d371eba3afe5a74a73651c
SHA1 4dd69dd670d0f6ab7e8f717667f328dd7d68b22a
SHA256 62c9e4dde81459b02a477410722c997a86023f0375470a3d48057ff77ea28cd4
SHA512 f9c5a553e598da05985673331c077692650cca2a7b85542dee0fb98ca0fd3564a7c058baecae50412b0dd4d8b244456faa1f63e55b7144a66af9176b0b34d80e

memory/2256-19-0x00000000003B0000-0x00000000003BB000-memory.dmp

memory/2256-18-0x00000000003C0000-0x00000000003CB000-memory.dmp

memory/2256-13-0x00000000003C0000-0x00000000003CB000-memory.dmp

memory/1832-22-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

MD5 62f70c43cfb8783d7c655f3972d0f321
SHA1 7c70e66aeef8ebb08c97366c57944482dac71a30
SHA256 f4534cdc3696206ad55b2a54c234e042621bc9c7ff17e9becff4c911611ae43e
SHA512 18a2ddb064a7de71e036e5854c6d6a23a3f828f2ff31e40fdb29a61f0c8d9b75082dc627508416c8eb363942ea707f46b3a3b78ad1eaccdfbc5ccefb9e1ff99c

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.tmp

MD5 bc96bb24128e69e007fe0b45ed9d88c3
SHA1 9f2b0ac1aa59d20b1f2bde26dd2497748965d9e8
SHA256 3cf98b4df9239fe2d2f7ac90a8936d811677702506b1557d6332e434f02c5151
SHA512 f3ec197719432993575b0cce86200bcced98acefc6d547bf15e9b8a1d1240a861c883027e8666dd962f144ad2e7885cfa5a7831d90cd18ccb6444d8af3678281

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

MD5 67667178a934d65fd366a96c058d13a8
SHA1 a5108c36c0ce6ae8f806f88cd53bf5239ecc7fdb
SHA256 26193a6361e38aa8e392733973c0a2596e4ebc3581de879033799d984b0e4550
SHA512 128576f37481c973d5e14e8b84070958eec4a87bf3794e921af6bb57d2c9f1f0a7168ad443adc31623919314dfcc739ca66cb02f2f87566837653daf166a14eb

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.tmp

MD5 71b63bb2e74b1c3bebfea4c9fdc79f7f
SHA1 5d7bc7cbf2f4bd1a50e13b8dd472eb08bc2647d7
SHA256 f4845399c9c25bf119f832443a7f7a1c3e116a0b2cec5770cd92df96c823cdd3
SHA512 7787919cdc0147d1cfd5d4864a033d2f87126684ce11da3e06a0aa7063139bd373f675766a72ff7a7e7d84ec7f2e8df1de9e895f3e9cc9361574a922554d8943

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.tmp

MD5 c50062ec7e679a45583511e3e46d1381
SHA1 309e66a5a1bc6b7e260b3efaf0016973f49f1cc7
SHA256 e926b0209a4725c70f8980c7b104d309bcc1131320c1cef03e992ab1bc60fcc3
SHA512 05d6086bbf5a0d5beadb4e8cdd7a3026efe4e9553e6dc56a5706d0f88ddafa0da4afb8fd32a9dfc7055337c491a2d1ab086bc2c64316cfbd4d6dd6d587152b91

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.tmp

MD5 8945fa1a5e472841a9f5d6cdce3b5c87
SHA1 88024fe416a432dfb96f73e58ba66732f26bba9f
SHA256 625b234954ee4a4d0c102437aae4f552a8a77d4b90a09a4553ebcf1e2197c42f
SHA512 d0cf04f4e704f16e5b99afc0bcc672a65e40a7e256832184d522261abe37c7d6e1d91d4f6651ee90b1e03e344642dc3e69c83b0f4db37e6a74cf9469e783722a

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.tmp

MD5 62019e1c1c0510391b94ceb3d3a150bd
SHA1 772914a31f50e3217567d606a7be5535e1e2e997
SHA256 4faddb8e9be0506fcc4465e5d8bbeb9f6a4ee79a5aeab0f1fffea6e00c25c904
SHA512 fcb1204dfc2039b5dd8399088c2ba8bd7d896e9b68a5ae2f74ef22a19f54b2d39f82459732be00fd2518b6cb82981f400ba628ce0f96f6adf716f143e5180fb9

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe.tmp

MD5 f78941dc743f4d9ad4fd350820f948a3
SHA1 21b7525c12884e89aacd779f75c13e0296a47400
SHA256 14cd92d1a30a67b7ceb6da4c9b79fb0cf1bf4378dedaef91c1cbda42611f8c31
SHA512 5e02d604059f230b286a7f7778329fcbff92cceea44ea6a84e1bc59448c00e409074c506774add9329bde90b7381dca2e0414b977d25ba81ce7cc3775821634b

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.tmp

MD5 1e7d4a132a0b438c54877a9040befd3e
SHA1 355939c8b7856949145764dadaccd18d816397e8
SHA256 bd47dd3b6a7cd1d6142eb475e74f070a623885d100d0a71e79736d20fc7db88f
SHA512 83ea6cc922fde7ed21a84b23f3441011087be3347eaa4662360f56d8d42bdba63ebe0f0dfa393e216a36043522e14f1e1860ab2c89f679e41c3b0e60e4162dd7

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.tmp

MD5 8457d33f7b3b32b6e822f40895793d01
SHA1 6841ee22a64d4f269eee47de9c73a9bc67a5e54d
SHA256 dcd69c8d143cfa2e7af9b96da8cb9580adf03f6c2e21c4affee35789b20396fb
SHA512 7ccef93920a45790041e16a2f7054503bf8f889bf701ac363606bb0e7f0a43661565ce925125003a73806bd92a0d742d128ed25fbc3bd16249779aa78165ecb6

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.tmp

MD5 b962acacdf76b421fc5c684d689c6a4e
SHA1 4f15b522acbfbec5885339ed5e25aee002f714fd
SHA256 06a8636a84979b643975c8ccfbce791fff7da29f78b50f21f639850641fba47f
SHA512 4a140d0de2ce6ed6cf30d8a891dc6b29246a5bab420dfdc4ceb02ea90f77d152f041040a3ddac34cc066241a238bb36b51eec02f88c0a3035818bbb8c7feee30

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml.tmp

MD5 3f50db313beb329d50f1e4eeb8c057ab
SHA1 b91f2fd9607bf1d1b4b9db9f8fbdf2e645d9ab6e
SHA256 5515ea16ecf877f8ab651ae2aa6a011a17f54ac5f9faefb4bfcd6eb3cd06328f
SHA512 966f0ee8e6815580752e3cfe4631dd25454b1f2f7e4233706b6207cf09307a6d88ae11cda01902a9597762ecfb94232f7552ca6d9eb8e62d309542c065b7fcb9

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml.tmp

MD5 4a5f2b6f23ada8357fb6318c3a1dd66d
SHA1 7a96ce93ff9e69d803a9edfebf1c9b9c6467922d
SHA256 9f687c02de43dcbbbb64c23a34ed78262d1b0c46ba303e134abcb091add87268
SHA512 25f40e94182814adeaeb57093c10fc2d12e9327cb070120e160e7a5ca19ad79b6e543d2d0ba5081b80b05301c1c9b26595627e3d65767516bb66186119320d09

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.tmp

MD5 0a674ce91a82a3153c1f2bfe7d9e857a
SHA1 a0f6d762b7379082c16fe0bf2f1b43acc9dc80cf
SHA256 89bd65693818d68ec474200ba34f9765df0ec6c5fa67ad7470b5aeaf4fd29e79
SHA512 71d3c917a523809478388fef067af3727da1b62f9e19f33dfd06c87a8717b6f61fa1004b74716489b43579cdb7c60e3a5fa0671c052dd22148c6a570b73638b8

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.tmp

MD5 4acca3fbe225c1c5550e73ec8906b3ca
SHA1 7925f7147417c963418b0144d2c63b2436eb77d4
SHA256 1193d764c21729afe15746f390472738a225105458ab0c18bcf7b9dcd4cf8848
SHA512 d8639f3cbea9f10437fadf4de46eb2699232d4ed039c2fc2fdd68a9c1984a872444144c57dda78596779e4e7fd8e0c955ad8720738ea9d8ff0ce5479ab9b2942

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.tmp

MD5 4b349a115086d20ec93bc1003b62556e
SHA1 b6c0a37b9fd87606387e5aa3a1acb5b55f9c5cab
SHA256 649ead92302e0272b327d85ddd50a981fc518d30c5bf6a346a3139534a2ec58d
SHA512 7291454f98c652e680d11bd73ac47765cb48a7146d5750a22b031c29ddd66c56098b44d3d079bc2eaf8b6df9152a7a4d4d683cc62e10fe6bc58692dd7d2159fe

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.tmp

MD5 e90d33efc8862c4ada95e9e00023f44f
SHA1 cc1fee7b3fa8fcb1bfe77fd2e95bd95bc11670e7
SHA256 c396f3723bccea2ab9bd575731e8445f3de3f118ff899e483189fed3e0b162ff
SHA512 c41a0c72175befb5c5a0842ab1f359ff0f69a3848ef12a22f75ad11cee074a675cfe419f5e4bf9eac10f7db535c2a6d9d7840eac0b0080221ae365b9014fe615

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.tmp

MD5 dea53e145e56ecb839fcc66d2ec872c2
SHA1 17817e010111de51b60599361e2f48ab57784a8a
SHA256 31f2c040cd0a1ed0e711591249683b389ec004481fe9a619620ad4a126a17199
SHA512 2db689d0be39376cbae3b6ca4022019c251c1b057ef194799ec152f964aa43c443e4a8ba42fe5d7f2fc27cad038f736514e79ae903a53cd2b707b696c4b9f1e2

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.tmp

MD5 0a9f4c2505face46fb56000850a3ebdc
SHA1 2ca68fe6e3f46bb6fd40078edb125911137ff3e1
SHA256 c4c2e9715283e69998255a6d9e80871055adef7ec9360279dfdc2d570aca11a0
SHA512 b7ce01e884f0634f5842e47c51f4461da60063cd386e97ac0dee074e77c3dc192add85ac9d1c555b1f650826142b1805787124019e1b52c540e29b7bb9355423

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml.tmp

MD5 6b3758b8b0af98f86e3f83d1f5ada78d
SHA1 09e2349e8de0a2d6a015257452618496b1a3eace
SHA256 c490b827e631d5d1ada9c8ae3fad5b10919b4485c7a7368f1d69e95f86131b3d
SHA512 f55c6cf078bd12efb20c6260d1f48dc4f18bc736c3235519243ed619d401ff132850fdf6ec406a9ad174a4330c5b09045c099f7aa13e577938b2319a61cdfcc3

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml.tmp

MD5 eca375cb4512c4ec83f8879cc2053601
SHA1 5937f7234d7b9077e8c42f9e794e4047db064014
SHA256 1dd16f88a7db93488ad7cdf5919b6de4d6017845d930dbd17a7629ade20bccef
SHA512 6e4367e0138adc226953895e12bc8b0b4f2bca58872302da1e900c29bcf7ea661e19c1b6a3d1b084b4fcebecf625050c9d7a4ed497170e6efdd6e3683800c154

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.tmp

MD5 e4def1b8b167da65f729ade69306ffe4
SHA1 15d7a421a11d82280229852ca50b795ce854c62f
SHA256 753be18a7481abf7cb71bbcb618a167846c13e3bf6bf8186975e2a670da0f624
SHA512 b31887ab08d65ad5524108720bbaf147cadad50b3756acfd6d1bd621272ed4d20431c3f84cb96212b7cb79a9770030b3c23ac73dfad148f64a79d5c584270457

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.tmp

MD5 f2542951e918024300c76db801e2ef98
SHA1 2dc097963f9a308d9a50b3e8071e8c3e865526f8
SHA256 6db15166e228c71a2e2d2e258d45910142f5155b9978927cdc330db805101a19
SHA512 d08c1e084a385948f7368ab76bc657325af884b74cd55e6ee54fbc9105f33713cb54188d789282df76fb2454ffc5e109b37a467cded7f2d1080c83076906c94f

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml.tmp

MD5 ecf6a6fc9f63f48e9c89fb9cecf56bb8
SHA1 fb763e133ced5011c60f99b124cf52da0320b397
SHA256 3041d0bbc3f6d88c9a8624c5b1f9b29e04e7644c98def464866e08aa80ef11f0
SHA512 0b6118fc99f4c119a39766e10c5e12ef5a3caf7bef3dd903a75094ebc5332df97789a0a5585b0929633c834b0200447955aefc9af161d250ef8253e26d7f4e20

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.tmp

MD5 bd0bcd5a22d56ad6f0b7f7a91686dcb0
SHA1 be265312c30bc4a2342417054db2e5132fd855f7
SHA256 119f53c211f563720110a5721fcffb7cdbf9a5ffcfcd6a33276410696fd909ff
SHA512 09f70333723d78379a9520a071cab4e28ccdbac483b0494685de0bc298845314e28c7c009c42b16078a92198343582304e5286715d813a4846d446d2e4b2bb90

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.tmp

MD5 bd46c040c87aaa45b85ee887e9593680
SHA1 b07754df0ed54606b655131d430b42ae3dac0511
SHA256 da727dd95be98d2db01887053cb238e72932e7f749d5caa3e526bfd0778ebbea
SHA512 333d723a0edc7ec29b4642855df4a37d1ffa689b547477dd640bae2065ad5f57559e9934202552a1fb14f36967f7abba35d55741ecf0b96b58ba3db9ae390515

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.tmp

MD5 b2f2bf7d031641d14508235e1496e524
SHA1 2f57a3c15abb9ed5034338db427ca99e7a4145a9
SHA256 71efc38bcf68b4adc7d163ac8a338b685e3ecd4db1d109a9e8630068b2a4188c
SHA512 62af23f448838ab8895db9086474ed67f1850aa420d498c48a3ebe64f7ea2a40d161f07711b585e808b174561345c9493d5967dba6afbfef31bc5e913675e108

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.tmp

MD5 8f7fe38fcee3282db9d73eb7a44425e8
SHA1 45d23de8dd315680ef7257add1e80a81d78122e4
SHA256 de20500c920dc5112da2d7cf394332c0f154b3fa574cef38de32112864a07b44
SHA512 c65bbafa212b4369b17e0f7b7036fbd47ef49830e107cdc09d03429011d900964086200177f218dbcf53ff215a2ba43df99993e4cc2891eabb317d13d5c531e0

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml.tmp

MD5 2e4cafb2ed6ef1b33f84fb2570244fea
SHA1 ff395c412fa84dad01dc2bc21ce29001e1440962
SHA256 f123f33534d7322ad38f63b9d621d258531e28ed1d574d07a6a7fc64bd2022bd
SHA512 92ee168d81e4d741283fab4f32626cc02eeaa316a87bb5d2b2b23f1179f1967a0cbd334c9fc79339c20814861a4b22473141ab7196b0754d586ae43a5638469c

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml.tmp

MD5 66fd051fd00b90534c8e6c796d2d4b01
SHA1 288a7d51a6b0627fbd0b542c5ce5d1bd98508ff9
SHA256 4be31467d8f581826bd8284f31d9e1ebdd455a9f3d17feae84834b83e6fce5eb
SHA512 ec87e51457a54d6c6257b4784e952d83d0ade05bc5d26904cf3fe3fc077b3ed4c40297c71acb38e46da9f3b0c5aa0b3e91c1b4c561b0af7f78579651223ee316

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp

MD5 f60495629a99a393650fdd61a8e6bca1
SHA1 93b68704f07bcf8d7e3bd5e4f0bd86cefaf4859a
SHA256 685c03beda7273697ba8e8fab0c28c527dfabd521a8f2c430e8435af0d333741
SHA512 7d34750f4ae2df6adf068200d0b470efaa4c4efe1a0be7c797434f88ef263360a61e8077c8f39a7bab65f6b9e25ecba2f0e7aff190ef8b94351c191e40e73f63

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp

MD5 bf99f57de0b04010049a98df22b9faab
SHA1 e9d82be666ceca58e389f6971c45503466f25828
SHA256 e6a5e558cedc6d5fe5eb4eee216cc58aea6f690ad2b1d8e9a8142f3744349d7d
SHA512 e47adf94ce7b8c44354f1faa42c9ff49f17afe1384bd4910bb09a94fc52aa2cfd3bec1d5b47b234b299e5491fe6e84d1bef2abc48595e352c9f2ad3b89d8a07a

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.tmp

MD5 8cba291b8fac87c568040a37fd605364
SHA1 0dc35b518d18979f965071bcd2d94f42b4af4284
SHA256 826bee6dc534537fae2a26f011be3030e4a9c6398522f71eb9f6eafb6b4e0a70
SHA512 44bf2baee9c3464da6f01705f3d6ffdd5fe6b9c7cba8346ab70e6411c365b1998886571969870dd142c76fbe66e9d40ba9fefa40aff75095be626cf984805479

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.tmp

MD5 ed40939424a9c675f8a459376e8dfc07
SHA1 7a8ca5af4e285788065a4b9768c6c943ffeeb644
SHA256 7109a02ddd1aa6b322a4278fb010e20066ec1e1e544dca6c6c415e3775e0fcea
SHA512 f3f2762836528139d3e5099839f86b604585c3dd2918293f250116ecb04dba6b286516610c0bd3cc2a21f055e31c90b7e18234c5e7644ee9750f4b66677cf4ed

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab.tmp

MD5 0d530ba0393caf40794304aa8c090594
SHA1 9b90d99bb34bed1901ef2d394daf28a739f72f6f
SHA256 28670bf5f230ad60bb3fac2ae9871ccf6d9f20347151af6d913dd63b6b44400a
SHA512 5788c4bd1417b9c55c01b2e639ad141a8ed964eed289d191addbcf7c889696e37333ddf3a7b56ebbb4a535672213582aa8b769da3d479dfec6901f56f5adc8cb

C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.tmp

MD5 e72a9983747fb08d7408e3d4285de2a5
SHA1 f053ff56f1f88d7acf91ad49e045d114f0cee358
SHA256 e660f0917329418c6d38897b9e12056e2d90a4afaa90a62d551becb8b5708ff2
SHA512 fa7bb195f114e317443f1607d3a2fbb5d6919d0345ae13ab5ec3d0439af87e3e5cbf04e57c96dac72a16fb1df31ad51fcd35f97c03579b19aa8d86f7c423cbfb

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll.exe

MD5 c6c4d70035b1fae3f3f560602d447e46
SHA1 3dd827c35050591ff8c42386f881a734f8bcc478
SHA256 b9fd633c9fee2cb5d393c9e82575e7628fa98cb646d41aed8121445e615677cd
SHA512 fedcfe4b0a4e4e19a513a2896ff56096df5d17bdcefce8a25f74a261f494aae44566dddedeaf4cad960be15cefc8811963a50cd7f88c1c0f4b0befe1588d9ac5

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml.tmp

MD5 9d15c4eb5ef4a13c3f1110a0f1252406
SHA1 4c76e1023353d64c001fbc92ac34889df81b38a3
SHA256 12836c8d1dccd6643c1543f91c89ba25fbc89a4d18018f4c78fd14567873eea6
SHA512 22641386ce632e17c72ad80465a7e285de33ee42ad2702be06560f5e75b8d8a309bf5eda989b3a62e8c337abd62f65bbce386df7fa284c09f42512ba12d5ff48

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE.tmp

MD5 d4e9c123b54588a1330d591970255fc5
SHA1 c6a146d574a0198bb5477732eefc899e2862a23b
SHA256 79e48f5a97b2d86d42463883fadd3219cdb8319e829d389f4b7022d23ea88ce0
SHA512 18985e05c0e8c1a879f62eed97f54bc615d89f5837e591b70baec67bac8f0352ca66173f14d46aa3286b01555796432dcd9a68103c5d50440b7040816186a9d5

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE.tmp

MD5 f03b9c44204ee438246c58afd5310d3c
SHA1 79491cd107f2087e37a8c370de47a3762d797d37
SHA256 226603ac4c87f6719b698a70b65c4cc6940354cafe80d2f39ff3793f06d7f4c4
SHA512 fd0b5dc48e632546b19b1c34ed7b3072beb07ef51f13b59d79a6a8b24b6ac668017fc2c8547044c8b3f3b50f570ee5d07193400574f12f74f85aabec315fa10f

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll.tmp

MD5 c01ff6d805f34644e0b3533008042034
SHA1 b300a904e586877e65530c8636ae027c45efb2bb
SHA256 4f2afe78d835eff030a2ecfc112bf582bded0e15ed6c711f7cc77e5a8bf0e579
SHA512 279072de14b32ad0754031300f72c124d3c7b7af72781a2ebe319fc6843a7328281a64d5e8a7a630d27aa1bae898844fc3a6d1fc1cede7427ef0686392e294ff

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll.tmp

MD5 f78711a87a6885715f26efef0b93c4bf
SHA1 122d4227620c1a4d4128ae733bbea8f7559da085
SHA256 a159101e6c5d56515500d20720b7bf90d8753c8939a266e51905b88d824cba81
SHA512 f422d61e6ee5eed7bf7c1cadf53f104c547f51083f3c7129ddcf5b94719e660ed29b87f7d0a19a8dff8c1c764962b97014c845fb464822e8af30e6e7b30e8aa5

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab.tmp

MD5 ea1319e55144d96e5d08e3da4be2bd08
SHA1 0752fb12982f59261e6822f1a489137f82cbaa2f
SHA256 fb23056ef511e1c5079096e6f8ac8bdaa58f888803c2463ac01e0240e8607e1e
SHA512 401baa111906d1091b69e42da5b02b1ec5e185807172a7e9b3361a3693f649fb78fe9a669d9fda3ecc7f0ef5e14ce58b519ea35953ae3719457b39d642b25111

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi.tmp

MD5 be916500cec181ab59923aac00117445
SHA1 c6bd92fa41abbcc7d9598823f34f2332a7ad3767
SHA256 ed908ba13238d604666b926b8410985cdfd0ef1c1231256c4f404da897ec16a1
SHA512 e57c7b5d11b82aa39773f25404f4519d203f37576b2c77bf6a60cc1fb93b21936fb0bb9b104ed63b587423a6e10a724a222c1c139bd72c13c3f83826532b6244

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi.tmp

MD5 ddc1c8b2d64bf8a78f013de2ff89d046
SHA1 f53574b6694dc7baf4dda51097816953e1e0a7a0
SHA256 22c61beed5b084a090a7d699685886762888020a16bfdf62d8bc62a0a96b6cc3
SHA512 7e920c1cf5b48d9422788d4f5705dd3b18fbaf9321a8012ecbcf19d31b40c17afa4cdf00ed0e68f6bb87cbc1815fd44debd15a05945975dbf2c0de096e90962c

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi.tmp

MD5 56394063c134c77fb79252d9224ca276
SHA1 58da3a4e6a8fac8678cf1575a27e3ffbf99624f2
SHA256 6bf644e3e9b2b46cd769ff5465b8f35beab5fd13d1f5df1b26fc271789cb3380
SHA512 0fa7c077d746aeb17619d2d8c4121ff3b8b402be501bec5c65967100cf4415211590917712e88901bea3726ac3a29f4b3b16f21b792a17a972434733c2696284

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml.tmp

MD5 c0d93963e10b863f40fe72002c854a15
SHA1 e9b46b48b74831d8f35ef2a4bc187acc2e6ce7bc
SHA256 36830f84aabe3c52c6ad3f24e510d214a28507c95da6f83eb679739697b61b40
SHA512 25efb5b2a9b40e2e4789da21e948913a2f77ee480cbdcd86197f32be68a30793d8828c671a3d338e2a97725fbc20839320c96d12a76d51837c404166eb8a9a5f

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll.tmp

MD5 0e6f28bc911923e264f48febafdc3c5e
SHA1 75059a2e6482e2d68c560c7437c1fbc67d9f9d33
SHA256 293ff255c6f4063c428e9a1e0ce04d4b5f9b7c052a02a5f0f43aaaee38d69568
SHA512 bb26713f1d6a233d9b008202191b142b0450dc36ad2f462bd681dac002fe502cfcff48f2a6c301f4eac0e1d683a9a96629466563dbd66d2842ea6de6de3773ba

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm.tmp

MD5 28b67ec4e2ba7f91082a8e3270a8e0e2
SHA1 90e1f4335c52df4a271c3272e3b6a70ff6a7e78d
SHA256 b91542587ecdc20102da79b8dc323512d54d8a8aa98578a5e59d32a8c3bc9ce7
SHA512 4567586537c6ab5287d72970f722de0526fbb8f89d2d95b52e76e925d9e4b238a979118cf0d82f34c06ce683b0c31a88f1c8b122bc36e522cf8222a907dd522a

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm.tmp

MD5 09931233bd5a387f9d9ce16dadb32f44
SHA1 808218574e996164d44c05c20dbf728f392eb1f7
SHA256 ceb07998b404a4a037f465dcafa566b2cda7b69d308f4d69288939dbafaccb31
SHA512 e2ca979e735a378987a4378ad8c3f7c0f9cf4cd8f5dc088c90d2c14d1a65d8e1b06e63d2446648ff776d5e4a3d4f3ce2f83c66e31946bc2fb31d4224a5b43874

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml.tmp

MD5 fed0f115deded216f8dbdcfaa8d7771c
SHA1 a36875e04f212c166ed8d541fed58f18e4fd37bb
SHA256 9b0418b3fcd4dbe41099d99404a5c91511c059270496da87752882032bd191d2
SHA512 a9abe6973a6e65f7c8d3d2c14e56735fc60cb341e0f6190fffe6b79c0a69928b7a870b0e0f1cc1e64209d5f7e52d5ac716dbc892790e74989e2f661db5089233

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST.tmp

MD5 b49d39b1abd27773135b226f25e8da6c
SHA1 28302d16440bb08648c3336a14382433fb6812da
SHA256 99e407fe0862ef9a9269a5d445931c5ef6e2e40220674cd90259a7db9901ce9b
SHA512 30ae7a891f9d565b9a7e847a3b1fff972bb2699d1b451b05df7287754f0bedaf71db7e9f1d2ca04024a472e9b66953642d194b4f34073baee27ea5b5c3406dd2

C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.msi.tmp

MD5 5bc3dc152d1098ceb422085a577a644b
SHA1 51be4ebaf348495a25956d05779cd407c73e79ca
SHA256 69f80882981b5af95b6da5cbd642681e92da30d3d5731781fb383bde9cbedc0b
SHA512 b2d128bcb3f48148c4558bb381a7f47be0e09b7e6d927213d25dbccc94384788fa7a7568460ff1533f4c9633c97e81b89542ffb475bf6368c7bfc8e7c300aafe

memory/2256-261-0x0000000000400000-0x000000000040B000-memory.dmp

C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUISet.msi.tmp

MD5 62ad0265490b625717cc0df82e04c7d0
SHA1 97d4dc90cbf684cb81b133d19685dbe955382fc4
SHA256 c1b294ad0fc9e3656058fb227051d52f7bf27e0a5033fc3c0541ffa08898d858
SHA512 29a9c1cc549f05391ae154751a9c7d893cee4cb72e0135c80e6724acca8f118d43cbe14c82c1a6a628c87ac9573350e227fa800521ba91e249fafbe15958a8f7

memory/2256-312-0x00000000003C0000-0x00000000003CB000-memory.dmp

memory/2256-852-0x00000000003C0000-0x00000000003CB000-memory.dmp

memory/2256-1087-0x00000000003B0000-0x00000000003BB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 23:06

Reported

2024-06-10 23:08

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe"

Signatures

Renames multiple (5060) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
N/A N/A C:\Windows\SysWOW64\Zombie.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ONGuide.onepkg.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\PowerPivotExcelClientAddIn.rll.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\WindowsBase.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\prism_d3d.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Internet Explorer\ExtExport.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\7-Zip\Lang\ug.txt.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL111.XML.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\msipc.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXml.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.PerformanceCounter.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\VVIEWER.DLL.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\1e95d3d56141dfcd50e03eb81f0c1e70_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe

"_Desktop.ini.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

Network

Files

memory/3904-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe

MD5 100b44c673d371eba3afe5a74a73651c
SHA1 4dd69dd670d0f6ab7e8f717667f328dd7d68b22a
SHA256 62c9e4dde81459b02a477410722c997a86023f0375470a3d48057ff77ea28cd4
SHA512 f9c5a553e598da05985673331c077692650cca2a7b85542dee0fb98ca0fd3564a7c058baecae50412b0dd4d8b244456faa1f63e55b7144a66af9176b0b34d80e

C:\Windows\SysWOW64\Zombie.exe

MD5 5829fa8dc997f814aec5aab48c031cf2
SHA1 bfcb09138d6f55824c5ccb1f3c3efa7c4b0ec180
SHA256 7b61abab5027b6452db8e8405e64b902d9f83aa6f65854a7055f48daad8ef6b2
SHA512 c61def35c728dadfbbf097cc0c06aa4f5de1663ad17003b0339c6d0d591cb1ef3adcf6eb9cf7555e5de3e0c942e514e55139dc1dee68084b399e7fdc3a782774

memory/3576-12-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

MD5 030936268becc9777eaa090d416233af
SHA1 06e2eeaa5da1c582a63554cab02ab2f77d595bb3
SHA256 674186ce834935a1aff17a056531feec563017b0d0f5c700f453b5c666ede851
SHA512 f4338e337bd9445e3bff48fd81413b796ba91dc72a5d4590d9d4ad21e1cac2068076cf41a52be64ed4e2f6e40349f326ff5c00bc2d17ed8c9f76e9279d00ea1f

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.exe.tmp

MD5 5526252be98ecba6c18d919f49a40606
SHA1 bbb9a0290a8f56375b8ebe5848a146fe2e982b1d
SHA256 f8d5e31616a6824e2881d092b85034cd0c4e45452dd9e6596af2b400b93213ee
SHA512 484d24a69571fa62411c3bfb951bfab2080faada16830b6e8fe59b7ccc93a4e90720c55afc57c17801df4548abfb0e4231c56e0a55476429b885ae360a1a649a

C:\Program Files\7-Zip\7-zip.chm.exe

MD5 440c0760485026897278b3339969e3e4
SHA1 1a7301a1ea58f8a7485c03cae1d20b814d6f7ced
SHA256 6bde4ab444dc72d098734d2f0be5887f5c47b61dd40e5783a886494b1ba4722f
SHA512 4ace99274ba9b29541a524747a0048ef0814ce64d75a5d3e6ad80a10a902a7802ca4d6c07f98135a6bbec612baf7a65820154ee1bd50747d282a71846ce3d387

C:\Program Files\7-Zip\7-zip.dll.exe

MD5 8f294d57de8cf7347d0c1da959e6169f
SHA1 016e4198a7759df41f537f7469fa8054e5ef8c5c
SHA256 1c2a4537c879dfd274456e2143c91f0cebff361a0ddcce770040dfb3ab0af0ee
SHA512 ad436be86dfcc2aa5c17a8de90f07588525e80fbc7ff631337baff760512de415b3246e5750f48bfbd5cf2436e656599690f03cf0e50c658eb03055cd69e198e

C:\Program Files\7-Zip\7z.dll.tmp

MD5 287622d84b9e25fb5744e3e3b73f672c
SHA1 d137508c0418d6dacebe9abfa793b0b075ef5344
SHA256 ad96a6f102ae30021388db1b2949ae57407e8f9d8a28257e87522882cd0373ae
SHA512 1c5c20d6fdea99817ea24a731f3ddb3c1ed120b3d3bc201c3d2188806e6d1d1e75b9a0e103cd40e6baaf14976534441b59123c7a1b02660a32e264da07b7d8e6

C:\Program Files\7-Zip\7z.exe.tmp

MD5 ded354dd2f4700a75a4abab464ca0dde
SHA1 b134c3598a14c97f0a0811f859a0eb152e6e5dfb
SHA256 be3ec1fe3e686bebbeff05c88562357d5eb013adee0739a1ff1c782adbbc7eeb
SHA512 449fccebd44c6c3f4487069dd0f55c0e0c68e94bfa20dae32c5022ff9f4a9440e23de0a52eecbea1b199bd8584b9fa48ff71b8427d59db69ae1388d61421af6a

C:\Program Files\7-Zip\7z.sfx.tmp

MD5 0f9675a4419f619c1423f05b1cf384fb
SHA1 5e78a6ed0d5bfb4e47753586185e9057bcadb71d
SHA256 e9af1a3eda368d6910e2d3a8b84bf8507eac0c4f68e2a13d4ed293b91f6b5255
SHA512 03b6791c188b10779e9e417c28cedff30a706f43764233f617d6ddf5965663901eab1a1c70e27dfb02bc93826675595ba3942bcba8a08dcecbfa4cc565f508a0

C:\Program Files\7-Zip\7z.sfx.tmp

MD5 42012c8626bef6d9b53e6bda5caa7f49
SHA1 d9fe86d684623c9ce9e045b282b3dd82981344bc
SHA256 c620098a46327734d1d0a5cdad2f2551e13548ac52eb0255d7f16fae695d0d76
SHA512 90ce58b636c408638941e2cc1dd248c04da061f8b8eeb53ea901dbc451065da887371a5edf60828d7fe31cf74d3aa91855984ba653bee89585e456c6e4af4504

C:\Program Files\7-Zip\7zCon.sfx.tmp

MD5 26fb57a48b4305f5bcd72e7b77553740
SHA1 f95957a24d5abb63b6f2857afa3bc8ce7c1cb2b6
SHA256 582ac10a5f4c16c3eb3e290b8bff8500f3ec571c7afc1898b0badd8ff7fd62b5
SHA512 34e7451d97f39d6d25f8cc429e5784a064e62e3c1673482da31e04ee3c513c44eecd19b81c1256444cdfd2aa12a8aa58a4fad64a52afc03b260863744572e731

C:\Program Files\7-Zip\7zFM.exe.tmp

MD5 1575d46ab261f0a3923a8f7b4c3dc1d1
SHA1 39968abb5a21bce503fb502fedb70c2ca378d729
SHA256 0f96760f4a7fb894e87881081d5617b2c7f00fc945de679518980f0697248df1
SHA512 f76fd55d101c31d1097477e95885c8038b019bfb35f9d1fb5004181d6232f40216dc1e1fede913344dbc2bb7c599984a327e938e070e4aaf8a4c3f83475dd375

C:\Program Files\7-Zip\7zG.exe.tmp

MD5 b1880dc4869f926c0b3c669ddb7b2b93
SHA1 d8951748542cd3756c14df2518b48634ce13bdac
SHA256 3017612808ac60699539434c14ff2e7ad47dc8204ca94079e337baab6f5f28d7
SHA512 4c166df9abdd06f059a2f5de17eeefdb96230ab76596b396e10abcee1bd8adab6531bd02039284fa560e3c7c15419d020f7ee903aaac3047f29d084df1489655

C:\Program Files\7-Zip\descript.ion.tmp

MD5 47a98d83432229cf45fc0fcc29d3314b
SHA1 67467bb0852fea94f703ba6c8aa645817a20b840
SHA256 e2f93af37578da0e2dfe1c4cc26f0944bd777575307d187e4874811a782fc60d
SHA512 e510372689e703ae46da320a231293c366e2effa96876f4752508b7731f02b71190488ed556848e37478ef7dcb0171262f579c1f910424deba2e9b445a92b262

C:\Program Files\7-Zip\Lang\af.txt.tmp

MD5 be148c2901df575431a3bc1d49dc7bad
SHA1 ae817974836db9630f489f35a0b334d4f2f61f10
SHA256 0388172a2d36d345910c43313172e42d394efa164425b98aa80c1cd651491427
SHA512 64301438e4104b592afaf24e6ed062c287df6e347029d085c8869ac5d846a85c79b9fb48866f3918ebd83c69484389d08e90a24b7683cfce4c7f30e273a30e19

C:\Program Files\7-Zip\Lang\an.txt.tmp

MD5 c2defd575a455f6f26a2e4fbc53ad7b3
SHA1 b6c1b1923b118977066101c49797ea31ddf69f88
SHA256 fd9534572a8918e72bf798e4f34d1f51f3ccd030081995d5d15db7dbadda0c60
SHA512 d2d558329dccc31add25069364275cb2aabf91ecc272713c495ede979e8d5f4302c3f93d2e02b40184368120ef3599023a17b6bc517943b6fc78e9b63814cd5d

C:\Program Files\7-Zip\Lang\ar.txt.tmp

MD5 448cd60e6c8fdae3718c3d4becd11863
SHA1 80b3057677d35d9b30c13b3dca406b115a2feb72
SHA256 c6c871bc10239ae69cf25d64d418024fdf2ce70bc1da35218adead9fe837d700
SHA512 e1fa6f8f4e66c56ea0b986d4719306d40f4376562f921a0150d9aaab808241ab0bbad9f386a7297689df79a3c38d3e6018b41493b969041a3c2284aedd7aeda4

C:\Program Files\7-Zip\Lang\az.txt.tmp

MD5 681ba18b05319ca1bb195e265daef50b
SHA1 3b7536a0769e5791fed8408ec498d6201df24528
SHA256 3fa02fff37935ba1c3a41589812c1278c141e0d9801a539fa5b8e0ea75f63ac9
SHA512 9c7de8dc4a8749d991374674b1035c865e2633e0c87253573ed0eea92221d147e4f1b2b86392fa607f6336e2cd4131d64be1e876ee07716724b13038ca8bf481

C:\Program Files\7-Zip\Lang\be.txt.tmp

MD5 b02b385957caa0dea16186c0ebe0ab15
SHA1 0474930099f4e50140da643efe47cb43f23bdd77
SHA256 4aa17ffce25d168ecb40dcee7df97ffbe85e201b3e01b49aea131d1f21e6077e
SHA512 165496eac683fb3dc4ce379a5ee5b7a1c8a2014eb324a665f6d662d0d7d2f84a34b836835af5e0c95dd4ddc3607a5d6c703e9817c9971feef6caf7063b44f6ad

C:\Program Files\7-Zip\Lang\bg.txt.tmp

MD5 c6a4aced62190f072572950dd77ac1c8
SHA1 3245b9c1274b73d4fcb88d8461dd9335a13bc7c3
SHA256 e951d7151f11f3abddf184c6ac074e89fc271cc413a2ee8d17115d5aa815a8e4
SHA512 173780a4c91db4e68ead992f3e810cb640f94b0f73ad89906adfebfe86c1317e3b1b6facc08a5f3e6a00e88941ba8058d5ff5c58519f59c1528901a6a657f527

C:\Program Files\7-Zip\Lang\bn.txt.tmp

MD5 5e89724d6e69fc52f48114be49900c6a
SHA1 98d74b51b25f6e54e257151b430bf71867ce99e0
SHA256 122d84b8f059d2eda3f759ab3bee04ff4bc6619bb8bb84699784453be3862329
SHA512 17b544cfdbfccd7143e930c847973e2f321e11054b6b84ef964eb1f580a1186263447b462bb85082b0ff3b0670e38d6fa93838628fed6b3d0e63fd7f18b3b507

C:\Program Files\7-Zip\Lang\br.txt.tmp

MD5 9d2f9a4f387d881b02629bdbd2907483
SHA1 7d2e94cc9751e246e6509b55b9a863ec4075f310
SHA256 f41ddb2730cbc0836a46479d34b48faac99e7300a3f5a350736e71dab444d051
SHA512 dcaeb7d001faf699e054a8cf993c0050e769312b1becadd22973c456fe9bb0e62a7ec2b61520644939c13bed0e9f160fd407db1af43508a920ded605838ed53f

C:\Program Files\7-Zip\Lang\ca.txt.tmp

MD5 aca36ba2d6b1345345c529d1c9e773b5
SHA1 593bb4db09895563f4516c943b0b4ce036965ca3
SHA256 08a0964d06427d0b76fadeb2c3274e6c4a5c7390fc64698848e7736d72abddae
SHA512 c56cef12d1c80a18dfa09e20d8e5706e60f4b2a4f5e8313c804de2345d033ee9c535e7e0ddf77090356bd49e6e3178788fb336fc2cd78443c1515d77a0e75ca2

C:\Program Files\7-Zip\Lang\co.txt.tmp

MD5 f3d6109bf6626f2d640815de73c8ae60
SHA1 90f83cde72e873a4f553be57b4ca8f1db1f8fc9e
SHA256 465e60c5642d4a572e382439ea25ec1b90fd878f7bcb4760f2d110b7474cce05
SHA512 cbdf87cf8c595a78b7ecc574fce05f116767534813295b13f9bf6414dccff321a24ebdb4c83ee70b5064792e861bb86a361caa796509272f2bca73d9f3e0cc65

C:\Program Files\7-Zip\Lang\cs.txt.tmp

MD5 a56a4f4ccad2f923dc24006a2922f4ee
SHA1 e9d64a1382165366b591e0de6094cd74ea3ef4b0
SHA256 8d347467db37901965e4c769bfc6115eadae2b613a1d2d21ef54f2a579e2c5d8
SHA512 a4a2d2e93b4227bc299a3b0993bafca7d186b70774e44783f255eb31f531551093b6b4707c4919e253621c140c840dbed209d2f5b4a7e87f796af7f890149d47

C:\Program Files\7-Zip\Lang\cy.txt.tmp

MD5 9091929e892f9aa645c809b9b6c620d2
SHA1 a7535fd1568824830a1e4d3aa774dbc40e814bd8
SHA256 94311cc0d32f7a486e139e06ed2d84435ea5e678c92fbffcd27bdbbbfff2d3f1
SHA512 580e9ef19a8ffa3263b285b3267fa2c1a648c0478b56370925b6c9cbb8d60f77eddc02d695dd598e179a3110e23ebd760c7cd9bef54a10cfc5510376ab000db5

C:\Program Files\7-Zip\Lang\da.txt.tmp

MD5 6f2d4ef1a6d5f2f361c3a8fd68b15618
SHA1 378e14b43174d773b69b8fc3c48a66149213fd4e
SHA256 96be9efac5241368953011992cdcbdf6308eca68ca575333610f7b03b7a5ca28
SHA512 489282928251e26b4f1ef14a7318db69eeb4a9b9ebd4624db8e24bed732137c0e680e1bb4dbd47bd3cc9dbdd83c9c16b4f43653a9f62afbaa4bedf26d1362de4

C:\Program Files\7-Zip\Lang\el.txt.tmp

MD5 6d496da69b0d0affa651582ad83cf8b8
SHA1 791a97c5ecf7fa85794b993d31b76eeaf8553a43
SHA256 dfa8d3efd5a5f819324d543280024b3d6f97048622b6fb45b6817d032d7c1e6a
SHA512 68b0727cb9639e12b09ef8fe6c2073dafbddda8407188292b087a6531b6ed6d9148bb65c78d3c2dcd1afbaad234667661baccb84186f29ed313c60b486d56d01

C:\Program Files\7-Zip\Lang\en.ttt.tmp

MD5 c5930155d2c8f6c405840fb759ae964c
SHA1 9424feb8a60cde70df06b52f26ff84ec7eb983f5
SHA256 c79d79acc758a8257e6a649670a3687d921a094001cc9fbe7b8ed7a5c4aeab4f
SHA512 527be813410a224b1008eb221dca8ac274ae7d9836c882bb115d9e7524fcc7d2973ad4ca17c85dcfb9ea29315803f6d2326bbcdd41ff2938fe7044c89a3d5bcf

C:\Program Files\7-Zip\Lang\eo.txt.tmp

MD5 09d40937006bae386f958eab17d865db
SHA1 59e0e853e36956dcd4ffde0c3e6980d879751367
SHA256 9f4450b802ae4624f6ae1f423f71373c07de49ac0de2c0482824510c1cad8b78
SHA512 f1fcbd133faa28e71737b239b699e38dba75a124a61dac679c74786943c843e502fe5e79c716012deb21a1801c58498419cfd48b172363781d964af7a271b498

C:\Program Files\7-Zip\Lang\es.txt.tmp

MD5 1fceb0b5ac9a1fe9de52341a0f1c6428
SHA1 93aa016df3f1b0a2f260c0ab80e65ff18e555a3c
SHA256 1e142926560387fe3ae0840646ad6354f7bb8c4e349407457401f7fc2c57829b
SHA512 98dc057629e7db0527c18171aaa14db287336c3b7bfbcb66eefdba9b8f403d7f56867504914523e6cd635fc23b48c5840d2feb3fc0ec784d1ac5811fd84285b1

C:\Program Files\7-Zip\Lang\ext.txt.tmp

MD5 046e552533012c6f1f657c48db659bc5
SHA1 a951a8515000923221623c08c04c0c5b012efc52
SHA256 50cf855cda50e2644095eb7cff260c134eea8f4c38697dc7b38654ee5b9949f5
SHA512 f3db0027bcc0d8eff2a3b92e338f81a5628a24ebf5d7e53e254e41b1df298cf7ea97eecae7b58a4ba0ca078ead7f36438dd4e4c7920bfeac1a4e9f20bc9286ea

C:\Program Files\7-Zip\Lang\fa.txt.tmp

MD5 832a176a9518eb9a5b317ccd57b3cf90
SHA1 637edac39ab196e4bfc3ca9182c12ff3e2935ab8
SHA256 20fca407d10df31365a2910b7de7ba84213d6f5c3660016c49bf2c777d513a11
SHA512 924d2cc3a55451e551ce423cf91be772062d191beb9f795728cdf18df0b87344cdb0322ca0929942a55c37344611f3031314f52e3c35ce144cfe2986649a068c

C:\Program Files\7-Zip\Lang\fr.txt.tmp

MD5 765c97ed40986e43a4f19109ace224a4
SHA1 7a3e61370edcfeee14df98420ff6affc85c7e208
SHA256 71ced85ae8938f70e773c89d0d1f3f1970a7118bad552728bc5ad13d063d804c
SHA512 3d69a7b54c854b99b8bf8e6246e08c94a040534dfb28f84dcb6094c60e5620af0a025710cf2124fbc942910e1556e4d39d6233e87a1afba860dcb0c178660f2e

C:\Program Files\7-Zip\Lang\fur.txt.tmp

MD5 abd4f5f989b31d113a5465bdde39ae5e
SHA1 7f2a5438bbf76c4c78308455264a10fb4cb6695e
SHA256 23a1b089b2cd697bcf2d6bbefb64b69a0e161ceb6388673faf016d44426bf105
SHA512 20ff428caea94629cdf048157deb6625e18ac77f3281314b4e654c7cc04dab097c83a7238939fd991e87fd01dda4278437e50cb0737f9ebaa4e390ede3d0d5ed

C:\Program Files\7-Zip\Lang\ga.txt.tmp

MD5 1d1a1e5623d27768a346dd767739efd5
SHA1 0a64beda43e4d46a6ed7f96030a81fc6da4f6e97
SHA256 283b1c472e2faf6f5d4550eef1cc0b5711b2e0d131df59f7f65899aee275c494
SHA512 1d187f3f49f8fdace7eebf4dd1ec3261eecf3b826cd7b5898bce911a5e0537d32b999a6c81f1fc2b325c668513b71567f918d68eedb975d00189cec311f8fdd5

C:\Program Files\7-Zip\Lang\he.txt.tmp

MD5 7509bc199778239ac8b297c9d27ef3ae
SHA1 b3cb64cc1fde736279d017df0c598100c029714e
SHA256 1044dbfa2d3749087c3c4fe93cf386c4dd08a2987ce4dbe48ad421a2305f48a7
SHA512 106eea9430a061a48de47bdf15dbd4ec93efb8e8b7979d0b25ce23a34406d9a4938063b5ed1e3228c57fb024ca65d944a5a3d9f862f3b19470b5214df7222aac

C:\Program Files\7-Zip\Lang\gu.txt.tmp

MD5 a0aa78f7f567fceaf426a6f2d76863fd
SHA1 ff82b307c699fa113e638dae417725d544ee4eec
SHA256 9a819cef7a9ff34b1efbccdcfb4fc51a88b5ae767afc11c51f8f3fa5a1d75eb2
SHA512 8b45276fdb7e0844f51ff582b951fb19596749c665ad08f82b31ad5aa87a9c56474ae289776fbd0ef1eb731ab32e5171aa902514a56b05077b52f4864b27dbb4

C:\Program Files\7-Zip\Lang\hi.txt.tmp

MD5 8159ab7cef73dc5b5b9ceff83a93ba7b
SHA1 7fda8f747fa998c1e528ee57e40acd689e5b00fc
SHA256 f1355654a4afba9ae9077c1eb181430e1dfea222238e3ec7cb40d484155b5fac
SHA512 2140aaa789c2dbd58b5d7493f735b852e16c8531a0035455c07e13ddfe178320a1dfd55671d7bdce82da76079956ab24d90993091de74057fa3dbaccfe3ef191

C:\Program Files\7-Zip\Lang\hu.txt.tmp

MD5 2650cbbc71da858381eda1735c3c0b27
SHA1 51e5c1d09bf9ad786135be739d8c49a9718ebfb0
SHA256 6b17c8cc67f7e431f713f552f98a53723b9cc870e374afd80a2b21b7b4943a1e
SHA512 876aa8d0e79b86dbe4ecf6e18914705bc4ea9d5827a0a9fae62033c34586fabf06d5b3fc3953bd38fe6a099b6f2c5d4ed70ff7629838e811a1cfe6ff64fa908c

C:\Program Files\7-Zip\Lang\hy.txt.tmp

MD5 2a17fabf381e367ae5e5b95a867d6276
SHA1 9d01edf1a39defd9426ab576431a7eaed37dc674
SHA256 bd5353bf6d4157846872cb7c3676ed5bd13b28fd843413f351b27164153b2cf8
SHA512 9c4104b3f35a253a4a576d59680c857db70fabb6caff587e729b057fffd9f9f53c7d7d7fe365a0f903f485f0b2175691b8cb8aae619aa42c2a825c8a1b8b795f

C:\Program Files\7-Zip\Lang\id.txt.tmp

MD5 c4b897ec9285fb900f576d04cee67d9f
SHA1 d3d75adbdc81f8eb7686a3746595b93c644f85a2
SHA256 16d6229354c9a0ceece7877c6354c1c7543049a69739d510d1e93f0590bf991d
SHA512 62909c56ab9a87add1b859e0b56844107b317e53fa0c9372735149ab94a5dd888512d4cf464b9bddf3b5aecc5e8d488a2f79d275d08f661850e169a2d7c2316a

C:\Program Files\7-Zip\Lang\is.txt.tmp

MD5 cd71b144bcce995bddeba8167e3e5a57
SHA1 0bbd7cdf8c9cb35f62bc6f8a22cbfe20b0a3fc1e
SHA256 b5167d9273dfd3c6c4a21f47f3c9f1ce47807c9eda54f2c091ff0728253efc42
SHA512 e06c63f99034872cf517abff2cc6995a12a4b8b13a64b53979a6fbe85aa73c0f9f703ad9a825095e4cc202b58275b6b98d1f7875c86206e80136bca9915c3e2e

C:\Program Files\7-Zip\Lang\it.txt.tmp

MD5 5ca332a7515f3870307a720abc45f150
SHA1 72cb7c2884999e44c9c5a587cc944f5b9432d6c9
SHA256 d1f3f5fbf5e806f4581fd5cfaab9be42ea9b20df0865ff0d2157f040e33ebba9
SHA512 8c256e6b6e89d0b5c92defa84364b2c29e52fb7f3c1e363c384554fc3428fb3695a7b792285f27bfb48e13a44248702de5ac043d491fbc99d1de3ee8a95b177e

C:\Program Files\7-Zip\Lang\ja.txt.tmp

MD5 6f2a77ead792daeb78a2d636e28b4702
SHA1 01d121abd09469995b21f7bdbd13cccd4db06d97
SHA256 5e983624c89ecceefa9e78d673a749a20a77d27c1015a45f47de07738d67d069
SHA512 6af0bef3f3f7d62e6fafbe35d085f59dc79857a1ee7255963f4c71c10d6ce984429c932583c34fe78ab9b1d5dd0575bfa6cc3220ae487ffd3993c27d50970eba

C:\Program Files\7-Zip\Lang\kaa.txt.tmp

MD5 9a35d2ea1fa8270a83c3b1ff799f490f
SHA1 a2a439e9e6a7d267cc77db730d439f316fbcafe6
SHA256 2ab83fc99e58a28f9a52254d83da80bbd498370983830f903d741a3a66137bc8
SHA512 760418f477b555b8ec29d74f57c709e96421b2ef00d58adcfb2b16f33f6dc4dc2edd1900767c2932493f1e69212195e6117151938acb485aac8c913edf1a69c6

C:\Program Files\7-Zip\Lang\kab.txt.tmp

MD5 a5bcec741e7a3581cc279a38ccaf41b7
SHA1 9a64af385b95d88205876f03142fc830833e24ff
SHA256 b07a803464534cbacc9b811e39b3e8504d1db7ef81a6a0af81be4f08186fae52
SHA512 7dc1d849539fc82e3cf4098b1d211cc48701552d02a054dc32b359259985042496cf1fd9d51bcf343bcfa3f506983f387a670ccfc2950d2b54e6fd7390a64678

C:\Program Files\7-Zip\Lang\kk.txt.tmp

MD5 d0c61dbeb8c37d9fad24dc0682dff9aa
SHA1 64bc6f990d3107539ecd27790d2e985c4be5b5c3
SHA256 f67c6804f5dec8555637255f3c87fbd3613e128065259839def0f73d0eb03bfa
SHA512 d7f32f827ff666a10fcd50f04192a0374c37b1d184e7952d1dba62b924c6a0df602cf24170eb2bf3251f66877a6af1363863bfab8e7a46b465dfcfa7f4f8829a

C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

MD5 1eed17ada314252d4056084169f35b35
SHA1 87b9c18dcfdd9f1654611ce98f6970f696c6a1cc
SHA256 efe2ff95a829f8f3877ea822119c46e401a77d70acb0c3b5f4344cb8866b437c
SHA512 bd507f2bbff926648d50dbd965be2587cbee06e80297fd85da4474e8400efe709fffd341048dc5520d5273e8a8f6bee3e705f6b864adb1fdba509b8eee1c1135

C:\Program Files\7-Zip\Lang\ky.txt.tmp

MD5 46941cad8f017254f81295fd1d9f351f
SHA1 6ae38aa1d632f02364750bca9a7f4a67e726aa8c
SHA256 6ea32f36a3a1f0631da38411adf9f35267c5e01f66867f5f97d7c9a268d7605b
SHA512 e6131ef483815e59978b7ec70afba120d4e115b3b128d4b33bdb3cd50b57f61bbc20939090cb9df015350548246e11de3c87208d06b6f5ab5f2851ff64431495

C:\Program Files\7-Zip\Lang\lt.txt.tmp

MD5 fc362ddac11bff8ec457162d0b5c4731
SHA1 3a1efc8bf7ebdea028c63983fd8fffff66c52f6d
SHA256 140f6a4ea5574cd40d38fb8d511f3ca6d3f0d16fd325a5297bff7a3bd45ad753
SHA512 ef71b6ab4dc4337779f3847ada9aef5bf2ade0e2eaad377f1b1b364dc38f09ca765e9e74b0ebb0e890ab5bd3ddaa0412869f62357961c77fb62bc88203ca23ce

C:\Program Files\7-Zip\Lang\lv.txt.tmp

MD5 242cfdc7beb8296a7a95498d9736bf0f
SHA1 25e7c210162b9abbcc8298060a22375da0a496fa
SHA256 9e5aed8e2c690e6e4aa70206f82d0cf4462044b8ab152a4d439b630f550ddd71
SHA512 a61e09727f7e185d8fa4cbe1507048145540fb76ceec50fb468dbedf816ef39c64e57c278702e1e07199ad97e625656571a5e36f601c6b9a1a3f77505075b23b

C:\Program Files\7-Zip\Lang\mk.txt.tmp

MD5 a80fe11c679d7f3e6178d01b9cb63b84
SHA1 329bdfd40af491c24cd9981fbf1be40865f05ec2
SHA256 f4f3d316a5fb598584d71055e62e8060dd29e1e2454013f5c9db0c3522128d5d
SHA512 d1c6973c97561a1ede90bd0bf32ea9ba99bb49cc8df61905bb35aa977b11a6f5873171ec54c1e7e1eb67c1f955b644ada69c99a7320d48d94d98930d6571e144

C:\Program Files\7-Zip\Lang\mn.txt.tmp

MD5 94061a9cb27b4afaf5e2a297c646222a
SHA1 6c20fb7d20cad2c2304e16c63780caf5d588e64b
SHA256 7b3811519ec10fc6f5812c0655b2c88207c7296cfdfa01607538efd0e0f8dc83
SHA512 1ee667344d14f6ac71c1b75758f41e755677baeb8a7d8d43f46c6f26f7780bf8072d4488a0cddc13e6fcd746c79bd61cb36ebd55e5730d8e495d8c3fe35a6bf5

C:\Program Files\7-Zip\Lang\mng.txt.tmp

MD5 36fd6af73d99d36d70b4de5002ff8e70
SHA1 871e285afcb13883d4bb647b28e369346e3f272e
SHA256 893ca8c03f75261256a5809d91e9f682a3d6c0e21f54775f73a74188de830fba
SHA512 dd07df3d6d53d2e5a0591050cf96ea9f3cdecd3a25dd48b88cd18ed69709a29fbf1df9e23e8f4dcbbc06a0e2ba7e4d1c46d4f0b32d67e6de99ba274ed17a96db

C:\Program Files\7-Zip\Lang\mng2.txt.tmp

MD5 aa8479aaf6a2d975058a552495402a26
SHA1 0180f24cf0913b47ba08bf8100de1169ad525159
SHA256 ecdec834d6b45484c76b2f8f4ac248ccf48442ad5c350d8bbc07dfd4f3690935
SHA512 927542ae54217b7aa07b0a0269cfe502c203af1aa384b76a1358619c3a8a9a40ba4a215288dcc3914c3299183dd2e7b1c0e63e6bacf14f103dd9ec9589d0662e

C:\Program Files\7-Zip\Lang\mr.txt.tmp

MD5 bf8a232d75cfd4641840047f474b1a58
SHA1 27d2295175dd77b75505a0e1c9c2793cb9b90c42
SHA256 261716073c9163a93389851ede5d0b7539f45ead254d7d7c21f04a8f2e4979a9
SHA512 04808577aeb26edba6d48c02d9cf11b3ffc8013d8aaeb97a9c36a4e62b1b0c4ffe8a89e53ec779bb07382895e49482974cdf261ea5228d3409a6d8e24e5d55a7

C:\Program Files\Google\Chrome\Application\SetupMetrics\20240508122721.pma.tmp

MD5 f860ad3fde1b2b6bad4285ebbd7d0cf3
SHA1 57ac1ba43e8f1d59dc54c88246d677f7e8ab2061
SHA256 893477a099c344e8631b0f9029d2f0adba50b8a45393b945e41e82258838e066
SHA512 0dd9c4b1b8edae53565c3a5baf6604e75850cc5dd442bd30eaea2caa24aa84784de2e783fed9c872843fc93994ddafcae3c2e27bc7ce3b08cc0089855891db36