Analysis Overview

score

9^/10

SHA256

7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332

Threat Level: Likely malicious

The file 7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332 was found to be: Likely malicious.

Malicious Activity Summary

ransomware

Renames multiple (4914) files with added filename extension

Renames multiple (4709) files with added filename extension

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 00:35

Signatures

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 00:35

Reported

2024-06-14 00:37

Platform

win7-20240221-en

Max time kernel

150s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe"

Signatures

Renames multiple (4709) files with added filename extension

ransomware

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\Zombie.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File created	C:\Windows\SysWOW64\Zombie.exe	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	N/A
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\visualization\libprojectm_plugin.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\America\Chihuahua.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Niue.exe.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar.exe.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\js\calendar.js.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\cpu.css.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jre7\bin\kinit.exe.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Knox.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Madeira.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Minsk.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Defender\MpSvc.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Media Player\it-IT\wmpnetwk.exe.mui.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata_5.5.0.165303.jar.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\clock.css.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mousedown.png.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Windows Photo Viewer\PhotoViewer.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\settings.js.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.exe.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Journal\InkSeg.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_thunderstorm.png.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_hov.png.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\America\Anchorage.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.exe.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.exe.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar.exe.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\gadget.xml.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Journal\Templates\Memo.jtp.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2388 wrote to memory of 3044	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe
PID 2388 wrote to memory of 3044	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe
PID 2388 wrote to memory of 3044	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe
PID 2388 wrote to memory of 3044	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe
PID 2388 wrote to memory of 2560	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	C:\Windows\SysWOW64\Zombie.exe
PID 2388 wrote to memory of 2560	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	C:\Windows\SysWOW64\Zombie.exe
PID 2388 wrote to memory of 2560	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	C:\Windows\SysWOW64\Zombie.exe
PID 2388 wrote to memory of 2560	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	C:\Windows\SysWOW64\Zombie.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe

"C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe"

C:\Users\Admin\AppData\Local\Temp\_.arguments.exe

"_.arguments.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_.arguments.exe

MD5	cbc9e1b01be1fa3082b1888736aaebfa
SHA1	ac29827bba8d7bf9fe63eb648a232c3c60a61115
SHA256	e6f34951a92a58450945db9a3712f42cf3d9cda86f6763c0bb0e1b596f1c9d70
SHA512	4bc2a81878051429d2b8ab263824eed52b342f56626ea7b0ddebfe509a220fbf32c47a814a6f62d7d0b0f33a4a2a101124025da729e59f0b8bd3fd29cce29dda

\Windows\SysWOW64\Zombie.exe

MD5	ce2043d8e0621555c53256a877ff3b4a
SHA1	be7b2680b37f3524835cda788ccd3654c5f7160c
SHA256	80be9d5c3f559ffca770813eb9e2a501f6b47142c96b5ca6b6e77d0384d0ec2f
SHA512	d3a5cdea77c7a87c55c349ffa64b4d76d65a458f1ba76eeb9e24926993e5dc06a62933f3094b671441b80b11d91f8c4e02870c3c580fb62b18d6aab2b6f2407e

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

MD5	7717108f725e852b3a3e17d4d8aa6de6
SHA1	a093922ba90b994e76db954b4770ce97a1707115
SHA256	e38df47fa17464c4e8e02e9a3fa89c2945dde257ffa468c441ac09111f3f51b4
SHA512	d83062870787e2162c4f7be63351540b28103518ff5da6ba337bff9ba85e0a6cfc45770e6c6ea7de687e55d45af96da03b9be7de85d84871699b254bd633101d

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.exe.tmp

MD5	90dc2794d8ba9debe6042c5760ac5c07
SHA1	13486e99797a4f256b2be12485dd44749a31f232
SHA256	d3258890490029383768eda937738c81ca1c98f4f8e1cd8dbab0e3a613c13df6
SHA512	8f46125c4248963ca9484d501f7ca88a846fced153d3414a328dd663d7bb324e85f5956531c510919f90d8b504f5b17106bac189f1ae01f09e5603e2761e2045

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.tmp

MD5	ee613132ee72ba6c97980f481a9b8a4e
SHA1	1f4ad9e85382d5faa7d8dbe7a48b1a9cf41302c9
SHA256	13751c14ef7890f75741edb20b2548dc0c8fd6e514d1f6a85c233d7eb2e4d1b7
SHA512	c6ca0ce87810ccd23cfa4f5606434599dfca3eb998d36a567268e796fff7d24e19a5ea2a2d1b6d8d3612bf8158ce5fe5de0eb17425dc2e01ef06deac7bb41e8f

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

MD5	62b3e8d0f0dd9a743e58c6deaed414c4
SHA1	5f88753af619378ea586e0a20bffbe3216e1151e
SHA256	5831435e854597c778b7d1f531a52d7c34a7230e6b133195f29b9c430ab55a26
SHA512	7f13769e25b157928ae48a1b09460b05643c5e0233d234664cfd1c4e3c4aacc104530f368eb460bbc61a2e2f85d6d2d79d0f747e0b72f444aadd4fb69e20d0d1

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.tmp

MD5	74b13d053f5e7efb3573f70261c91872
SHA1	173c4b9b6fecedc52e479e4b7fdb1fae964dc682
SHA256	bd1b976130a4c3b2c3a1f83464c6547a3d5e26976135a948f482f43bb8717e8f
SHA512	9a8bb22fb17e6214d900c0228ea77b4b1b447dc6eeb3721ad546e503572a63179a26d0a20c818e62498b7e69558c266c47f07e38ff9c8bfa16a3b7f00ca70381

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.tmp

MD5	d2c446a2607c0f08fe05a4e14bc48522
SHA1	779fd79289feda43e6ad3bc9aff8b6d9c5eeeadf
SHA256	ceac2918b06bbd8fc7f2eec8d73de74e8c11320fa42c9c2f0a54362a3bb2634f
SHA512	d771de5344e02faa25f4a1a7a9627af38d8b90afd442ce70eb1de1d5732a80a3543df555568f2ea64083085a3aed5496a37c7d1a08608d403b41a287a2c2d89e

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\PidGenX.dll.tmp

MD5	497aaa7058591fea61309217a4ac7c4a
SHA1	c85fec290c8252a3690b99e5b602d3689ac1e690
SHA256	1a672991b77e598c1b97132a58098654dbcf26615f10075950e840fe489d962a
SHA512	5b3b2011f401819a0b6f5970fa4a20352faf40103d32704ae0661a87b83f7c4c0c90c7b9a7ec4b355b070d2faae906f83a55fa860af00665d22a49f483979a28

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms.tmp

MD5	532d0023b029850ad5c91f100a078988
SHA1	c8ffd7e50a925952e1e2372d500e84487e87d4d7
SHA256	c0dedf04d7ecba1c3fed2ff78cb734e9179ae7b87c0245368ac4120447dee8cd
SHA512	db09418631763ae750b119668c86dc7f76c93bfb75f5ccfc5fbe3d6538bdc37f8e2c3d737a95c3e635c07ee0fdeabf0f3e4207e7e50556685399b9e433c7d775

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.tmp

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe.tmp

MD5	35f49d82cbcfa3fa58f7a6d8954020d6
SHA1	b549a8956f0a283a029bc532fb5a3f7112d38d43
SHA256	5513142b1e1b461edd0158eb7caabe17381dd70e0bee98000ac3dd9e0534a269
SHA512	8883f0d4c9411e6f070a51c7018fe1eaafbc2a4f221cc68508f07c51e502c7a501cd015c763611f295e92e2d784e93a2d0263d0964327ba5b1fe74345c86b7f8

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.tmp

MD5	76d3b5f91ae6cf6d21bf88bb99e9dca9
SHA1	a2a46f512d214b8780e68cfa5c67f1463451296f
SHA256	cd881933352658a0219a44acc4d53aab60901bfd658fb7bac0c06a8c7910238a
SHA512	5ca7578a617c9cbc568c999a6a33ac40933aecfadc397bc148909fe006c4a953963b12f0ed55e727c18d07f71720836597ba2727ca23f06b07463d365214cc9b

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.tmp

MD5	84efb1f3f26941165da4394f52c2d468
SHA1	966ebe3d75963526ff9e103bccfd1f9528705ac0
SHA256	019f24a10492aa2c92d849091593ea46499742b24bfcc193b8e80d48907a12e0
SHA512	c22441648d7984cf9949c18285b67d0e49bfc5c40fa2098beca7e96e8034492daff219f6c47a86c363072c0435b45bf91e023a8cd664b063ab2e70e4da7a6d7d

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.tmp

MD5	d0cd77cd2cb0dee9179043b66f53646f
SHA1	bb46f4a36fa6352070423e642cda76dcda7930ac
SHA256	a338d3a59658d45c9235812508b973722b519c13d41329249dacd882e73989f6
SHA512	3b2421a5a8e8f7188c657a6b1af2fe5e8acc84e0f412e9aa31c3e939cf90bcfc3b821c2a240a0732d26f14c520305faec34929a4ab405a1a2fcbf81748dd02bf

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.tmp

MD5	d4c9e6c8f6403b44b5870540afc96151
SHA1	65ab2cb72e476a8805cb71370226375f432e3f71
SHA256	13b69862b45db35c4957b14155eb70dcd2f0740c7e7ab394338b6f2edbaa74ed
SHA512	2b78acd2042f38ef89612e4b5918fbb2d213c4b867a56e687bac1ab2c41c6caf229ee20878e67363c55e5b0525dbac3c03a9c31b909a6b0117ba188f3a5f238f

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.tmp

MD5	fd469de27912583253237094ea5f20a5
SHA1	9d2c55d2b8c03f47477458673b9715d11eeafd90
SHA256	6e1d38b2474cde5b41e8c9a68480ee47f76054fbd95d9f2d1338007b2a2da35b
SHA512	8c6ed4e81e5d05fa82b3b00807d75d223a36f898cf7a3c68391ac602e4746b2c8db8c7d26eba56941e0617426af9611e14f1a9c7d81822a3e041610f6af6a619

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.tmp

MD5	fe31e1cacd74900a728fffbbe4c556a7
SHA1	c10375261d942783c5a69212c083ce7d26e0199a
SHA256	88d60a4bbb6749aa88fe3d1b388979137834136e997b9a70bbbdf88a1f965340
SHA512	31edd7c967268c1df3dc1bb27bdbc6e7c41a7af09351143fbbcdcbf6e93b7b0cec1ad7062c9b10450044b316425856f6bb09720f944296e5b884dd89ca2754a1

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.exe

MD5	73b4c706424b61b22134633733dd951f
SHA1	53508b22d45bf0cf439db6f9c7ed95ff8b54e356
SHA256	acb1070d01a3e381edf5ace27b3c8ff76b2c73c900071aea8ced6ccd4488cc4b
SHA512	35ec482b32d68165952e98e3cfcb0d00c34b64910c5aec67c7e21d53be6c6961514ed0432ef0d5274f5d5895ede5713b34110aa51140cb6400f94db5e06b42f2

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.tmp

MD5	2bb2c1b5f67adb888fe639cbbc601dcb
SHA1	b01481b6dddfd693c3472305fca7041cfab8f6c0
SHA256	149607ec7de1c99366eeef152f9d28f05668a63149eee9753d087bcdf6342ae8
SHA512	f89ed74737d704b2be1146e4f4c4c83d71a00ece8e72ba2bc444357f2937d9f670c7a6cf6e840db9787c7154168c4e58069e09c790c040eed31109ba10c4eb47

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.tmp

MD5	15c25014bd762f202ded213c6cbb185f
SHA1	6d454534b05ac16515d9565803d52de62ee0cc94
SHA256	e02fc97b6c493c0f841886602694ad3167985bc575fe415f7324292011efc97b
SHA512	b7d6396970172df4a15c3683c8428d7ecf80bb98d534906ba38312451d4c21a8c3378d9153d6166ef5f5d7d2a1121ae5ed4a29109d50d7c35e3946438236493c

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.tmp

MD5	63304cbc353cf7606e6e695dce6af615
SHA1	36b432bd0b299ee1a282ea1ef1d1c23959c50ef4
SHA256	1fd089c829369820ec714ebbc7db189ee0e927b7cc897224f9e957201e140f37
SHA512	c26a511c40d45506583d2320c454b01b4c6f3022b7dadd747e973d9eebaaf67389bf45ef6f7fda24204636c8304fa3888801be9b02d4d62c1ffad2fc2d2c1051

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.tmp

MD5	9b418ef46d86320a84e9423bda5a3909
SHA1	2803b6c152d7fa141d206da37b15ac30d8673f33
SHA256	cb40d2692a471bd581fe3c8c185eada278b698a9a06369d02af78cc4c2f4fda7
SHA512	93944713ef726e16a2d23fbf4bd853c30ba2120b4f2e9bc9daadf735c32d6f6eff3328486c48e86164b5f39d7e15aaa98a9ef2fd020ece12a5e839f55ea7767a

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.tmp

MD5	d286012f8c43b68098390b86cadea6a0
SHA1	fd9d00b4116de209a7315f32ce9a62a5eaa25582
SHA256	2bee8312e2fe434844c2ec247aad4f2b451088c50c32a1878648c1d4865f94f1
SHA512	2bbc8d3bd3ed7ad1ee83600be218fb9edfaf6235fff849473c33a92636cb7af652d6aec45e190596ecf66c3c1afc6b47d65eb2ee35edef8ee2eafb30a05f67a8

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.tmp

MD5	1181065013ede744b9b834b26b14cc09
SHA1	8d6cd42c530241f8c59fe128ef05067178101fb4
SHA256	23c620966c0ddac4765bbf4ba8e986407ca43114014ffa05b5499b472b9bfe91
SHA512	4dea698c819b66b3e78abb55fc1ae02984ab9d9e9b28091defedb9b176279bc103f627704f9aefcf07770008ac2782b41d6fc9ff4937275ce1086d81796ad794

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi.tmp

MD5	ae3ec79407b51914c20046c9835d36bc
SHA1	6230f0cf9e90b5afa8489fdead2b14e3830a1942
SHA256	bd1cb8f82141441777cf9e999f93c7d30fd0f099150ec8342b3cfa65183b1ad6
SHA512	67b7eabfa84a90215a9a08c10dbf1631b1a1e44f94011f2753f6d61bfe25dddd5be0d0ddd06beeed5401f8ef38a4b91eabde5c9adaf5d8a6688daeb40f61a1e8

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi.tmp

MD5	c26fa0bbff084ad705e7f72d02cd18ab
SHA1	c63f06958385e0bf2629a4278f566ddfc3e0cb68
SHA256	48f8c4a9b5ee93721395d4b9b691841085a05147d1dbc7b299b5e7ab3e18b1ea
SHA512	8a65112f26d4da85c3ee0f847049c9e31333a496f7423722ba71dc961dc9836eb9d58fdfba74f2b7449febd964198a398f6cc4e4c1b545bf959b88b5d8f253d7

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml.tmp

MD5	ccfbf0200cc429ab8f2bbc8534d0864c
SHA1	4796de1fb522703faad086bd029e64b47d68e3e7
SHA256	005af9e3c2b7e8899f83558bc7af9a19acc0b0aebfcf20a034eb9c8a5e87044b
SHA512	554cdd315c6c5bde6fcea8db8bb9cf279cfd4407fbfc0fc16725580afb948e2e196436fa4e1dbe6a5d860b5eefa0a0db2751bc5458d3462cfdd3c686f7047770

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.tmp

MD5	8c273cdbe79ee9ab24e785a6cb5d3bef
SHA1	bd5f93d249bc28040bd05ed6b9866e9fd05ab185
SHA256	889998915fc0d1d106ba2516c484deee13a8ea20961f8f8fbcd204be7de68d09
SHA512	7e7844c953c41f0e102e7134c5bbdf725f90eaa2e3bf7068bd2419d9b5c7ff5cb8ecb9f49fb5c99ea08d932c646bf99b10ef6d6a9d571a64e217e543e98651a6

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.tmp

MD5	88f9bd88273a2e3a34794897be8557d2
SHA1	0d10dec0d017fd74321cee5fc1700055c5ae7dcd
SHA256	cdf9168058c44e9a397d2189cd30cd89e349e518b446f4a415195a71bf4ff3b8
SHA512	1926ecb93e6d571ea51e23e8c2863afc9eee9692b46749e1e89050914c45af31af8e5ec16f877d684aa268a68fe9a17ab22b1a953bd8de9dbaa2ab8334450e15

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi.tmp

MD5	93cb16a21b8447b7711847e2921592a2
SHA1	65acaad34889306539606ebdfae852df68bc4f69
SHA256	e0591da10c82d07086d2cd6eb6984903db982787dcbc67165b4cbf81c8de57b7
SHA512	d074726e812dc34174fea101399bac0d119eff0d51bd1b8b7e36e9d65929a66911fec6020dbc37818168c12bb2d39024ba01cbde176c8968b3bc86ec57b679e4

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi.tmp

MD5	8adca8b3ed69f2d8785eb4d3ec7c2c94
SHA1	28ba5a6da6de320392e8f7b92bf7c943bf1fa43e
SHA256	5083a110158c7255d0b8f2b406530f25f72def79d9287b00265339cf5ccfc9f5
SHA512	7f4820606702ffdcf70ae05bd87457064647ee975df3e4368ce052c47dde49dabe724378aafaa6ef63d27fbd9c61fe8f39e4bd86eac26839208d99e5fe6ad9cf

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp

MD5	d8fd28a418d219fce9d8305036fdd28e
SHA1	182ea4c94ae6bb71ff65729870d55b24a7d0ade9
SHA256	9eb75353f2c0c0aa2c76773f5a7842b64356c876d7e3ca8d6c910be8d17b2531
SHA512	cdd527267bd710869c0251fd35f10dd5805dee0272445314cb5b71cdf459590eba1141bcfebcc55df7597f8e19af431c64e470cead33abd52cc2d98a4b18f86f

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.tmp

MD5	3d18515fe114eba84e27a25cdd747f99
SHA1	4935f5a4591ddb400f0a5e841f7195d25546300a
SHA256	558b2634804563abb467001d4eb8a5975926920ea9b64d348e5658cae0c6259d
SHA512	6423a4dc2567c52e83f77af8ac33105a5d16db7a322c790cd30f7bb57fd6560a62315e2b84aae07c6a20a37da196a893c456acc43b2288853e9eadadf741e892

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.exe

MD5	a07036bb74b707787fff99eeea76e77f
SHA1	e4433935e72a7418c287f52ace63d9b058ffebb4
SHA256	f3a3d08fa3719d6dc721f16c947f63abbeadde150a90ec8bcb11933742ba279f
SHA512	667606ac4890dc9ac3d5f88aa05c3d2b0d049b279e140dfe816f12c107b44b37b2860e8d5b4b232a73e1096a6329c6863494cb588c1d92797983145ccc4a7bdd

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml.exe

MD5	c3c08d39be5a0ad09a4ad245505098d9
SHA1	7d7c6bd5ca6b8d4dc6a66e5d2dc3482c8a5ec38f
SHA256	6dfe92e82459d5aeef86cd38c7899c22ecc75009553287506243c90d6833a587
SHA512	99881d02ef1b7045a3b57f99beddfa829be311614d720cce433524bded3742f59b41fd013a6d83d046790d608f38c2f8e7c8901982e2fb71b4d26da822c72576

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab.tmp

MD5	00c236d5bbce564748f6410531ec3963
SHA1	59aa0a90f35535603c8e079a56d49cf6090a04a9
SHA256	774298907b9f12e6d90554a4eaf5a464da17d13e1d87e77301ab6df812675a77
SHA512	fbd787ec1a710383d38a8bd2109a7c2e6cb70a784d4e409e8d9d1dd8f86854ed2590a726b3bdcaf0384feb5ed76394fecf547cf149e3202f0edb93c287471d23

C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.tmp

MD5	87f60d208d001106b8361c022ee52931
SHA1	1cce856b9b0f365fcc8384f542835b6f16814bdd
SHA256	12864689ae23d0cb96c7d593ef5d94dd7dde6645f3b92311044884a002250e9a
SHA512	e11d3e93316a419235550c88190dfd586b6513ded4d377d800e66957249fb84e8cc2ce8f2b47615564f3dca7617a6f4f617d7c1629f4fe717126c4a5b1d91333

C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.tmp

MD5	8f87c4fb100472c84d99fc437ffef243
SHA1	1e0a01c0212a163d26b613594d96ccbc2ade4378
SHA256	027b5205f165a277f723eaa3c07b4b60504e73458185262d804f93ee22e0d18b
SHA512	4557b92843f87c7a6c694fa7045f6ac69402325d2ce21d744b5a0b41ec951768a064c0a7e250982000afbe91cd1470bbf4cf05b7109115429441453c60f04eba

C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi.tmp

MD5	b627d89df53a07e57909c5b128b596d3
SHA1	f8b7ff4f523db0518b189bfb9fa7e2be044ae7b6
SHA256	180c4a3431adf8c2a531ee4f8053e45ff9e14069bf37005eb68919bbed79258e
SHA512	6512e1352ddcfa238aa582d9704a9c9817006c06e94f488df6c5a60f77bd22369b26d7c94bd18a9ff22d1541a64524393fde0888609fe30abe2efd0f6ccd8fa6

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll.tmp

MD5	324f5a318813f95a85c03ba57339ee47
SHA1	b00d4ad37a44bc9d2d7063e8520f1d67ed0fbf9b
SHA256	4adc7ea3f568f39912bc3ac3ada7b69f88f65ec3b2cea4414ed0690e099a9f11
SHA512	3e61456dda27ea7a8b7a82a6e3d6746b096f47c25c04fe8c734de7e9b7fc82d061ad63d4c474ab41f6157e1168544a5bdfd75b08599a16f4aca4b52f966b0e91

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe.tmp

MD5	e151e5f5e3a743a5329fc0336f8cfc5f
SHA1	6d53549e0d399a20bad78e28d5d335bceb3cc8c5
SHA256	9ca85db2533c2515f76aeb7e787ac8dbf3ed95f1b639f5dc39200fdf165e2d06
SHA512	2963ceaf9df154126b717e7c4277784e8bfa5648305230cb41269a3e13a24bd0424345dcb2d9d143405bcdf0e771e7c0bc3cd8375ca89c3cb612d3c57100f396

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll.tmp

MD5	aee59839d721acddfba1278b1a3f327d
SHA1	c1fe36a6525d5d50b421178af6b7990c3b2d37a4
SHA256	12dad0255450abd0344ad5e8b2b81cabd9ad718f4830cd4d083eedea6a805dd7
SHA512	14871a8f9dbec8a430d86929b9141fbc819869c333a70a60f217c0ca8e6bb37f6af9b81ecd2ae889b86323b5cac98aaa8c44efc87c355ba1c9539831162e5056

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll.tmp

MD5	ffdacaf182d5f0f0bc5cc1ca31bba1d1
SHA1	17485de754fb2d611aaf9a0e4ad6e9ea3b542906
SHA256	f873dc2ca5072abab3422647ebeb878dc22e183c564f4508112b7d09ab777f7e
SHA512	0ec43de9c122b8b3e3805d8ac11f7e48d670e5b8dcddcb48470dceff5082e9955eccba82466e4f3c62c0b2d36faf27790e718b6f2f8be71ee436c4c311e5088b

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi.tmp

MD5	a913fe85f696d9ae4072464683b2bd33
SHA1	dda6f2b11e55276e7c6e517f42725f8e109587d2
SHA256	a875436f49a47198abf1bad63622ea4730eaa7870d58824f1b497347f4f08a90
SHA512	e8679362f70b9fb0d327c909c6c7a708230f499560874e7134f5a75a0512b276d149664cb0abc3a2df986cbf67ff97fb8d51b5f39cdb55401ddcff90bd070f27

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi.tmp

MD5	2ffb4da982af5ccb2171842f6f720eee
SHA1	b4987f9180fb0388e3cd38bf7a3f506a16c881c2
SHA256	c292fbf4b4c742a66d8a41da6d7d0571fb3fb03b04cad0accc75126c658d5f4e
SHA512	76e1940f1cfbf7bd5c85d690b88d9f3159d31943fef6f3121f3098891ed8c441f5d6bc6bc655e7c770504707d1541011d13d5c95f15068ce773b04e02eaf4b3a

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi.tmp

MD5	9d7f6c7287eb32186a8e7e2f4bd26bbc
SHA1	1b41ab5c620f1d66f73135c477f36abae6615f38
SHA256	83ac9ca1d566cac47df37b6ab6f6363e6f85dc67f03820d60873aa831be31a5c
SHA512	3ae50d7868a60f006e06e0a6d32fbd47969956f5e3e62adf616764d3386b7b7a1e8a331ad2b1d7b889a1fea94bfceaf02b4146ac4cf15c0f84f805d1f3a34ae2

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi.tmp

MD5	62d9e9c10cd95c03e7e872c958db737d
SHA1	7dd774d8fd02f6f78bd9c39ce57adeb30128fc62
SHA256	1eb9d63fcf4c40512bfc28bfde6b531046e835ee2cba83bda3c13c62ca82fc76
SHA512	e7da270b32a4edea38c6f9fe204527c4b97573c3b99cd74c73f0989579efb8427657f4573b9632657efaba8e8419265eb6eb258f6fe228430170e4eeec2d2d49

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\osetupui.dll.tmp

MD5	18e1db5185b25dc956652446b6983fb0
SHA1	33e5b69250c751b7c24b51ef394f4cdbc899952c
SHA256	710c52eaff8eee43528588f56bc5e761b24bc3f5f082f5d6fda6d54e699f3917
SHA512	028cf8b947dbeb96fd10e704d3e2d2018a5de3cedbf0e777ffd0c0fbb143e1508e9d6b662c4b92ee9e5b4c10fdaf8eb1f97d0e865647f9fa02d3804ddb5a9b64

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm.tmp

MD5	9f6e0c9a894443b62759b91ab7ea386f
SHA1	2f3e2187c11fefe7e9266a6046697e2a6c4d1b8e
SHA256	f0715abc8f32e62478e4eb090dde7019460694f286901116f32f0301c9286b2b
SHA512	5ab535b190fd3c92b83766f9f58be10ecd2194d452dec084fe600308993dd02a5768cdfa2afbbb1644d6625ad36627259f85d0e1b485988befa30441cd6bae6f

C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.xml.tmp

MD5	c52bf5b54677c02b95518c8e60ebfa8a
SHA1	1eb2c781d2b42934ec4e57b249fded5427108cb0
SHA256	307754e74b8e47ad0e1f17df28023132ab747038988fcf23fe7fe76b563435d8
SHA512	e6dbb42d357c78122dcb2d75f55bfaa8b98be21688dd7bf578a6cfe1032371f4cbb790f4754736bad2197ae2bf17da399a1cafa9955a664f89680f0fa353bb80

C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUISet.msi.tmp

MD5	7c600300265b8c8ae3a42de01273699e
SHA1	74bdb1a98519ae55f4a010149658475c756945ad
SHA256	1d106f9b109795737cd3f2a1c1787e3703221782e2b91bd6cff92bad7dbcb0fe
SHA512	b3b3b0b784d605f4ccc45930458edd24ccec7fd28e842440b5160bdd4eaaa6c7af03f18e8ba54a6fc6ac6219d244ee53c9b7ebe665b9f8806e76ce2802d89ba8

C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUISet.msi.tmp

MD5	7be47098aabc5d21bb7b8702d3502bf5
SHA1	96aeb231d032a88cd51fd838b6248ebb6ae70a2b
SHA256	06921d7008d712a229902a9bb6a0b01ffdfdf54af67944895198fedb4350e641
SHA512	5f9639dd492e2ed8f71516e779c040b8d87854cfa5fa72714ca321e2e6768f3b9066ea3b309db9b117d11ee8ab0ccc76c64252ea01489208da03074abbf31080

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam.tmp

MD5	9ac6dab92454da526193e4a4403ad00b
SHA1	37f6f147b59e4fb5c4d9b35af669f5765c1d6d5d
SHA256	1e792709618f4fe5139edf614caca73dbb1594637beee0e52acf75e5090e02bc
SHA512	60d61be1da14eff65eb456d7a7de0d4c7905a3e414374805005990a00cb6af01963c3c5288952976febc6ec42413fa92dc549d23e2a258bf2bfdb9d0a3545902

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 00:35

Reported

2024-06-14 00:37

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe"

Signatures

Renames multiple (4914) files with added filename extension

ransomware

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\Zombie.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File created	C:\Windows\SysWOW64\Zombie.exe	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	N/A
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.SapClient.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\OSF.DLL.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\kn.pak.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2356 wrote to memory of 1720	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	C:\Windows\SysWOW64\Zombie.exe
PID 2356 wrote to memory of 1720	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	C:\Windows\SysWOW64\Zombie.exe
PID 2356 wrote to memory of 1720	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	C:\Windows\SysWOW64\Zombie.exe
PID 2356 wrote to memory of 1852	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe
PID 2356 wrote to memory of 1852	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe
PID 2356 wrote to memory of 1852	N/A	C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe	C:\Users\Admin\AppData\Local\Temp\_.arguments.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe

"C:\Users\Admin\AppData\Local\Temp\7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

C:\Users\Admin\AppData\Local\Temp\_.arguments.exe

"_.arguments.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	91.90.14.23.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	43.58.199.20.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	65.139.73.23.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	28.73.42.20.in-addr.arpa	udp

Files

C:\Windows\SysWOW64\Zombie.exe

MD5	ce2043d8e0621555c53256a877ff3b4a
SHA1	be7b2680b37f3524835cda788ccd3654c5f7160c
SHA256	80be9d5c3f559ffca770813eb9e2a501f6b47142c96b5ca6b6e77d0384d0ec2f
SHA512	d3a5cdea77c7a87c55c349ffa64b4d76d65a458f1ba76eeb9e24926993e5dc06a62933f3094b671441b80b11d91f8c4e02870c3c580fb62b18d6aab2b6f2407e

C:\Users\Admin\AppData\Local\Temp\_.arguments.exe

MD5	cbc9e1b01be1fa3082b1888736aaebfa
SHA1	ac29827bba8d7bf9fe63eb648a232c3c60a61115
SHA256	e6f34951a92a58450945db9a3712f42cf3d9cda86f6763c0bb0e1b596f1c9d70
SHA512	4bc2a81878051429d2b8ab263824eed52b342f56626ea7b0ddebfe509a220fbf32c47a814a6f62d7d0b0f33a4a2a101124025da729e59f0b8bd3fd29cce29dda

C:\$Recycle.Bin\S-1-5-21-3169499791-3545231813-3156325206-1000\desktop.ini.tmp

MD5	c3391b5544ffd9408eff4a197ea703b5
SHA1	36d16d88d4ec7c8d4a8108f3fb5b51cf528a396a
SHA256	eefc5ffd6c84906141bf63b7ccd79c384dc529f678d25265ac0bc60bb8491b31
SHA512	b1ed2c0d7de0262c35d0aae42416341c0da02f07d9284a83307f405656b439151c4c1110abc4832d99efa7f779f2008063f519a978647ca228d109c996cc62f9

C:\$Recycle.Bin\S-1-5-21-3169499791-3545231813-3156325206-1000\desktop.ini.exe.tmp

MD5	3c5829ce762375425edab4d685f598be
SHA1	d5473fcfc94d24430fb948600737720759f04027
SHA256	610a0f582ef1e104a3659674ce8c085838ce522a1ced2fc66036eed29bf49f70
SHA512	e8733164d2bd7d16563630a7503b3fed6c9ee2b6137f9abd5b6b561ed5560eca69b38655f11dfa2efea9a3f1abcb9a7ae39c8b59299ca5892de8f231ccd73d2d

C:\Program Files\7-Zip\7-zip.chm.exe

MD5	d7a59a8aedb4bb72dc4e27928187198a
SHA1	4d94d12c2b691d2ee92030d2b50cc8ae3fc83147
SHA256	6717f8ee09fac26ffafb0fb6deca6d3d0b8f5492e6dd5434f3a773e2148039ee
SHA512	c2285e344cdfec4909374538b378ef212473efe262967ea250708c76f25f2b72a7d45788a16fd91478fc81858e13561506405c92458d2c01ae5994bcc757659f

C:\Program Files\7-Zip\7-zip.dll.exe

MD5	427b145d75763fc075e2de0150ca90e3
SHA1	084f20c1b570afb6950e1f3ed61952b7e63521aa
SHA256	193a5ab1ada2a1fde5ecf8c0f92faffbaf1a301b965df1bb4e42d11d94c0841a
SHA512	f916e8e7cedb71d39e185f577914b1b4154395e0d2d75a5f9e907176ca28df448706e4c84e76df6f3ad05585b1cad67838f2b72f3615c23d791af37475d43345

C:\Program Files\7-Zip\7z.dll.tmp

MD5	a9570bc1f9e840ae2c5531b3faa68d96
SHA1	49afcfc998c47993117153fedf41af2997dca73f
SHA256	eae348dd5f6931a89339d0cd7c5b4655fd4608ce56a02635d53162736073b7e1
SHA512	545b3a7c7d732dadf8b67a4820b51b60ba5ec4422c8eff00e591e5883fe270fc2d45c066777ec9d54defce4b5b5788a38df01cd03e0d278235cc25270355fd26

C:\Program Files\7-Zip\7z.exe

MD5	8de17fedca6bcb848000e07ad4dbfd9c
SHA1	9b02de171651090ba4d5aceda66a46dbc1c08ac0
SHA256	619172a858fa5a0f8af9f808136a067759f8d9a83b83dfaa5c9ccf9c33c287aa
SHA512	2756eae34ae5b43cb883eef3e6d4f262654be7e09616e62f0099bcacdbe600752fe146860f6af3e79b373c89aad89faca1935f419010614f8b3564171d2986a4

C:\Program Files\7-Zip\7z.sfx.tmp

MD5	999dc4cb944616d8c564e79593176dc5
SHA1	8caf6d023542b2b7554bf3e978ad43231d02a461
SHA256	e31c675b93872fb9253f8a25cba97066b10b5237dfaa540ca604425f6bc14ade
SHA512	615b074d611b24a40ce5b858851c39a4316bbd639613044bf777ea9f182f5e61dd558c40f3d7f983942a3cd9b9a056f710ba27e89576887f243a8d833b299a6c

C:\Program Files\7-Zip\7zCon.sfx.tmp

MD5	1c31097d2a660b66ccb6c1f83868a9e9
SHA1	2b7b5f78c46b35922117f6a43f773740f5d2533c
SHA256	fac9572f227e02427db8d29bc26181e6564400211bf6a950951e8ad345b81574
SHA512	d15280565d6f7c1642987b13bf69869a66d68a867d2b0c73ae64c12056af1b7e53b6ce886bff27ca52e3a8a5f404ae7ca391bfb3a73b3d38d59adb1be4497afa

C:\Program Files\7-Zip\7zFM.exe.tmp

MD5	70a4b12185483cb5640c18efa312c870
SHA1	7e298fd6050a2eeb19760a01de4f2da7c7b5b6c8
SHA256	2c056800fb5e8d3b7e3b6bf206ac6cdd421e607190c8cf424812542b7d4b2ca6
SHA512	6fc102afce9b79e977b41083c1ba1d2179dd395a2257ac8b4b4df61dc186bf61532c139085e708d587a97a4b93c421aa686e1a412a20891fdd30f6287dcf24db

C:\Program Files\7-Zip\7zG.exe

MD5	c1baf1b9bfdb5cd183e075ff4ce03462
SHA1	cfaf7738a98b0e7a927ff1769748b3a5de248bba
SHA256	b05f10168924769a8cfe16167ceaeb21dbc8e0e71146bfee486bb1a54f52eea4
SHA512	b5896d1a4a1070a49a72efc11cd0e9cc2db2e26dbbc849b428d21227846b55b02c1284a24fac0b4a78e22062522dc4c6938b7e814bd142d948afdd18c53264ed

C:\Program Files\7-Zip\descript.ion.tmp

MD5	382d1711588f2e7510edfeb61e287683
SHA1	a5f9dea3224781b5f60d6d6fd369b7955206847d
SHA256	9a37cea6971a823d7bd9367db6cf34bd4dd89870606d1c482db73ad9c92d337d
SHA512	31137f398b68f8c8b399fa726dc3aaae7701e64e0b26b9f8887ba550b049f8e4cc4129152a3222fe6a170b55454effa8f3c5b1af463f60d1545c19f30b6825e1

C:\Program Files\7-Zip\History.txt.tmp

MD5	ff1d02b34a5710aefb9aeee50e5abc10
SHA1	8ac00a79a58fa713cfdc18dbdeff062c18cadd52
SHA256	8a771b8fea7f050a9695163ac5db4149efca14337f674c3602859b83f7db7460
SHA512	c888ae1e0d64041dbee16da4fc17dfcec891e62e182dbe07557ea2a5d93774ef588355db421ef6ba62fc7a6e786d809f334c0906005f7005df6fe3c5b2c10d8f

C:\Program Files\7-Zip\Lang\an.txt.tmp

MD5	47c2ba17ade7adca1c026023c61400cc
SHA1	2f978bfde831cb0071e48a860cc70bfee8e8da8f
SHA256	156c4ef659f2b49257e85c98083d5f63a36fb17fe87281b9254333b02cd37772
SHA512	8cfc66b0cfd804d6164fd643c6ab45469adf74b2afd25ad816696e276b7c20b3932aada23aed1b98c74012566548855548ead56d54de2d08c5b2407964624a69

C:\Program Files\7-Zip\Lang\ar.txt.tmp

MD5	98d63c30978ce1182b121995b8c65871
SHA1	9a5f2a163872bfb7b81c7f26dbee82095b3f7e9f
SHA256	25e3fda663984f810f9d239954f9ecbeb792aaf47c04620ed68481990cd28eac
SHA512	00daa2e7ecd69491af6b300bbe3df51c0117c4ec8b1005910b9feed2ead77302c1184a28171d10b7d65b6f2b28d833c1308f387a0e19a412f1be6ff7ef4f6c40

C:\Program Files\7-Zip\Lang\ast.txt.tmp

MD5	2b3539a71dd24caa90a2943bea6210b7
SHA1	abc8f14206cfa2d2a353fd5692635f6816f5a9a7
SHA256	743b9a4b002015ad268d79bacbd2ea1086744bb25bbcfce9b7f5900ca3284e6a
SHA512	066450fddbe2da15a43020e185b928676ba3e3c9c86d3d35d24e1547144de75590c2a91a74a2222b5c31aa39dd051830c1d0610dba496e596fe0eb2cf829e9fc

C:\Program Files\7-Zip\Lang\be.txt.tmp

MD5	f7caf89e6499bc0f90451687fc3b11c9
SHA1	bf2efba90e7b7f0ebf1780296dafa61ef87e25b0
SHA256	456346e20bec19550f2597d0a052a319715338be6adfaad225600af3850e6990
SHA512	d1c118932e4f15665c64a21b70820a34d51af5e400acadfb676fe5cffb397859442a33e692e9f6fbc4d19d09ecd57e395e57e2061ace785167c3e67e4e9c0793

C:\Program Files\7-Zip\Lang\bn.txt.tmp

MD5	2d85c963eff8068d4202b4ca5ecb1bf8
SHA1	5b6ecd781b082f13e37a63c901c7ce4e6e27b43f
SHA256	206c2e8d9774002b27085c3fe71496819b68673fa06818bd6f7e23d18cf6cede
SHA512	7362a88a1420c52b0f36663ddd625d0a303418fbc9d15af42dc41b194f952815383bcfa7fde9fbd3f343e010fb684c13a97479cf7c84ab664733fe4951c7b06c

C:\Program Files\7-Zip\Lang\ca.txt.tmp

MD5	a9717a7f1f663b2b8ed98a6c97674ffa
SHA1	f078b12ada7791bc64828c20930b670c21ba5b2e
SHA256	f6575f7d9121feb97aad5881e3d2a96b1cc61686e39c1abe5d508526eadec483
SHA512	c79c382280e28bb184698d663c89318e68950c2dd6ce57aefafcad47500be405f0aa9f24388a02f4015f5c873c813bf46439be56f47db2105e2bb1f9e61b2dc1

C:\Program Files\7-Zip\Lang\br.txt.tmp

MD5	2b9fd412d0da90167625c7019113de44
SHA1	7455e70eb51af7194ddf7fdeed7581c19dbeccc3
SHA256	600a43ec06980fea38ecdec946e64d74ef556edaf4016a0bf9b126c9e5e23f0a
SHA512	ed339998fb0eaa23abb0f16bfdfe983f46bb027664b61fbfa3b1282276d97c6573eb5109af171ffc0a31236cfffc040541332bdf230e8cfd301494732ba961a3

C:\Program Files\7-Zip\Lang\da.txt.tmp

MD5	d61cc25acad66c62713541004bdf87cf
SHA1	e13aea30d23237527097537e26c013206e3fde74
SHA256	84289d47399b5c4c08f3cf960a51b54eb7b4f2f7fb14d28936d9d3229c4f27fe
SHA512	bde13c844afbe70a3d26d062dbdcd62fbc7051064ad5cf07f17aa83a1e6ceca8c4f45c0eee8cbabed5fd359e8d24c051519a42b18e4a60ab2700c7ca31c2534e

C:\Program Files\7-Zip\Lang\eo.txt.tmp

MD5	5cc47599cf95fd90abc6fced2fae5a58
SHA1	9b134e3907888cc46a0d08eb72bea9454ad31926
SHA256	fbc5b315eef7048d981469157d8875fb7fae7d4112ea23b6f0db5ed50f0d4b36
SHA512	bd5351c018186580cdee916907d99eb7bae2645e3814d2c7bc33421b4a29b4658845c2a005cd012ea04b2c81f01dde955efe9a5c1a2163af16641e35bd0f59b7

C:\Program Files\7-Zip\Lang\es.txt.tmp

MD5	082fd6c286a6d1ff1415bf25f95f46d3
SHA1	8147b4fabc3cfeb9d76ad14dd4124c3d31c417b4
SHA256	4c81894c703356ec131291ed97d907e89a22f65b5f51f86e17af79fccd8549b0
SHA512	a7cbc161968cb72fea4cd8a813a230f3e560bfd239f91b28d64f4f59be3c1fdd26066c14ffa45863074ba267f5350499357e169e4022e28851242a529c07a6a2

C:\Program Files\7-Zip\Lang\eu.txt.tmp

MD5	978e6e1ec64cb1f9ba3d4a4e39a92120
SHA1	255f95db83b3c21f1b523c162a94b1a0269bfa4a
SHA256	78d2447e46464ef6d48a0af01f25348ca61c1a6bcb9051e430e602f4b12a1cba
SHA512	3278020377d35a419a616e87f6a8385a1a5c90d3d429d6896d1b83f0f26d62a971edb23ec9b93f535fc432fdac8b2ae8df336b82a32d5780b80c475781942c58

C:\Program Files\7-Zip\Lang\fr.txt.tmp

MD5	3e262506fa2538307230552dfc8ef7ef
SHA1	8211645ad97011ea49f78733d2b695ddd6d6b499
SHA256	38e98f0199f92dbf769c6345d321503b689547b955588dba97db82be8c69ad9d
SHA512	d4177a89f622304bba06ab960a8c692679501f444d0de50707e9ec464db1f1be8751d562b7881f5380c671e085fed3f5f433cb00db898f42d53bb356de8cdbc9

C:\Program Files\7-Zip\Lang\fur.txt.tmp

MD5	ee36e77bed31d4737e6cd8bb656d02d8
SHA1	c03196178f2148726d698e75235b40c270523ad0
SHA256	a7dafc2c734275edea9b2cba1eb6a2791740d92d9e8a2a2694cf2700b3fbf27e
SHA512	0e3fcb6f19754772b41297fe9aa90e73e112f82f1659c0013103aeb688e56b0409f08c1853e327486e517056f8de8ade91df2ceb85ee2c7e50e17a086369ccf6

C:\Program Files\7-Zip\Lang\fy.txt.tmp

MD5	31d9072c23129d84b222dacdbad80e97
SHA1	68cbd67e1e1805e30fa4274454f0ac694d80ff59
SHA256	a42d671e9c5efb1fd9c8433022bddb4b592b254a458a005990ab86fc8257ccdb
SHA512	0cbc14a28abec234afd05c509f4a3fb0991bf64d113c5af62e5bc67b2d569d77238cf48eed2a87485c9f401cf1b4375171438f68bbe9620991219867bd69769a

C:\Program Files\7-Zip\Lang\he.txt.tmp

MD5	c8db6a9b33c057103abd389f20b66f51
SHA1	6f4b6deaa0b334f99b4c97fb2907a2f83f955501
SHA256	43474d53386379b69fc09766ba5247e4c4d5f3e4d500a4b62c8d46e44c43185f
SHA512	192f5e2cb8d829600b7ec8a00a6035af057b275352450f04570a140484c919896c87d1e54fc9fb45cbae25615cd28a4c08a51d8507a95c18cdc9fc89f97990b8

C:\Program Files\7-Zip\Lang\hi.txt.tmp

MD5	bcd63a6fd2b53d9dc8fe1b22bda1655f
SHA1	3bdac8ce05ff9cf855a4f3fb9c53b76f496df485
SHA256	bdae07cf5815184d242fa7742dcc681be07ca0190a0837e78d08dcecbe0b4c43
SHA512	2c7a29743b932e312c412989e21983724760a790a759829976b8d0c9b19816b4718feb33ac5dca930c35d965d9cae5066b457b256dd7ee074b7cad02c20bcc6d

C:\Program Files\7-Zip\Lang\hy.txt.tmp

MD5	a1de82dd9f5905834afd91f77e25c03e
SHA1	963506eb6e78aa6de4fde6e0ef1f1ff09c8dd9c1
SHA256	936b1b6d57dd8a67ab96b1fa27b263133d1be583ee60b38152fa3656aa278da6
SHA512	e5e0ee1a00380bd6554b5db7bb568cf0c4fe2651646cb15ae6e812c8b35244078595ae561c0783d656fceee8b26d8ec8b8bc5886d85dd52ffb2681a4aae71f1f

C:\Program Files\7-Zip\Lang\it.txt.tmp

MD5	ea53f926480523de877c8aa17eb7e726
SHA1	f0a213f94889f319a1d5c4771f76cbaf70ca8c22
SHA256	db7addb19f9ffa86da777a9c85c4adec7a33972bae5515e683e983ff4106865a
SHA512	cda71dfcf8df43580ce348fe4301c6645a906673674b3c99af07c032e301da97c5d25117cd22cc9c5ddd40ebcc5ac890f05dd4d06fb284da0bca491b0c45aedd

C:\Program Files\7-Zip\Lang\ja.txt.tmp

MD5	9ab108a5bcd05d0c44753db10e4296d5
SHA1	fbc9595583213e37a3124be2972a382ec95da494
SHA256	4743f1b147d9f22aab64a364d22e6c69b4e751b28741e28235cd465bd42710b5
SHA512	510d2e454b307bdd0efa0d4708000623806483134bb011c47dbdbd2e746e52d30c84decfce70b87fbff4f11a4831f5dfc388853c11de5f82ad2b48c9fc893ec2

C:\Program Files\7-Zip\Lang\ka.txt.tmp

MD5	19ab4d5a84cd7584c337e5f84f65bf1b
SHA1	3f280ccefd79987b01152044033468ee31f4c419
SHA256	a2ab3930eb2c2778f1c77f043c9361f55c0314e134778c918f8885e8c7fc6505
SHA512	ad753af244c00d201889f606107e17fcff916bce745e1faf149d03bb62677418ee7f76cf0bef79b8e785f21c8a7b5e5bab8f616d228ba8be3573512e0b8d4ff4

C:\Program Files\7-Zip\Lang\kab.txt.tmp

MD5	fd2911ccaff7bec81d4f4bd7e9fcbda8
SHA1	6bee5909cb08c5a67e29d32d57f3c36625958b52
SHA256	44df76848775faea01e8af959df23a334b1e5747dff577b36c88f0b93dbafc03
SHA512	295dc84b6700d9d0b2cb60860385a97c89bf0fc4948e5aea11b47b88ebbec4ef7d049fbffa747715b41deb70e6b3a2feb7562f459eaada3d5aa16deb07cb549e

C:\Program Files\7-Zip\Lang\ko.txt.tmp

MD5	443bef08721aeb1da108b2a045f256bc
SHA1	ae4ecd1ab06c903338994de9299d6794d4c815de
SHA256	cbcd8743ac7f40d92dbc56addb2692c075b1c3d88bb5746aedc1013fcbad18b2
SHA512	7ab35c7a002150de94a6dfe72334f3a31b3fafc1d2b2e597d169a4f55c1ede9fcc014eb93ecf2ee5ef1503f03ebcb68c5022ac88fa9f377bd9f281dd15d0bb5a

C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

MD5	2553a3dc31dff06909db0d4669173f5d
SHA1	5975e356d2e9591c3e81dc9229ce8c0d9acc573d
SHA256	a7c8ecccc79c070104ad3c9796ae347f3d07d73292cad78a97dbd59097fe4be9
SHA512	81bc881135481e18449c2ce7d38bcbf094c358d687a837e348773f97e6ffbe9edeee83483e2b79e298f9c34d7584bd7d4f87775726095754f16eb06be9502d69

C:\Program Files\7-Zip\Lang\ku.txt.tmp

MD5	7ccead5ff2dc721ec40a339536ca6b68
SHA1	1005f2105b2196eaae550eac4dbbd2c727b04f1a
SHA256	c240966ae5165dbbbd95f7eb9e7f3a50eb1aa34f0ce7a17bd5c1c8b4033fb901
SHA512	348f6473ef66cef0bdd4742f9f5caf24acf35fe44ec9919312ef3e8ae1b664e354dc667cfdf744c2ec08e382309b4fba4895dabf9b2ca062544292b82308cf5c

C:\Program Files\7-Zip\Lang\ky.txt.tmp

MD5	35b08be8afc4531b64229dcdf49f9a75
SHA1	f8f5194e4b61e1245b452a228aa30f893bde98a0
SHA256	7c10c243845d7457a5637f96929cd520ee96d676125dbbae2ede0e4804a0b89d
SHA512	75ea11fb2800b7ef1a0610e77258a9d50a502fa65ff30316e97804a2f69ca0eab2fc330c74cad1d6aa8f12b36663056840147f6a94e27adbf001411cf8c7da59

C:\Program Files\7-Zip\Lang\lij.txt.tmp

MD5	f21345df37b55598be182c89c2f01ec3
SHA1	3147b656ff147e7e972769aa54feb74130cddae2
SHA256	da2aa23414fddd2a03e571e26a141f7678cd1c70fa0a7dd2278d8095a829c5b2
SHA512	ff3a21d9c214ac1e0ef0780020c473e0bbe978c919e9a71be3399ae9cda60f697a01424fa61b2afa53c6c48f9fc027e017c643eaa6cf9e98e2bae3df81499722

C:\Program Files\7-Zip\Lang\lt.txt.tmp

MD5	54c6f3754b0a3400b2dcff93cceaf884
SHA1	ad08a8e52e36eb31b00765536357af456856d69f
SHA256	e52b5a055620f839c580d15165e754bfce75fa1b3a5e634e7b97103af396d782
SHA512	343667ef93830b4bb6f81f19f81018c2552608517d42af7e82d9d2872885bdab203e3f01a21eca9548e4893cbab6a9a5936c274b574bb80e30144e1df6f55e41

C:\Program Files\7-Zip\Lang\lv.txt.tmp

MD5	0a7321df93ed846587979eb014f77490
SHA1	35110e2fdef194a82a08292c663c1f6cc1f8c244
SHA256	e04693d181071a8947a3a7726b0b4e074a5bcb8cb206ac5517c14cbe56364d74
SHA512	af2f0c63e3060db0005cb388265e3a8d09b8861db02a84631490b772fb9fea48e5e4c8bd7adac93938e08f63e8a30ac86712df577b8e05d1169cc2258f825a09

C:\Program Files\7-Zip\Lang\mng2.txt.tmp

MD5	251fb0d66630f0e1b9463ae1cd08dcbd
SHA1	679ac30f25c132968c969c613623a51423201794
SHA256	b363c840d4ae67e589f2266683e4e6a9702b7929ee4379060d9cbb2ca44cca5b
SHA512	dbc73c7a752d4a0c21a3c06cceaf25dcb01ad6cc73dc9146fcc6b380c8e9e8ff90996549bd463d3931cbdd52885aa151590befaec605d8b1e899e91384c8a11f

C:\Program Files\7-Zip\Lang\mr.txt.tmp

MD5	b5198389237a89bbba95f3ee97b516c7
SHA1	87e725d9232419057729bbc439c003969d0a0c8b
SHA256	f415d26700a9b0eb3a6a5d059d85c3d17e20d744f5f7f79ae2daf66070d227e7
SHA512	d7cc7c50aedca63cb818dfd8698b7d81c4ea374365529a2c08970553c30e793f153481a14d2727f9df66812f7b11bd5949aabea8e9671f573cc91eabb888c217

C:\Program Files\7-Zip\Lang\ne.txt.tmp

MD5	20e9fccf576345ce731720ce4fa29505
SHA1	c21da005ca41e5e391180dc0b38d3314b88c6c41
SHA256	f14e2a6a7ac0e720a576210fe53ec9ff72523d2571103e623671d76d96129ea1
SHA512	899fa9666e59b93fd527b9389393c234fb9f8f1bdf5304e978d2ae45c993ae8044b3bc9bb2900786fe09dc400aecef33e1c36576c629a2cc7e9db68a8dbaeadf

C:\Program Files\7-Zip\Lang\nn.txt.tmp

MD5	47757785fb29245dcfb9603a663e2f9e
SHA1	312bd2dec9364f8a0967ad50c1bb4594e8364519
SHA256	7ab67707df756b87012df7b1a8817e3e5dd6ff9b9d9935832f5395f083c39457
SHA512	cf6841736a50a8e97f779edd15009e5c81081bdf859ce5491d8a899d8437c56358e1f5edaa775b2e519cfc12531f237eaf4c881ce82437f979e29c3733970dd4

C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

MD5	2ea07ea0e94b48ddd6cb7a5aaf244e00
SHA1	df59b87875d61b9603be1ce16fb4fa67b9a2c3e5
SHA256	4d361d1ea6407e84daa9b643619f9d5ea950728b43f57b455558822096048ae1
SHA512	e0dcea9d4303687b0042e77c6ebd620c4235b2e9fa9df7e5752f3cb574e9c4fb73bf47b6eb185ad5545007cd5c434d1e861bd1cdf4969ad59b40462c5791ce9f

C:\Program Files\7-Zip\Lang\pl.txt.tmp

MD5	82401c3a31c4925df3c522f646f02c83
SHA1	c607e5d4b90670b8c4ac06da5b923a5cb496b1ec
SHA256	a73ceaab6bdb3f7d24a5c625bcc301f5c66fc3fb5f5753696b0d5706c5ef9b01
SHA512	5cc7fd4c1a7cfc79e9eecbf6c0c18812bbead05cf905b1d4358a78c0d50e6d4b575b5b56611ba54db722e3d564468810c333f6664bb42f4d01dcb84bed6aa340

C:\Program Files\7-Zip\Lang\ps.txt.tmp

MD5	9520d72e4c91bb6fb151bc48e0f3377e
SHA1	3a5dc2afa64bf79e2806c9259d532d30feb24b9f
SHA256	ba1e70d9248431d3b7284257e8a324e2897f1154a6ad9ecb32bdd1b3c74f1af4
SHA512	0afcca5ef7ec00455ce577be5f41cca0168266f0f0c9376e06a420ed70675e01e35d1facf7004ffc3921c268cfd2d3ee430f80d2f3c5922393870e4728ff3666

C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

MD5	637606bc3c6c75c01aeab5ac7aad604c
SHA1	2171f5a7ee142a53ff282f5b1e49dbbd17787ef8
SHA256	4750cce2f8056d942df844da760ddb43d565931c37ef886590878130d82ebf58
SHA512	3e5c24da8f4af279cd9832e708211afa826190e5fec5e69441760928268778728991b792347acdbf49dea184aad980a7a85aa6ad23c31d760e1dd8b00e99ea80

C:\Program Files\7-Zip\Lang\pt.txt.tmp

MD5	fb4c257eb66cb73698547beb4478b5a5
SHA1	3a6f60ae75c155430a963f8dfb03833b5195d187
SHA256	9f392e862f12f52343c7043a1dba01ea82666de7b0a195122b10d11cc4ddc711
SHA512	e62b30421b7063df64cdc7f6a256dd5861bc0d7ea110d8cd8b2c265527f1026c865b603494b72a191742b6d02825ef4f96699e1c38622925d69906e1ffe896cd

C:\Program Files\7-Zip\Lang\sa.txt.tmp

MD5	7bc4642016febb95e0506b9f586c73f9
SHA1	0f3b4e1551f5d00f48635f8b15f06b17883adf19
SHA256	a14d5946ad92cc29e5a80f661ddcdb1672b8d8b71071c7d18c892a78126c3553
SHA512	77615c5ef06f15c7f7eea39b2217f648d6af337ee1c0832e8efe9b041662ba783cbcf3d7a89f03595fac01f8e1c506ffa249e8bd294e6408bc033ab44d25a08d

C:\Program Files\7-Zip\Lang\si.txt.tmp

MD5	ea2eac479ca54e9583b20c61065d99ce
SHA1	f5dc4dec6d5be69634f97c6b4de9fb16e0e7f592
SHA256	345999b0afd5e64b0ad948ed8ffefb058e85a96729f599db5fceaf1d2f29b39d
SHA512	612e38380128568504ee427b428cd07e7f89276e4a801dde0f0d25f105427bc513de4b07957118bc677f653755ebe8d4296c210803aa909b9937a79ef7e905fa

C:\Program Files\7-Zip\Lang\sk.txt.tmp

MD5	4c4b4f3cff79e37c5c26a358bbec7978
SHA1	b1bcb2f40ca609e577696da6d96966c0e5ecfacb
SHA256	aeadc641b99876b9a063151fe38fb8cde1c66d095e9e0b5d2a61f4560f63e649
SHA512	3e487756fbd9455dd37ae35a5dba527091a0971803168e706a5520e66147594de70b09d6c586c1ee5a216f37ee3c9201033c945461a4803c1e242d3f5e90d471

C:\Program Files\7-Zip\Lang\sq.txt.tmp

MD5	bffa10205b5bfa930b72de50ee54e2aa
SHA1	a62894df1b71848c063980ee15e660d83a5b744e
SHA256	bc196f391197d111db2a2b9cdc9d76d1749c9d6d74615ed6ddf650de503a066f
SHA512	d2e01de058def582f7354b74639fef9d1873b6539a3eac60bf262a75cc6183aa459da3f67f7c8a30b149b4d47bbd8449f74b37b780fe9f4e3034719bd1625137

C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

MD5	4190cd52f0454d708997442ddfb39e5f
SHA1	0f3031db4b3095621de70fc78276d4c3b2910e74
SHA256	4c5e7a2d55b0b14e26e9612e70e7f8d3b979068599135357cd9dca1b388cb5c8
SHA512	91207846f651c3f81d3da530fbaf150f8136e7326d27aca0e50b0431acaa6d4b451a2722bf709c5e13a2f5bfe381aba4e228a1d5b10189c5527b8ed20e3a670d

C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

MD5	d7f78d7ab0116a982c829a4c88747001
SHA1	285a8d6f072e4fae6b043978ef3ede7ae11f1726
SHA256	26f1c9c10cc792cf542a8904ea65f757a113c642e785d326f3c7add64cd96c90
SHA512	162fd19f11eca483617aecb1c7811d7024f5b53810db11d0ba03b3410acde8a49811f3f9b7d22e57b89428c7d0e789e614567da54081906feb578700d1ca714c

C:\Program Files\7-Zip\Lang\sv.txt.tmp

MD5	2d6f1e7024b30be40c4ffb5cef3b6d0f
SHA1	8be96107b579d9c6785087b37382fadbc6acdcc8
SHA256	e11504c639393e3ce3c60f7514623fe3d0b8b2d2141400b1d21842df38cbb19b
SHA512	7299c096298b4d047af184e81d979d3d8f9180c2f84a6d57c4fa6bc535484a09ed822e9bad7070b56c394558ae31e48fe2e4c28480e03e12c9618e1fb1a756ce

C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp

MD5	a24df8e45c9888fd40446eda5a196f89
SHA1	754e28ac107391f271b03e384cafcdb51be11aba
SHA256	d4a62afaeb06fb11e62e5cc060b40f9501b2ec33e8bf9c2df17afbe133aa2016
SHA512	a7073c286fb936df1d01e9390e1642f0c754617e4dea8f945fea3285a2b6ef5f51402ba12df3a2daf7300736e4089bffe13504460d6928a60871f14c3d2e5d3c

Sample ID	240614-axf2ca1gjk
Target	7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332
SHA256	7d5c85ee04931c50dd777c46be681a6b6e50af05d2a18500f485e684965c9332
Tags	ransomware

Malware Analysis Report

2024-07-28 16:25

Table of Contents

Analysis Overview

Threat Level: Likely malicious

Malicious Activity Summary

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files