Malware Analysis Report

2025-03-15 08:13

Sample ID 241016-jjr15atgqr
Target 68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN
SHA256 68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cf
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cf

Threat Level: Likely malicious

The file 68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (335) files with added filename extension

Renames multiple (4664) files with added filename extension

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 07:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 07:42

Reported

2024-10-16 07:44

Platform

win7-20241010-en

Max time kernel

119s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe"

Signatures

Renames multiple (335) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Zombie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe N/A
File opened for modification C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ms.txt.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Internet Explorer\DiagnosticsTap.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\msadce.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\7-Zip\Lang\ku.txt.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\Common Files\System\wab32res.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\7-Zip\Lang\de.txt.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Zombie.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2208 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe C:\Windows\SysWOW64\Zombie.exe
PID 2208 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe C:\Windows\SysWOW64\Zombie.exe
PID 2208 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe C:\Windows\SysWOW64\Zombie.exe
PID 2208 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe C:\Windows\SysWOW64\Zombie.exe
PID 2208 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe
PID 2208 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe
PID 2208 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe
PID 2208 wrote to memory of 2340 N/A C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe

Processes

C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe

"C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe

"_03 - Documents.lnk.exe"

Network

N/A

Files

\Windows\SysWOW64\Zombie.exe

MD5 168b8a40d6184de588db0202eca73899
SHA1 76f49b238e54890601c1cff214e53541c1151ae5
SHA256 ce0b91d38b8d608ff1540b173f5a062d16e1f62ee6ca96bb02747db4294a3de4
SHA512 fae0b3627e591952d90c801e281f507bea5cfeea59826e175e94bcf246883342096a3aa56a5d1f56da20462b3f1b15db60da7637f4ff345b7ed92d6a2029cf4a

\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe

MD5 babbebc549d100d3e67a79100dc98f6e
SHA1 7c2675d304f19d8a20d7269a34d27eee5ba0f7af
SHA256 9b7e1d1b47a6affeb917be08fc305fe3247328e1cbf834340dd23465f4c26776
SHA512 ddfd43816721bc1e3311254b7e0cbf959d74e70401bc086123e77c4e5bfae8885a1f256878d4dc49f4b80e093b76a555f405935690e0a6d0519828d586e96990

C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp

MD5 38e43ad15c5c7a197701cc736198e786
SHA1 613038ea4b1ed0a318824bd701a7404bda9dfd72
SHA256 9d039fa0737b2fcc4d8d5b10809145437487abf239df4988ee771c07676bc8ae
SHA512 27047e118a01a1a1e041bd38cd8928ee5c50afb4051aa1e81804e916891bd94b6ac0e846e40616001e9bd2233b6e5e7efcb83898801a99cd75dbf7eeab9a5e94

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.tmp

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe.tmp

MD5 751801ec0b2621068401229569a8a8a3
SHA1 a8dc63c87a00adf3536907e0d0508dc0ff5c8d41
SHA256 3db62a30a9889f62a54bce0275cec42a6da20783ba0cd62650797c88fcef1b33
SHA512 c20d12af9cfa0812362385b1652fafcd30cf11b0efa5ad080160be8c242c680032a598256ac6100ed84a289ca4b4ecc37db8617d706819e40eb12652c82ff950

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.tmp

MD5 d2e045b2a7b6fa9f08523df355e7e64b
SHA1 2eca5707f6173c22495b20829d8eb539904b39b6
SHA256 eed13b02165747346c1ce7259a240a8327ea1092d1b78d4f09c05b4416c9b781
SHA512 61c878970f51d9d4cefd623172f307a9039a1ec19c46ad93228125567ade3b9384db634e351d0a6a90bd036f1dba0b9cba6039c80884103a372b0e7d72304bce

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.xml.tmp

MD5 7762f4b9c2d7272faaaacd864aa09f53
SHA1 84f68d9b34b1536cc7f0b992da8885512d0a9eb2
SHA256 69f3c409e9b422024d851ea26dcdbe6e02e218dd4094308eb1a22f3c1c021e6c
SHA512 70d8b8a4fdfe6a08dcce657e0b5fd0fb2c4d229e5dd3a659df64c00d5b883e70dfb99d482003a1749f7ba74dbab3313d12e30f13b91eaa96f36995944c60920f

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe.tmp

MD5 8bc64f0b2ec9a99284163c2f338642d6
SHA1 2a90f2255bf6e410df2287a9fdbaae6d88ea7faf
SHA256 b1451905ed1b02e97760eaf9f1a22ac6569851aa83d9af18864a370e1518c82e
SHA512 a3a84044559b35b777dc056d3aa767da55f363d97af191989a8784518306f9e34d1657464492f4b21e4d47e32d175d4e0ab557476a99291ab957e4a05f36d742

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe.tmp

MD5 f64465a806a53efa4c94d0ec3178668c
SHA1 6bc58e20b84816e637e720f3be72fc57d867c191
SHA256 2cedf592d9249c10dff4881add70254a0d762630e2409d9eb8672674bb723b09
SHA512 a874cf81bfa4c25e3df81dac11eab55918f776a25a613f14ec39c8ed28cc994ea1cc85a678ed71866006f56bdc12a09773bc6fc44553333c3d143c8fc9ffae32

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Setup.xml.tmp

MD5 cf4769a465940f6bcdb65e1d072b3430
SHA1 d343119d913df3bdf27e78f382bb13cd61b676e3
SHA256 01b7239dea3dff6823fdfc532b9a2fb6d0740e9840732be66ea7c4e95da9a84b
SHA512 c16c43d09e17634599ec08b517c9a8989aa1e83ac90debf0f9dc3ed06c276a492b41339e2b03639e85f1b17edf0f93919aceffdbe93c8b8a86a898a94d3af0b5

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.tmp

MD5 fd63e1d4ba82f0b5b144c0ab02047559
SHA1 d7aefd826f9f93d2998e3e9a119dfd51b08b04db
SHA256 ab871aeaeb560ce03bbb7e153b705739a923079f6ba96105a6cd6cf47121f429
SHA512 9797b31890d1141a3f38008224390dafe2ecef14e2a086ae8684d4f870b2dc2a59e4a1c9f8a2c8d58b04f9e67ea7750f3bc4c2144c4af0185bed0f5ca77b9170

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.tmp

MD5 279bd2aedde89a043b5e74cf3069c650
SHA1 09cacf7339b110bd337e34cf7c4fa238def497d2
SHA256 5f6163de57d2726e192c99f208ccc7d9a3dba9ecd55f5399cef0335f91289979
SHA512 822ac241fd0649968fbbe452d836d987650f8b8197e25ee91bec9ab107321b41fde4934a856e957a5e329d563e34562f6b5075b2970e7a10695e31dfff71099d

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.tmp

MD5 0571ad29d59897bec5b39cd949e57a55
SHA1 869d91ff69b1f7e9eac9e0ec5ccaeb2fd511bf58
SHA256 613c97a1c1df7787d6a2a14c82498c4549a2984bfd2a72f4e39fc5ceb78a41fc
SHA512 1aa14175759422e6006fd7629f560961671cef58e760d091cc30f9b40b029f3591221e3d338bf884534d53574499db5ab0b77db7060a8858821a9e91fbb16bc0

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.tmp

MD5 c49f7ebb91361e19c2a6c5edd4426c09
SHA1 48796a475f50edf4d768e23ee8395929ef3849c4
SHA256 80b4d27b5bb25116c39b32cbae15abcf3cd73167be20ff46bac3ec4c9f2825c0
SHA512 4c85b09ae162629e948bd98b04f5a152855abcda7af9040162506c930823b794479ba0fbff41700a13e9ad6efc4db77233e4a4e7bdba94d448a84ff1a5f06b09

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.tmp

MD5 f53b503446cadbb432314bbb73f0bc40
SHA1 3b6216b8920402be98a6fdf71e539f90296d2186
SHA256 e2eadafbd3cf5d504358163fdeb5dfa5f5d44022e79038fb4d2163830850efad
SHA512 973aa3b74702f01f5b215553e61046f87e2292895b004333c608f92f0445c0505f0255f8a5ce6d0868d05ff4afb4b872cda43fe879247affa5f12253c9f0d93e

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.tmp

MD5 9628d091f9a92b81eff813e807842782
SHA1 e97f801bd4f5837e330913cfb7f7a8156d117a7e
SHA256 c6490d8edf3f073a9e2f444a9cd1c16b4d56d3895b992c707508668e539610c8
SHA512 a668ca7eb1fe4820e7f262553468ee28aab6a0f37e829eda592f9394467da7d49aced40aab52e11531371f8621c2d77efee5d4fd9308066f2a5164ea06105421

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.tmp

MD5 51841e99b8451ffa7df4bee52915bb62
SHA1 b7e9693ad66f07de5f778825fc86fed9053aea40
SHA256 d8d9377d0ee90d3de0cf09d4c6335b6b56f105954834050a9e02af7c8b6ced11
SHA512 f269f3f7b4f5e302af1c018a9eb4f76e0388b7189d01c047c686a7141db6b6b287c5028703650d5e15c7c15badda0b1d2947b633be6ccde8bb9078cd013c2102

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml.tmp

MD5 6be42f3e9c40d69840052b72e0720a94
SHA1 8d2096f13d06c0007dd3b02910e456035f9873fd
SHA256 0eef6fca2ea4d62bf050f8fc81a33fc409b39f1fc1ed9fa7d14f9e6d4499f9a8
SHA512 6aa214b9ac10e847ac1e836a879225b7a33bc0cf284637d4bf05aa06c1a24e428e5863375600af5888a6d221b2d3df7e394a1dc0f77307374dd8970572ff19ad

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.tmp

MD5 f4ecc27d96fc2e2b834889a58474c84f
SHA1 412db9cfffc1aa58d7a8a1792a1d79a21b1e3b49
SHA256 509595e5b26dd6a3b0ab4d9f384d7c8c02bab498d5798f29e3bd163dd9e0b9ab
SHA512 32c02ea435dd9109f1b7fc02e9920f90129f7c99183b69e54c357001088b6c29a5799731811d115ee1bf569581959822776c081a86128be40af8ffb1227b847d

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.tmp

MD5 ec27ddc78b0d50d260eed52f159b53db
SHA1 b7285bddc71dfdb2b65f2182c25a1c5d934ddc0f
SHA256 a51833e9d622a5ccf520d576a4bb9e4bd3e1297725e551a198ef6de50d6b2dac
SHA512 33f238e9d0b609fe33e5db3fe469748e54f85ff12c770148502e1eb064f2052eebc7acae0c97e3deee0a5fb80d348eff1e2fbc155cf9e43e792095fa0e571c4b

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.tmp

MD5 e3425c82e78560315a4462ce788c39e6
SHA1 c6448b4e24e2986a3d60215c41d4d5ffc592a016
SHA256 46fb30643cb3c9086d775e35adabcc1be041694a4f1d9c128ef9cd04e8c524f3
SHA512 97088e46af4df908786adc06048ee037e1220f2798dff5b83e0b06d37264f6dfe6d4631f2353787c96f58bc3903561069fd0f62c8fe2e18fb7cbf9d7c0251a2a

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.tmp

MD5 281e06b58a22723c176898d0f7f1688e
SHA1 cce22aa28be5b76d3e87a5c9acaa328dd92c98c7
SHA256 e34cf57c177f663bb48f955c10b49a6a143268b5882fb918c8730624e7a75866
SHA512 2ecee37d7993888a4592cb8aae7d3d0be2da96bd045cccd83764b5df526df0c744163df2f0002594892e45fe49df08413e5fb1ebccfe03723ecfc8e10dac2904

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.tmp

MD5 e32b0430077b007f7064fedf23c9ebd5
SHA1 10a965148d55d83b899ca724e306a51480b4d0d0
SHA256 786fe1fe2bcbc18c57319f21ec840eafe85bf0fd60a5a7e3a06dc729e9ce2b48
SHA512 12c08303d01733f7f975b50a5a3fb9a2458408701df3f22ebfa054bf22a713ba014d19fb544db38fedbfcf89a4c10823b589d9e1b2ba527237f6a5ae1314a81a

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi.tmp

MD5 647f177581b8cb2239acc5f41ae7493b
SHA1 22bcb29b70988890fcdfdacfe7d6f750639d6c61
SHA256 7ba888a865a940be5448a3a6f87c0f9e50d3221814d4527bb6f9d4262a1f11a7
SHA512 64f7e1125baa12b8b70f781d0b05a12c051a27714d70d156751872232c7904e60722230b9380d371c478f425adbeba9c5281fbb8bc02007944e4819c9844893d

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.tmp

MD5 f21df38a44f488e041e58bd993ee4188
SHA1 d1bf9453ff4d79ad5bd9cf575cde45f5fb7a911f
SHA256 e15f0473ef7302ac056641c06b70f07d86dd08cc5156fd4fe3419cd45ccc6635
SHA512 8082ff2978842da819808a0ca1c657289e0d3636332586f7b43944ddf703d202749fa3db90e3b342c4cafd7a342c0253fe55de4fbcd4ea035270e115e0360159

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi.tmp

MD5 29b18e661e95fc2a9d1571ad993a3ca0
SHA1 64a99a9b5fb94cb4b475992bc60de32c40c52bf2
SHA256 e626605a7468a242f1257039ba531db56230768fd0353f75fb3d1593097b6739
SHA512 a0eef8a7df6d7125e1f3e60af13de7ccbab6d7b5f6ad811b98a70bcb5942c086e04f14c2e73da87256d553a9aab0228061a5e8feb25fdb6867d022632f71d72f

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi.tmp

MD5 6ff027be8dcf9a6f7eccb0a92d7b8364
SHA1 f8b2979647ce4bd49fab3df50a7c9a46db89daf9
SHA256 5844423f8e63b70e41bb17b30c29e95f02457a892aa8d42dd2db6c6b32a7c3b5
SHA512 52769d88403128e0db4e3bd790264b84604fb44d2752cd51b5b51ad99fb7af7539d172a3c12beb8ccd15490a2450ca9993ceebcb3b6d8ca241ed4f88750c8302

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml.tmp

MD5 95c15c2e9d996ef54d6160f4c2aa6461
SHA1 ce33f3d22a22356f4d15c14541fee0cf589d0096
SHA256 b3368f171e63e5a4c0affad1ca2afcbe475b5c0c2e6f3f3a1fb221a46ddebff2
SHA512 e26332556b5e7ff0fc6a9f749aa88d9b6d781b3e6f236d2adc26faad4c281b8d3f1b52faff362efd3d22b07882dc535aeac60337a700593e8218bc27190a5dba

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi.tmp

MD5 b92f11edb2ae4a79b0cb6e202d6d1443
SHA1 ee24cf0e798a03987133fa5d50650b767ee25900
SHA256 6dd111f7deef9b34baaaecf61e531b00a2e1af288c30f9a2ed6b598f1b836897
SHA512 92a581e7544618711cfe040d024ecce6f0da3d7761ec01a77ad5ab624ef822447d11dddf79b2c1b8fe8635765998fa222bcf31c4945fa33ee0d5ce8c646c25b5

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp

MD5 56c8e3b08fa8b46166bbf031455f276d
SHA1 7182e4fe34314dca639cc4de0b3cd699b77df88b
SHA256 5ed47da551c863ca898cb331ae778dc54ad62db715c7587616120e163bab1406
SHA512 12e1684b1b4c26cbb03910a3b2b753b71f11701633a4b9a978f05299e583a529db142421b7826e9d4839f386346da70a5da9bffb378784e22e79c64fee7e18d8

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.tmp

MD5 cda348f5590b9cd3dcd54f4248e24176
SHA1 da13354bdecd8ab77cf6dac5ebf47861b2a81269
SHA256 9cf2924ee2ef0d3f977bd2296f041ee6d0a2526d037f6e26eda651d3e6eded37
SHA512 1e377301cae92dca2e153773bc334e47083d380630c23849f24646ea8c65134086750555cbdfef0a6b714ef65171bf822ac04c499fa24fb280d6a0a6acec4109

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.exe

MD5 eb5810557ed477bbc465bb8248c23e83
SHA1 a6f3cad86305154404ffffaab2d9243676e408c2
SHA256 a5ecbbd75355630a23a8262f6c6edb7abe3ba3f81d5837d5a0c49e860ab9bc74
SHA512 7ff7ee8e776fc9fd758750c21dd984b43fae8fa6edea816ca52339d52a236a766abc50ecc3f2411b2462a88f41404e13ed0ae5a81ed0424505efe20b94986404

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml.exe

MD5 6a325b9064af8f5b5403a9c540eee5a4
SHA1 95b172eaaac443c030052bdf6cdfec4b202ed254
SHA256 63ad3fb73cc73b785b4bc7c8989a1e5d38d885cfe52be82ec316b37d3fb8756f
SHA512 a43e8626b507f3a51e2a6a881261877de7edfe95521c6959b7ed56444bdd6a39c1bdd94479d6ec83ce6b6057d59d836bee3b83fe5f5bd94c743024229ecd989e

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab.tmp

MD5 a58339f7fee28e215f514d1be235f2e9
SHA1 dbe4e2f12b0a6b13b6450f0737d57d2c218ee590
SHA256 4759f8ff50e468c87478c832e68cf67914c0310ad9dadcce424a2620e3b44003
SHA512 27d019a6ecad2dfacc66abfa6c66e4f06b7472a42eb7c97c4289910d1d551410c4e11cd6fc49e6643b3c68296cba6ab693d3ca0a6de77fb44cf78392d135bd99

C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.tmp

MD5 8356c82c4cae602d076416afe257c9ef
SHA1 cc757d5750852c9178448fb6fbb492a2b24de9b0
SHA256 34c3854a9361fb16d8b7664045e3ddb1881c25e8a4987b8f807723006d084fcd
SHA512 828b8e025ad66c8c92ddca3ed4d650fd8a19734447fb6540563a2ae9b7b0b836c9a7ede0d488ca8094c74f3927f98fb561f1407831d5ada35c41c1299223ee96

C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.tmp

MD5 6f04f9a69cb246a893209b32951e2091
SHA1 2d73fbca9b01c1978aec5916974800bd95c02ab2
SHA256 7234b715ea6ae8c32ca6b9aa8f1931d397bee121decffb6c1ae2b7b6df4890d3
SHA512 e631bec9cb0e20ec025a891c5e27d9789c8bcabcd8e984ecf5f603cbc7a6ca1ecae4669c30c7a46313db2fb6cbd0b2fb4767d797eb4f807705b99a179f2cdaec

C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Setup.xml.tmp

MD5 15cc4df24af055d4ee216ba69195025d
SHA1 cc3def7860d5394750d8bb1e16158d412161aea2
SHA256 63c938bf10db9ffc9075f277026fc604adf22ba581899ca3eda5a1370b25c0d8
SHA512 ad64a12152763182cb8a98c248bbf829c8eb772e4cd361f41a8c74deee498b653f0cacec0174fdb16eccc6d6d61fb79a4b352ba19697a5acc4028b02db8a757f

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll.tmp

MD5 586b1dd930aae9511dae83dd37119462
SHA1 8f1ec3a3d3bf770d2f41e78850f3dfee9f80133c
SHA256 45772c8288a12281b9a223efa3f439b395d0b685bb2034c8495e65121ca95b50
SHA512 ce2ee52b6e96523216e684f0ff81c277d4e4a0e341fac7260b7a71acbbc8241141b7f8f0ead8f0a38d66a32e4ae34d02bd9e2e53b511cbbdb1c7910f7e7f611e

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml.tmp

MD5 658190852abf608b0b77c4dd8bf9a06c
SHA1 ca0c33fb8c06f2b2b980a8b52833a5afbabe12d7
SHA256 614d392d50cbe61ce46244aeca1edbfe520b476fac4bea5cdf8d6d079995e43e
SHA512 92176e17e5c991818508cc29c3bfc5122982fb4a4f0fa646cd6402052cc32702d9b4426d7e96e081cda891ba1d347b2ada293e4b641f02de3364b5b6199d1724

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE.tmp

MD5 d0682d095e5bd72952d921b455dc68be
SHA1 9dd5b66d7898c7e25175fa054dc5865fac6541f5
SHA256 dee0f9ce7b4fff40fd6c387bf53f7227f4670305085a72403a412ec7600f3ec6
SHA512 1b43af20bd2e77290a3300a612abd4f18ac6bc731101a72c9f639251e3ff2a79c2016f3dc6f124be897b7ca30df52c034874976043da5857a4c0afaa6edc8a9f

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll.tmp

MD5 ea4b7245490230f7269da30861c9a3f1
SHA1 9b5d867c005c286f9dabe3bfdb39e3968138b9ca
SHA256 9c58b3be16b64c0b130238de198ac51ce97f8118e368d04790200659828179b3
SHA512 e908e3aa093b8aac1d4e7ec179e70849ddc34315569a8bb54498905bd9afe56ae22d340d121d154f15341b94b2a0d88a04c2bcaf35334d7d4444628eae924957

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe.tmp

MD5 5b4c6a32835e7a4405df98cea34a7272
SHA1 3751bb9a3f5a5e21a059b76ef46d8e0b3821d4ac
SHA256 25cdae37f3ba54b02dc26d09041348e4dde33a1c03546e9b0b6d61c1ee121968
SHA512 d4457f53be6ae34cfe02b425d394c4a81f060d3dfdca8be3debc42c43d9bd0350582d739dbe1a4c8c39fdd698f545ca6ea7a67fe074b1aed722cf1b4b2a48afa

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll.tmp

MD5 cd9b0af61b6abe8fa250799ef2fa889d
SHA1 66529828747ec12077e51b5fd2d43af4748d39b3
SHA256 c46adce02678d7d64072ce80fcd558de8b225146d2dfab28d42036ce081fc2f5
SHA512 f62bdac1126aeba5b1ad5692f5ac354d1e5e9a93b5225a7035686018e904badb77c5e8edb8ba56a1ab73bc66a46591d164661ea75bb183e3a84f4e8614d864e4

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab.tmp

MD5 f6178d513ed3d2c07e8231f4e0040502
SHA1 7c866cccefc13571b5d5c2188e68c0d9bb22dbfd
SHA256 b639bfc801d55c5a5d597b384d58ead99e47fd9a56a2e36aa1fb3908541a9861
SHA512 656b0560d3fbc591a3963fddf7866b1a38f67be8fd27e39c2b40b5e8066b5df537274d11ca8bf8a309646ad9414bbdbab0b9907ff915acd17abecf253496eff5

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi.tmp

MD5 32d00594971fec9c94618fe23b7273b9
SHA1 697833549d163409f1e7c727d6380dbaaf7c3120
SHA256 bddc6131e60b341bdcab89de7687fd524e6ca21e0506ecb5ac0d312ef79dd009
SHA512 0e80014f4f641805aa02e32badeaf72a255aed961b2e8aa4de8cb5f7398961d96718e7e7cd912556e011458969b971c3d6a4b0767d026299764f6939825e4c5c

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi.tmp

MD5 550e0172a553c9f65c388a4c63278218
SHA1 ded58f61a9a621cebf0ccd62250137760e8d33b8
SHA256 3179e2ffc2297d87e8a6f478d11ea48de5fd1f553152f583761bf4b84ae9eccc
SHA512 cbf668b3e643ac9da696c566b523392cbb69e5d5790e81d084599482e15e171930954d65972cd53503466f79dda8260febe6291ffa9226a89f0632dc0971fa01

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm.tmp

MD5 a577f7f34c766a6ff6a62e63abae7469
SHA1 c68a6e4c8450a29ad8340dd57e312c5db828a042
SHA256 dfd8d24e9e88452526c9efd185fd3e22757ecfc777b7f9b0c4d69378a54b4183
SHA512 a4d089faf4adc6baf5919d1744814b9fff47ece7b6037fc860063ba14f912d6db5db671286b655c9d1011308cbe082dac9c8cca96d5a357fbc895201496932d3

C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUISet.msi.tmp

MD5 f89f5e97540ca0727c60f9ddf72beb03
SHA1 194456a2e5b5b7d0f19fe137853be4533ef71205
SHA256 16efecc821dc6536133c0a96c526b171f7c96282440c4aa2f594aa08d5f73fb3
SHA512 97960c67afbf526dbd0617e43ad2d11af0f0285e89b468d11312f162c21fc9868c5336a5c808798fc5eb8009d6317b22da8eede9f3f655ac18b85c8216728533

C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUISet.xml.tmp

MD5 187bfb86c9ce53e8e653f18daf9c16e9
SHA1 19578988385d59ddefd5885db89c2b6fa1c17a35
SHA256 4a3f03229f3e5b6d76c4d3874de6d2fa415656da43ba2da7c1487e4a511993ac
SHA512 09f43cb56fda3c80035637834cfaaa02d9b90a49ea891879fca9741a572d3783fad7a7e270081f9fc0e5fed84ccff04db0a58d75b30e1d9e72942d032ec83cae

C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi.tmp

MD5 cdeccb34fde5b0687f2ab0eb9720b00c
SHA1 9a96417ba0b8dd5027514d04fe24008f3e6e61b0
SHA256 740981c080f9754018c5f4fa65691723c4438e9b3227806fc4b1373a5e762a93
SHA512 864be8e2e331f64461f32de5c30037e1bb52e8b62993c218b304f1b4c0c526b727d02eda83b9498b2012c5517547c60eea5ebde07d6ded4e805031efec81d6b9

C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi.tmp

MD5 dfa7b850a6667a0dff1ca23fd907a9e3
SHA1 a874726804b1f90f2487ac92415dcf9ff632a134
SHA256 c38b4051a56665ef59a33b67d57f7e9ad5fff98c73c236b05289d3f96ceaed80
SHA512 6c70f314ed1c2de370e6e9de01bdf0064e98b80a108ba424c52f6882d6452c5a95dbb1987aaa23bb889d2ceff15f7b16be4f80f4a64fc3ad2f5494cc4a4a02ec

C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\AccessMUI.xml.tmp

MD5 4bd176bc34eb63f51cea9d5d87becb96
SHA1 499f85421365a5f2582aef0ffcdbf82f9f377479
SHA256 31b7298c7092a57bad505014bbf495dc8f95e1ad2d0f22566040fa9931c2f229
SHA512 ad82c38425ae203b8cdb915e21ec96b343c256a68e30703b815c621aa6d8e16620003a5480b6be1e0a8fe5421f52f8c89fd4dd9b8fd8e01c20c3e24cf8478330

C:\Program Files\7-Zip\Lang\sw.txt.tmp

MD5 40573cdfd87cead944b43d8405e8dc1a
SHA1 b5f7d42ebd3b11016443e0bd2f9ebda0f3466d92
SHA256 e81efb9dab376aa5ec32834221c11bf3316efa305df0441ca5a0b89233003c14
SHA512 59de9b1342061744e36b12108a42ea29d4f854f1a850ec4d76dac05447cce3b8c68f6760bc6c94413ad61bc5a2726a5201051c0ed7c5521c1a251ae8308c6b9e

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 07:42

Reported

2024-10-16 07:44

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

110s

Command Line

"C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe"

Signatures

Renames multiple (4664) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
N/A N/A C:\Windows\SysWOW64\Zombie.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe N/A
File opened for modification C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.ThreadPool.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ug.txt.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\j2pcsc.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymsb.ttf.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationProvider.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Client\C2R32.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sr.pak.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsBase.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Zombie.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe

"C:\Users\Admin\AppData\Local\Temp\68c1a0e47940906cf09f65a9680409b93e3103c20d71edbcb5cb7863bcc776cfN.exe"

C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe

"_03 - Documents.lnk.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_03 - Documents.lnk.exe

MD5 babbebc549d100d3e67a79100dc98f6e
SHA1 7c2675d304f19d8a20d7269a34d27eee5ba0f7af
SHA256 9b7e1d1b47a6affeb917be08fc305fe3247328e1cbf834340dd23465f4c26776
SHA512 ddfd43816721bc1e3311254b7e0cbf959d74e70401bc086123e77c4e5bfae8885a1f256878d4dc49f4b80e093b76a555f405935690e0a6d0519828d586e96990

C:\Windows\SysWOW64\Zombie.exe

MD5 168b8a40d6184de588db0202eca73899
SHA1 76f49b238e54890601c1cff214e53541c1151ae5
SHA256 ce0b91d38b8d608ff1540b173f5a062d16e1f62ee6ca96bb02747db4294a3de4
SHA512 fae0b3627e591952d90c801e281f507bea5cfeea59826e175e94bcf246883342096a3aa56a5d1f56da20462b3f1b15db60da7637f4ff345b7ed92d6a2029cf4a

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp

MD5 d94963534bb318a2d2608d3b4175adc9
SHA1 eecb86234c873540ce3a61d6de14e6cc1d2cc655
SHA256 96c05e7b9f879785d7f66d38b5a271881989b13ada4ec6aeef12225dc435639b
SHA512 375e2a3307c643481825049a43bb8859a61989be98d900c4d921dc0ad52108276efd13a321a3b9e7b82539d3d0cbdd5d21d79b678ec5c1934c6f4ffa60e5fb46

C:\Program Files\7-Zip\7-zip.chm.tmp

MD5 2b691e6a115521abf346fd65953c6b5e
SHA1 5945ba6aedd16b33bb1132973a9764f0e73e2198
SHA256 5cabf559d2c89b3cdfa98284ba9cbd53ebf59ef4614da395925f1ab85305efe2
SHA512 cd9441ad41343d5fd0df01e9332854136466a09dbccf39682ef4fb1895173d90be99cbd079a0197ba84232685f140463ee3c31da8381b247e75698defc3cddec

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 262c7f7b328684c6644e54acdbdd7755
SHA1 f3c491383d625a76d884a4e4f4014008cc49f183
SHA256 ddfe6c1276fac554c0d4bd1205b2490579fd6f87294e899b9f5fe9e982006e79
SHA512 9527e27ac16107e8b58b7a7d195ad4135ec00c9577810fd486fa01d838f5fcabcd3cd5072f1d95f0d1e06a1943199498a36ce792d00a0c886f05c4eeaa185410

C:\Program Files\7-Zip\7-zip32.dll.tmp

MD5 a6588e8900806af351d327842a80e556
SHA1 70b0fbb442aaaca1f205a2341089c29b331b0b00
SHA256 f82bf6f5d4559e6cdc8257e42ed64ea82dfb03cc1c80175e796cd9c2ff649c21
SHA512 0aa65aa2ec74d09abc543ca1f58a87af61898d6bbb4d465ee56172d7a4c214c88178421dd3334917766e11f1ef801ac176384e664c64332e1f0b7e9757a5f224

C:\Program Files\7-Zip\7z.dll.tmp

MD5 58203e7ac4ead7da8780f095bcb761bb
SHA1 8c0f1704a6c35d72505d07329438005f059846cd
SHA256 5b82b7b10f92c7f11c3b8aada852894d1e06fbbb4fd0b2e6551b6a69a215ec9d
SHA512 114af6d52319d08dbaf5625f0f57c8addf42437b72691fe782268c0e607a1a78ba510e793fd9adb00d8c3be4704484c5764ab18e8c273a8c628dd014f578b57e

C:\Program Files\7-Zip\7z.dll.tmp

MD5 9a242601f6afb5925a0aae987a3c868f
SHA1 d9700256bcbaf726be56b1c7a74648103b823592
SHA256 5383261747af367396ddec5258e75e3b95112f48d4eafcecd0858c1a2917a40b
SHA512 80b98a64c77c146367d0ac01930dc77e049fe084e4a8f92051cbfdff2f4e63382f3e25a5dc061b5c365f288cdca5cf09133443cdf72a77ccb74fd780517aef7f

C:\Program Files\7-Zip\7zFM.exe.tmp

MD5 7cf97e4251ea9e4989ce91960cac8dfd
SHA1 5cfb4b829224239917722cc0cf8d23f365e42be6
SHA256 cfc49386f51448b984bebe5ce32ae538cb9facd3edec205694d28db65a617cc3
SHA512 40ba5945edbaca69e3810b2c0f79c2283d358511311d85b85b53c23cf9d4e2800fe1ba5e58994897ed0e867e9e5220190fb9fd33dcf168a6d816504b3298f284

C:\Program Files\7-Zip\7zG.exe.tmp

MD5 eca2a5fcc15d6d643a600953bb9534eb
SHA1 e9b5eb2674fa0139be9afa5c6e585ade73c3fc84
SHA256 cfdaddf3a5c48ef192b101bb072e6a605abc5ef33fb8ea7e0a945fc8cc12e583
SHA512 8d1be84ff774e5fc8cd0d45ec7a666a5cdd9bca99b4e94825033eac94a9cff5f9af74e88dde2681d1a10ec0f00e42bca83f950cb5aff4afe8fa67f914829bdc4

C:\Program Files\7-Zip\descript.ion.tmp

MD5 a9f70dede535a9c3825b37b2d7fec808
SHA1 0abc6d8bee4e11bc14dfbddd72ddc7ee0ed6331e
SHA256 9a87cf9062a1869118e0f5dd9dc70c4719dccd91e2d830432a0e9b737eead40a
SHA512 7e5e21d895a14c08270c8dd7fb2d774565ce4818ac19d985d30830dda3cfba17a10fd59896cba16b8b820d644f39e4ed03e056413d2a0df0ebbfc08fe4f3f9a6

C:\Program Files\7-Zip\History.txt.tmp

MD5 d7bcea9011f36dbef6be0fd206bcba54
SHA1 65831c7c43c4c56ee35369f86a161ecef8b26fda
SHA256 cb785cf9c30de7f8867ee76d8468017b26f401c531450ed63d828c0b85e6c6df
SHA512 f9ef32cd3c64462cc59fd7ac0fa3d1cca310bf56bf5f1d1d09bcbfa3c6533fa678dc933a0960ef56de23a30f8f4b1c2b2d48f523c552f220c67f44f2bb932a32

C:\Program Files\7-Zip\Lang\ast.txt.tmp

MD5 38d8edd15e68fc6e940192e9c1130662
SHA1 d3921437e6d3d92999f5f29d2b95650f8dbda82e
SHA256 5e4b4d1e3623ca2540377dbd411178b483793245e9ddf083df7928e6cc2c8578
SHA512 164d2c73fae80b87a0cf1fe1b5e14c898cd2b3f54ac2d061ed5ea9c468ff38b8c5692fada914b50634f0b74c63b884b9cb59529674b6d29c034763f03de1c6a3

C:\Program Files\7-Zip\Lang\az.txt.tmp

MD5 b9699c971089cd773bde36bda7a72eb6
SHA1 3ca2a83065522a9fbe8a4138a277a00658aa030b
SHA256 489a4091e2efb179d9cefeb909877478c8bf90b929c0f996abde7a9680943381
SHA512 23fd7dada00b241cf555ea664b117ee2f6c652aa2a5755c8460b40177baa9204732bc5a9c9ff2de2d89add00058f0911230d09931655ece6a904e6641a2564a4

C:\Program Files\7-Zip\Lang\ba.txt.tmp

MD5 dc7fb85dcd76721874a1b404defc6573
SHA1 7e9e1fc8ab9fc180661fbb930deda29203e5ccca
SHA256 35b36445289851963173cb05517686e1ec1ac269c85b15836cad50fe23939533
SHA512 71cf7b8b3b09f85d7dc043ed13e16c1dcc50b2ba2f7758159d58976e3a195c916a846541cbc95e660991b7fe036597f290064ffa7814b3c4ed520d10e4060411

C:\Program Files\7-Zip\Lang\be.txt.tmp

MD5 1e4c6158d31a8229070c7f9e550405ba
SHA1 51eca66b6f36d354f48238b3113dd9c2ea2c4a6d
SHA256 ab52a62aacb24b955885957d0f32fb84ed94d3e764ed66616be8319089384ec3
SHA512 ccd590d4446614862cfffbb56f685f5f0cf2e32017d355aa7e0b9010ee42a6f0e994047233de02f6146257ab3141e50f2606b42228fdf9a274db01cd42db0760

C:\Program Files\7-Zip\Lang\bg.txt.tmp

MD5 696679d18831962c36366236c9ecb6fc
SHA1 21d297c770a11721caba2cecfe06784cf2211472
SHA256 0792e47db7448000061bc469e1b6eee1d62e455b2a62f2a89a66247666f2f27b
SHA512 c440ce8ce71530b55451cbfc70290a20622c8a8a2d9f36f1c93e83be57e8ee7cb56c9ca773edf58ad08beb7c8343153e38f1bdc990ea5f7d8d3baebfd0f81111

C:\Program Files\7-Zip\Lang\ca.txt.tmp

MD5 9698ac465036acf93436ed5d17786003
SHA1 e7ce95930ab12cce3a034fb9c8a2e468c4b4ffef
SHA256 7aa719776e1c0f023084f7e9e264d89e822d1a49239f0ec976b6440deff7bbf4
SHA512 8277c0b3ff687d8e66b8a882c1fdf1ec7594392e8d27e9b522f5798da1374b27d372e22b8c2e2341c259178aee71d1f34721da25a316cf4df0f4412658766561

C:\Program Files\7-Zip\Lang\cs.txt.tmp

MD5 e08fa4bfc66c2eff9f82cb707dc466f3
SHA1 92f1eb0549ae796888a62c8e33cde3c11c225452
SHA256 66fdd7081bf8d0a2f95c47f7b0cec94e8609078bb3d2cb68f40c9b8e123d8fad
SHA512 a3d393165ad921896750b1af2b5c79965884406d89434309708faa0c7a14a0df2fbf21fb1b31e317c56c33664dc0aa7b1094dc1efa058dd3f5170ad4754cb917

C:\Program Files\7-Zip\Lang\co.txt.tmp

MD5 01dd0e0b0eead1f2f34c5c4695802e05
SHA1 c474eb4b3854d9989310ef8caa7b1cc5d7181b64
SHA256 d73a66d8500d8c42abc2f266cf6dcf2cd6ed6802dc39a201af85b9026e59b94c
SHA512 118a837da05789cffa7bbdfd2df204f3ed0ba5656302dc8495208b6971719d45bfc29a7f7f3e5f46998aa97396de8a2f07fee7b74bab4e5aaf83b8847020f26d

C:\Program Files\7-Zip\Lang\de.txt.tmp

MD5 aa987e92405530c69574145991e5c29e
SHA1 a2843be09beac16e1258f24b0f78aee20ccfd9df
SHA256 17003e42bbffa2ed4723df1f9d34be19cbb8fae06bac1cc7322a05eb2ca4395e
SHA512 bbd28225756acdbc76010c3e123ca97d3908cf15092efa140e1330c282c71399616fbb72968b8c852a289d88259f66828972ca25c0cfe42a83bb1e03c83988db

C:\Program Files\7-Zip\Lang\el.txt.tmp

MD5 37609441139547c8c66a39b243bc468e
SHA1 81cfe62e475fd81d362e6732047aabab31eca298
SHA256 1b94c1830e65101fc65d3aef869bb21590732818ac28158f22563fccf76c746a
SHA512 c6af4e72dd013d2641de53121d4a12cfce2e31ae3dde5b5adb2cab3afe4d3121481535fb38dd95db281284a724b201ddf6e5ed08aa8bc7bd5aa67d0c4d828f01

C:\Program Files\7-Zip\Lang\en.ttt.tmp

MD5 b65122d82d2d7633d6493b881fdf4780
SHA1 7022b1e797df73f642a527ffc16835a3e428516d
SHA256 93e81b813ecfde25f79fa6d2fdb89fb54248753c081e7249a6c6d7119bb417f5
SHA512 918eb4cf268e9c8fd5623e893f02a6febc9059353166ce9424e2e1623652905ecdfaa704bc0dbf88a3acc1d9b36ca53cf1bc2bb2da1f1688b1a29ecced7cbd73

C:\Program Files\7-Zip\Lang\eo.txt.tmp

MD5 8b9e3108049593310007c3914fd24abe
SHA1 ba899a949f3da5c01990630d95ca360d4770c4be
SHA256 82f94e297104a25d15db69c371d9759f37b7eadfc6d5c8b2fa0fdd20dab94803
SHA512 2da91c2be8b3da7a0241d2ab47baa75b98c196f7aba4289c7c36ae4dd65c7fda20cfd23ef2f2a6749a4c8fbad9caac8ced4c5b6bd9f0d264e8532434cea37254

C:\Program Files\7-Zip\Lang\es.txt.tmp

MD5 3efcc2e6f21476ee42edb29f32348822
SHA1 18a7c2ce9bbfe2e8d5217f8d6d4dcc26cf0e7255
SHA256 0db72dc4070fb37361317b4f54ce577d6e3a27c0da3e9347316acd42ab03e955
SHA512 8556c38d21de5ba7b0854e1f74323fea0648ddef6fc9d2740bd208a5b3404fed1d36370a40a5bbe17d873ee45496b87c57645330c9578e6a031017b0a86e7c69

C:\Program Files\7-Zip\Lang\eu.txt.tmp

MD5 f8beb530e46dfff507426b4a1b3ac272
SHA1 88d20ae83cac7c1c6c9b52dbc1ffcabf9878b0e9
SHA256 ee68b015c0dfbaafafd8bbaf3df73281b853434a76ef308c95cc4a45096bb786
SHA512 e0a922f6742a0b9943f0ad9e273e57855d6cd517de32e39dced7f1cd9d25e97dd0bda32a0a0dd855551312c4f4a7d4bc6329a069ba22ab1b2c02033520140204

C:\Program Files\7-Zip\Lang\fa.txt.tmp

MD5 be0177f75dec1815de307a641293255e
SHA1 aa9e0032f049d02f7d7d52b10676a1b41c204726
SHA256 757088f53f55ad47c32260015934cd4984d943a387343b73db567e41ed2e3faa
SHA512 06b94bf6196c59c8046561ab5092097977b9e57694ff7d6dec62df8e25d3a5713ca7cdf5b424b3a0712b22ded6ebd9f16d0bea849b6dfa9af63e82522e71b6f3

C:\Program Files\7-Zip\Lang\fi.txt.tmp

MD5 08ecbe14c8e20ecd86dd59aa82f38646
SHA1 7315cc9f2c29633369ff1a25d921c9562d3e1009
SHA256 f24ef0de00ea915a3aa85c09ea71b1e8635783f6032d9a2daf5462453c83d6bf
SHA512 e609cdd04deaf697a0c70426cd7057bde67ead760bad8453ba64b4a415f026fdd7ad92f153097b0e879d31416fbbd20211f17fecba22c6435fe9a9fd33befcb1

C:\Program Files\7-Zip\Lang\fr.txt.tmp

MD5 e033a99421f9dd1713827e65a6280460
SHA1 ac01ef0861b18e7404d4a159d1112aa00004cb5a
SHA256 56c62cc6796790bd3dedcbce7212a524203547d6f673699d18a6414cc6dd68e2
SHA512 2244ad74e2fc7b39af814eb9127f53f17d9db93835233154dfd80d23858e832e1b782531c2c009e8a6ea9f1f94e7846fa95154e418ab90ef60de6dccad141d64

C:\Program Files\7-Zip\Lang\fur.txt.tmp

MD5 fdd153e676cdb38cd20d150f3e71180c
SHA1 f655c0d7bb5910d593e7b2507467414ef8f1fb8f
SHA256 1f53324c2dac8d186a94d0d64f61bfc42aaff46eb341debddb188dd4a82cd549
SHA512 1cc09fc5bc63fd6b2f8e123ea8f9033f1522fbd5443b12581c4b126744f386994b82695f3419ccec58bab867f24a7842b8151ad6845e34d80938b492e6040d67

C:\Program Files\7-Zip\Lang\ga.txt.tmp

MD5 f7e00fd78fdc51eb244f8e0397a15075
SHA1 d1a897bd386956e116af7a9b42dbc2da7695f1e4
SHA256 cd99b29f84245421a147d597fc81a0497dc113cc70a8fb3c1ddbc99a34d3b5f3
SHA512 48404a17b15c0642d2f15a0093898110cc8e875d6cf2c43dce3e46f1986a90cdf5bb8454708e1c9075de8e0dcad8ea6c0686f4727d227455ebc06e4c4b4bfef1

C:\Program Files\7-Zip\Lang\gu.txt.tmp

MD5 15031fc63052d8e26eb1747eee31d1ba
SHA1 431dd552c43e679e7b041d50a80feb7fc6826244
SHA256 0f6b3a7d585b6e4433a3241225c7dedafe3922227efb0dfc4e905f25047f550e
SHA512 e673567ac27da19639cc418e74f930ebd6253d6ed4041604121e7c510d0a8be95c5bfcbb62142cb786f275430dc196b819ba208f493445359f52815c3f527ed1

C:\Program Files\7-Zip\Lang\hi.txt.tmp

MD5 ba85417550db1c5e98976ed4c25cbc72
SHA1 04ba42a9a2b883ec0c6eae4ba8430c9b68188326
SHA256 062615dc3d0c0a713f1b1a322fe0302b4cd075b4edc0111671b96f4d9fcedf0e
SHA512 eee379eb3c64c91f43986cf780f76f47ce27fbace336a80ea71632212c1f88117fe9843b45267661f70bdb43e20951e9fd54e7397b1e595c5b43b9977765058d

C:\Program Files\7-Zip\Lang\hu.txt.tmp

MD5 6f07fce1f348127beba80d2678faa761
SHA1 2ff482bf808020a6b74aecbc701276d29e7dc2f8
SHA256 fbe0d26ad9dd06e7a926ee2a87fd260acd80c7af023ee42c7d15218bc3984bb2
SHA512 5687b8d0c9bc811f22b8a81f5d5125305916819cc7280a26e0c2d0c8c5e3f1972a45eb031e9056c8cf20a49e4ee6ba7a507990eb8343c02b1d699c168a21dea6

C:\Program Files\7-Zip\Lang\hy.txt.tmp

MD5 fc24465d3a1f943e49bd098a2d7ce7a4
SHA1 0737441f65c49a3c2855bd5965bfdb0f010a2d38
SHA256 d4e437e61f13eafdef17f4de4e5151d2a07bca584d7f3a7a651a311ba96d7ca2
SHA512 7e6fd0cfd4d7ded72728cf0b851d0c150fe323992b5a1c397418a6faed2235b9342a71f307037ebce84eb4ffb91de7b65d36f6242342a1af5bdd126674d793a4

C:\Program Files\7-Zip\Lang\id.txt.tmp

MD5 db846d29bb3e2177a549007a402b1d1f
SHA1 afe2b01935c4dacfc67d8f7d10006df01c63ca29
SHA256 218d7a49457014ab2535b8c802e63f606be15f00a47bc73fbdb780fe181cf0cc
SHA512 008f518d7359738aadf1e29b3dca5bec2ae59857792b7c05fcfaa7071080f33f6280cc5d0af924b1b10329ac1463d86407ae340ec1faf04d6fab6d1d7eee7303

C:\Program Files\7-Zip\Lang\is.txt.tmp

MD5 24ecb7bd23e5b5ad8a46213d516a3f8a
SHA1 8f360513df71596add4057f64cac6b2b796b33f6
SHA256 06588b41580177b2a7cf886694f8382a73d2925cb41bc95821936e9a8192d81e
SHA512 aaed8b8505201b475f750da138cc967c0a051dad88c37f96d458d5702e16245461d15c92d9807c0a7b2883cf9114669ca83b7d6f709287a163f4de1b72923c30

C:\Program Files\7-Zip\Lang\it.txt.tmp

MD5 f5f39a312147f39eb8b249d42be04f8a
SHA1 df41ea575bb04d8469cb2a8cf782cc69b6207e5b
SHA256 f0cc99a08b6df23232e8f7f984dfe0328fdd7b1f295de0e90de19d7358fb1980
SHA512 a106bc7879a4ea6c36dd2a5bea3bc2ffa63a2df99978b7764c23424e6a1a0cdad99e48d942d5ea0875450123e351a43730d8225208ddc7b9f4dcc752776c5946

C:\Program Files\7-Zip\Lang\ka.txt.tmp

MD5 c920644525688c9ca80eda37f061f5f8
SHA1 c04cc06737207636971b4f0e6491ff839c2a9683
SHA256 94aebd4aa7a15610da8ac8458f0d9ba2b1b4eb86c7e0862551a7a6c1c251c885
SHA512 42b79fe470d3c798e45358baeba02ef39b4921a5dd1df432520c6a405bcf3831cd39163d9b79ba03f62f1ba1bccac5cea23ae829ae0d2d5696371f639fbba7e9

C:\Program Files\7-Zip\Lang\kaa.txt.tmp

MD5 43db6b83455bd324fac804499eea79b4
SHA1 0db5590751d2815603844f32020dbb7353f28e51
SHA256 43badc0934061ee073aa15df6182205eb17609ac15495410a41cd68561da4098
SHA512 7839dd547d6d777309042f5fbf46c65fe11f613fe71c831df04c3290ba369f95c72e6c16e03d00b1b5a21348fa35d0ab107a496cef3d3b6652c2bb0f5b9cd0af

C:\Program Files\7-Zip\Lang\kk.txt.tmp

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Program Files\7-Zip\Lang\ko.txt.tmp

MD5 e4288f8f71477c5a9c936c7a63be9ca5
SHA1 536ea7bce878f8c5d72e5377092851150806122e
SHA256 1f91295f3f3c5f0cce4d881d7cca0812c75885b1d59c4e1060a0d8647d63f77f
SHA512 5472b83e0d4730b4c95435e44f65b6ba3b97f420e00efd06e55baaa2e539510ad321c065a1748067f4f85494eb0db59aaa7d75981da5462fde9cfdcb70cdbd8c

C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

MD5 5d691688c8fcd6ad3706b1ed27f3c56c
SHA1 3b3c26d8474e346ebcaa956dfc74b3acc58b17dd
SHA256 7b0ea5fefeb2d7fe84c6b361f2458aeb62a74b29ed8884edfe477a7ba6d37cf9
SHA512 35946037092b540ed751807d599b6df3bf81f662b417a7f89d4b7c28f51ecc1c965e0bba7167c385782be62686cea77d11048cb13e6f1cb2cd09121577e378ac

C:\Program Files\7-Zip\Lang\ky.txt.tmp

MD5 6f67a0a0967645ea78b467b315777c7a
SHA1 e3bc820a6573ed890ca95e9bfa035386224bea0e
SHA256 1a9a3709d2393d393e7e7a25c45bc47a55314e8a5ce5cae192157f7dd670b3b3
SHA512 9e44fa76fc316daab6394e742ebf15b4275f2fd49fb60e89b6d67b3ce63a14bf680d694078f85cb4e6623d08454ded25062738f0c87f540cfb9c2f51b0711eca

C:\Program Files\7-Zip\Lang\lij.txt.tmp

MD5 fde3c79c047a9f25750b9dec20339e34
SHA1 8d771222892c1be4781319df1eda4fab6d4893c9
SHA256 7c521129e51eba46b65568deb111318d7a0029c1bca2333884a4c7696f492758
SHA512 6c4f55e82bf2130989858081832a021cda224a3ea9eb214ef89c95696623cbeb1c36aa4742063623681540d66aa2df258a5657cebae068a8e65d8966f2d142e3

C:\Program Files\7-Zip\Lang\lt.txt.tmp

MD5 f49200411713b499b50deb12696b69e9
SHA1 ab62e6b92d00a511bbef680dfb5807546e289ff3
SHA256 6d2a9cc6e4c05b85179b8d0e090c22bd2ba0e714172c3513754af327f3a96dd0
SHA512 cecf1d055153067525258be634ea8f058e576c55ab824e32972d5b87801f89a663ee0e19b63eb095ca957275463b8ca2875a5d2bc2c85d7897a55f645662bdb6

C:\Program Files\7-Zip\Lang\lv.txt.tmp

MD5 ca90ca269c79265b662031f0e7c8eff5
SHA1 1d46cb4e569b53ffc5f349aa1232055994365fd9
SHA256 fdfaa3095de202370a7fd5caf7909875e0be7c472bce268ad2c0767eea84b3b1
SHA512 960562387ba65faa56c25a5de45d617dd43de99a46ef6d95dc39f10b205ccb5d2dda08f177f83c70046156abadec719aede8cb3fd746c3c81067d0957f4bf61e

C:\Program Files\7-Zip\Lang\mk.txt.tmp

MD5 63d6b3e00136ba198eb700fcd1742af2
SHA1 f4b049d43db315113315be8f677f85c7727e7e34
SHA256 52e37fc4b81e19fe1c4828746556e47ed903e988bb11db0abc2d2a911ae45574
SHA512 01c883c8464eec71890b298321ad5577d8121a1c65268f37bbcd49614f2e31f46f5e1e5630a7fc7634f0c612f4d98de8f7f702d763b8cd3c957ddf9eec8c0fb1

C:\Program Files\7-Zip\Lang\mn.txt.tmp

MD5 e56471ee0b52fc6cddf8ab7fff8a48dc
SHA1 276847e7b201320c3dd37125792006724d0e9f81
SHA256 0c71e97c29738c2307ab7306c427d810967c9948185d5b29d25c67013586393f
SHA512 f0656d09aff02d6dd5931462a408557ee5adaad38e0a40ea89a441113c8a647b1b8ef30b5a440ec3b3ca4d4e09de6a8c2082b9d7169e71dd375a4cb91e95505d

C:\Program Files\7-Zip\Lang\mng.txt.tmp

MD5 b5c53adf7bfd5978630fe2f2f66e99c4
SHA1 2ea310f3aed208c9f8b64d1dd44d7b2a9ca39247
SHA256 45390f54167dc3b32103c6420a8b62a3b7f7998f5f35ec0b9e5e42a82ac10c41
SHA512 660d0145d6af67907f7f11cfc8abd27faa81c5434294a43153aab6c8cab0757a999acf534d0c45a1f6d876ca0b2339ce507982e2a1623fb1a68dd9de46b8ba11

C:\Program Files\7-Zip\Lang\mng2.txt.tmp

MD5 cef146dcf4ea95718dd94eb8dacbd2d8
SHA1 1edaedeacc89e5f895634886d2a474e9eccc8424
SHA256 2cbcf46cf7c328512b71d960b3e55e63add5efc60b4bc8747094804852f341a0
SHA512 b35ef2743b7c86b12d9a6bb2a6676e868c8b42595ef44420bfbee742c1dc91e9cf2cc5a9da6fe68e2784867de73d8bcfa77f74c7da1138a8f030c74645a1a5c0

C:\Program Files\7-Zip\Lang\ne.txt.tmp

MD5 48846ac68d1569c4c7c1edb1d3240835
SHA1 e1a3ae5e81ae85b40a13b06de968bce562c1031e
SHA256 a258f37af15efebde1cd0d56241aa304b7cfd989e26602e3139eae93fba971a9
SHA512 df80ad52fb5a693a6aee8c2a8989c6670e5f9de7ed85b68652a7d620de5c492db2e5ee79c7fd53b19a550cd66118c02594a448f77805e83002e28d2056ea279f

C:\Program Files\7-Zip\Lang\nn.txt.tmp

MD5 1312cc808ac981be0724350d5d59bd44
SHA1 fcae20b91ba82ce4df1e6e6cb787bd6bab3f0e30
SHA256 7cb81c084a7b749de78e4cdc5eb9713aabf7b4624ecca499821f446001a70da8
SHA512 2454bdfaf5be0f8740e787d89de4270b94c486e1457dd7d1dcb0c5322fac06d587a103a6ebb34ac33783cfca1b3c5df9c90edfbaee2ac8465b5b4291441bf2af

C:\Program Files\7-Zip\Lang\pl.txt.tmp

MD5 b0ecaf6e5a13bc1de5cf2cba3ce77bb8
SHA1 4903446cf62b6e515066ae852a4751c7edcaba69
SHA256 2ceff23f464c96cc8a69f226de06800da6040e635f1b9f653c5419e6c4074ad9
SHA512 f425fd50518448266f8612c796546eb89582db495d5f439d1707e886fa72d3bff8ad5d8232ec1f2d55172a3d8c757b01f326c3414e9e4e4bb175c4ecd7a0e03b

C:\Program Files\7-Zip\Lang\ps.txt.tmp

MD5 201153df828d3dcc6209400e1fd48979
SHA1 1e4caa40f7f5bae9f18e0b47c0af1c8d42e6a64b
SHA256 3a356388898fdf94e642cf99fbab8f40c22b76074a0894c1f04194d37882c78f
SHA512 425eddcd0b461b1ad8b852b74e4a4c979723748e46e77a1455c47b456b99b842911534697d3b0bc73e51b5c771a09062ab8dca5d68251d1256c4d1b45e51d579

C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

MD5 410bf11df8f3e8e06b38ed5d2c50613c
SHA1 83846f283b8b1c6a834bf7d3a052d7e209ac9f1e
SHA256 97395a19e67e8261f8e8c81fd600a9cbca2765cac424ee5a5abed55da938ab95
SHA512 79d888051c1dd965a2b9a9ffa09ea109b9ab06d98785c9ae40faa6a6451b2d2be02671badce90bb93e72e95232331377bb8751439d0b49b47e8a46411fb210e0

C:\Program Files\7-Zip\Lang\pt.txt.tmp

MD5 36903481b25a14454121882bb87aea96
SHA1 297e622fcc628612e09f1adf5971257792249aff
SHA256 bd792fcb7fdf67423f76e16d3de2cc4e14024ba4429cb00717564c6d1deadf3a
SHA512 51f8f8676d290ec63ab8cb4843e34297514249f35a6dff67942415ed114f59871e3e8b973421c1aa3e9ad9f0bd859c95c4aa905dcd9b1f4656c8756f58b7a189

C:\Program Files\7-Zip\Lang\ro.txt.tmp

MD5 081333730c4c5fcb91c1cf592e51ba0e
SHA1 18d5ffd89d23488768fb544027e32d149c32794b
SHA256 25f0ed8b4b1c3cedcc33bf6e6146eadfbb3debff2ac6062dcc299616794875d1
SHA512 894a0d8c6150cc67d1a16b6e9a50a6b59d147b9deba019587d88845ae9f3d80f9f8d286220949fa130b902fa58535406eb71299e5a02cf09c8529ec0041babd8

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp

MD5 e4cf9935e3ad6be246a5b2e4474c5239
SHA1 80700c103a95d34de21f1c3c00e9b8a9b651abf4
SHA256 94980ebe4b62bd173b38d400adab562e19bf3e09d422fb10ff999f75c25f61b4
SHA512 10cf0b0039a4119bdec3d87d99d97dfa195564b124cf73a5a037a4853daabc8b31d5846b69196e992b2bc493826213b4f0f0eeb1aa4a67c03a5673835380500b