Malware Analysis Report

2025-01-22 20:16

Sample ID 241020-apnq8axhjc
Target dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN
SHA256 dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113b
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113b

Threat Level: Likely malicious

The file dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (4154) files with added filename extension

Renames multiple (4548) files with added filename extension

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-20 00:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-20 00:23

Reported

2024-10-20 00:25

Platform

win7-20240708-en

Max time kernel

120s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe"

Signatures

Renames multiple (4154) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
N/A N/A C:\Windows\SysWOW64\Zombie.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe N/A
File opened for modification C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Vancouver.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-multibyte-l1-1-0.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Melbourne.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Managua.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_zh_CN.jar.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nb.txt.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Indian\Maldives.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Menominee.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Singapore.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Linq.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Lima.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\sRGB.pf.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\mozwer.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Zombie.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1716 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe
PID 1716 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe
PID 1716 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe
PID 1716 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe
PID 1716 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe C:\Windows\SysWOW64\Zombie.exe
PID 1716 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe C:\Windows\SysWOW64\Zombie.exe
PID 1716 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe C:\Windows\SysWOW64\Zombie.exe
PID 1716 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe C:\Windows\SysWOW64\Zombie.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe

"C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe"

C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe

"_NetworkPrinters.xml.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

Network

N/A

Files

memory/1716-0-0x0000000000400000-0x0000000000408000-memory.dmp

\Windows\SysWOW64\Zombie.exe

MD5 dd136422b166b9cd5d24e5e901d59cfb
SHA1 54b9d373275fdb43516b7ee493f5b77e80bf99c5
SHA256 712cdeaed4d7984ac111013315249a8668d238ea9d82c1180e4a5b8175edf5f4
SHA512 bdfeb1dc15ba224ae9d187baea6a0742a5816c9d5216ff3d402ee5b4843bafe3b6b9c7c55b1e7f4ca4c588b602de42dedd5e10bb19578220dca90990c182fb79

C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe

MD5 608d3661374bdcbdd7f5d4b271b34ece
SHA1 339aa299787befe87ec67b638d14562c3e8499fa
SHA256 eacc6eafe44aa84d74598bd278b4d5cb77210fc82aa5276f5337664967d4cd02
SHA512 58f02842b27c750591649967d2f9c3be9273557aa44e142ab898bcc4dd70d7500d03d297565996a869c0a210f19e4ee1649a622a4062473ddf00f7fa11642912

memory/2064-17-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1716-14-0x00000000003E0000-0x00000000003E8000-memory.dmp

memory/1716-13-0x00000000003F0000-0x00000000003F8000-memory.dmp

memory/1716-26-0x00000000003E0000-0x00000000003E8000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

MD5 8ff0e55245767a0c653ffc64476441ce
SHA1 698243a2c3a6719143612b5990e3a1f80141c376
SHA256 f5085cac0f089174b3534eed63b7216ced9d685d12771bbebb1b5d537f835ddf
SHA512 903feaff9a389765b3a3c2b8c1ad8782a5218e86a1b14fe11aedcbfeec1eca2c98d16cc2e71e1b141003a7893937f5c3cd5ac4ff5e2c1e5f69e8403da49c96cc

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.exe.tmp

MD5 c4a7d60812df1e5ad60f2d7a8d31e118
SHA1 033ca9021b6740cf1f1d1cd43628e2dc306cd527
SHA256 c195f8e8e9319776547c31d1ab9b298844eb2e7c3718c5f86689d7f1fa545143
SHA512 a03a5ac34343b08b78dc8eed6c4c03c27e2e967ae6b761e4fd119fc3b28a465abc8b88e71c816c21812529efbdd4440c2a6738bd0dda7e491783120919320725

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.tmp

MD5 bab20c8387d8e2ba7d054dc04d365463
SHA1 b2e9a8ca9d37ac7451d7f48d97c67bfd05eea9a9
SHA256 00500ad120e09fe42929defee463f45e1874e99fa70d40a8802c8c28340994e8
SHA512 dd35aaf186cdc60500f5801969f4156c59dcbb2568dde60503f87e7cbcbd631dc12b7e1639d39dbfc7562bdbe837fc1a6e011ee288ba192852e250d1483b56d4

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

MD5 4936bc3b6588e11d0ec05cd0f484d88e
SHA1 4a1fba078ae8ed773619282da5aa4f3670e20a2f
SHA256 c8039d351d2fb8b15c4d5d22c32dc78059eaa7aee120951294d5a26e17cf3fcc
SHA512 73213d1ed2256ac0482296150c8cfe514cd6dedaef00b8da45191f55ec74005ad14eecdbf0ea9c0257b7bb898b4a561f0dd4d324335206446b9295cef16481bf

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.tmp

MD5 5a420015c3695a2737ca37cb5af665e7
SHA1 82a1d80a4d57312b90553acd823f77e7df96e94f
SHA256 859b0048cc5b5f4fb063217eb6889993f6944159e2dc7f14f25c17e8d766c011
SHA512 d61d46017a6e50fcb408e206f0f15e15178f12b2944b856fe0c190a3c3a91d0e48b290fb3e3ce9bf83976abbf80ef3ae1f8c4f4fc1ecb3e4d57eb342895ada3a

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.tmp

MD5 20c00eb0328370d8e0254be96d3cfe4b
SHA1 3de78a5b5468c40fb52375642b34e67aca6d4bda
SHA256 1aaf3dbca5fe63b3a1a76242e8f862864c8bbf73033cf78780ffb21e8042625b
SHA512 dcf640ff0bfd086c9dc6b30a67765baa8bf9b53d64c84c9099bac8da95057d352033909e4703a5f63859c28d9d01ed6690ea8cf399cc0c0aa6131c57081630ec

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.tmp

MD5 316b8b994f35edd928064e3d13f4141b
SHA1 e88f55cda51957481bb6d8fcc58f13cc8bcf10f7
SHA256 12ecd1b13cb82f7bec68ab49b59e3f37000e123262831e4b755f2fef09671f74
SHA512 d06bb2281894c1a40266777edb8cac61958a23c038a86ec0ba34c3d15570e0cc0cda492e1177a3a38886d9c839ed3e5aa16ca7ffc2fe30c5e5ca7152d6095758

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe.tmp

MD5 2ca34c4448eed7befa883e974607a488
SHA1 0e75940beec0198e67d54b6dcf2b1643ed2aa64b
SHA256 3ea3351ef24bd82dc8402da6367bbddb27becd2e15ecbebb23e610eb33cf5e63
SHA512 642da4e1116f8eba5d62508fff5d12391370bad23c9957818aec4c5687f7f3533e2e52e5ca585f5684002ea780f9f176453c587dfc217ae287d6b383a62dfeec

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.tmp

MD5 4aeabb1c6ec759f33a08439d264b0a9c
SHA1 9bbe9c80b293baa1919bd22399099bf609f04402
SHA256 d2d1590bbc75721dc10dcad15f38b657cbb339c440e3a1ec3e2465c4edec9177
SHA512 233b7a6aa660aec47a3f9972852da5345f39a9161eb78d0b29a2fedc94943ec17c2d5d9ae5c2dc97a494c139ad5ea928b7f6f15e7a6c7e058a38ab4509456eb0

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.tmp

MD5 0ffe55e7d981917dfc7aae2524b92257
SHA1 882e944628eff6d1f62f2f2054916ede6714018b
SHA256 d449d5d8acd2540e286793df06b18a0f89d650ed79ec49c8e5411e4404c57296
SHA512 cab30f400ef5c54da689e22a8bef2b34f54d5d2265c69413b527f92726f051d4f76f3bfa40836095cadec261eecd30598a68918f18300f595f3c4935463713bc

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.tmp

MD5 815c332eedb8b4a58c0ffcec39fc9c02
SHA1 1bcb4ebfb5e6537c0562126dfc599f430a30580c
SHA256 a8a0cda249a67eb0fdbee3d388d93732cbb8663c821b24a0d113625670b137a9
SHA512 aa9b98c68d78df700cf64a3f5e7656afb98f4372fd71df8af0ae6bf9f4e899915a4046743c7f76c18121c1e3efe01e0c8c24f0614d3cabbd7b2d3a6a501d4867

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.tmp

MD5 c7541b74f13e97d325c37176479aab89
SHA1 80048b195697cfa290dcd034f37a8869139514bc
SHA256 f1e092599c701df418505892ee566c3dabe6335cabe1b605f64c069e5ce930aa
SHA512 c319d0fb7eedc5a0216b0528b8474d1279223e64f694967f89cde97b771f76eec5d8b8e58f37a9648e93439cd7a1ea9fca4a255999b1b4ba597d9c43ef32d49e

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.tmp

MD5 9d1da69f05af685a38721fc0dc1f3468
SHA1 825a5c56815b3de6935b83d0a193c44dce69f60c
SHA256 d4fcbce04e589856d423860bdbc85d866ebb9894a73d9cfe29def135194528e3
SHA512 e789ecbd57c5e75b0cb6d09b95e67a47e8125d128bd3854b8859bd41af28c907165db3e79907f4a4c634007995e79d29355d481555a2d10afc3f8d60b1002eb3

memory/1716-89-0x00000000003E0000-0x00000000003E8000-memory.dmp

memory/1716-88-0x00000000003F0000-0x00000000003F8000-memory.dmp

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.tmp

MD5 22b12501d0d802c4c1eb36d6d2fd70c0
SHA1 6c879f674f46e4499865fdc82f06fad47f129d35
SHA256 60921ec11a3f0ff553b9b8d9d8f17e69f1dc85bdd5bb8ef0dc36e93ecce65dcc
SHA512 ff7da6720d13c20ce3b62d2c7ab677bfde41734d0a301c95004a1ee83ed587577052fe85b04273b45184dc77e71e03c3446a619734771812fb87369fb2247ecd

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.tmp

MD5 cefde7b03c24d604e411ac8def41fcb6
SHA1 2301ceb5f3813366ecf2ecc4e38dc205b9e0e21a
SHA256 1137e0422eeb69e782c8776b024f8360eefd57e36920ed95aec14d5d090aae70
SHA512 8db29da2fd48a298741d0d17c8f1a0f7c1af7fae5984e8205e5facdd1f158c1176bd5aea6568ffdaa660959ed7047d91f6c6f8b9aab6682060065f4422ef944b

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml.tmp

MD5 987aaaf1dd5ab5a9b1c3095f96c8246c
SHA1 37706abbf0ea1209f37bd18b3d18e3fe2cdf5430
SHA256 b8f24a90e6c158b76370eb7df7e24750691b6ff059027476c41d3401e341ec07
SHA512 af9c65c9c6db0f100434e206628d3b4599b8d78d238696bb4b991349b315c9ee6ad73b678a2d816f75cac7513dcb09092a2c67e1174a8041ac149608e0505830

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.tmp

MD5 ee2e3ad5c6f0cd79990c6daf363766b1
SHA1 fac4024751d9577b3498f4467de9497cd27ac277
SHA256 ffea2c4eb9346c7f72b41714852da7dcda88e09da63556828ecfda52838640fa
SHA512 0764fe8f2289aad0ea501b34c20d17d29a3aa6656f2dd46df112970b1f8abebf74b21f188271016a99853bb62458e3eaff2f47d24d8fbe4c0df087bc9331fb4b

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.tmp

MD5 dc26982632436a128becf60604bc84a1
SHA1 cc0ae52ad142363daae40b00f92fe0c0d65a93db
SHA256 ac38993007c7c1a15ec6f733a0eb4bce6ca5ce6ef06157c9267ef4c4d72b7ff9
SHA512 876c42ea0e67fc6ea42a05867e5328d3aa56ddb1db104c228e6519fcf668c6711ad33e8a675b1de283af833d420f13c5ffebdd72ec170f13e76b7a827af5807c

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.exe

MD5 5910e59235d17c5bd17993406acab3ec
SHA1 fcfa5fabe77988e3d393d13c66919e0e47a1e395
SHA256 0b7bf1a9981636ed4a6c101250730509adff65495dbde9731476d30e18f70cd3
SHA512 aa798cb515355a55bd1aa22999ed914fdfd4be72fa5b324ff5de11ca2afec00ae6cb7dc41d93ec5cc96685180aac262dd1988d75e913561871f6e7e7a55b5d67

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.tmp

MD5 27ac72833f7dd75a62f1665388a1d4a0
SHA1 6f4640331ef6f413316c758882701c05269171db
SHA256 9e3302034dcef56fa3b4b259fe7f2d9c07ce740a12fe83b5ced219f188774350
SHA512 78d97a765352516909d29e245a0064b2299f03f3854ac40b3ba88a21d73d9a71183cf16e91ce2eac71d460748964a69aaff660379c261c2d83f4298a28ea8d45

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml.tmp

MD5 ead286936353c3911e81081b430311b7
SHA1 374a1255f4c68c5d554440102ce6b465bcce7fb7
SHA256 d2f21e635a7d7856c5be7918826326d6c7cc783e20dc4180f1ab95906028ae89
SHA512 1fa8ddbdb76bc551f10c4d917539e0c1743e93c03e461d9efe6944b1090277e474a2de0884871dbfe1d863d634f942c62ec975300aa5fcc8b83b84fbb6382360

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.tmp

MD5 ef059a351c65344669eb7acb90b843b8
SHA1 6bc8e10cc18d17f0202a573fce6b642f4608edbf
SHA256 68b21364633d2526dcb386826d5c7440dbd84619619f0f843e8f44e9fb6596bb
SHA512 5fab644e549f65752f1ff3bc3a826f193996bbb699bc0c778853d937d5f8ecbb5967cf626864c093390e61caccd4b7dab78622eb8f8098056a7dbcb525c86ee3

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.tmp

MD5 37aaa48e76abbdc04c6099c90f140c23
SHA1 0d3325de362784d1e7223e500e5c0edab25948aa
SHA256 20262af6cd6a9488b2ac264ffe86bd834f1ab4903fd9611030d018b49f70b2cc
SHA512 f463607cdc8d49b0f6875e7525e64604b3715b10e50d5c656954e47a494419b3ba95c13f2ed4821d674ad5cbbd108a8f0ada41073fd6c867c473663b90f73a5a

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.tmp

MD5 8af3d5103636e79860eee57342e54267
SHA1 2a8b2bc2eeb47c042b14aa81a7845660f726be07
SHA256 8755621fbf72d1b25fadf55bf5520f76a8d77fde918db3479dbac2db3728dfd5
SHA512 54f2c4b4e2ddd496b4b8c1bacaba1ad4a55d2d33ed712074d574d6847160966b36713985ecacca63b1931384a6c4197fadbb2d3ba2d3085d84e3c3a02b9b0018

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.msi.tmp

MD5 c005b5083f5d22806c0e332987fcea96
SHA1 398cbbc8a48da06269b16575e784263db0746f8a
SHA256 b182c4e8b411a68d35775225d4a692f3591aad3db5578fc6318d989037eb6dc2
SHA512 a524860402e8b02b45734dc6fe2f2ac9ef1e637c3b0d7100ea7b21e9e05a209166c9c39408ae6dd2ab333e9de0c86809d7ab81022fbb8b57f0e05159d334e4da

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.tmp

MD5 117a30abff74ec5e50d3c6ddcb1b9099
SHA1 856ab090ee3f11d11436e1997b3434808e33d414
SHA256 24c8b368f36a23c580801147c6b4da59d7a33b0c27967f4a807c5c187ffc38ef
SHA512 f21429b9ae9d7454823dab20f175fb0b09e1d0233a89124df5da0d25dd10ea5a680253f056759598bebe33cb0ae15478743279f58b53d5561ec405ddca945b1c

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.tmp

MD5 f8b443860d1ee42a01e6631149c54b3e
SHA1 d18b029bd2766b50a6a9feb79c00ca08458cfe68
SHA256 4acb408cb050d029c81e126f13145ddf77f7618f84239596e374becabc75ac60
SHA512 ca5df00d98e9fe4778beebff75fccfbb07d0f2e8a1651d57ebfc75caf414d46ac0ffb82af72022f6aec00da5ae93a79b4aeec37a0eaa2ec43328105069c8aa9e

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.msi.tmp

MD5 66c3093663e17019fd707f602138a57a
SHA1 b94bf9a4b67e108ea464baf6784716ef62a83be7
SHA256 e39e25f6be94ae6397cd1c00973fe11855f543fba3ea2060dc1cd5cd0ea5148c
SHA512 14933fc43e2b6bed2bf677663442dd55783fb547b142b3744101856c1b0c2f22808eb7f6983a124674e55120c2bb0811c810a8d76ef8859b7e9291d94b4cfaf9

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.tmp

MD5 55f55856cf18f190c3ba06956710747b
SHA1 a00491e914ea2fa1c7eaff79054a6b03ec201943
SHA256 c1274085479b98343dfa1a7a6fd3ba22dc9ee8159d267ccfa46f49e728533fb7
SHA512 32c2401bed057b01a90b587dc75c67a1309b4a3c47b2b0693f485a748022813b667809db5096df0f3ad64f0e1e3ca726cbb5659acc2a321e66167486549fe5a4

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.tmp

MD5 04719fc188f3f0d6d99c957f022d4ca6
SHA1 bb2d6226a46d092a5c08d053ace10e4c20a67ca4
SHA256 df0134b5a343dc9a78f402cec2aa4d38dc28f7338d917c08d7f88402236c7ac4
SHA512 9fb1a3f13e00060b75a106a568afade0df54bc2f060d94ab0fa34b96cf93106297c667c318f8da1abb221546fa862691a1703be33d5a90450c397a5cddcb9b32

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi.tmp

MD5 a5f05313a49cb33633b3907ae1903eec
SHA1 dad45cf0b89e979fda906f9506ab055a56a5e9a9
SHA256 3cd7d2b2ac6db8c61503aee89c593c26b79e7302751e355cbd44d7adedb5261b
SHA512 dce4914c9b669919b7714e780f765fffbd9808a234bdd39379ea1ee55948e5237a6761cdf0895911a6459e9aafd7c383356579ff48c07974f3a4461be52b81cc

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi.tmp

MD5 3266e8928d547b5d874deef050205bf3
SHA1 1766690288cc78ec0106bfa910bd29c6737f314d
SHA256 634efb5f4f308b9f9a60e57565ed39258ec4bc2b4ae46bacf2297ce74182c7f7
SHA512 adfd8be46545195f2db737ea587e05281c926f3c3d54cf86236aa43e84430cf0e4127ba4b0550ab3f96696636db0115957e5527180c9bf192fea2ad1130a54ef

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi.tmp

MD5 0988f8c318081f9219be2b5ad1f22b4a
SHA1 a639f8212b4649d323c0d69338220443851f30e4
SHA256 ef97a440f4390b1c79356339ae603a11af12a1b47aa1bf7213ab259ccd1d05d3
SHA512 ec9b2c8eec3f85c8b5683195221b56bda31beccb1f55543994ed43d26381aac24f7aa6bccc1584b19c95cbc3ca32741a076b12bf58cf679ce1b0d8a99651e0d1

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml.tmp

MD5 0b6b8df5728f704f645bf4ba23a9ec71
SHA1 d8deb21aa549db5e1884b0a829953fcddba463b9
SHA256 c630c0419260eb34e466416b3a69d7e3700b8ad3342d210e81eddf1924b85276
SHA512 d043a2d40999be4929be5a04532eb0944d1fdcdf198d15e896901cceb530b45c0c21420f32115ca280528f3db46dab1285d59d15216fe59fb2c4706a9f58f594

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml.tmp

MD5 410d473b9d662f5297bfe0236cb34c9c
SHA1 fbc43e6661a1a8fdbe4d61f3719662a936141bfd
SHA256 784b696874fbd03bec37be7211d9f417bf3f79e8198788fe5f926933bb5b9c9b
SHA512 61c3804be3c18aea6f78af6901dfc000f6f2e65de23c8778155d4d945b9a17da251a4d6964b879196599f97759dc50494d1573dcf27eb69aa0797c73fcea08c4

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp

MD5 54ba999d285e889ceb78c70cdc1ed574
SHA1 9fa50c359f311d82ecd228734a8dd996fe37e849
SHA256 972a16ff831c51a28b97f2efb1fa8447d16276245f3c1e47aedfdb11c31a491f
SHA512 d807cd475f8be3649c121c0fb5b92b8360a1f9daa92a7268f3d6729c61d29fd2761f3c84aeea526296fe8fbc48457a45f7a7e4788ce4bec8fd9bc19f95220797

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp

MD5 832406f193806a22350bf2b8b11bb460
SHA1 4770c3242efcaf6dfb5094a57519bbc3fc2cbef4
SHA256 efa0e81e6cad337781880a3d4b8ca44251c6cdb30cfb1d8cfb3780e062716728
SHA512 71e11f48f7ed3bfd70e543eda6d6adf523dfd921c6858da8ebc624de9b65372abbf2baaf455e17041162cf0cfe90b67d7e7565797cc5619559d340c3c809757a

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.tmp

MD5 3eb7e470824093fe166990e41455b66f
SHA1 b2a025441e645640e74a2493a3c31f809f7fd9ad
SHA256 7675af1ce8b54833720fd66464883b1a265fc9ffe961048fbf6abe23dcc16570
SHA512 009ccf694e37ee08c1a8c6df2e9a7686c60533b5b9219d2d2b970efe26df2b007608fa91f75d2032319230a7f1c3e165d4ab506e31e868b738d331e2dabbff3e

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.tmp

MD5 61ef1d9d74e363c8307b892dc0328a46
SHA1 cd019c10cbe432604d75af9264beaadf237801b9
SHA256 5f9cb5657feebb78007bbe312b76e44679c9c9d6434512481b25b57b5775db33
SHA512 3c45a0e7a6f32b3ade26d3becaf2c71fe80a66180f986ae4c8b48053ef118b604843d62631ee720b8773aab23f3c274dd91f716bd178354e10e3eb147dce83be

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab.tmp

MD5 0ce847620e2e2ad1cd497aea329ed671
SHA1 c8abb93e78995e9bcdd6005632c4b3d368728172
SHA256 8f58636dd3ad5bcf3dd0cbbbb252fc81d761f691b846b9977fa0e65e3c5eb292
SHA512 52671a8cd12c362a4421c9f5ca43f7086e859782602e0d4824f774e001a3aec5b30cd45004b620ed4a2dc3f3f0ea682a63d49d03cdb3c0ae4fbdd2ef42d741ec

C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.tmp

MD5 76c962f8ea965e7de8f287b294891265
SHA1 ce114502ee49061043adebecaf9f9b86c72b8371
SHA256 0dd0a741afd4e19a2a02d6d850408fecabd642776333472b03ba73169c0edaa1
SHA512 3f36d0b68963025af2956bce9ff75496897f464890fa1ef06155842b57fa0b5cc19f755a039222dd0ba32c06ef3fb22e74500953cd71ecaa6372f8e30753b35e

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll.exe

MD5 6bd9b5209c119ec37476fcf421328549
SHA1 054fb020a52a68a21ccc82c121a0f480de774595
SHA256 57bc3a6eccf5554c74265aed938118f85a82afd2f4e1f7cdd5fdd0afd2b32c12
SHA512 8b4110bc5725a939926e75da5142dad13a7392a041d81211b486acdaf0bf9003bfcdc8aa5edc8f8cec13a21a1a1533b93f4d42b32abf12d3cc1ae0bca63e53d0

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml.tmp

MD5 6b12cdb99e4739f6c28eca8fe9c3dfb1
SHA1 9a87717ddba1b5be86e6c642354487d7c782c7d1
SHA256 a08cd62ebff48f0546ea4371d25418106af6b17f3ae176020a6cf8fa320c6d5b
SHA512 72067cfe62aa677e946ce008010ece79d402bf169900eb9d918aba49e66e2891c8443433a82286d4a298b0cbb5cecc1ee210d95f7a7ba2aa5097e983122ef48c

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE.tmp

MD5 2e93ff0da1c217f02e75f6985e87d32a
SHA1 f29f3da5add5e82ea240f0f889cbb999e1b0ec79
SHA256 e2b345371aee484f801da0e0e7395f9592ec8f47767c4091c4c7ff790767f9b3
SHA512 9ff528a1324d0f562420a96987fb9946238b65b2d80e2d7a9d37da2b2146b77922b9005103994addbc46934666e264843bcef3337defab79e391361a2f87d4a6

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE

MD5 fd37498583e96043ac37583df42b3f2f
SHA1 6481fb94c84f5f40bf34aa7ae73705090b10172a
SHA256 ec55a99b676a15a6fbee9a4f9813f637b44a476ccae6fab9392cca11833f6ff4
SHA512 aaf0c3d45a222c4f67af8fe0838844d2f53f8bf2b67e1eb811bae92bd4b4e91006b3c2cdeb175ffdc4add29d1c907dd2bac193ced1422671913c49b01c30a2af

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll.tmp

MD5 a782e714eac6fd3b2eda50fe27854811
SHA1 2b897011c9c6359b4ad08d54981a49f51154ca7b
SHA256 d88516014236662b9c8330fd16143068c705b183af9920e7d18204f85db10b17
SHA512 7613e196b991036431269e0244ccc34b5dabe308a5116cf4bb9f0669b4850d6d1a11231c4e2d3897806d7932a2c33592960e0c518d8263d54c6949a8011daa9e

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll.tmp

MD5 806b02b9253456c2c230754ad45693ad
SHA1 c953677a057235bf18aa1a7cd0b30da1fac448e1
SHA256 58bce0a3c6f4952f2a5dd50c07cd46b718da45da69d894babdab5ddd50e869db
SHA512 a10b19a95a251388679e0886e8bf99c968ee8649c6d4538e794c9bf52426befdd7faeb4efc2fc8ace767781916b80e2cdd2c3ff46c3b0ae8750fe6b61f0435db

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe.tmp

MD5 45c62254615621076b5475db83a48d1d
SHA1 71eb82c09f8472e9ba211762f5ce8d4f549cbd43
SHA256 8d8955705f0c9c2ec846de4153441e747ee4e8cada716585f5cabb7f518299e8
SHA512 c020fe45644ac0ae91f6b94c0474bb5606b272dd0328008372eb00e644605ca94e887c45550a14c8abffdc8ace0cef9b283f6dc184122973de85de47346b036b

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll.tmp

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll.tmp

MD5 04716243c7d457718574ae375d82321d
SHA1 64f576da397031e1aa41cd7ec6cdaeafe2ade47c
SHA256 5051e0ea671d25bec5703a312517ff611698dda167f62515719583a4df0adb0a
SHA512 33d4bd11dbb8c1d5a7955bfd23069d28e5f13689f15d7d4cb351c1143227a1aef47303fd6e18e9d45bb2d8b9b5573d54657dc987819b01b7045613f703d49f79

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab.tmp

MD5 13052a4911cd34aa38b9a5fe9260860b
SHA1 e9c161385442aab36ba2edfc54a5398855f7ab7e
SHA256 804f7b747c5761c85ad3af266a27052b7e77c434ec57419b10190a560f4633b3
SHA512 52905b9d38e680e882cd2d1b5bbb7ea54a14c9cae1a9e181a841b17b74a6d3d48dc73145114e35f78aaf280e1165ab3b681868dd1a883e5d8c8d0fad834cc4f8

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab.tmp

MD5 b92ec1cc408508d51ee5eab383a3a80e
SHA1 5290e7b9e67f549d1172228ba893131aeac3ad58
SHA256 f46da93c60f7497e37a48bf7c408cdea51d88a750749627c833b1d90a1799a8f
SHA512 2e1515673d89d424735f1a8ed7f759a196d26069e5520db13b2e24487464479e29d031cbdaeafca78e156ae24a48c33def765baddb6960cb0ee6adc451fcba5a

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi.tmp

MD5 bc9013fb34df001656378e200ffe6caa
SHA1 5cc186da7564f5853fcf25eb629dfd509325fdd1
SHA256 048efb3679f81d168a88cf52d9a74fb90f955d54529543a8cd7b99faacfa00f0
SHA512 245c4153545b892bb76c9f48d31df46189fa227fad8a65c6996486f4d71212311ecb0f700faaeb5d27d0550b78f77c5f7d6b78bda605eae727f440ea6682904b

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.xml.tmp

MD5 1bcc3f3c94d1e81e6999490ffb41d50c
SHA1 2124a3ff8ef0f09d44991878f2522cf09ea2ba7b
SHA256 da83a716691016262ddce2bd7b3f0202ab814954b0b10fb4eb6a66a63b84087a
SHA512 6f8aa28bd135ddfbb6d735c7fd146dd9228e9a67314ea52647067f96f022864c3e9f5bd0ea42ff69c7f5fb0369616ea9bc90117baf855cb381815129d8d27d58

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-20 00:23

Reported

2024-10-20 00:25

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

103s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe"

Signatures

Renames multiple (4548) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
N/A N/A C:\Windows\SysWOW64\Zombie.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe N/A
File opened for modification C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\System\ado\msado27.tlb.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\deploy.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Contracts.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationFramework.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Zombie.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe

"C:\Users\Admin\AppData\Local\Temp\dfba8338c3941517c1272ee379e101124dbed47a714c4797335e985ba756113bN.exe"

C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe

"_NetworkPrinters.xml.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 105.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/3572-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe

MD5 608d3661374bdcbdd7f5d4b271b34ece
SHA1 339aa299787befe87ec67b638d14562c3e8499fa
SHA256 eacc6eafe44aa84d74598bd278b4d5cb77210fc82aa5276f5337664967d4cd02
SHA512 58f02842b27c750591649967d2f9c3be9273557aa44e142ab898bcc4dd70d7500d03d297565996a869c0a210f19e4ee1649a622a4062473ddf00f7fa11642912

C:\Windows\SysWOW64\Zombie.exe

MD5 dd136422b166b9cd5d24e5e901d59cfb
SHA1 54b9d373275fdb43516b7ee493f5b77e80bf99c5
SHA256 712cdeaed4d7984ac111013315249a8668d238ea9d82c1180e4a5b8175edf5f4
SHA512 bdfeb1dc15ba224ae9d187baea6a0742a5816c9d5216ff3d402ee5b4843bafe3b6b9c7c55b1e7f4ca4c588b602de42dedd5e10bb19578220dca90990c182fb79

C:\$Recycle.Bin\S-1-5-21-493223053-2004649691-1575712786-1000\desktop.ini.tmp

MD5 c4f6f30f154afeca6705a9280ce03e47
SHA1 72acdff10ee14a2847ece61be19862a58cc86b2b
SHA256 e5485da5728483bb49bfb3211e3097317d4319a0527c7a1ff98e7a68a42ba47d
SHA512 ea80aa1816bb8ee507a402f183f959d9cd480e2cbb962ec607a9727350f885361b1e59ee54305a4ff1ab63d647b5dc38c7c6ee19c2c8254e03dee1368cd94611

C:\Program Files\7-Zip\7-zip.chm.tmp

MD5 58a6d20a86b30307b100aafa8c9ee814
SHA1 d7db7aba10862983765e8c6cbcaf1ef1a9da81f7
SHA256 16afcb8de48ecc046b5dae960d1221e227d411f02ca2ecc3ef0aa08c1a5de2c9
SHA512 96e2d5e26cc12cd89dd1b060615e7699e52667bf8c1f938ebc9c562e13f081ec95863034ac9ec3bd35a0f888e0e6d3dd931ef8207d0faf770576b1f41c6a8fd1

memory/776-11-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 6ed7bf89a02ed7fd71628830a5df766c
SHA1 6b09a5965d15e4666599386ceb0bd9194ef553ad
SHA256 5b9020c1d1aac8a56916477397bf0c47de4d88845db9cb02c3121f0bcf09acd1
SHA512 51f676562cd6de23bf69c42b63e1731f9c52ee3071cb453aeeacd49b6339fbf1ae8976914c59e4eb672870cf99724e869989ca023d07a17f5a0919e30ab5c553

C:\Program Files\7-Zip\7-zip32.dll.tmp

MD5 7640a5d8b5d28cfa1a03455bb3841a60
SHA1 6ded4fc70840012101582bd87a763e9725a06fd3
SHA256 14aabf9ca1a021cce8e9a48c1a51f56eea8916bdc0a73e3175110807cb4f4d47
SHA512 a86502d745562cfb49ade3cdb2349541375d3976326f7f71701b07bc6bfac806bca1ff7c6d71066776e9b71ab334e5343b58eb966acdd6fc2fc74a8c54a496b9

C:\Program Files\7-Zip\7z.dll.tmp

MD5 1b1d19f99301ce0848395a841a4af160
SHA1 e4ba7d5ed0ba0f3093ed6bdc34e64086e19cab07
SHA256 a078da845de9a83245b8973dc3f6c4a533fcb5659bbdea9c3e275e634737e9e9
SHA512 1fac9980bf1f21d0b6cc29f55cfa768a4e04d7e9045b4f83fe2d413fb3a01fceb57c8ea643c76123745b3ac5354b44fb993c1b1a8c564af97e11398da4f50829

C:\Program Files\7-Zip\7z.exe.tmp

MD5 88b62b87ad85c2013fe03a73e0b38266
SHA1 33f7476184f70d5ae5ba7f1f8e461fa130dba466
SHA256 1b597e97c0f25ef82fa0f535630f521a676b926b5912d4a09c71683710d32f44
SHA512 a356556f927328eb88f399c032effc9ce92cab0aacf1324e2dc0e3566c5b3da45657bc12a8b48764c7de931378e80e20cb873401ec9e2ce078f8f76e88b767e3

C:\Program Files\7-Zip\7z.sfx.tmp

MD5 f39e5a5924c23ad61f29126275f980bf
SHA1 578cf5e3da9ef4df5cb3ad677293da8de6a8af00
SHA256 990db47af40732274559f06d077e091f5f7b92812fc1094328aa97c3e95690a3
SHA512 d02e9ae1b8260fe9258d2b4d6a5e4f2910bc42a93a68a6e1ec537c4c49a0fbb13dc622ad6cec410155dc29976dcf029f4b57162caebba7bced7402a9fbb9a822

C:\Program Files\7-Zip\7zCon.sfx.tmp

MD5 f41ce8acbab9ab6c80a36b8285414bed
SHA1 b14355eb0be6c25a4c0f15298a1a28cce45970f9
SHA256 a4f50ce9b434932ca123c5f839dbd249a7ea9b87a9c499c61616c31b1f4270aa
SHA512 4b619267335952fb1241a482e41f2a6ebd67e4b1158d9d24eaa27e76b2643645afe1a93fa726e743cb03439d526dc1a7126d61ec4e87b79d9838a100a70fff65

C:\Program Files\7-Zip\7zFM.exe.tmp

MD5 21ef5a34ea1fd91547a2bcee8354153c
SHA1 b71aab34050ca5172a314cca6a23be0e540dce56
SHA256 df1832939f06a73979544b3eab143ab67f567aca9f022a5508effe3ef35dc33f
SHA512 e6e40201c2af731b9e4c478c349e92b0a9738a896ecc760d6bf48fa3909601c145bbffcc2f1f1109c1b6dacda7c22f9bbe2c52dfd784196a2a15eec80826ce9e

C:\Program Files\7-Zip\7zG.exe.tmp

MD5 b09cf9e445c4a95d3863f5134c6bd034
SHA1 5b60d815af407c5ab8bfe7b4b2b7704d859dcba6
SHA256 2ac97d942caeabcb22eb6e02a682460281ebd52d7b659f807fa3239f4552a99a
SHA512 b68f2c46dea4d8c8a447bf494de3663cf86b57320464088d7c1264b7a0f410135572e4794b3461908842471b17b42aab122b9ae427e6d27ea08caa9b24c683d2

C:\Program Files\7-Zip\Lang\af.txt.exe

MD5 4a25737a5f4794f35488f0d64209a6c5
SHA1 7d25b0d573b1e8e1506bb105e84b69d4daa29531
SHA256 f650e401f8dddd5ecd28cac0657f8013c4c4fdcdef70f3b6b3a820b80c4e9f80
SHA512 439f462cc14cfcef639b71c108170bbaa3ca52e6b1e3b85f72ca905879cb5b0d93a44200f6378d5d1857b1a9a1c037ab0c71fc23439a3962f564e01012ea6614

C:\Program Files\7-Zip\Lang\an.txt.exe

MD5 da9c64c8328d44e1e7fcc1e67b47663f
SHA1 0231f5b716c2218c0a4ce6bf31d9c2ade4e473a4
SHA256 9e3744475fd5ad3d7df46e7ed4a1f57841b2102908da3cfa8574c87bf0adc8d1
SHA512 2e9df772f85074c8fbea742ad2ad6f62cd6d530ebbc7d0b0826c0541123a3a0101248df40aa06e603df1cd277ff9ab9de4856a30ab38ef283bf5abdf696f2533

C:\Program Files\7-Zip\Lang\az.txt.tmp

MD5 5869b3ed60ae20719d9f986d1c934b4b
SHA1 88ace11b7cf5acd36799b15f10764938f04aaf3c
SHA256 f68962f406f188a600b82ceea798df432e654106c29ae5f3ff665ecf33f7a070
SHA512 f965a9ef70a99aaabb14dbba7e769c1e911897b9451991d1fb2cfc13a23e73a7fdd997e8666d67b1b0aac12a9cdccfe24241b1d4d9c860ee4de96c5c5bba04fa

C:\Program Files\7-Zip\Lang\be.txt.tmp

MD5 94de63a4a27c6428381de27f370e814a
SHA1 afe105b1152388d473e3b7c04c43b65a3221be4e
SHA256 34529621ab4b0d05793f300694df7d540f19bc62475fbfaca1acd28f7338e917
SHA512 c843a946535a1de4103f412a3b297f3898b25236b00bc45097adce1f00a585bb8bf6658cdc42c4e94af1bf7528be6f49327c947eacf3819bdb2ed1ae18e814ff

C:\Program Files\7-Zip\Lang\bg.txt.tmp

MD5 92e41c4f30454c4276f5882aa5c83d15
SHA1 b1ddc89cd8631dff6421784ec888235d26b834d4
SHA256 2edd4c501c33a6fe5bf8d3891498989488a958224b4b1cbbd17348815e2a5b68
SHA512 f427c5bec967240b20c71e82864caf7ce376bbaab31eb4fa687241bc99a863d373cd84acc84a2a7c8f81df5b04642fe263bacf3f1e158030a03a28584a02e0e6

C:\Program Files\7-Zip\Lang\co.txt.tmp

MD5 6e4db368cb0d07a0a5f247e777b32be0
SHA1 580a54bc9f1b0ca447b2e02a1bf14e6bd1770da8
SHA256 5f9b124d42916881514ffc2d36a66f3d44528104bb572ecd6f74958c0df87942
SHA512 049213cf5a3ff4bf4b4b66f2b9a444318760b7297ad9ebb0abe9c42c53ee16af1cd036341648c3abb3cf03afb74e8e74c8e495c60f5452745f01f13490e32ccd

C:\Program Files\7-Zip\Lang\ca.txt.tmp

MD5 65bcd7aa50d2e7a84ba655c6451163dd
SHA1 31fd49723d3c9231806bebbc90832d7365e41ade
SHA256 5ee32d614d7a0a0a03b8cbbd818394cf98a11e827cdccad475774a5771e6aa77
SHA512 206bea74c9828d88da897a80255df66317ef5eef089204d6c50d2ed75e9f059536137c53a1a652ca09685d8ae0d0ac301dc4441c6ebf543a296a243d04daed0d

C:\Program Files\7-Zip\Lang\br.txt.tmp

MD5 b482cdee1e146d69457d2125411ec244
SHA1 67b0d6f535f416c5dd63e96fc6cd0cc2bc4781bc
SHA256 75a7ffed7534fd9ed88a080e0f348df724cfbfe9221360872afe1c1c87ce252b
SHA512 975b92f2a94419d9bc59da3e6fffa0515b9530006c6e7f6db4c37f39d683c44be7085d42618bd793ec2e2b2ddba431532b6e71b5cb6ca7867ee56a8f8888b0fc

C:\Program Files\7-Zip\Lang\bn.txt.tmp

MD5 4b8bcf08afc3a38e9b78004b67ab6ed8
SHA1 ac0a2874373699aa65b93475a5093aaaa011b19b
SHA256 1ab68209842a77adb35d80b1bc6865b62ffad0ae997c1050fa8b5966042af57d
SHA512 4c08c9c2580cbc71fc251b7efb25a928afb9f95a8aacd75fd43536c1401efa897405c65eb04d4a16ca69701f183c031db6fdcc521d89c070b350e811c425276c

C:\Program Files\7-Zip\Lang\cy.txt.tmp

MD5 5f556624364d636fd9a8bcf3a3849efe
SHA1 8112f0aef300e04c78cd463204820dc781a4bb04
SHA256 a8d9e9cecfadd434ba8145d0043368bac921085514cc1055c94d5958fea47737
SHA512 1dbe69bbe9002e7d8cbcf02586e6e9be95d0d582468e618d7820e32c2835c136c2784e031b7fa3c4c4ee50f1ba3bc3540a538de443f8866417e7d2ed7a45b42f

C:\Program Files\7-Zip\Lang\da.txt.tmp

MD5 27f006b3aae3591ee5337360e86d8e17
SHA1 758d40f61b9e8cd35535ec5cacbbd2b64ac2aece
SHA256 81ec0d516f68a4f42436024a5a159f8dd77771fe90d14fec1abcf469bdb07d7a
SHA512 a6272bab6c3c59a7a5a4260f913e6b067352169d0cf8635faea699deb9b463b448483f954a65779d9162d2db91ed6a7fcbd9335fe47afc591aae7608afeec1dc

C:\Program Files\7-Zip\Lang\de.txt.tmp

MD5 a734b2a27e01275a11d0cb9236ca5576
SHA1 c18f6531a68a81ec27e51c0bec5976fcfbeff21b
SHA256 d2d27d758d499c245f413b0c201cf5c123e748f7cf3bd2378bbb4a1b8a3abdec
SHA512 0a6fa57132f263749777b96981006b26d8c59f6d722309a1c155b1cd54f939371ccccded0fc82816bad17c7b67cf57ebedbf926a1df24c99243118d48fe03703

C:\Program Files\7-Zip\Lang\es.txt.tmp

MD5 f00579803c6561bedc8eceeabdb5532a
SHA1 55e606a0a4864de1988629d6557db98675065e50
SHA256 9d8dc5c349e30c667bb2f8eb82c4157004d1e7ef04a5b097d118c26407871dc4
SHA512 ff8c22b3d31029f6261fb3f5d4a21354cdb8df9e24d725fa26d248fe46287b838bdab1865687342687b92eb946a8d10ab9b126e6848a247677ef7ee3d53fff79

C:\Program Files\7-Zip\Lang\et.txt.tmp

MD5 490864a2568b950a9e78a3740c84ea37
SHA1 f5adf4521e4b63224a087a72be3377f63eecda8c
SHA256 65d3229bee45eb7c521c1f752c38cc91f526bf27c742ffe4ed5aa502d32e9313
SHA512 d11f5835ea160650d2671024bece86fa46c1a9fcf4d52b1a223e1960fe1e1d5c749377b811a9a5717d8033136bb26756f1b013ffd8bc47f14abd521871dc723e

C:\Program Files\7-Zip\Lang\eu.txt.tmp

MD5 10fb9ae0ef83ca499e5d3a6ac160b4bc
SHA1 c1deb245f41c9f9962de3f213974a7e767ba302f
SHA256 dbe338fcdd7a1bcd1d40ff1eb094326332e62479741a26727945c92d287fa9b9
SHA512 6d27a537e2cfc280c892e5e8681c71b49d4812741b602e3eea15a0a986fb88e0a3be71fa94c347a3c578e0720002e4cf3730564ea76bd4b3a61d3e809021537b

C:\Program Files\7-Zip\Lang\fa.txt.tmp

MD5 c50e5bd74075a37c8ce36207936228f1
SHA1 8c734879712ab63e5f17de5e58d6d42ce70f8784
SHA256 e4d2a2f26cc77a3d30aa02d263c66591f258c1661257bc721a8828ac46196eac
SHA512 8a778188cc1d0680b85f01ec0068aaa41e396afc8af7c92c4fda83c371533518ad34213f17011f219708f97189b585bcb0563f7663aedb3347ec53bdd1f482c7

C:\Program Files\7-Zip\Lang\fi.txt.tmp

MD5 d73b8bccf1a360515d7869b67de76203
SHA1 28745d3fab2f746d21f25af30a2496e810f71379
SHA256 d393d1a447d0eb0b363bbcfa094cfacb25451ffcb8285a556e01447c3eaebf63
SHA512 af8ee84c8710f26297a314dab314e50552357f9d6fdb8b91caf382227da8ea39d7b73fd7873f9c6f74bf5598980bd38788139d95ff7da497871091538d3f86d3

C:\Program Files\7-Zip\Lang\fr.txt.tmp

MD5 7c130cb3c252bcf2bc1637ef20191d42
SHA1 1930a2eedaf7177f72533bc87e924431cd08934c
SHA256 8f9687c356b18d76b802b493b60d692df491ba1b7a3e184dd006b3c343b9f3d0
SHA512 cde349ce4815d841c38a69a7725e65167f61e3e61082be53a0717d528b4e9b3d8cae2d5f5c1f383a3c78dbc68e83b968f969fced7b428c083d81fe90ac4414bc

C:\Program Files\7-Zip\Lang\fur.txt.tmp

MD5 ce62e489a91beaa9dfe1f3566bbc8e19
SHA1 26da8760a41c904191e7769a8b669d143d0ca7ab
SHA256 eae9c7fe24dc362387b02b7ef078ecc89ef22f89d5e0bb8226735ccadc7dc0bd
SHA512 dff75dedeb48ad228d579b9b638d5ae9f461742ec263c70105f54b60b45470efd7a09b62370f05edc580c6f658d146101d49f85a6be03de6cf943bc38ea2db91

C:\Program Files\7-Zip\Lang\fy.txt.tmp

MD5 c37301f8433d0907b1cd7f10f39c26d2
SHA1 a84a75aeddf8b9e5760e05234d0d71218e2a3fa7
SHA256 c1d8513941545e444bdddda315a10c3cb566fde65dbe36f7ede0243935d925c0
SHA512 f9b495ddddfd7a59c84cf575265bc2f5e9504984e8d8b3055db1a077a2540b88dc74c38ff595cdfc68564254558b004a06d8540e994e40da4ed02e419baa8cf1

C:\Program Files\7-Zip\Lang\ga.txt.tmp

MD5 a836343134c89822959dc8f2e4e3949f
SHA1 b8a061f9194cbfdb46e4d9b9843e12b4595c4120
SHA256 c8cef28905cf6f856bd4e7dbc3096a5b98aa99dfe4b97e79899ecbefb93f40b6
SHA512 575612ed1eceb9fc697a1628a9e42cea37b52ce271ac6b4e049893618f36f81f75d80fc8242fcf615b9f75c3fe127ae4fde6e5ee8cdb5faf42808d48bc6c4613

C:\Program Files\7-Zip\Lang\hi.txt.tmp

MD5 9d066be37cc96999d9d3ff4cacc642ae
SHA1 9745c3726b1db61d70cd8c6ffbed61ffa2f04d0c
SHA256 7af40b1a787073eceec90229e6c6e06661c6e08120a322724d9483421a29408d
SHA512 b09028467f89d1b463af4b7611d946e8479e7135bb37dc51710e769acfb02242c9237db4345651ecd277984a190f3801bbf9167fbe7284719c949d052a505384

C:\Program Files\7-Zip\Lang\hr.txt.tmp

MD5 e10bc49f79e3f67ec730f87c7bc25112
SHA1 73e61113542b50b2ce318a056b6d3c4b040c0223
SHA256 df54824a5f9c1a4707051ce390348925d1088b846479c0e91ac0bf42bb5b5832
SHA512 c0405684b79554ef1572116d71f230afb5711233814d306807e340db3bc2e150709b0ad50183a07286ef1833ca31864bb23ffb6072d28fea4dce57a010445ed7

C:\Program Files\7-Zip\Lang\hu.txt.tmp

MD5 af2423e9a3dd9092dd8558392d36c1b6
SHA1 ddede53e85ae8124d9af39bff980e62fedfa4b52
SHA256 dee82ab112eebede6048bde1dd4a199f13873105a785b5a7091eac57c6c15917
SHA512 2c061461aa7d0aba34765ec7ae0f16b4637ec536be319626ca8dd9bf125e2aa9d98d834ca59926d362bf4dda856ae27e8fe702a1c06f95c5523d5d2084bc057b

C:\Program Files\7-Zip\Lang\hy.txt.tmp

MD5 e84f90c5e614d2b2cc70a02133bdbbcd
SHA1 fbfd642dade2377c9be8144a6541a24e140862f7
SHA256 4728de874f648dbb58638ec0e38756f60366c67b37bcb25a573aea7d7a75c17a
SHA512 80e977156d630fe96e7c08cc941b2d03871e3b514fb1ce27aef7a629ae3009c57d960696bf76a04c5dc6a9f6281dc5e99c6c589cae59aed5ef4338f5712737e4

C:\Program Files\7-Zip\Lang\io.txt.tmp

MD5 3f386a9b996436b791ba98354d66c0c2
SHA1 227828c5411c3269b08568e16a0397069cda277b
SHA256 b29e3495beb325f0786f36d14e5c4099bd150aee273e9bc82af30d3b462f2616
SHA512 5895f67126bc30d7bc083afe69352e414596bb2d747f5da7250349416e03c5348d56c3b7a61faf13311bcf04de11c689ccfce2de05a3f6fe8200eeeabac173e6

C:\Program Files\7-Zip\Lang\is.txt.tmp

MD5 3027812b32afc0dda7549a7b66993f76
SHA1 011abc7c2cf0ad88fdff110d37ce3ad63dc34591
SHA256 6480a42cb10773fdd0c6dd2dad666298c7a0f7766d886b222f2e6ab621c843ac
SHA512 2e0252a6cc871e61b24a8ffcea524643e5c69117414283154e156fc77a638aef8e1458034cb2bd4bdcaf7d8be2421a1a774d51a3df37a64bda3c4ff8d3193f2c

C:\Program Files\7-Zip\Lang\kaa.txt.tmp

MD5 76faf55d92d979571604f66940d7de4c
SHA1 326ff05796a7ceb8b5814decd80f62a3c1788fe9
SHA256 4cdce2778c843767ddd0ec72c91b2060ae589c9d80535c13c27c6dc8f2e0aac2
SHA512 38249f7651ffd38d5bbd12fbf8de31379842344117a5f8a4f2768f4fef303175980d587acbe85c8e366d5499c8b2b3a6454bbd275531cdcb57d488903a64e76a

C:\Program Files\7-Zip\Lang\kab.txt.tmp

MD5 bc545727a434d0e93992372a6f1d7b12
SHA1 9b475f1177498a5557e3a8d237431acb0f722c04
SHA256 1c10c72f4951a938bfcb0e6daf0052637ea61caa7a6dfc8da76024bf325b7cd9
SHA512 1b4061c7d194475216347cd9ec615e2b1b48c151a028b188cfb94fc78ae306bb1493ed1311794cbb5a94807f960f0f13c84bfb470795a6715cdae8cc992fde72

C:\Program Files\7-Zip\Lang\kk.txt.tmp

MD5 29993ac68d52e2c49a716f23b55d1d83
SHA1 0a01a5b5837a540330603e487e1d6a463e727317
SHA256 c380d8d3ff8a6b1b65d3557ca63d04967e4e933474898d8aa6a82b2f1da3e37b
SHA512 b0618b0ea3c98aebbeb50d5702276a13ba63c5ab0cfe39d947128c0fd85715fdcb6779f510d9b4e776f758fd2400686fea6dfcc6dbc0b790d7d036e6f19623a2

C:\Program Files\7-Zip\Lang\ko.txt.tmp

MD5 6e35b05f28413bb6b556e91aa7d3a671
SHA1 df2eb4f1147947e07d13fe381000d14da6dfe86c
SHA256 25ad93b7678f3f6a6b9da99316f80ec8bcf34227e8682eb2b5ae4bd60f52754d
SHA512 56ab777bf3b0976f7d896c0e0e32c22a9b2f16f4061fb7c28cb09bcb607ddddebf6a4a3e8136a38008a1f6b8ca0d2e95851d63ded2ae47f3003bffbd4b860796

C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

MD5 e6d40519057a4b9f4f99c5212c9388be
SHA1 7c2a7adf3c317ca4fd0d328b95af3f4e42675c81
SHA256 1c02cac5a8cafc544af5366f4fc09a307cf3450b5ff5b406c85f3dee82241d6e
SHA512 2b8be26df62ee88f9b3f34d06a9786c5a91713931c95964cda446c00bd77822f9fc369159d1738a59db5c3b618ba3b097a5ed05e6fd5f5cf223cf80dd043126f

C:\Program Files\7-Zip\Lang\ku.txt.tmp

MD5 ec1d9cf24819166821d1a27266b5c9df
SHA1 c57e72de21f83d919b9ea3ed68e0bf7085aeeea1
SHA256 08160b2e5c7a9ac14c43bf7bbddbc1fd451e820d113f97d0f09bd2fcd01e130d
SHA512 c2d9fe5dbc0fd8e7c0c03abf6cc092c2121f81addba7ce791ff6cb59748b59e1b214899fd3d97d71f7573e7fa8659cef01d7ae8f385802f2db8e82d507184472

C:\Program Files\7-Zip\Lang\ky.txt.tmp

MD5 de38b22aa1546164b8a056c649053165
SHA1 97cc10d47be4d9144f5ef7a376c97ba362cef8ac
SHA256 6f93a27ab86eaa6774251ce33fc0792d8ac7baeac2a111914fcf0ad48470a923
SHA512 603583d91d9e06dcaea15ba7b80b4025a4a4d3fa67bddcf6bf4c7e235d1d6e6048084320a1618b9fac86a74f7f2665e90b803f73de8229c15c405416e203c84d

C:\Program Files\7-Zip\Lang\lij.txt.tmp

MD5 514d9078e6057810323cdb2e16d08cbd
SHA1 a990bb617fc86e53c82b2775775a2976a598ba05
SHA256 8bbde88eaf0a6c40ebe9c17728536d96993e4bc2131cf3690e62a68b8e76e01f
SHA512 92f6165aee943a98f32519722d8488ae85881ce95600c675298d1bea8cb24512e06263edd2482a535c8b4a6e8dbed0abef46b56fa5e587da837b4146c75486ad

C:\Program Files\7-Zip\Lang\lt.txt.tmp

MD5 bbbca1be12d932ce21b12ca9cb76a3a9
SHA1 15ee723eac4b2c8d317c0d8804f9125d46de64d5
SHA256 50ed9be5326591eceb3e6d51aa137ec125c37c0075ef606e594c32c249b2d975
SHA512 9d4d3181e48117a5c53893ea00083916449986604186058f7737e9cea5042ba973738e00e86eecb4d6789fc5ef75ecc29e034e1449940ac84593dad6ee1cde1c

C:\Program Files\7-Zip\Lang\mk.txt.tmp

MD5 ee0002e6daec22cada4a4961787b5869
SHA1 2448afd835994e15014a19746378b75fe4a75d43
SHA256 3094d0017229f6bc26326ea9333816378ba0c44e0ab20aeb6bd7de5426bd4ae2
SHA512 97ec33043a69dd6a3d05569fd515ccd8e93fcdaf8af2df5530ea25c734580d7cd467860085663248289edf5fec31a5b52b33d9802ef86e4b4690db572f9e163d

C:\Program Files\7-Zip\Lang\mn.txt.tmp

MD5 f54e3463c7dd4420474cce075fec2497
SHA1 6f8f0f264626e87e3dda5e6a7a4a0889900801d3
SHA256 147e5e4e64100fb4f442fc2eda1b78f388bf502a57526059818ca6f31aebac73
SHA512 5d6c20b5c5b5c3a7a84a09753cbfe628af8c795b499fb7503609e225a869f70afc48d673233f6e1133d489150a5d0b66c8544075e3735d6168fe802094c60380

C:\Program Files\7-Zip\Lang\mng2.txt.tmp

MD5 35cb0e594a8d3828c01dbf5257f4e13d
SHA1 ff5fdd07d5539c6346727e66e4d03c51c0520346
SHA256 c984894a09f2dc9948a30eeff34a4d204cd4bf5253bdc90f53ff7a2d19bfab58
SHA512 01d295c5fa2d49973b2f8ad61ac7a9c28e2195f8d48b178993bd8bdd15310924adeb801b4c80490b7394edf8e725a0410245a5afc882a8c5c952ab54b7445fcf

C:\Program Files\7-Zip\Lang\nl.txt.tmp

MD5 09de29a424f7ec9b7f1325157dd773e9
SHA1 09bae0e14e92ac8f2989130a60f194a5e21bcd13
SHA256 edde963cd854f66efe6e69daa3839adb0f4306693ce1adb4183de06297364814
SHA512 47882b9f26dcbb2a7c523ebc6f8efdf43c73afe6dd73a4537c6c2fa8d19a7a8bf6062961935e0fff852d90014d68a1cc8e963ef868183bd5d28b2d1d2a6ad652

C:\Program Files\7-Zip\Lang\nn.txt.tmp

MD5 b313b05caf7c8713c2964dc13a878e1f
SHA1 b42c4f74637b283c5bbb3df6b7b30a7ae44a6aee
SHA256 de2ceb28c839333d558d991cd22e815f24d3ff857fe13d1473a469bbf3ac48cb
SHA512 a3b5f1effcf4fb0ef128b3eb1bdcc48bf9baad56ce2d7b44604fe01469ccbae55d47e895abc2e274c8a5af329c6c93b8158f06fb539be6b757a9c6341101002c

C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

MD5 1a7f97adbbcd0f1d52c2d856f03d268f
SHA1 76af70ea7b3fdfdad0a2a69853f86b28376e14e3
SHA256 057fec5bd8433144b46d5397bcf3fb7ac1af7fc5c01d1399fb8dc139090c277f
SHA512 ff848effc3d228e14f7e595c6ba006c8aa264c8b7623352ace2437959681d817bfdcd3bd42d395bb240a525ab13a0f02439f99e62d4ea6d9e4d9615b30d816d4

C:\Program Files\7-Zip\Lang\pl.txt.tmp

MD5 f6c2f7009c578d39caf8cccdd7117891
SHA1 a0137cbc3a441757d2d8455322823b754ebc3d3c
SHA256 2ceffb23681b63ef09215b7ae33a081d28d43e52dfdefdbbb0d6241169e0dba4
SHA512 db97fcc761bb99f3c4064b13cfa0a0463189ddb4135cbbc4613199e822e8fdad6bcc27b47cc37be3a477c179eeb271ec8f4eae62c67cd3f8aa74edf029df3520

C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

MD5 7922abb67ffae80f9da683e4c9adab94
SHA1 9fe59cc9e04ab204ca5f5bf4b76897d0ebc8c9cd
SHA256 6253daccdd7ea56fdb8897525f104c5cdb5c682093dcac26548161bad507e8dc
SHA512 77fae0e5a75db1ed3e0910b85f223d997200d473af06ed2f0b80c6180da1676bb4a3b2137472d1783d4bf366c6afe6568b0b0ce1500b00aedf892ac138af21b6

C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms.tmp

MD5 fcb7e48d0c2530eb10872abfc690bad4
SHA1 dbd41ba621713dbad45d51ad283e079e93136f0d
SHA256 720f6bdc4a972a3632d8783bf338ac92d1d67ff536fe08c152aff7d4e456f005
SHA512 770b9a825d02bcc0ba6e13d3903624fc0274e8dabb0f3959e3ceab65932f39e1677c62c04e956719b1bd399a1bd71b5d47fbd30f795fc66cc115551ee194635b