Malware Analysis Report

2025-08-10 20:09

Sample ID 250518-n4jmpsdj3s
Target ffc12ca25bb6d6e172f848b5f1ca8a7673f7e56ce70f7fd3e05d1486c6a288f5
SHA256 ffc12ca25bb6d6e172f848b5f1ca8a7673f7e56ce70f7fd3e05d1486c6a288f5
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

ffc12ca25bb6d6e172f848b5f1ca8a7673f7e56ce70f7fd3e05d1486c6a288f5

Threat Level: Likely malicious

The file ffc12ca25bb6d6e172f848b5f1ca8a7673f7e56ce70f7fd3e05d1486c6a288f5 was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (5247) files with added filename extension

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-18 11:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-18 11:56

Reported

2025-05-18 11:59

Platform

win10v2004-20250502-en

Max time kernel

150s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ffc12ca25bb6d6e172f848b5f1ca8a7673f7e56ce70f7fd3e05d1486c6a288f5.exe"

Signatures

Renames multiple (5247) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Zombie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\ffc12ca25bb6d6e172f848b5f1ca8a7673f7e56ce70f7fd3e05d1486c6a288f5.exe N/A
File opened for modification C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\ffc12ca25bb6d6e172f848b5f1ca8a7673f7e56ce70f7fd3e05d1486c6a288f5.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Diagnostics.EventLog.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\msadds.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\UIAutomationClientSideProviders.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.XDocument.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbInterop.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.X509Certificates.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-phn.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyReport.dotx.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\UIAutomationClient.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.ZipFile.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Runtime.CompilerServices.Unsafe.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Zombie.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ffc12ca25bb6d6e172f848b5f1ca8a7673f7e56ce70f7fd3e05d1486c6a288f5.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ffc12ca25bb6d6e172f848b5f1ca8a7673f7e56ce70f7fd3e05d1486c6a288f5.exe

"C:\Users\Admin\AppData\Local\Temp\ffc12ca25bb6d6e172f848b5f1ca8a7673f7e56ce70f7fd3e05d1486c6a288f5.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

"_desktop.ini.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
GB 2.18.27.76:443 www.bing.com tcp
GB 2.18.27.76:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.178.3:80 c.pki.goog tcp

Files

C:\Windows\SysWOW64\Zombie.exe

MD5 051982095815acca2792790c54a9b817
SHA1 f3ce3f25eccb29c47374b2f5a8139d46c1828816
SHA256 3721663b01d41e197fb9a416b902c63422b5e473b9a30ec6864a9e2f42b48754
SHA512 291fb2ef651e5b2d70168fcdb03c76aba8e7bbdbdc194b15e8a1b85b75086d62d14122408f1e13032ba157e0e2f0d97516eed0602a2aa1594531106db8375ac8

C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

MD5 2a118e1bac102a5b4a3b6b084b2df09a
SHA1 4fef1c770a8191d060a8185483d6523710dd9a44
SHA256 a2450537c5845847383467499bfd1f50ed0de3b11b72c51b5a5fa7e0a4f10f77
SHA512 8cb4c427fbf58c6d7d301c99847cf42c1318cc212f1d9e422674554181be1a1a2b8b84c5f398162a4837cb57d4cec8126eb833d5f1999c731263766f197e440a

C:\$Recycle.Bin\S-1-5-21-3690492401-2005096563-3427069815-1000\desktop.ini.exe

MD5 67194279190097d31f46649408ba9734
SHA1 9e368521986bb09c43e78866470b6f6fc9ec5867
SHA256 fb9b268fa8658bce2e136a98486bbae69592c87d090b80e2b7af69c0dcb1e839
SHA512 0398e469543a699467f1fa425091b33496041931faa32839a96f0f2146ad1cbf2e2fe63ea2ef42ca2d400be96ae212843b9e79876b836bc8053c07dfa7ca74f9

C:\$Recycle.Bin\S-1-5-21-3690492401-2005096563-3427069815-1000\desktop.ini.exe.tmp

MD5 e150a5507581c4b9682796c73d8f7444
SHA1 da99844423fba937a8f0ab9c902729d0f109efd4
SHA256 6b0ea5f5f43d5117a8311a9c0574166c77d4b34f534652fc9f8b1f7ae0178fed
SHA512 f03c414a6c82fa074df93fa8f158ef816bc0eefd5a335d26d2ec0df90357eb81590fe14073df135dae6aff84d8e9ff6b37292ed60b2aec24f7d096ab35277fad

C:\acb97a917c2e38db15e8394019\2010_x86.log.html.tmp

MD5 bf0057bc0f4afef151fd53726aed29aa
SHA1 b61be6fe5ce2c699e66c4a8a1309caece7bde546
SHA256 079f7754357407b91756a519ad2717ff7df7f3b12778899ef648227ae359ef37
SHA512 8363ccb5e5662c93961f44cff34130124e61a97989fcadc1847a744858332427b99076cc1fb92eae03ac35f45bb5d983ef1c9cfc52e0e66061389e6d89987100

C:\f32c6debfbe15d219b06a854\2010_x64.log.html.tmp

MD5 27efe2c4ce9e96f1e954c114ae735ec1
SHA1 ba0ba3bfa8ea9f2055fdfbdd469ac96231eba656
SHA256 3dca45fe51c562e4d421c4e2f2846679db5547dcc20339f40b4605511238a272
SHA512 44309760e557be4ba009ebb48c25d8af655c131e3ab7143914e6f3e97c080998cd38b93ee96e4d56186efc839742665d0e75b95e69db025d6a319d0ef4876969

C:\Program Files\7-Zip\7-zip.chm.tmp

MD5 5593aa6efc50c69019931051a486c3b2
SHA1 6910923e83fe4cc3cd0efce31c64cdf55b96c1b1
SHA256 35cd4f72d16b4f66656423b87a9b1b51d524276435caab1bfb46c55d02a5f91a
SHA512 fbf9eef64fa4b16e4049610df018761ade5a046beb8a2989198d8e6ef85f78731f4d3b2451a5675740eb5f20ca69ca635042603c676046f04fb1975bcd82d799

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 9a70c7abd7dd1c073119b0e9629be12f
SHA1 76660cf28c104dd6063e657b651bc4c7740b8b89
SHA256 c3618cc118f8a89d769517465544ab27a909f1b6ac19e0a69f7a01efe6d6fd95
SHA512 c8c3459e4258bf3afdf7b72fcba87c129686bf09accae6604ff20ed55c0ef842902da56b4985a80f1741e56c19f6bb5fcf2ac93118fa939b0e6206a3a0342af2

C:\Program Files\7-Zip\7-zip32.dll.tmp

MD5 a88bee71a23ce18810099b70a1809034
SHA1 4a0f86aa400c4782b7540444db38f30dfb703c99
SHA256 4ab5cc77119041f2acaffe2084127ab8b1d31048d71109073c6f9512e31d1ff5
SHA512 530df6383eaa632ce30643a2b298a2018d1fab91afac3706e9db82fb1a47fcc11774be2a39e44cef37b91c548dc74e31a43101d6a0c7cc4d781ace000fd966c0

C:\Program Files\7-Zip\7z.dll.tmp

MD5 8aada37207f1acfae93704d546b722bd
SHA1 6c16bbbf262af3d50e59d7a522776e61bef078d7
SHA256 d7b10e21492a977ddb0375ebda4d0469abe2b4e2602a197796bcf07ed6787270
SHA512 2f52d95f6a1a8ff52562a3eccd05cfa495e04a3f0c69670f32178eae84f67e9b03b848fc199f448debba5f3df216ed0220c6aa721b85804b2370bf1b385891bf

C:\Program Files\7-Zip\7z.exe.tmp

MD5 3834453f5db81021799e58fbfe00fd76
SHA1 0ea792cc1a8eb63f35d31f507d3a768abe5e33db
SHA256 a02b55e69138849a9cc51af001e42ad03b8f58acf65b49cbaa43bcdc8341cb97
SHA512 f2efe11d6734d6d9405b8f7d793458413eb911757ad7211d2dacd9989d576d8b0127cd3accae9257a60f58587016b4464e29b90f8f923b51ebb7cb70379007ab

C:\Program Files\7-Zip\7zFM.exe.tmp

MD5 2e540b38d0c2e571ca6bd5cf9ef306f1
SHA1 fbd334fd7e712bf3e82362d0c26a6717dcee69af
SHA256 42643d43b2b4b3f154d094a3e4a352c7042f8416cabc0dd2bb00b18a30418737
SHA512 d1059ba61566358e1c83885201a57951fbce3a1dbd9a5630db77c32f44823431643f6f38aaed485aed8acb09286d7b4684a1936ee46de6f440d4e11f96875b64

C:\Program Files\7-Zip\7zG.exe.tmp

MD5 99e16745c3661d74a2c05735ebab58b7
SHA1 605beadd8b72c9264b2dede76c2bb2ecce5bc98d
SHA256 9a70d8b0e16da2a4eb1411f9bec308aa2d95ee1efeab19d4be5d73dd1229b0b0
SHA512 ddff19a07d17cdf938ee318bb5616273f4d3dc391183ac492038f3bf5dc4f829ed2f5e409ada9407602bc65bc64eb856bf31090cbdeb8611c060a77f4586c1e6

C:\Program Files\7-Zip\descript.ion.tmp

MD5 1076057eda1d3ad65a0e1c53b24931bf
SHA1 b9202f8d0fecf06f97fb19636f983cb4874a31bd
SHA256 f1f5e6dce9e34c1b6ac3dbfe271af465ff744b3098f663aecd06d136310c3424
SHA512 a893d72c4e8d72eae1f9d13282c096a92f903d33b4caf93bfb47cb30784f4611812c3e1305ffc94ff8a549ec841371d1f03e623cfb5bbc0d9895802f20b62b4e

C:\Program Files\7-Zip\Lang\af.txt.tmp

MD5 150bf06ee73a66905b1655e9fd46f4e4
SHA1 120dbdb875dce922ed251b0c480381be4f3f60a6
SHA256 cee5d95ad9401a23ad9649cc2beaa6b7c59b5548c521f42a30402279c5c31b65
SHA512 45157f2e1916e51cc455dfd7a446f8d70b4fe254460f4028934018b18ad9a8ba9e16f689855aed9dd7bf2b0d5b760dc80f3ca4696aa1c34d65ab992c9073374b

C:\Program Files\7-Zip\Lang\an.txt.tmp

MD5 60df4621743608cda4d01019eef1cc32
SHA1 bc6e74e3b89d894fa23020f23d817138dabc32cb
SHA256 7e341cf07e4bfabee6382e1b80e3b40d9314f4d3a77f3d85987ee136548bc61f
SHA512 638fb9d7623104a9ed34e6213f70087aa0dd6f9cbdeb8ac478722648ac539bc29f57ff9499cbd600be0ba2d0520e83efcdcef83125edad17019c2810150bc2fd

C:\Program Files\7-Zip\Lang\ast.txt.tmp

MD5 6402a58e9e2805ddb17608acebde2c4c
SHA1 df04a77a0c4404ea035a2ea250960162acc59873
SHA256 5fec11be07115f72057016e2b433500a70ecb52ef0227473bba3ccbdee6eff26
SHA512 9c5eccc39e8319a79ed22ad6f970a56be5494616ea26e2d384691be0e33890eae11078d4d3473f2bfb27007377fb4950179e86276b5cf0a519d74106c97893b7

C:\Program Files\7-Zip\Lang\az.txt.tmp

MD5 8e200767edf4e12c26fac358133b24b6
SHA1 6659238aa8eb6d5f15716591d097d35f0c370ea8
SHA256 8515f12f794db08aa9c373620b3ac661564748b95cd6a234af1ee19f32f593d9
SHA512 85b99c6f415aa582cd05e7607f4648697ba9e4abaddb8e05c9d714727bb2d3d6e5ba85137cc59428ff181396f15606c691f1034b97eddd4ed4967f95b1c525d0

C:\Program Files\7-Zip\Lang\ba.txt.tmp

MD5 2c4ad3ef690ee5b2bccc7b9bca905c99
SHA1 757dee0b10bbfbb1ff06761d88bdc8b51a5674c5
SHA256 1b909ac2edbce4cc2d096acb844190bce047504590fe459f8d0bcd78fb5bf565
SHA512 42f8c7489dc1557e7abfa201f3c98a0d99cdb445c96149ef2afcff894990f1edf28ae7b5262ac379e1f8f76c652a8a5952188a8acb4ae9674fb28a4e0a313f74

C:\Program Files\7-Zip\Lang\be.txt.tmp

MD5 aa8f021d18626aa69c74415ecf5acc19
SHA1 3558bd785a4ff9a69bfeed7869709b17e528cece
SHA256 7d4af9427764b93cd53cdc32f3b3cee6f5c1ab6b4f88978248bcd4339dccd017
SHA512 0b4a3c43cf5d9826569be3c330163603c616971c93e8427c327507fb598fecb71cd327e764d04ee33eda5c632686970982bbfc3f1289a2a62ccf1cddba8a5c34

C:\Program Files\7-Zip\Lang\br.txt.tmp

MD5 889cff0d1aa42c2db40f062e7d4716e1
SHA1 35adfad923077c9f14f7238106b65e6f63cceacc
SHA256 a10df6949b29ee86ce8cb0901ee4ae43f21dfcaa7b1cf395ffa29f676fae6436
SHA512 861761751e1d88ebdbafdade5fb642cd8753dc262b567cbaa319242e39d62cdd7d7445aa8d685f34dc72d1e404e27f40a8ca0f72e7f27a267f1ec1520f75fda7

C:\Program Files\7-Zip\Lang\ca.txt.tmp

MD5 2bd559069c6ee6358f643acbc036be6e
SHA1 4a571dc93b4b86539ee39e9b16e6b03e6c2f9e93
SHA256 688bdfad01aff22f1083e3a959f77e8f61815d6485ae0f6829c32e2755198367
SHA512 bb87210985ba7f81bccacf7ce83279b82afb8a3ae5a3e62ff8102c83fad7510d385324cec0a523b83151b1b1afafee368edfe60aebb9088ed3665d4a8f274def

C:\Program Files\7-Zip\Lang\cy.txt.tmp

MD5 2e28745e0fc60d735cdd6b24c3fe38d5
SHA1 e63b3c42160b4d34adf66d10b77f39b88b4e29e1
SHA256 46841fa61012312b573aaf851e7ed37a135b9bc4d10a6c6aa071fba673331189
SHA512 ecff554b474747030ede4ad62bcc7091969cf4b295eedfbbe9c08714e9b03eb11521ee65ef7bf8ac2cb2b01ca386c8e2e68fc5d5a022d3ed2c16484f7c609377

C:\Program Files\7-Zip\Lang\da.txt.tmp

MD5 03a0c33829e31eef9799f5fa732a3935
SHA1 8653c80a50eb0350ba558bfee5b40ea26bf2b2be
SHA256 376e144f109929d98760a316d87a5b1265972d321dd4c2f38b69406193fb583a
SHA512 28605cbf2bc3ff12e6d8ea53baef7f81e0741216aa2310a691caff17c5d970cb533a79c97a8eb04e842eaea1d7fe2b189598f7da8af2d5c2092d2a2f133611e3

C:\Program Files\7-Zip\Lang\el.txt.tmp

MD5 15fd1f2448e5053249c95cc558eaccef
SHA1 dc82cb8c6984b6d7cdbad7a6bc3fc2e028e52f62
SHA256 6c9e280ed4c96ffaf31b56a3e249f125de58dd8d917577d83dbb03a9966d3e94
SHA512 d9c8f2846e568ddbb7d6d224763e3a7cd5e78a0bef34ffed276150adb3c8137be01513e685b678dc851c228eabd29e2c779577a75ac957da745576006a319f7f

C:\Program Files\7-Zip\Lang\en.ttt.tmp

MD5 b7cab0fa9c5f2ce4e68dd44630e6ff3d
SHA1 08866dab7f5c7302a8cf251c202e4216ebdad112
SHA256 d50239b0c63316ef92b0004e01913859fe684c9a442c04b2a212abbb779619c3
SHA512 e542137d21a0c4099acc114fd529110d728b6b674493e25029b56e9e6564ad8664867f2753438ca32825e298ac16dad94078205faf729420dde6bba8803912dc

C:\Program Files\7-Zip\Lang\es.txt.tmp

MD5 f0de8cafe472379c431b4e5d842fc0f0
SHA1 7e1556fe43346f847ced03e0d8dcee8a4501c5a3
SHA256 97832075a86f63faf1fa1afb16c6303200fd89e2ae33b2df021b9c806849beea
SHA512 f141d814ffb39f2fc3015dc21490000dfc4cc68c9dc2ede2fc534be6e6dd464b4aa173ade27d6a19ef43f524be1ff41a8bc431bb62bf048f50745766fa0c1dd7

C:\Program Files\7-Zip\Lang\eu.txt.tmp

MD5 7859e88c69d2684adae0e3922d229876
SHA1 7304c40998afca659763f82b25c37894bc4efab4
SHA256 f6a60b6f38011ad781e711214ad8546ef55841c22c667f63ee1addf06e61fa42
SHA512 85fb7aea0a34e79e091431b51ece0592285fea4727f8edeee9a3229e8310d643415f577ec647c8eac983bc87894b88e55efce75a94a75a2c787913d472fbd136

C:\Program Files\7-Zip\Lang\fa.txt.tmp

MD5 8c0edbb7860e753a9edbfe3073b2476a
SHA1 c221179fc2952be7b4583781703c1e76728362c9
SHA256 59bfe96bc15deec01883e3aaecbf70d3996b8a930c2c6c544257f447e5ebd28b
SHA512 ee99128499ed8468b596ecc5d586a4ddea5e3047b6fc20169a5b8acc8e85e0f77f60c37f8e79e2d950e451a581e650a0e6ec5a38fc5802e3f45a3448ff846ba4

C:\Program Files\7-Zip\Lang\fi.txt.tmp

MD5 f71f4625fbefa9047ff7c216b15857df
SHA1 9391bc8ac64fc0e5de3eea56469a5bdce8c281a1
SHA256 62b11cda04eff2a8d7b561e90f097dbec30cdea8e2e04c8ef12b5e3a82466dad
SHA512 5e29bda24044aa8cc8847609703a0872ce8bf04fda0f5dd7ad1d2b3a69c566b18691a7bb9e5138c3e0e3129eac0579ec66329d788b057fa82041142100bd16e1

C:\Program Files\7-Zip\Lang\ga.txt.tmp

MD5 02b181144092101f9e691b63a7d1a0b4
SHA1 c9f3bd6bad4efc2e908e3afb778b9e94ede22a77
SHA256 bccffdd2ed323a00d4ebc45598d9e4aa913f044f8d89755e074b10dfaf115bfd
SHA512 9ac5696bdea17ba1f7d89a9d50b06e6e93e41679d5811788fe7fd7f7bf880589dc23ee6c683171a6e8cdda8351c0ce87bd3f731a47541a849cd814ba09f94add

C:\Program Files\7-Zip\Lang\gl.txt.tmp

MD5 3834f81ea6a7d2f662b845184e2174ed
SHA1 03ac945c00f225b09d8db36d8046534b01b65a10
SHA256 038de7ecc5521ab04873eb2e73d13d7b98a58a74ce230bee76488804895bdea1
SHA512 81c3e64082de935a097bb61d6740bc4661e8bdcbcfc5b3a1422a57066d3da8dc47317669b4410e0ba7909aecff11105b3975adee1a0f8c2cf4e58e8f3c6ecf49

C:\Program Files\7-Zip\Lang\gu.txt.tmp

MD5 0b4689bd3de28d0fc38f6cf24d46912e
SHA1 0baedb5e912a4065419548fd499f68284363efef
SHA256 749375a1116e29288fab56a9ba4fde35c89c5b9deb2575df4f6e5ace176d7073
SHA512 25af3de3065c792a0b5de747bfe2b37a5a12eef973c08c14b19d77e7e8f80c55403140e5e05bc97ac410958f378492157cb783a7e54bb3296b088088311ae1bc

C:\Program Files\7-Zip\Lang\hi.txt.tmp

MD5 fa0c09216f62120f3ea8b8c8658c851b
SHA1 da76703cca5fb9f2a5a3429d7cf3ad4dbc4e8a3f
SHA256 74c6a8b26b6929925adac08395448d158f8905fbe3af69ded485b2394fe7f859
SHA512 66fc967de8b4eeb1983d6d44bb36ac84a61c7a27f7cd256b3b2bb4b4eaa62084e95e3e947873a9e5233062ac6a32c95a91b738b76b9e04134004a6baee0f8a7e

C:\Program Files\7-Zip\Lang\he.txt.tmp

MD5 28a80953234454b82c6796361267f23c
SHA1 7826de0e7dfc1c3652a1d6d909dafe533466ea16
SHA256 c21ba60b7f1668b8c48beb5c11c714735f34db3e1531ab539f400f5073606c63
SHA512 5b8ae1cd696c3881c7463c073dadae417aca2703c64cee66e2bc617ff18ae8320066670f3ed7f78a533aab059f85eb7af8166fb5d933ca1c29b89839fe7957e9

C:\Program Files\7-Zip\Lang\hr.txt.tmp

MD5 1f056e6caf53ee818c273a4ead9c78ce
SHA1 e2bc6d4e60b290750fbc9260a0334b0a1ece3333
SHA256 d955255ed339e0e2c487ff1e1f5fa33f82883056b85aba484cc03e8e0cee4e2d
SHA512 8e1e7995e652eaf434c7d06ae662d16794c92f109e176061258b3cd95d73bab3c213e33d785f498234cb87f2803cc9c15b2f88f6e22be341f10f045f6d38b64b

C:\Program Files\7-Zip\Lang\hu.txt.tmp

MD5 72cf96be4e51e118d10a92b099350e89
SHA1 ad797dc5c367e2393fd43267bd8de6ee5e35d968
SHA256 7aafafbcc5a0e550c566cd87fd34becb4a7bcee175fc79b48a60880bb63526ae
SHA512 62fb0c869da20b786cba509e563b890208e23cc23ea70891d00cdac2f9dbde62f6c91cbe0c6096347acc095975b7bde8bd3d062a821f5580d1139b495800bedc

C:\Program Files\7-Zip\Lang\id.txt.tmp

MD5 4652229c1553e2f8df2e0a4429c8350e
SHA1 e9f5c7c7d6ae2e2cf81dd1b5492b95d9ce04b52d
SHA256 dfd21493c3edd9d3424eeb858238aa84a5efba943aaa18fe545214c4ada8033b
SHA512 0c59f5e9631d1e2d72b64070e482d8607b9bda4c303139c9dedbd5854daa09d559b62ec1685549befbbfea7558d6cf5ddd3346855b815ae293194ea71aef1d1d

C:\Program Files\7-Zip\Lang\io.txt.tmp

MD5 9541c46ab86f0eeaddc1d18747822411
SHA1 a5b771db7429d349606f7715841ed00c0d30312a
SHA256 15856015d52d1d519d29f5c4da57596a814d1710cda9f40f4fa6ffd39e006401
SHA512 a3e66044acf7ec5b41e48e735c065a177203631881070c7edca784386e4a4c7c00926c1be55a4a3f0df72171a265a6111ae8081a502960b4da77774e98585764

C:\Program Files\7-Zip\Lang\is.txt.tmp

MD5 629ca2505d41b1f9a6ea39877c95fd11
SHA1 ee8096e6a0e5553ecf8dc54aaf3b72e8f96932f0
SHA256 6e75ef40839ca681962b7ce009ff13a7a6b5667f6a8b0bfd55bd98ac5cdd3b1f
SHA512 b72478bd184071a6534ec03fbc1085856b7f7a87d206b9620e92e8c85930c12b60d637f32a248d9358140781c707c7d2d902ec8ee2bc4da8d41ca45b791d2e66

C:\Program Files\7-Zip\Lang\ja.txt.tmp

MD5 d7c7684669cff6cf199f2a4ca6179389
SHA1 5f54f0047881f166318beddecc6bf45c3f373c1d
SHA256 c7685e99599c4b38322da405b7af99466571453d957d99f68083fa27ad436203
SHA512 ac643f59e5818f4b8a2a9938f97af3be702512e61ee8e26b633a10d5c134b1751baf3b994bcae9303064a7d61b0e4902d2557a43e1efe6511f723a5b2d5f5ed9

C:\Program Files\7-Zip\Lang\ka.txt.tmp

MD5 896567ee6b0cb7339f3738419e6bb034
SHA1 031cf019d41f5399904e023e4d6e3922cb888393
SHA256 601b5f559f1a8c6d0362a227c9715077fd6f917c85866c9f8cb94aafefb82cc6
SHA512 a46483b008874a098e9fd8ae2a43cccf3d568f7e7ef245234edc9408e5383a99d717ba2a78ace88a5bdf76bd9e6289434076f3e453b5b4ad933050327a2190f2

C:\Program Files\7-Zip\Lang\ko.txt.tmp

MD5 53e6a78ca47b745ad14f29b84f245083
SHA1 fab73f3cf7533b0d4fa3ff63e0b409f7ccbb6172
SHA256 acbd0e6c25167afa24b8e3213de3952b83d9686ac7abec6ccc93a7225a8ebbaf
SHA512 b871087bf7c86e8fd4aaddd94205f7968801cf07007ad5aef38e306f1d651e3ba9e581dde522f0e001ac60cd0881a640ef2a79d79a93b2a2237a68f9a59f4ae8

C:\Program Files\7-Zip\Lang\lij.txt.tmp

MD5 764a108d8b6ab169ceebe6e625b1ac8f
SHA1 7e2eab96433bcacacdcb96497dec6118ee8528b2
SHA256 c95d0d31cac74f46cb49694379a828959abd6b2ef5c7a2b0c520fb6d4b1d91e5
SHA512 7224a11308514c451d5e5c9a16a699a7d00c4dde8a5961dda3716e575a76781aebb05efeea5c73a520a4827b2a77511a9a2d65ffc5d2d0ec1f7607e81f425483

C:\Program Files\7-Zip\Lang\lt.txt.tmp

MD5 c9a96acdfc071c044091fdbb146b3953
SHA1 ede78ce4fd72ba7e6807a0e70ddcda217a42234f
SHA256 300a3348dfba889fa956187e6a33956ed97ad4f48a64cf7435eaba8bf9dac324
SHA512 dd185cf974b2ce1b64e3eaff67698e4d307633d1d39a5e1ed3b2cf8577c353c5f1daaaab624de9efd9e3333f4273eb4fa1facad0ab269831b1826b281c6b05f8

C:\Program Files\7-Zip\Lang\mk.txt.tmp

MD5 7b3050365b9b05b97d3f623d5ba6694f
SHA1 3d2df69c35b131ea0ac69d5bbbb8dbe3e623ac11
SHA256 9215c31a5e4daaf9e674a6a25565e9bb844234aafd5d762d892380a56a03a76d
SHA512 04ed6e4237f700ec5d89afb6bed2cec95d7bc70c78c0516c8eeddac71e6388f45ad5471f5871b0e90af3d27fd0b08d4af9482810e70298efc77ab89abceb9a47

C:\Program Files\7-Zip\Lang\mn.txt.tmp

MD5 73133d0c61df56e789e262646fd7e20a
SHA1 88bbd51fc491d35caa6330e34779fd028896ce67
SHA256 7b10b47cc7fdbc192bfea1015a112ebcc49d394afe83d97eb5a3202c8d236465
SHA512 2885ff43ed6364ccb00aa725755e7411c13bfd2043bcd714410c85cbd45e58ba96ec5de713a82dac050002476b9bb20c16880d2134d913cc9ba187193e0e8da9

C:\Program Files\7-Zip\Lang\mr.txt.tmp

MD5 0771974878faa68d020c7a37d5149af9
SHA1 a39daf3f50f01eb951c47a214e5ad053d95816cd
SHA256 8fdd2b96de204cd65e8b97aac0f2539cefe6a0dba533a48bb0ab88fea8614d25
SHA512 34ca266fb7e220bece19d6a381dd61e47347c713a3c4b16f86df604efcf6adbf68ece22536a98d01ecdb11b7ee75f88c3b5383bbdabc42b93ebfeae439b4ed33

C:\Program Files\7-Zip\Lang\ms.txt.tmp

MD5 f4d198712b229a1cfd41f7246dfe2310
SHA1 15af87605e12d446f5a0938c6006ccb4ce8c51e7
SHA256 3b7757d823a723df3bb4eedf9f3935db07f976d4a70726fce1c8ae3bc2413bda
SHA512 1e60dd1d6c81cbc03a657a0610509dc34f2027869da248861b5f129808bbf715b163895110c855fc94ebe66be7d7f425e275b52dde1931022942f8fec57588de

C:\Program Files\7-Zip\Lang\nl.txt.tmp

MD5 4b0709defb71c2e02eca488985c9aa53
SHA1 fa61e36a6b990b13c55def40d93c4a85957c7e84
SHA256 0dd74351377f34925c8339b8f6a7b12080affedb8c4fc517da29b474d512e88e
SHA512 33482836773a0c6ccebc2a69be5ac2a3801bc7f52cb6a3faa1a4f8a73dac9b37815db5460bc64140a1709b0bf6ad7b1469eacc82347c7468e23a7d73565b7d05

C:\Program Files\7-Zip\Lang\nn.txt.tmp

MD5 c5f701d9ad4445e6a7cf990db1c13702
SHA1 3dd39ed52b07719b2f2d1a1b47fc5d2a5a84948b
SHA256 78cf9fef41b33b5d9b91035f1b30e9d15767b1003c74e64c185368a07f697fa8
SHA512 d5bb179bafd0a55965255dd702a9dc44508a9ee73160e44ed2b77b723bcbffe0269f7044eecea8c7e40659fec9a6755e1af49fad779f3a3f06ec51441addb7fd

C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

MD5 ddc77dfb222a888868fc22dcb1d8b3dd
SHA1 3865947b1454cf87c014bb6548d71a0cb96c8a56
SHA256 6bf29a90cd653d524e8452746638174c6e4d1a4cc709a87e236ffc67311d183b
SHA512 1c75d6b127db4bd67023d285d6365b39adef5df0da3456a960a26d9f8f0887c636f71259a9b314ef84a6aee47200848611447a62f7b8035885878ae771e6682a

C:\Program Files\7-Zip\Lang\pl.txt.tmp

MD5 68f6e4b352921777cc4e02adf685fea8
SHA1 7176b5a903976e4905a61af18ddbaba30fc1d6f4
SHA256 9ed92425ed25f65bf8f80a7f0fa235368c837e3be626756be0507cbb3abb64f6
SHA512 2b4606939c1e816c238de2e42021b9c44b0b6435a81530db2d6e56481b966f198ad68f1dd56239a31411b6d588c50ae357e74dfcc256dcce4c35aa8bf0dd89de

C:\Program Files\7-Zip\Lang\ps.txt.tmp

MD5 e8a2040a246e88b95cbb6458cb00b4ba
SHA1 16e2c75ec797e9f813a98539d8813502bbca712c
SHA256 b408fc7761d24eac43fd08994ac9b734ed79867ff604092198c40e55247b98f9
SHA512 af7fac1c59b76aa5563f622e06a422b440fcbbbc7fd2a94046cdf455a46b1872e8e52c79b7b628c08779e5686a9da14c6939adc04d72fca778c67ad850b2ed5c

C:\Program Files\7-Zip\Lang\pt.txt.tmp

MD5 61945ccf349ee29e91476e226b79dde6
SHA1 b217a08aefbdfedaaca45b47cb4299eaf2faced5
SHA256 f220f94b1d611ebfbc10e5c04cdeb6e112a28a3c7585981abcd7eace5c480efc
SHA512 1dda3861353c5c3f38036f3866c01bb3a539a2a8dd152f3b1c471bd73a7a9528968d46ed9c7808bb15b7855aa7922964ff6bb5bdbd632df6542d050d13251e50

C:\Program Files\7-Zip\Lang\ro.txt.tmp

MD5 bc3a604efc5e431fff929679b0d4090f
SHA1 c4d3cbf8ce33b4058a4c6916dac3187a803d1d49
SHA256 4272b284a57f8b3c9a9f4d2a7fa7f1991401a54f152dff0e095ce72ae870f220
SHA512 5e1e9df4f836990efb6e844fe76fe6b36f332e677a9e4ae0f8f6219e4388fdc46ee4d226bdbbe70557600f8ff8557db49f38315f8cb48d5945eeb4e5a4a19e30

memory/760-1214-0x0000000000400000-0x0000000000407000-memory.dmp

C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp

MD5 f4000711e4685be8217b62d4511011f9
SHA1 37c01da6f3caf3f6b347ad59ce0a554fe1a37ca7
SHA256 1f3f22a29eabfc3a47939fe466c69749f5734b046c439152b9478f1108a51c33
SHA512 51cdbc6f1123419829884dd5c7dde30a33ba0fe682e803bf1fbf8e5fac12831c6498a18b577440e3ff9614909c35586ee2515b042c940b36b4853e6422aa384e