Malware Analysis Report

2025-08-05 15:06

Sample ID 250519-qzwgtahj5w
Target 862cf953da4034533e8e4f3a5ee1ed001dcfbb6a12f1376e5741942255faefe7
SHA256 862cf953da4034533e8e4f3a5ee1ed001dcfbb6a12f1376e5741942255faefe7
Tags
discovery ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

862cf953da4034533e8e4f3a5ee1ed001dcfbb6a12f1376e5741942255faefe7

Threat Level: Likely malicious

The file 862cf953da4034533e8e4f3a5ee1ed001dcfbb6a12f1376e5741942255faefe7 was found to be: Likely malicious.

Malicious Activity Summary

discovery ransomware

Renames multiple (5232) files with added filename extension

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-19 13:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-19 13:42

Reported

2025-05-19 13:45

Platform

win10v2004-20250502-en

Max time kernel

149s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\862cf953da4034533e8e4f3a5ee1ed001dcfbb6a12f1376e5741942255faefe7.exe"

Signatures

Renames multiple (5232) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Zombie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\862cf953da4034533e8e4f3a5ee1ed001dcfbb6a12f1376e5741942255faefe7.exe N/A
File opened for modification C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\862cf953da4034533e8e4f3a5ee1ed001dcfbb6a12f1376e5741942255faefe7.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.White.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\VisualElements\LogoCanary.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.dub.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.Royale.dll.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\VisualElements\SmallLogoCanary.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.stats.json.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Diagnostics.Tracing.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Zombie.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\_l.bat.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\862cf953da4034533e8e4f3a5ee1ed001dcfbb6a12f1376e5741942255faefe7.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\862cf953da4034533e8e4f3a5ee1ed001dcfbb6a12f1376e5741942255faefe7.exe

"C:\Users\Admin\AppData\Local\Temp\862cf953da4034533e8e4f3a5ee1ed001dcfbb6a12f1376e5741942255faefe7.exe"

C:\Users\Admin\AppData\Local\Temp\_l.bat.exe

"_l.bat.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

Network

Country Destination Domain Proto
GB 2.18.27.82:443 www.bing.com tcp
GB 2.18.27.82:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.201.99:80 c.pki.goog tcp

Files

C:\Windows\SysWOW64\Zombie.exe

MD5 ba33915eff6a8a64483fcbd41b3a4319
SHA1 69c3cf6203899feb740fddc36903aa45ac658d1c
SHA256 9832a0f657621439c28c6b1aad76a687ee46015a8f95d2076ff6654ae641a22a
SHA512 b379695c8b6cebeaef908ef8349ce97eaa410bd91f94a7fce7b21db9a371f3578aeebe1507ac32e1d6da3fd155cb17961baf4f19bbc07f50671763a9430c0bd6

C:\Users\Admin\AppData\Local\Temp\_l.bat.exe

MD5 22ec1fe17c595fa79124f83d572805bf
SHA1 ff4334282b94dcce2575bd0c4cda7ae13b5fbffe
SHA256 6a413d250fd3bce513fc72585d4e2b47babdf6c35d4702ef3f347e2b168a561d
SHA512 40eca34972e8ec1b492d79a524ecd1c04bfcf5c2f9da60cd40f79def84fa6c8ce8eec3643f8218e056cad864950e04cd86f4dcf89ccf0b284ae4e89c87145520

C:\$Recycle.Bin\S-1-5-21-343936533-1262634978-1863872812-1000\desktop.ini.tmp

MD5 628d07f161a648a1d81dbeca6a64a2c9
SHA1 e8c1b3bd8e3c95f28a65aaaa2ea8054693a0b8ff
SHA256 25edf49305524f4648d9bccf4333b6f6a8a0d2ccb70b3774b8b034f09618f769
SHA512 7515a568b897957b3ca7a243c69d2c7fddf89978fe4d6c5bc9bc2b8a00c44ce61b69a57586b53dce399875d445d7cc61dc1a28bc2753546252eb48ee2a1c0c71

C:\$Recycle.Bin\S-1-5-21-343936533-1262634978-1863872812-1000\desktop.ini.tmp

MD5 a345103b357235636d03240cb93f55ae
SHA1 2f6280f733aaa6a1de9febf3f697afc044115a2a
SHA256 cac22d9c2b4729a7c0b9f6ca4ca0bdfbe096991e834a1cbd3501ff82f914e159
SHA512 33e641878e0765003f1a7ef85760305b410113211058e491545eca5cd78bc7b702ef91c5dd317379bbca2a21b77b374ce74859393dda45e67daab91195f96cd1

C:\73606aa2173bf79693c8b74b\2010_x64.log.html.tmp

MD5 afadb538a0c8e25258b93ff269a3b7f3
SHA1 bfb29e2ab81ef80b7309e8a2a650b2f197f028ed
SHA256 679d7b6d502de3da7ae96f8bea1cf01e763c9a41de01ab6e2c41efa5bec4d4bf
SHA512 b945b6704fdbac777f3afa86caeac0b70f00d26b5278eb84e34cf4354f5a32c8dfc262b993c4b8fd19213fa906aca1654882bec20ac9d0e00bdb35f8c6ba406c

C:\f21fae8705b262c53286e8\2010_x86.log.html.tmp

MD5 3c33ed4377cb299029d92c0126356a5a
SHA1 d281e655d7f5af5219eed82e6f872681289881d4
SHA256 138faa8e54be2eefafedbf0b3508ef302fdac97e669330d3507591d405b1463d
SHA512 08ef7882c9c4efabc7fad90b7d8257d53816326d93118487ef111cf6b77ec218ced13afca03d11d4bdf8fd8b201d1c047a12ebb0cda37724ca54f21cf702e778

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 f667cf5866e55e6332d4533653c82f4f
SHA1 4ec05c337aa28b6d8cb09ef66cd43a21513105dc
SHA256 caf438e5f3e2a4adc6d4c0472d1bb6c5b03bf14b357f094352c48e6f48080eef
SHA512 19f5834f5c08515ad5d5261b33bf0be60ac761acf050adffc015de12357de29cbd922a9c8134bfd016b7f8fdcd4e229ac35695f9c9308083930f42a7c9072b72

C:\Program Files\7-Zip\7z.dll.tmp

MD5 5a898c79b0f1dd89476ec4129b807819
SHA1 7f488d84a071659699544591e35f839a711b9632
SHA256 f2d4fa532a7a515cef94f5465d73734c0d7e1faf054e1cbfd9a9147ab107978a
SHA512 37fd58ec4de3f923bb2058f5aa98a7807cd4b8a219001e9982dcb6fc330cc4e53f484ba14b732711ca6637fcb71ab2e283355b22b00c181713e59464a28f0c58

C:\Program Files\7-Zip\7z.exe.tmp

MD5 e57f317e8773531dcee81d8eef9055ec
SHA1 9d794882be112a5450e8e19ec671ff603ebb8838
SHA256 90010380f066686d2cb80a7bde7727b68355d5adf71d8e2d5c43e53ae24ec6b5
SHA512 d87e8f7e6256c0973ee259a3359d32090039eae120c367748792bdf6550594f7259af6f464dbc4ba1e9e117223e5cd4da4d3f73deb9603b56fb45924c46c9e26

C:\Program Files\7-Zip\7zFM.exe.tmp

MD5 e290baa696d306262fe72df2e5d3b7ae
SHA1 b0c9ebe785feede1ec48b14eef7d489034cbd378
SHA256 b54b430f2c886a9484029ea9f37131db9cd07bffd472ed635b5961f8c7ec2a4f
SHA512 08bd581664722cf7ec393ab15e33a8e34692cdbccfe86582e95476d3bd0466bfd022aa7438e98ac5edf103f640b4667d26ebd4a058014bff67d96f3d7a049888

C:\Program Files\7-Zip\7zG.exe.tmp

MD5 fce001f1c6820717f5dce61b02f7bda4
SHA1 97f6101a0eca4470b93e96652ca451fec9782090
SHA256 ba13ff4084f664cecf83b0261e76da94ea55e2117bb2294fa6a3b13b3cf487a2
SHA512 3f98000d6a3b306ad69cda7aca5de1cd2c0693450ef0684a1941cf955999a3400ec7dcb9aedcf75306bc0b92941b8517500f198f1ec21f24f94b2947b0639493

C:\Program Files\7-Zip\History.txt.tmp

MD5 9d4262295b2d7f5a81294b919a78f76d
SHA1 613de211ac6141be176b911b30ae0357baa446eb
SHA256 06cd398d28b54a6c57f2f8dce1b2dbe05952dca1475f79539a18435edc7d4fab
SHA512 e2da7d5d181f9281e346d197c7a2990e9fd9cd36b35e803371cad820b690edeb3dd509dca56755f4e31657455f171901560e11ab348d5b586d6ca0adb96ca805

C:\Program Files\7-Zip\Lang\an.txt.tmp

MD5 3999bc7365d98a3adcd1a10917c8f564
SHA1 6b3385bdfb12781ff804cefb511ef5e9b994f923
SHA256 9b36bb81f8b9d8c2d332dbf73b0fa670f0cb0e20180d1d05918db27759bbca13
SHA512 abc4456812692cfc35ea982b024de042a639e27a33b9b5b35f903a0684eb20772f85a9066a0fdda3390b6cbcc05c9a132eeb63d5d61420aa7d4987f104004fe1

C:\Program Files\7-Zip\Lang\ar.txt.tmp

MD5 4316b46f2f17dd623ab88b16f739e88c
SHA1 950eed046f36bc6fdd843a43168d19b831dd023b
SHA256 22e0a3690ef9dea058b9f0092b8b8dd8a6c20b352da1c3dae613a3a26ffc6b9e
SHA512 0264460d6cd65ef018b90558a12ac11ac6255baf4d28775ac92d73397dff962a9c249f39eb34d851b3479f43ba4e28bd57ca12fe9dc12c947c6c76de49bb0a9f

C:\Program Files\7-Zip\Lang\br.txt.tmp

MD5 23bb1c1dd5c7365e933482f6c52a3564
SHA1 7c7d7ec2ba4e19605158473a87ef6ce0a777c317
SHA256 94aa9d880931b678e62ce30dca805efc0e3cbe6b1ad53aab2b1fed694ddf27aa
SHA512 53fc349c63142c88748d452793b0be833e8bf731af0f92c708d38bf80899b2fa8e9b6888ff4b6a6a23699e4a3cf1612501b6772f771391a71033439ac0d9aa11

C:\Program Files\7-Zip\Lang\eo.txt.tmp

MD5 1a4069272a9205a9c8e2e5f7800b5769
SHA1 4904b4842bf5405deb7590948f35a6f421c52a3c
SHA256 d86d33af8112f1d404c5e49f09e98e5ed32c7d34a363dc0f4df634d2ca26c3e1
SHA512 16917c448976796a3246b34eb39d8d58c739bff3671806426b1dd3e10830a176927d87d5ce22cf56dc2b6002c3f004510c4216c6c95655dd9257907dfc6e233e

C:\Program Files\7-Zip\Lang\fy.txt.tmp

MD5 2edb8a81220af59e27b713052f2897d2
SHA1 7172733f401ed09437e1e1a1dfbb1075fcae61cf
SHA256 9e32196ff904375b1adaf54ec7fcf4c900f02885585d2512cabe90e5676a9e29
SHA512 aca6bac5b66d7cddb69abc831eba6fdb140f9e7edfcf2833d665581ac699b3300b3ea99eb9f57561d28656a5a8527761a29baea16ca6758e9c09a88f24f0a58d

C:\Program Files\7-Zip\Lang\id.txt.tmp

MD5 de9a72289eacde1655e457fb16e7654d
SHA1 453778f047b8cc28bde9eff56a90a6b2be2935e4
SHA256 2fb542c6354b8d3d6349d51f9406b80991681be6ee4aad5cda624dd114ccd44b
SHA512 fd8f3666d37a8b10ba2495ed16195e61c8b8edd42372205d438c0b173af5ef020f23f0e8227c6c38e1a7aa80f97f8bf4afb924d6046670446ceb545fdb8faff4

C:\Program Files\7-Zip\Lang\kab.txt.tmp

MD5 3d563258f6a89bff8bd8d0f41672a25f
SHA1 4ba71621d2b0e165f42a14b2759ecf35a40c890e
SHA256 31e6459cc71b3a91091f3cd36ea7886dca3fa3fad70e4ecd998b055dd95629c3
SHA512 61133830978cc7549b832b31fa865fc1288c2746252d23c9310e80501498f6f32d297ebbd1ac8b574ffddbad592805139145f707e7162fe75edd413d3eb0cc05

C:\Program Files\7-Zip\Lang\mng2.txt.tmp

MD5 474f721ae5298174d9c9c54b2e0f9b74
SHA1 d098b37030bf47c0730586f464e6e8ff04f12f61
SHA256 c09e2a3014ef9e83ca49eb7f247e044b66282bb3f805379ffaf3c5b2ed0e4a71
SHA512 4743531efb942aca10b67e75327fe7e745b994147a18e3c7789432f4e3653278e00df3258ef3649bf680b71b3599b112a2b9ddbd0e025eacaad07c86a226fe56

C:\Program Files\7-Zip\Lang\pl.txt.tmp

MD5 4dacdbcbb94177583262bf7844c09df4
SHA1 2d870543153b2a649419e11737bfaf65e2aadaaa
SHA256 ce8d6568147d4aca9e1031bbd8cc199218ee2b1fa2891de30f9395ada0e3f989
SHA512 42e038c3cdda5fdca3d8bc132e0c2ad31b53133aa66e6ccf378dc1fdab9a6526fae3abf5e22ce013a51bad26d9631352880485586c52787e693e6b591de3a75e

C:\Program Files\7-Zip\Lang\nn.txt.tmp

MD5 0ae4744ed231b5cb0e48a8aa4e6372d0
SHA1 b676d958961bc1d9a029876b1a2d27c887f1d160
SHA256 497a7bf39fdc2854089b78d728e58a7f55391d61a6d35a294017ea2d09df8a07
SHA512 53b691e417ae06516340106db435c9c417228f21552eacf834cb9eb6404c07cb3ea7f7510ff1f01d6b292697e080d795fef9443a36cefbf283a94cce6bf2b498

C:\Program Files\7-Zip\Lang\nl.txt.tmp

MD5 c331cad042b917e20a04e0861aa896ab
SHA1 f508e98696508f3df76d9fa6859eb14dd5a8c409
SHA256 089748bd70b2c39d60f152cd08bdfccb0bcd697d60235ad1272dfbbb61d539c3
SHA512 186ecb641ab6af365e4cf749debfdd875b44c577d862d97dacf40783f8090589e5b23e45d4c342213a84e2b61b059a7b8b6fe068a00c3d39cfcaf85f5a5164d3

C:\Program Files\7-Zip\Lang\nb.txt.tmp

MD5 c88951755437f0ef1319db2a8947cb44
SHA1 19b1430c158c458df57fdccd6024ecf3b15e15fc
SHA256 eb189ad9c392464a20e556772396d79c6b62d656900fe0548da199535ca61fc2
SHA512 5b8701814296bd14786913c8155598d5815363763e7594a646e0b7dacd03e1673f821ab4371b50f5ba42411ae1f2d5d526d2794c1401ac85e45ee3cbaac70ed6

C:\Program Files\7-Zip\Lang\ms.txt.tmp

MD5 56f771f79ee6c85751e95191005d55fa
SHA1 d8807f3b1c06e77084b03270bceca180762a3682
SHA256 4d7db526ca59b3f6ce5596b5fb1ffc033b6e6e92906b8b442066339978ed71bd
SHA512 3db2d413201a3f6f2299a5eeb974c26637524bf86dfddcfeb25ac8e8dfdcd121b3eca54e2420b60342855b2d2c9bd3779af404f96257a3df1cb2ad6d40059dc9

C:\Program Files\7-Zip\Lang\mn.txt.tmp

MD5 0d5ec90f598b4a0164ab0b0d5effb522
SHA1 a1c57b3dc0bb735bf6a94756277d54c96eb4b233
SHA256 7d8e44205883863f48b146d3d9e5d1eb8cf7926235534b878499033fcea15cfe
SHA512 3b1a6afbfa5570c1ef60dce6bef2e773891695811d73bea4075926b975fe2d0a768d0ab31bcce78ebc75f613ca217d341da3066ddb242186e8e53f85d3442dd8

C:\Program Files\7-Zip\Lang\lt.txt.tmp

MD5 405acf248f4c6ef2069bf77585c9304f
SHA1 07e5bd057e2d168a735fc891970e7f63ff5015dd
SHA256 c52bf545ba848ac334c96c5d293b10e145e65ed4d26db84b6322ec091811a453
SHA512 846acd07bc450d5e71634f27051c5be0df3c28c640852ab0a65e242af00680a551b2a41b7636282dcdde9ec90428fb0c5404274b09a97df5acafc5edca2c7103

C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

MD5 66b8f1ff502e69dba92a32591d11420f
SHA1 33abc92efbf04166aca09b720e5d93aa25e4abea
SHA256 506b3fc14d966f642c887f5a45b8c58fe775352e121cc65cb3abe14ebd1d9aa1
SHA512 bba9df30409700badd6c9c9036725061c1bc8bf6ad8a1ceb39f0a8431603dee243ca860f9c301e6f2efa276b12d9812a46a86c90dc4e7fb031c11d4756d04209

C:\Program Files\7-Zip\Lang\kaa.txt.tmp

MD5 95009aedaa8caa0e24e0356da476aebf
SHA1 1a240dfbf75ce281835666714ba21832021aa3a9
SHA256 f3e89edafc89f88343de2f55ea6ee0dd587817ee8fda5c0ec0753f64185d47dd
SHA512 50c7e9bd60f66987d109de3595d58a5cbe72fcc94342f1e9a8c705a7033c1398f75d6e998d0ced313fb47926949a33968b3f430323cba843f60a5943c6bcb0d2

C:\Program Files\7-Zip\Lang\ka.txt.tmp

MD5 7d75383ec2276330ad2781b52b36aa55
SHA1 0285bf4e18ea16ac6b5401d1693ef04659315e4e
SHA256 645f63a5ed6bba8011aeb20b61ca2129715e7ed90b7032c22f357a472fabe2fb
SHA512 67c490e948530e4e6b2e2e166755a0a86f01f5f5df72180eb54649272746d8b5a596bbb1afa13920c45029b5725aafa4bf6f350a84e7ddc1743dfcd5be3f05a4

C:\Program Files\7-Zip\Lang\it.txt.tmp

MD5 33f7fc2e8f11b933f00ebec035384a92
SHA1 c874f17c69da22e7313db6a42139775c983020f5
SHA256 04ad2977115de32849eb72770fbfc8b9990a125b3ad27c35d705e58ba6095fed
SHA512 d5c7cd333c36febd33bdcd5afd956f94bf85d2244b829259f616abc8952a2959abc549d16a861c78703edd4412a181acc224757edec25efe0d51db515de0b04f

C:\Program Files\7-Zip\Lang\is.txt.tmp

MD5 ec4beb040a65cb7c2ee7269d1d0f82e5
SHA1 da70f751fb5d6ba1f06d81a265fdc2dfb5ecce3d
SHA256 18b198b0563838f3559ef6b500bc59a2e55813884498b9be8008c990baf3ebbd
SHA512 8f1c00875d35c6dd64ba1d4135b3cfd26356af085573792bb1805a422617ca2d51616a6a6ad8f7f79bb274169f71927905df0c9cb4404c1cc67a6417a997d127

C:\Program Files\7-Zip\Lang\he.txt.tmp

MD5 665c2bc24759fd95aae7a65fb1f66dee
SHA1 05fb52e713461a49179c3b1e5f164f76ade5f8d7
SHA256 8c299c93f3eeb5860152ad9a15c47f3bc874a0d738189302bb413f869234f1b7
SHA512 59c15c33feff3825ecbf327bba6a13ac6eb9950b88a97ed936b6c074387f4e050e73670c1847bad6c9ce26603638b8fa70ee94eb8d1b5a7eda656441eba790cd

C:\Program Files\7-Zip\Lang\gu.txt.tmp

MD5 5772cff5ce3a3ee5db610eab00963b5f
SHA1 39865908b0c1d3e740ff23c66440559dd9f3382f
SHA256 d06c80264f3a9d7d3d3d985ff9551c3b7a306fd53bae012f28790301c498f024
SHA512 6efeb4862072cecea0454852e73bd56f9c33e4b936119eb0e28e1a7b327e3de5368488e243bfba3db51c190d9f887fa3ac83e28aca4321d17abd40359d1b1b8e

C:\Program Files\7-Zip\Lang\gl.txt.tmp

MD5 83abc62ce4c1be9adb8d44eb0d6b8202
SHA1 c9aa8132f0d84fe33760a178a81e9a9f88eb1a07
SHA256 4ee19eac0dd3f9b14cc473f4dac26aac90ff2005481ceea5c26948c30f9a0f26
SHA512 fb9b3ecc7ee7738e85cb5e3077c0ba3f69cad54418aa3e0eb6d2e3a588ff47f0522b875b9149eb3ad496002660c3a0143c0f7547b7894a286970ed2aae6b8d60

C:\Program Files\7-Zip\Lang\gl.txt.tmp

MD5 c1eb663be5e51a210f29d5ccb594f01d
SHA1 b792b151805fe416201966802382a8c578ca0aee
SHA256 1633398281727a229725ee44281ec83634e8d68528387fdd060476bbacff5838
SHA512 d891a6869b888aa9a080bef2b5b9804ea9207400b6fbf9ca8735270d8bc26394d9950dc1d2a8c36b4b17b69438c34d59964b6f43daa650c5579b12046559cf35

C:\Program Files\7-Zip\Lang\fr.txt.tmp

MD5 4ce8e55b69134841080785b880074cb5
SHA1 69d2c001d9d6c1ca65435b1e37f042bc2ffeb4a9
SHA256 939e406d65431b49dfd24c5eb66ec141306bd5cd6ec0d8e6960f9868d1a79550
SHA512 69a49fdd1d96e349ad6711edecc723fee6e5a18e8d7a85f70de6e9099f45bdcdd08f50efbd642d691b7501a69c5b1ae10eaf97732d03523dbb2440aa4014cc23

C:\Program Files\7-Zip\Lang\fi.txt.tmp

MD5 d3f1c8c7fb0b4b786f60fe76358cd79b
SHA1 7d7784757559532b32baf6d02f67afb3a65bf481
SHA256 739e52642124014f269cbd327c1ff56e72bb10a6ee8ca7c0182b62276073c97e
SHA512 7a388d2e7bc621b2c9f01d6af3e91d7ec9e6ec57421cbc17f5f82348900493450d93a3f156aa860d4d563569e61cdf1375a446bb849d525d8752305db1b4d631

C:\Program Files\7-Zip\Lang\fa.txt.tmp

MD5 ded48ebe0375e303368dcfaef0301d6f
SHA1 2d32d2427843a1a0962f6e027ab6d129fbb3ea2c
SHA256 6c50b4272d7b34d0ce022962984dd25cf60e455e0b444423fe9f6e441d48b9e8
SHA512 12154699ab60cf40391cd3175e16892ab4ab7add0722e0c7a36f4a06be9a77b1154409b846021ab70919416245764e522d9ff89212a71f4fb219ed67ca7a4510

C:\Program Files\7-Zip\Lang\ext.txt.tmp

MD5 664afba47f15f033c966ee975f6055af
SHA1 91e1237048f3ca358a526eb54f1d102fe1ee0a21
SHA256 2bf6ddd76e421d405551240b8e2aa681341e9c45642f35303982fc7f2298dc86
SHA512 e6d27019b1a5e9cda1aeae7308c592a8fe84425144974353f87d49a1750ed67a378f8ebf48998be2f1ffc529e80083b7232781defe2b4e514b4ce171fd02d16b

C:\Program Files\7-Zip\Lang\eu.txt.tmp

MD5 0ae33203212c2ffaa7e2bd01a3e8ac08
SHA1 e79dfcd5d96cc9c28ff1ca2f9d173f581a381fb9
SHA256 1df8a175c46f3fb915dcef76daf57cdf525f23ffd52aad2785614a74fa762cdd
SHA512 018cdd6278f6fa93504a18477dcf98085d21942145ace7cac7306982c7656d648d0ef6164e5f677a338f5e5d2c1cdf8383bbdd3e515194457bb5e9961508c635

C:\Program Files\7-Zip\Lang\et.txt.tmp

MD5 80d104300bf3c213db06e5eb8cbe0f15
SHA1 0dfd1268f291faa63146a9cfad69656c945ee1d5
SHA256 1594f53535fa7b339bc7aada5bbb8508d3362310d418fa97f00bc8510ac7f134
SHA512 a58e355f951e16476c7d5139e1f6789e86df8763a263b2b1691c7370e1eafb3b54743bbbe7ea2cd280ab345d82931bbf25aa62621053a0f80ddc0255db48099e

C:\Program Files\7-Zip\Lang\de.txt.tmp

MD5 586a0a2a65833572c767047b6cefd659
SHA1 52d19f875b47b658f74d7b73298f9291a57923df
SHA256 f322a99382ecc9e11b6b88e95e31811ed2d980821f01322d994918c554d777de
SHA512 e9782b811ad3f189ae7e4a26ae3610d6809e0a052e3906797ccd1d66653ef4797d850249580a6d2cce13eff6cc473f78124bb454003012b69cfee0c6371a5c29

C:\Program Files\7-Zip\Lang\da.txt.tmp

MD5 c1b35e60571159b29fad5fd91fc91789
SHA1 b32dcb1c0e594b738f1e01d949d41762c1b84b00
SHA256 047ff3899ad18257c52c01fd5b681e5bbea8d6546676899415f10f223bd31912
SHA512 fc38c60fcba30e005d1f246a3ce1f1ed69b57e89d87ed2f087e65957282b3884fa59340da178f9a1c5b680acde30e8d68408fa6473ee01355d4a0f40472e963e

C:\Program Files\7-Zip\Lang\cs.txt.tmp

MD5 93f04edd3727bf993cc4322ba6002877
SHA1 367c05f2e5f71738c6b3a7bd2e24f86c65959d63
SHA256 177acce42e3fcf3c35159a4767ff855bfe494e50ac5e9b1e2b1cca48d125d9fb
SHA512 b8f2cdcddf3b56cc3cdf6064cc1248e03624f05228cdcc7ee3ed3236e2d191a0d477b8a001fb239206b80515885baff492bed90f272b33f5bcaba95878774c92

C:\Program Files\7-Zip\Lang\bn.txt.tmp

MD5 9651bcabb521fb2cfccfbb390d267291
SHA1 f47f7676dd2041b4efad4973fe5fb93de667ecbd
SHA256 be404d9d6a84b9a458520c9efb00482aad41a913765918578911b8a7256a398f
SHA512 f02ab2be5f7475787effd9fa6f323ce6f45e9b6aed77cb894aca2af7e62da237c05201c03de4cc0331b15e54ec72d5399a190c0328cb98ab9678d15c2e7fa8fb

C:\Program Files\7-Zip\Lang\bg.txt.tmp

MD5 881ed63d26fff3b9470f2a76b1643d82
SHA1 f6a3f2cc3ee8ab6a10c59862ad394878ed818f68
SHA256 3de184ec89dab14528a362bf6d97f60c6ed142c5a97f0512a30e54e3b148cb7c
SHA512 e1153fc75cee418c2eba575919dcc08c0c9db45936fbcd3f0322b9e30215b0058bb7eca09acfbe1a1f3f5bff3f8b9542b8162165fef3410a288e10cba112b6a3

C:\Program Files\7-Zip\Lang\be.txt.tmp

MD5 bed1e1d7829541509da7d83bdd2fe4bb
SHA1 fb987045111461c04930eee59077e834a7662e4a
SHA256 45cde2d4b650080e2d135eaa267917e15e18977bfb5f4f4d13ccef84372b3484
SHA512 84d8048b0b58781562a52a6c2c419280a20307912f716f62a688da8ff42b14be0871283873fe533af7a922b819a459ff40de24fef67d126cc41e22b8fee41a81

C:\Program Files\7-Zip\Lang\ba.txt.tmp

MD5 4546c1a02701de9f8624045f78d3745d
SHA1 f64fe02614c8d717a584f075b4b7391a08a4fdcc
SHA256 2865f931cff55d858550d7a9413265da5b517b8a50ade87c9e181a1188a19c8a
SHA512 ca84945d2685bbf902a068b4711aee3a3fa10d46cf7e951e16cbc91e0212944061a0bc73d8d370bab2202666259ead40cac50035a46b1ff95e4361d9b1a8d4a0

C:\Program Files\7-Zip\Lang\az.txt.tmp

MD5 379ada79095f5f3e28ffa3e08ed94813
SHA1 f4fe2b9548874f8bbaf8ba8c16aeeb73bf3829b2
SHA256 23826875d95dc63ec19e6c6ff5470d7e0796e6cab481126118c125fc8460553c
SHA512 269da7ba99f422f70de8cc66e795b2aacdd41bd58b9060dd618075bd7a8a585ebf9a004c75881721e656a5618a495fa32586fbda12f0b49425b36efd8c41ed76

C:\Program Files\7-Zip\Lang\ast.txt.tmp

MD5 d2501117c67e9bec8a1e94f79c41828a
SHA1 87de84e02095a4dc95cfcd6385dfaa9d67c9eb1a
SHA256 d864fd7e10cfc69de5666fe0fe764bd6dc7c9f4919cde7da76ca2b4a071da220
SHA512 c291def82f9125f07848182f9b3f09bfe7bc5def013d24fc6c4b75acf6ef97effcbd4fa93f36350c26fbc5f40dda480672813e4de110e8a578e1395a597ec159

memory/2544-1209-0x0000000000400000-0x0000000000407000-memory.dmp

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp

MD5 ea0f2f19606406e9770d3d6b2ba2656f
SHA1 55cab72e08c43419e37c9bfa01194fccb0e400b8
SHA256 cead42d4036e986faf222b97da1f1aa06b2c6f8b6c221486c6fff2b9c8bf9384
SHA512 31626d88bc282bbadd6da47095aa04f973928b14f193513b35a65375bda6be0fd6165df276b5e938dcc8bb32735644e2c894ad9264d5c926e0c2bfc1ed2bab18