Malware Analysis Report

2025-06-16 06:28

Sample ID 250529-l2pptszycy
Target 5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d
SHA256 5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d
Tags
cosmu discovery ransomware worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d

Threat Level: Known bad

The file 5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d was found to be: Known bad.

Malicious Activity Summary

cosmu discovery ransomware worm

Cosmu

Cosmu family

Detects Cosmu payload

Renames multiple (5201) files with added filename extension

Renames multiple (5341) files with added filename extension

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-29 10:01

Signatures

Cosmu family

cosmu

Detects Cosmu payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-29 10:01

Reported

2025-05-29 10:04

Platform

win10v2004-20250502-en

Max time kernel

150s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d.exe"

Signatures

Cosmu

worm cosmu

Cosmu family

cosmu

Detects Cosmu payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Renames multiple (5201) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Zombie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d.exe N/A
File opened for modification C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\HideInstall.jtx.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.15 (x64).swidtag.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero2.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tr.txt.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\WebView2Loader.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Encoding.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.DataAnnotations.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DAT.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Tec.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Csp.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Zombie.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d.exe

"C:\Users\Admin\AppData\Local\Temp\5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe

"_RunTime.xml.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
NL 142.250.27.94:80 c.pki.goog tcp

Files

C:\Windows\SysWOW64\Zombie.exe

MD5 71b7f5e4c8fb472b8d4d211fdba04069
SHA1 dcccf53b2754fd7709d2d29098b91b9499b7d20c
SHA256 46e4e1adbc8b1a64269653f10c687939c4db9b2f635287df88e1bff43c8959b2
SHA512 f0cd440e76f4c01d190502f5ee9043a86a1d5afdd58a0b85ac931ef0c7511abbb3a81adcfff9687feb8545e95092a763321582e8df3125b12dee6aed7a9627d6

C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe

MD5 fcbe327fcdc6aa74cff2ea9ef604b44b
SHA1 de257f4499f62df37cb00447272e2040023d06f8
SHA256 29017ea942730f5e7293831256c16f56ad79b6bcda7829f22517a3918eac5bd6
SHA512 2f2f7a2035a73deaa84fe35428408d24827b23829a3d0ac83ea5a9ce9f63474e58a5ad69daf8dde16b5dfc700868c560a86885be7ce1a8d8ed450e85cd43d01c

C:\$Recycle.Bin\S-1-5-21-3920234085-916416549-2700794571-1000\desktop.ini.tmp

MD5 13db11af92d283d0f88f20a02f2e9027
SHA1 853c7388a56360b9218abbcb48a53035cff8d5c2
SHA256 93df258d9d180797f27428c3f5378216ab40ea1d207b82475d21e197d515fd4b
SHA512 5053a7495c0cb74173d81c13ea72e75c358d7d7851016fc491c91549da4e5f3ff3e368517b73631367f80c47b31445c9d1b02f20a3c6ab893cf70c8f75626738

C:\696c7642e7e054530349\2010_x64.log.html.tmp

MD5 e3846e31b11f3a3cc99bf583bc27745f
SHA1 f2a4758766c423b0fe5fbf60ae450d79d70a5477
SHA256 970d640515463209c03d38d79b4d37460615646518feda97cc404c6fdb15152a
SHA512 5afffc9ff7490dafa24eccb1fe2c978fb199e4e0038f4cce279c83459dbe1ed33e5596d29294c05f438fb04b0a3f192f4bbd7ba48cc0e86c6d1abd5fbafd21c0

C:\6eaadd5e1536cd09900c16de307910\2010_x86.log.html.tmp

MD5 502a502a6431daeb2cae59b2d7b52869
SHA1 f546c33fc290b9557d5b675de27d762f1f40983b
SHA256 15e11cdb188c4786aa5372296b8dd3b0a8b8b69aa450ce9fe2bd67cb2307326c
SHA512 b9f60b314d54b325502ab389ec8612f3b1f325e9af2a29274581a0ebfc7baf7e7bc02511872c00a0e307aeee42ff06a1d9712ab616593b30fddfadf11734d628

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 0275daacb227dcb36443732703f6b00c
SHA1 b0eef818f5e4a6837ad2e3d86fe09e577de48fd3
SHA256 a588dee7563a657ac78926b9bcdb4c5c1c13599d1f2dd57cb29ceb6680ce443e
SHA512 dac30c28e524750df504135c0a0f390c6fba68fbb2f4f7e739c88df0e693ce36696f260cfaae271c88d5ea697e09b72875dfe77f7021ef1e9436636cf6cfcf34

C:\Program Files\7-Zip\7-zip32.dll.tmp

MD5 6bf0a9ccb16ebb71b642e8b290a3427d
SHA1 1beb951aeba9ac29b397fd42e1f5e96ceed8cf77
SHA256 237738964d3b7f613377da821ed8a564bf7d611e8dabf5701757597f5de105ee
SHA512 c2d29d2b26a68a7094975a949db817321eff9e6f508290b74b0172d22c5eded6d09cbc6881ffbbba959d02436f56a3ddea7f1f11e49efa321abebcaf39db129a

C:\Program Files\7-Zip\7-zip32.dll.tmp

MD5 5be05b5fd5b51effb55ec1e52be6c89a
SHA1 3f2ba28a8ed6beec0d535a6e8b32f7669cc84852
SHA256 1c168727288a3965ce96c373c6f0477f991553032e7cb168ea6ea1e95de933a9
SHA512 84c343dafc272c83449635a8b83260e80efd0c787934b4a39d8ef1abdfe12612246bfcefa0f691e100485b9f8d52f39474094c270a46919bc5c27b8701b7beee

C:\Program Files\7-Zip\7z.dll.tmp

MD5 7ebc74c4c0232c3d9cb0d1ae70122c93
SHA1 3f750bda9b33cf4c743c7c3f9cfaac1733a4ee4e
SHA256 d153b8bf476f8f2050c677e1ede8e1729b42c83e31cc658080b5cbf4b52ae193
SHA512 f031d9abe6ddace84df6016ce18a1a4d358c2b24c622c1ff4e56d9d32db09b4d0f19dd82de4667ffa6b9e4deb06a7aab99cf6b3659fd805a251d4c606069c2ea

C:\Program Files\7-Zip\7z.dll.tmp

MD5 350be7bccf3fba643d2050fcc01a643d
SHA1 c8d99fa67bd5d56d8e437d6c3ab6317841ed0327
SHA256 d7428db861edae28cadecaf81f9a26e20afb93a1359a0827bbd0c630922f9b7c
SHA512 f0885c91417c07d6047c12edeec7f7e1edb67101c436b32021160916ed436decc15d9545caa882470a36bb8c5ed225609ad97496d29d2415f925902bd209524b

C:\Program Files\7-Zip\7z.exe.tmp

MD5 ded38591a4ca4668e2a4682531a21c86
SHA1 ec925ce0ada51e44b1121381f75a169e40f71b55
SHA256 348fb388f68bfc3101febc3dbcfe7820269ca2b561638a58133c899963b2de0c
SHA512 9f432ab54a31e6a488f046898c48eec7e47077a535af934758fbf196ff227ea242fd3d9891ded7e4a4afc2dd263a529726341d5a3f2e86c522a5f27a15f151eb

C:\Program Files\7-Zip\7z.exe.tmp

MD5 7a7e7ea91a4f54a56b8d180bf5af42df
SHA1 7392aeca58ad92b42b8880c7dfaaeee15bfc31af
SHA256 90e394fd70d337e3dfda35bf6ec076c4975d2cd585feb6572591d679155b2d91
SHA512 b17f14873a421e3feacf849331185a83b846e33156199aea342f8d816c665ce012277a531f35393412c0a0481522ff5128acbcf2c1d842e948a8567c8eb9feb1

C:\Program Files\7-Zip\7z.sfx.tmp

MD5 41faa9986ac90cb4e08a7a5faabe70c2
SHA1 66502a1654266af07ae121990245a3a13df854f1
SHA256 cf74fda1c509507011bdec32bd9fe69e205e59c78a44e5fee0756c8eff82f864
SHA512 d30bbe394de9945b61a1260151ae5264fb1e7bdc3bd60229cbbf4f27fca27a0c79006da91d6e6e45580f5b06fda1d72b2fabfa833c9f2b681e75d699d329df44

C:\Program Files\7-Zip\7zCon.sfx.tmp

MD5 d1ba47d7ca58c294a3f5192673f44e70
SHA1 c93c341fe79ec5614f6c8936afd7b28fb4d503ad
SHA256 dc3b47246fab20c2a65ba001fd8c12feafa1581312bd881827caa08a873cdd0f
SHA512 2261fea887d4cb5cca2b7250b5c4049105e63ce554bffe0630e7d8228223b38e877e335585ecede309047b5eb7f64ab928e789e1f2d95edeb6ec2f573368d15c

C:\Program Files\7-Zip\7zCon.sfx.tmp

MD5 3f0de16cd472d970da3fa3c7e2975ebd
SHA1 a57496b8aac589b5473cf8b541b530c8713dafd3
SHA256 ae31469aa3719e94ce56c4f635668781a329e28811090e06a1f2bdd3fccb4a8a
SHA512 15639d6ee206739be61701eb3820a8415d8cb88e284ab3e633f1cddb9be41a9b50ea38b2da83233f0f44f532b76c31272e484228d4d04a0b1553e95d02550ba0

C:\Program Files\7-Zip\7zFM.exe.tmp

MD5 18bc4121280dedb6edc1cb4128c0ce11
SHA1 58afb44d71c8d7e06a8142bf21ba39f933915fc7
SHA256 ccb6493304cf8c819baa56cac16f89fb885b8d32a90eac3fea66bb58436829b5
SHA512 6fd225a02140efa87e2a444e319fe2fd49cecf2f6aa3ec4ec028571856c1ce299b5f908d9fadd1580f560e0d8d0ed67da1db83b331990a35e3c48fd2df2b6387

C:\Program Files\7-Zip\7zG.exe.tmp

MD5 473ae20de7350f9432dcf6ebdc35812b
SHA1 04e1d4a8653c1469def1ee0ed4b48be26a29324f
SHA256 07ceaafac9a82774db140f62a91251fa79a48a0d8f27f95e5295d43b31be8346
SHA512 bd34da9246616cd27df21b2b6c2ce36a68fc0474f6e87eae336928538216a832b4358583a477f333705034cc57b0ac0556752d5cf7da2f1b4fb6dd5fb2f919a2

C:\Program Files\7-Zip\Lang\af.txt.tmp

MD5 36233a7e33d9c29136b37ece71e5e841
SHA1 864051a08f34e05fbb1e0ac779aee4902f35f9f6
SHA256 08624a10310222cc54f3e3ba1ac7ebe10cd0bf91605565c504128f3d8dc39271
SHA512 ead45e33761fef9fc9e223420293db55a73509c5c0fc21bdc1298dbe165df902894a03e03e6c34cc0900b1f1fda63274a0a578197a22df1d416e946d7e77bec1

C:\Program Files\7-Zip\Lang\ar.txt.tmp

MD5 290dce4a8dfe5fefc32b68124a95633d
SHA1 795fe4956d56de8b9416c093b4c71fbf1e2b2d72
SHA256 d7673174caf1ca73b25c39cb1ebab46614d2978a452a20bde86d7722d19e6574
SHA512 b07eea75e0bd8f1ad2c9136db34c4e2ee036e8604a74ecf0aaa7acf9d9fe19388e7564e069412f7ae04c78510d51953735ea09b98df7d0fd763a4f037c22b610

C:\Program Files\7-Zip\Lang\az.txt.tmp

MD5 d91db376958e4842554790b3d76280de
SHA1 b3f4466b8ecb9410d48925db01ec79c340dca584
SHA256 0ded3e98c250de5f98794c074571eb50c13ca73a07fdc7b10a1ebad5286f0e40
SHA512 c2f91f0c4d2cbab66a8af6c4477143d3b1624044950f6d6b5163fac76eb67a820bee10cbcd98667c324d5d6ac5df1c376333389906907c755d66c149b9db6239

C:\Program Files\7-Zip\Lang\be.txt.tmp

MD5 1a3886850824b33479185e94299f4740
SHA1 5b9e9ff6a339961afe743213191fa283e487e08f
SHA256 6ece5428c03a8f02ec84231bfaeb45b039079c89ed681e80a0190fbd4710e771
SHA512 460ac0e29c2156b03711a90dbf0f800d2c4f36c4798d161e0fbd2b2216ca9e86f928b74ee549609ca8287721f6696b67d7993aeb5c650f5da7c8e3b21e3cadd7

C:\Program Files\7-Zip\Lang\bg.txt.tmp

MD5 641058b38a58b58052d5d0c63526bc35
SHA1 f96c527e8b57b08df24bf0055fc0bee3131fb799
SHA256 6156b5ef4603eb9887386c1c9a0fb414a144e7b3b16cea98d84ff3021c80808c
SHA512 a46238c6b84b27c6c1a4f3b2f037393b6d1e13232a8d1d3cfb93322c5e5af4de59f73eb9f184c4339a80e3ef50e8d5cdcfbb3425c640a583d521a49c52a6943d

C:\Program Files\7-Zip\Lang\bn.txt.tmp

MD5 a04bf1c4cc09dc5065ad2bd610688ef9
SHA1 2f77813214d984699a66956c8741e5d47b13d76e
SHA256 29eea6a171f6711e3045d95be0c67aa488b21cc1cb1635fb222e4bc736073753
SHA512 bdac7d003bd27fb63e03cbdddafca1a590e5833384f7db8cc80b2af39b95df25197462394d4f85f00f5c57f3fb5c5a9b3c0f7a7e6744f0925e98d925b7cff977

C:\Program Files\7-Zip\Lang\br.txt.tmp

MD5 834c779baebaa93ca3e2ef12afa802b6
SHA1 633d3a0f36c53994fc7516a060c8d67d1dfa1dfa
SHA256 458827021a74e1a0909324c0fdb356648bfe2bb9525cf32a274790a2dc3205d1
SHA512 4873439b52ae55a3d907077a70431ee58da9f9942564115110d8b3bbab7ba512978a6147fd094108bd3eb55a43ed91d88f59ebc58b7608c12c7eb6b2b8572d54

C:\Program Files\7-Zip\Lang\ca.txt.tmp

MD5 7f29d85d1437274e9b095a556a99120a
SHA1 d0a2b65093711b85ac080faf340c005edada3020
SHA256 3d1e38fed325f1a4f9bcb09c82ba1027a37837eeb35333a402e62f79b9505b24
SHA512 8f3c64dd25141150ca004d854b1ebc081b192bbcf2f3b99033a6561d321d7cba321d67cf04e3ca89be65b2c995cbbb20c382f2d90ba94f4a57db65bb61bf3ab3

C:\Program Files\7-Zip\Lang\en.ttt.tmp

MD5 c06be4433d10bdb024fa5cd3ce8060b3
SHA1 14689474d436fdc3a145f95bb6b476359bbd4ba4
SHA256 d3e5b657dca3236154cde1ef357b10df4e22868b50d5e356a9434dacb11c1b31
SHA512 a73138053df6a999c2b597712e3d02bb32894a574e913d5dad1ed21e93d9d9aa939d3fe5c05d97549811ddb851f9302f95680a8b9407a177abf0a4ba17322571

C:\Program Files\7-Zip\Lang\eo.txt.tmp

MD5 4390b99ac0280c310886fbce544b6f26
SHA1 95f2a898ca9bf538da94c87b854e52845a0ed81d
SHA256 f46d2e435065624ee94063690acda4c2d8a47a1561d928a6042f6a68007b4913
SHA512 438807a6bc2db9feed422c33d8740d28b981db949361adee5c0cffcac9a5b15b05a96f5eaa44572dced4959d14ea936d8768161f5dcc181754abe35055705b8b

C:\Program Files\7-Zip\Lang\eu.txt.tmp

MD5 43b090d7aec4a425f2bb7930d4c01fdd
SHA1 bbe4096c2142254305f75b9cd2959c9e43bb72fb
SHA256 0f74b13a783e17b66297daa92273e38e84f85cba1f5f017fe0f3a82fe9f231bc
SHA512 a3894cc37ef2cad04632d3b1b4e547b897108216110fb1588c49268ec5ac21495662dcd6cf67d68e58ef795883162fd07468eef0a5ffaa5d50eb21e106b8ca1c

C:\Program Files\7-Zip\Lang\ext.txt.tmp

MD5 120d4eed90fb0239eba6e112065ebb69
SHA1 a0f4367528e0f19cffd2c04fdc44fb35ebaf147a
SHA256 e74fd9d2d275d6971604deb1aba2813cd869ca202ed947ea609947285cb56b42
SHA512 d201dd4adf3cd22749bfd340c65473ec58cfa16ba1d39003c7f4e30a24138ddb2226905426462845c87f6613f99e42c926efeff5d17ef4d284900cf62025294d

C:\Program Files\7-Zip\Lang\fi.txt.tmp

MD5 554bd1b9bc7d540fbecf9280a7412f3d
SHA1 fdaaa06fcca47fa462de2237ba46007c7acd2cdc
SHA256 0cc02ba2c4073becafa3c1f59d8433a347baf233b7d11a486ddf947cb6d45cd2
SHA512 271a79e93fc98bd851705806ccbd930fcc41000a4ac50a45ccc2b025a11e6020fdf1ca775451930943f60eaad496a8309bfb553393790d0e0f319b15fab333d9

C:\Program Files\7-Zip\Lang\fur.txt.tmp

MD5 a9fa53d05d0c97cb0cf62879424b7ee2
SHA1 695a41c3bb3b1148a58694e956760834cede0175
SHA256 9a9a48e05cabf0a32accff987e41673001327658df8dfc155a95999b9745e055
SHA512 1b19d2e169c2f602bb71267e3f20a74b89b030f61f07737de49677199410dcb7008be337aa94338370222dcb9d16d7d12738c2b68766dd49bbdd03192aee8fbd

C:\Program Files\7-Zip\Lang\fy.txt.tmp

MD5 129f012fb8e4dd2c8a18f72a2b349ff6
SHA1 8144b40308f5a17cc5582e21d9dac54a465aafbb
SHA256 864da0127777a72e3b9a08a32c2b651f9e2f5ffd8f40fb0d55604c446ca53c1c
SHA512 f0070982ae3fc3c2eb113572b38b86d5197de0f7ec63b726bd3e97551d324f5ac2ba9dbc329c5ab14d64f03a6ebdce2ed816315b193006f4dcb2a727ca91720c

C:\Program Files\7-Zip\Lang\ga.txt.tmp

MD5 f20f282d9ec7710f3d9b9944ed4a1b6e
SHA1 c342596c2fa421389c4531bed4e28f156904ded7
SHA256 72ab8de69a2173fcbee872aafb212d7753dd6c034db7b1b6da18f76a76ee4c1f
SHA512 f7f26686521afd5d126c550a8480481455d800ff22d3a50a2c0f635b8aec8609baae3eae3ce117d9587eef99e26c8a6f47b09ee34363ecf3117615c84cedb26d

C:\Program Files\7-Zip\Lang\gl.txt.tmp

MD5 e1799855318913de43da36e89ced0752
SHA1 513f080f9af829198c780833773dc5cd0f8bf7a4
SHA256 94549acb61fadf4826d43e5c8932611311dceea94883650060e0698c9a4ab9c3
SHA512 f645174aedb7a6a9e57c9b69b94d273e014dd8833169f0446993304caad23e146f4ce9d073585f0695e6698fb9237554f37f961da66fe88a619c993fc1a58605

C:\Program Files\7-Zip\Lang\gu.txt.tmp

MD5 e67d356bd77ec1782e6814e0e1f08ea1
SHA1 ce59c88917c10b534ebf31105ab52d6aa81de53b
SHA256 f2d8573f888b8e05e8594b9d8f547ba526e625ced19d4413196851655071fa25
SHA512 9e6694839ce802295eef6948af7ee93b8d34a482e55d7d6a197d4b51abfafebce434d2b0f106ddca7a85882622e6d55800ed2474d9f0571255d148edfdb564de

C:\Program Files\7-Zip\Lang\hr.txt.tmp

MD5 230b9d7c373c6657947a78bd55478973
SHA1 eab024c16e850aef836855377a2d14e009e66eeb
SHA256 8b6b5badd2d3e23f5b6386e23fe68506ad256dc0e72a529a1b9bc72deed246d3
SHA512 140b578749086359d782557276868220b26a0bba6644455fb2a2957914732c95f035678a20f39cfbfa4448089c91cd6127c963ba8e41695d73965c5e2bc2380d

C:\Program Files\7-Zip\Lang\hu.txt.tmp

MD5 4bd0402f46e51556bf523315e6e6d082
SHA1 9205689f056feaeada5b3fb1a827d0be9fd820a2
SHA256 58ddc7d11aa80d597b1a648f38e897310d4f0477299cd6cd1dd186b1d373e15f
SHA512 0a731bbd4bb8efe7a502428608404797c887b4a2e902dfd61c1462964c8c68ab58da0efab4f3b1e476866dad214edee2d7435873978a4e7f2c0f6f5dada4bc7b

C:\Program Files\7-Zip\Lang\io.txt.tmp

MD5 faf1a506807cd7bd33b36e91c69452aa
SHA1 ea8cc45fb3f039e39e8a49c6942dea04d4702e71
SHA256 1d510eca7ebaa74228a3cc355f9cbc3c198e39f7cf1af4a8c7d5e00cad123880
SHA512 c1efe384bb745e70565cb3644fa335e0b9e156553283a74649342296163b91d3fb92384a8f030d48f8afd2b3249cbba5f3ce2383d05edac590a9dc964ab419ff

C:\Program Files\7-Zip\Lang\is.txt.tmp

MD5 3f1e4c82be1f4c0379a550cdadf3261a
SHA1 1c57f22d35fb239db072452600193527103b2936
SHA256 a8fca1d1e9e20b2e2f4518b3ba102c88c6a081be02c5075f5fe32b2ce937441a
SHA512 d7df525135989ec0a9c9e7bcfac320fa259d8c8227f59aa13fb978063aa5c747e6b8ed5c74bc078c40d5f148ecf8bd5e9fdc254ceac50f1cb46ea24ac767c64e

C:\Program Files\7-Zip\Lang\kk.txt.tmp

MD5 4d1b93737d91086450e9ade6ed6840fb
SHA1 d82e74c3bb4d827eda5a0b6888c49910781ea835
SHA256 cabee00dce6bc33ef4396d28314d841413dc41a00224fb9fb79f413bfd408296
SHA512 51f7e5d0b57dffb55bfb22455147cd327684f170fcfb3bb088ed5d7e3def4d80521f84453ce7779a5f14d2d3d9ca2dd2428892b21dd9eeb2745031392e27efeb

C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

MD5 1f9e6408caa38e15a7b9ee570f4b6ef1
SHA1 97ce813f097763980f8461c54b889595414dd8ed
SHA256 812bde4e2effa6c04803695381021927a9bf3f506b5d9f26cc59ab9a5fab131f
SHA512 49e6ba51c2f16adc9bc274359d85b8642b9d2d816b040ad51813dcb44154e450f05b42293dd422e52862f9b09111e9d83b440895e478d13775ba9e7820ba04b3

C:\Program Files\7-Zip\Lang\lij.txt.tmp

MD5 fdda543740849b3f11ae1267b6b3bc7b
SHA1 9fa9890d4f007dad1c0ce3c68558b31de02e9f9a
SHA256 b8b2b5eabea9124f2ac7bb14ca47b46ab48e3522ff2c3e63da1fdd8e872ec08c
SHA512 81b2aa7188df3fa16add1b16c31c8e77944f3de54e0d34869afaf6ed70f51f20d5c1089cd0eddae6ff307a468e64ed7c52728665bb399c1e6e80f414dc06fd01

C:\Program Files\7-Zip\Lang\lt.txt.tmp

MD5 42fab51edfa31c4def94d93a6d41d1ae
SHA1 4b74a0c66236957e93a701f48bc796a686bdee0d
SHA256 9838a60e0a04df68c67a0796fd10aa3e85e6319da90d51699de85ee056d7adce
SHA512 f8efcfd7520c1de31d96f53d84d9c8e5f8e0aeec6e722879b47a7f33873a8e89be4e95cebe94150e4bc2d1254eb940f28add99e312ecf76a626e85e1005c8ab7

C:\Program Files\7-Zip\Lang\lv.txt.tmp

MD5 121f87eacd64567e2158080068d1fa61
SHA1 7aebe43bf2f66646012f94b3661532169bd8063c
SHA256 565b417db87ab09dd15129fa6f9d1c3a4b5b84d4eb50a17e48ba6f06bda8e8be
SHA512 3a6896d219a6f92283622924904352e645b0169c26882cfa9a6a8d8c3fbb91a0d32447da180f9da6da06ac80c0ccee3b21da07ca62e941045fad36327c831a49

C:\Program Files\7-Zip\Lang\mng.txt.tmp

MD5 771ece5d3a63ec01e51c59fa773acb53
SHA1 92df63ace9c0946a49c8a41ce678921781321261
SHA256 5601f46b76e467289f04662d3208b5a30e66e1f96e4aca8d8e299e97e10606d3
SHA512 04e97752aa7e46d9e6cc2f99d7bf17bad69ab2f1eaa48d85b2e9e9324ebc0e7e88be201fd199d7ce512c1fd6912d359ed8a3592e7f85ab1246684743564a796b

C:\Program Files\7-Zip\Lang\mng2.txt.tmp

MD5 a8f6988e347429fa4af790b0d7624c2a
SHA1 db057d1644ea63ab4272854f3b3b41da836bc140
SHA256 0d64a20cd7d54a001ea91156e5c5d5de8180c137e35b347f6f7d4b899e1f9274
SHA512 06b55a038dbb3581e7adaeceb0aa37f2b80ef02023c9a7a1b09e86fb5cca4190ee739c7ea2011383413be801dd5799c796dec07d3a0725762b03bb0d632289d1

C:\Program Files\7-Zip\Lang\ms.txt.tmp

MD5 4d873658f1466c6d4fcb3c4d84ec72d6
SHA1 d92c089dcae469fd629a3edf9d5876b30664ebca
SHA256 981b0459e04774f71c83a851c97ec5ab1b7f9ae9fa3591d27a46b8993d4a5f1b
SHA512 93e70d86768946c07b557293862e8c207b0b5e2e9620e51e10984009b4f1aa50b174fab811eb656897069e50048580b332959a3e1c5ab0decee399641040f3db

C:\Program Files\7-Zip\Lang\ne.txt.tmp

MD5 c0048d49cb30de2acf775a68214de57a
SHA1 50e30cff47774500ea41d5f7ae3cdc03102dff53
SHA256 e5418c1485c6086f6c1bf9b1d7ba5f3584b417d9c24392d56b7dfcc2221c217e
SHA512 463d0bf0a87a3685486a3db75d2490e4419441376758a26769f8e3d606616dee7b9c0f34c4e65f48ab3b9094e91f41bc7df5e7bb4074425a358bad57d2979ffd

C:\Program Files\7-Zip\Lang\nn.txt.tmp

MD5 a68a352ae46f089b14964e8a1bd2539b
SHA1 df31b18c8967f8cc57e9b832cd9da9c5d3e551a4
SHA256 0d4bb67e2d756687467a1338d27124c854469b2319aa9d5c751baa761e1d7612
SHA512 b8472b746a45bdbdbc56755927dfd98704d78685630e9220d0612784d660e8d8dd335d1a8752cf7fd31c0f22b5327d4b5a5774e7b825d8c0bbc2389a2a68fd87

C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

MD5 248bf414644c6af49ab34a012ece0ac7
SHA1 7bc4ab55ae827986ec69069d8f87734380f3d092
SHA256 89f71100d376798d0bf2d45733152a1ba1f7d772db392c11c2f3ac68090cf588
SHA512 24093ca352b7e9fc91fca1cd1d7717c15101036fecaf9051ec036f36ac36e53dc7bcbf07c00cbdc929568ead6d7670ec4ec50904ce50b08d326e2602e1c76151

C:\Program Files\7-Zip\Lang\pt.txt.tmp

MD5 79df3198db923c397f70b1abf62c6fef
SHA1 492bbde58bda4df50f9c7a0cada79a81c5ee1b8b
SHA256 3ff8fb5ad147ce5e9fad6b6c28a623bffdda028a2ac7939f0f3868f82b0543a9
SHA512 b6277b56464b42f34c84aa190b5b291ab03c9a2109de9055e7e611104e5d4e63436ca54b73cf5e4104a75e53ee53708821462cb0199f5c26f0c025621ad4de8a

C:\Program Files\7-Zip\Lang\ro.txt.tmp

MD5 834b17867919d2bddc57c3bd0941eb49
SHA1 eaca0b4d672b21cc454504be31e05c549f282c34
SHA256 d0cb94d83f64c04470ae8da017dd129a9846a04fdc7bb0376a57f35566bdc5da
SHA512 0a7ecf1d97ddd883e5a55cdb75a282a95db55d955352752639a3b6b1c1da2b58da496043c4fd258d75e8f2eb8b8a45dd0751c7fd851105450cc6925d30a805cd

C:\Program Files\7-Zip\Lang\ru.txt.tmp

MD5 0bf45c91a80b85f73cfc3f7fd35743cc
SHA1 7d27ed8bcf3c0e17347d284535bb273cc93e65bb
SHA256 72ea7e28651908dd9e3a20ae18b38c622a77c967f1e30391b46389740efb9455
SHA512 f458f0f595b43e0227582bf3ab8e5af6ad82d3a659f31e1452780728c31b53df4f0a43460136a772090a200e2f8da182edcca98930a7b802d5ed9a1846b5df94

C:\Program Files\7-Zip\Lang\sa.txt.tmp

MD5 66f2716c251c6c482e035117b6b67c01
SHA1 e77581a4e9d33edd9f275b41c3950504232722fd
SHA256 987f726ce7fde52a85f8257804eb499559650e388f4368e94005b0c3cb2a2954
SHA512 a18455b77d37b71bd7e53ee359edb6212736cce01ac13a31474d1263c201ce1f0892d02dfdb5344fdf4f73a2899f9a6a29369f5ac688bf2c00fcdd1acc1508b9

C:\Program Files\7-Zip\Lang\si.txt.tmp

MD5 48a74aa200b3bdd752cf322cb3195642
SHA1 b3bb3be266ecd7f26aef2c53b42b2f9e902e3737
SHA256 5334558eac707eb7266487cb1e85a6940bc724e98998d39f7f106e009037b52f
SHA512 c6145ab5719f3c6ff5af88ba54a50b2e3b5f8dc52af472efdbcb3969fa11b03ad3f8a4175745471ffe4cf635d404935af4e8ed23e2e5e93fd20c6b281e2cca6a

C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp

MD5 77e4af0e2f6d58fab16ef720c3d62f21
SHA1 ed8e60f0f5febd35980f9fd9a79df0b049f557cc
SHA256 e36360b3170551ff8d50c760d0a7171de9a7c3927f307ab3d00d5fdfc653c1ce
SHA512 16d8abca2f5792449f404f7caaa9ad212f1093637f301023156b3b6e36c2f4097879a3aabee76d48a1be1d86c1f62e0912d1a3c81b19528cd4e47a375a88f1a5

Analysis: behavioral2

Detonation Overview

Submitted

2025-05-29 10:01

Reported

2025-05-29 10:04

Platform

win11-20250502-en

Max time kernel

150s

Max time network

105s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d.exe"

Signatures

Cosmu

worm cosmu

Cosmu family

cosmu

Detects Cosmu payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Renames multiple (5341) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Zombie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d.exe N/A
File opened for modification C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\SLINTL.DLL.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\zlibwapi.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Configuration.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag-dark.png.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\wordvisi.ttf.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.tree.dat.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote.cat.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryNewsletter.dotx.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.FileSystem.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Microsoft.VisualBasic.Forms.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Zombie.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d.exe

"C:\Users\Admin\AppData\Local\Temp\5f3cf17b34e548cfb8b278909cb21cf7f555467f55ddf61f2b8060c3ea3e317d.exe"

C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe

"_RunTime.xml.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

Network

Files

C:\Windows\SysWOW64\Zombie.exe

MD5 71b7f5e4c8fb472b8d4d211fdba04069
SHA1 dcccf53b2754fd7709d2d29098b91b9499b7d20c
SHA256 46e4e1adbc8b1a64269653f10c687939c4db9b2f635287df88e1bff43c8959b2
SHA512 f0cd440e76f4c01d190502f5ee9043a86a1d5afdd58a0b85ac931ef0c7511abbb3a81adcfff9687feb8545e95092a763321582e8df3125b12dee6aed7a9627d6

C:\Users\Admin\AppData\Local\Temp\_RunTime.xml.exe

MD5 fcbe327fcdc6aa74cff2ea9ef604b44b
SHA1 de257f4499f62df37cb00447272e2040023d06f8
SHA256 29017ea942730f5e7293831256c16f56ad79b6bcda7829f22517a3918eac5bd6
SHA512 2f2f7a2035a73deaa84fe35428408d24827b23829a3d0ac83ea5a9ce9f63474e58a5ad69daf8dde16b5dfc700868c560a86885be7ce1a8d8ed450e85cd43d01c

C:\$Recycle.Bin\S-1-5-21-1245416451-815278583-4285364870-1000\desktop.ini.tmp

MD5 1153b12bf51fdb3d869a1f135f09d7d2
SHA1 feed2cc3ca6f3ac72820b70947424ce0e8064e20
SHA256 027059fdf82142aeed4cf214761288b6bc1a86e3815490e3288254efe8ba8f12
SHA512 d50c8b49293418851331582501d7afcb258e09419e8e2a94ddb14fe502b40b0d8adc9ca27342b3de6d1b3cb5172e7e13878a331a8d94b06ac78948652041d681

C:\00cb55ce5a03cce7c8\2010_x86.log.html.tmp

MD5 7d0f89ec66a349fafb3d7fa74b0d1c83
SHA1 f71d6d8bd44a18c8e6c3697d8a44a14ab40a9a51
SHA256 95a4036c7ee83c3ffbd7f39879e5f78fbf31df48d6153506d265921dd97f9d13
SHA512 315f9468d5b68c22b09631233b41dc5752e89f75bb2b628e2b82604588a96ce423462cedbbd4ac386874b77efec8f305ed1d1ff4fd409dc33a929d1db2452f52

C:\09888c3fc6bdc8a345f7\2010_x64.log.html.exe

MD5 61477a4fb7f3c9ccfe2b8cc0b500da49
SHA1 e26d4db33d7e113ea1b5c928477eeb77febf93db
SHA256 02bf00fbfba23edc5798a3d43e3847a2f13c9f8c444fedca9ddbd84b8d616e18
SHA512 d8deb3156f5049131ccd14152056fd9ae433cf3b50a8481bc4013b18dc30ba75cae62442202de3582602c2fbf14a0a36243d518b497ace0943d17bfca58ce707

C:\Program Files\7-Zip\7-zip.chm.tmp

MD5 58ff8f2d02506f1d408ca4cbd1981d70
SHA1 e248599fdfebf75e9065525f7cadb8b818a64252
SHA256 e2bb275e5f917a45a5b8d2e33f2353c55f91b714a43581a6b11f75978c281f38
SHA512 5ea70bd06b6b96b1279072a6c2108078a37eb6de19c543170f60eab2ff14768e8f7f1c983c092afe5c769035ea307e81261672f64b16960ebaba084615e7f9fd

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 6aac7bc69f4810bb5df77cbd0dff1eb7
SHA1 5e706fd2635bc9bf6598f7891f265d3b55017f49
SHA256 180310e587f8612aaca5affebd3624b5ec59b8b7a4f2d11223c150d109cd8f02
SHA512 393c81318fba1e2458fc5f0c4e354e55bd3f2fbf74e03cc158e9f070dcfa81c937a20ae2f76ade0f17b9501294c7db496c70bbcc70ac946d54982555613dfe7d

C:\Program Files\7-Zip\7-zip32.dll.tmp

MD5 2c95c5cb8cf5977a4bf6d5f36d6606a0
SHA1 40eb76d6eca64fbb60d08706fa2519f3c45f086f
SHA256 276bc89af967aa112ee2c57ebf1ff8faf01a57fd5e307487e88a57c3b583fd36
SHA512 58e611e5b4bf7554a0f5a0d6ae49f358348d3aa13e7f63766b604b3b50a51e2ee1a12ec4ed1cf12939d6d9fa76ca8e90e3c1f980580314e0717d8c2cf3eb550b

C:\Program Files\7-Zip\7z.dll.tmp

MD5 c2f1abc9ad5929868cad0b74d15f6acb
SHA1 2bdd5f726e99532a9d7afd73ea56c23ff377c7c2
SHA256 e9c8b6cf3b063938674d97a1a4cb18d34129589726da56ea0f8998d6f679e283
SHA512 d13538c9ced038f643997464757237daf929404838d300a298e4e9f1142d03dcdced25c7aabffae91c1aa093bb62abd500e2d18055a4ea123807adedcafad09b

C:\Program Files\7-Zip\7z.dll.tmp

MD5 038d0dd4d206aac68b960ec9fec02965
SHA1 7ef9a1d0de787ae630b06749d36e4f9089f35508
SHA256 31f856e36980a0fde44d5c8b4905068d5791a272f30f11f9ea886f16df8bb963
SHA512 15166838d83abe956ff2f0c8ee682fbbb9f5ecb3a0cf1fece8d24c1f08f2b4080fc21cc98a91843d00834735bdd97125650ac3c5d9ec0ec47a238a166ab4140d

C:\Program Files\7-Zip\7z.exe.tmp

MD5 19329dc211daf8517585947554d1b659
SHA1 79ddf51a2d048055e70061676e27948f0dc86ba7
SHA256 2837a0332394666939d07a8b11d8ccb18a8950f5e14317bbc865891897db5b78
SHA512 238558bf4dcb596ce344699dae2f89a59a6be3c9af49ef173c154372a12b5cd84edd8d2de90d288a32830f2c7f7873b8ad9ab5b00483b5175419eb0f9cc4870b

C:\Program Files\7-Zip\7z.sfx.tmp

MD5 d5543f943c1b519e868aaed82f0dd3bf
SHA1 9a52aeacedbbffac02aa1b7ca30bb3af3cde8985
SHA256 54aa4fc5a31ec16f8aa15ce00e70831219f6ead207c75db262d6707690067bda
SHA512 4c023a83324431b585232e3bc6bd948c22216a241d638d7b358ab14770b9a24ea35976ebb104e627a43b379b7f6c93182b81adfa33c62b8e8ccb48755ce8a553

C:\Program Files\7-Zip\7zCon.sfx.tmp

MD5 7ed48b1bbc5e1fd3e95fcec6e99e042e
SHA1 45a8c779b3500dc7d1b14562439f47f9054a7bdf
SHA256 77422372441857a9c613c95d478d6199733355e1130bd1dd8c2874c709abaef7
SHA512 68854e3f231a8d575c9ea122e762b6c84b49cb9fc8222bb4b826910471110b5bbe8b36be9ec679ecd5876f8f1529ead185f2b3ba38fd9c2c3748bf9a98112b94

C:\Program Files\7-Zip\7zCon.sfx.tmp

MD5 3e6584b52301a76884b07d3d027066f7
SHA1 d6475657d9e4e7dce0d834f4b301fea324f8585d
SHA256 04301a5972a420d92872f0937f8157978d311f910e95d25ca177ee2cde34bd83
SHA512 f687ca952484e8d10baa6b018da39f55225afe5e7f8539cd772de2a8e33b26db5eee439e12fc713fbb953c9177999c43c83bb93bfea4108c3b5b7b8ea9df07e2

C:\Program Files\7-Zip\7zFM.exe.tmp

MD5 c3c98b578bb3ac955fcee2a41c6db2cc
SHA1 f87fab1859df4570ef1ec6330b4b2799e5a5a4d6
SHA256 c0f61952e7d55eb99142832bb58944ab390fa5c3ac700f612111ea903812aa3b
SHA512 9d84f3a7efae9256859739924c9efb7a83d6b573297e9401bcf35bb7cb9936841bdb0fcd73b43b79a55454262fa741e49e5f7e5109148d76a3b0964a0f531419

C:\Program Files\7-Zip\7zG.exe.tmp

MD5 5c8329c3fcb5cabeaa272ecbc317d780
SHA1 073c420cb522c46a845c7ead349a361bbeaba38b
SHA256 35ec9a26626406b47bcacc97bbc82f76c4151e19681e472a7a042b60ba5b908c
SHA512 8d1055b429f6db40aa6cbc750175ca443d5f51734281bfb3a9363dcf2a8b4c0e69c1887eca14b8a1e25846a6db968ba7fb3a2e76a5dec91018d3d0c07f2ca976

C:\Program Files\7-Zip\Lang\af.txt.exe

MD5 91188c805a32f494ca8bb75d1cc1897e
SHA1 0f27b2afdaa0a24b25e48a1fbed01b8cea5b3e07
SHA256 cd68406051d0a9eb30a1fcb8503e84dbc426521584d50194a66bf1a7cda68207
SHA512 cadf0fe56622909b0fd548056ea4703f83d63ae559550efd453afc26751e1b1cb22a946229a843e604b1188d2099c97a753564860e426eeba7c55cbba02b9556

C:\Program Files\7-Zip\Lang\an.txt.exe

MD5 395cd7e665f57a4a4706ec1e60b49b06
SHA1 0d2ee6b2423c42ec0fdcf5309fcd7688ca516ba0
SHA256 70a4ae7abd6a9bef10b3ba4cce6cc2507edbee54cc5be54c5b24a0a764275c99
SHA512 a5a87e6ae8301f97acb4a53a2e30070701a47554aed24ef91312b9afa6173b135b2f9d1ea1e0e7b1a56ea47be36d47ca3fb2dd4b9be9ebf27a64413390506e66

C:\Program Files\7-Zip\Lang\ca.txt.tmp

MD5 186cc34834034df2a28b871f91ca2e40
SHA1 a8a40059605eb40390d410862b033af17fca726c
SHA256 4774b46d5e06928b2e86290d81c019682cf65e0da7eae2db43a2e2df55240ce1
SHA512 fc8ab39170547a63864c6d1f46f1287a799c67b8fbe35dd3e262c239ae3cb7b8752ad8b6a94137b53ad11a5058e93194f2b73529906924cef3486ac22bf72361

C:\Program Files\7-Zip\Lang\co.txt.tmp

MD5 8d5885bcb507aa641a43bce3b391a0d4
SHA1 25b163e2c89a582ef17e075da355ef7ac0a99989
SHA256 6e89919c0b72ab46a9f54af6063035597526685408383db3d97ec0216dfcacda
SHA512 e92e0ed1d3dae9eced0e73339a6a0c2f0c7c6efa2451cb987266ea3982d618f06c2684581b8248db5ed836c3a2c9ea83472852a580a0bb2df69e232edd66533e

C:\Program Files\7-Zip\Lang\cs.txt.tmp

MD5 8f0fd16a63561f741876d94a1691546b
SHA1 2118f6c4073b7161221e78356e80995b84764b9f
SHA256 ae3cbcd8197c6dbd40b80c025f09139f1e8c6508e2e9f28e27f8f9ae1ac26afe
SHA512 c74c1beed145a0d7be0c4ac1dd9d8da64a07ec278401bf6a407ef90bc06172e1a0dc5ce0134246566f5ffaefdf3f77ef5f26a61f5b79f0fedc9dfd996bba8ad8

C:\Program Files\7-Zip\Lang\cy.txt.tmp

MD5 a6139963ccf9d5e4950c8f867b7d76e9
SHA1 ebd765707095596f4d928235721e536e997d7552
SHA256 d5b071528f50cdca6b596c3092bd940276fe56f033bc3ea4a9e94aea6d92f201
SHA512 2fa0831e779aba9bbd9e87554d660e2c62fd2c9f7fc8cdfc28e143261fe2dd42a175f4e83f9819030ecc22e05609229deeb1bd784260e2df986ed5053096af56

C:\Program Files\7-Zip\Lang\de.txt.tmp

MD5 7d87011b59cc9fe8bfa6acb1eb64c290
SHA1 51b1899aa93c60663074bf02e89398e95860b3c3
SHA256 dff6fece7ef894e1c5abf5314174c51701e1991f145a029c666ac0916f1cc49d
SHA512 ac1b381b3f44946f7a6fc80162c19ccaa85e4d01415504b1bfb93e65f0b83b91f443e8aa526f81f685622c15a1ec8c2bc8e1be1d890c33b63149e844e169ec50

C:\Program Files\7-Zip\Lang\el.txt.tmp

MD5 4d496fb282c8854fe984fd40d0aedc5f
SHA1 c199bbf2110c390eb630abb92b9c3ecaf35f36f2
SHA256 31f41774b5c68cc345fc6c9e3f288ee9e4320d3135a3eb62dd0538bf3a4fbaaf
SHA512 9e2200251665f88e40fcafaa93d559df4a1c19e2065894c1666209ea4e28dec7fda04b413da88f81eec7aa922d6ad34c511364d427c3f552d30f96932c0a2614

C:\Program Files\7-Zip\Lang\ext.txt.tmp

MD5 ce33166d51040d2dc509998680340639
SHA1 0ac0f275bf62526807932c980037b1acfb4d0799
SHA256 88a2f80333599932d86761e24ce5b391d9099ba84bd07047520951e0a5990883
SHA512 c9cf466e2029b086fb37e492ee4c05a3d2b4d81a85fa6dec6eec924d7cb44b861023a99b672a3936c244d72b8b088c402669c3a0f5af6358df2a8e453dd626a8

C:\Program Files\7-Zip\Lang\fa.txt.tmp

MD5 2e262a7a2f89bb1391f65208f7937b90
SHA1 f74f9b8f93979faf17bc4ba0c43a0ddafa4bf912
SHA256 0c71ffe75b26b22254ffd346b2573853c32553850744e78a4290ff3d934ceb5f
SHA512 ab56194c242dd3fc582db2d3b2611d30f488454dba56081f296981a416909e750bfbdc6a27138e413afae1348ffd11ea4067f34aff265aa653289e7aba31ef4a

C:\Program Files\7-Zip\Lang\fr.txt.tmp

MD5 bb1b8d8f80f1306052c80d59226405c0
SHA1 ee0ee1827e6d5e454b07aaf3759703c58638f24c
SHA256 40f529aebb3f8f056980fb3319a03caf4d3415a102a31149eee8bf97ccd33c51
SHA512 13416a634301a10170bf63e00b46e52f371969bd3e6dd1aebd8dd67416e21221f61ee2c1b79efac38d045715de9b3306fc23d71dac53de3fb379e86f7c9f03fe

C:\Program Files\7-Zip\Lang\fy.txt.tmp

MD5 aadab33f1b017ff7f149b992127537b7
SHA1 2e69433ecfa3cc208732219a33f6bfa65268b817
SHA256 1f34933967766a8be5fa55b04c8d98d4666899375d377a0f1e0b2b0127a56caa
SHA512 64a410967e6c144b79f0df7dbee34f313385ae34c5784ea6520b501e504adb7e1f238e690b73c8a6f63d16c607fde2d225414a8fbe9043ca7ef01b26ea444845

C:\Program Files\7-Zip\Lang\ga.txt.tmp

MD5 bba403b363cf46b7d2a34c1f369d1af2
SHA1 43f083fc21cb2f0cda38c219b612d62dab9080bf
SHA256 1511fc28e4969352cc4338cfd7253f8869817a559826e8fdac5b79cf3a4f8057
SHA512 f934a71040cb889d08b1c657bc5c99b3eda97191a0992f9769fc86bb4be2a933ee678945abfce95a369178a91da621001278aa62769f7d5da0b31793f4db7534

C:\Program Files\7-Zip\Lang\gl.txt.tmp

MD5 928520c755d998689e5b103169c2d34c
SHA1 ec64bd52aef903cf45d115d1ff0c8ac044b0b1be
SHA256 ca2f89298da2ed9a1325811e6d696fb7c9faf21466f89cbb128c5c597db1d2fa
SHA512 d24d38e0ab46ed6a3d2226ae4c8b0fa1956a3e3b177c5aa455ab50a887a3b34a7010caec3397b9569c289df13748adeb4ef1f9bb6ec9cc46f14936feda6a77cb

C:\Program Files\7-Zip\Lang\hi.txt.tmp

MD5 a04efae50dbccab57626dcb0102eb315
SHA1 eb465f13808dfeaca14d970c80a0782a70784205
SHA256 0c7e8b0e805c3e925dfdd40021818342aba67d6886de7faeb3eeec60c818e2aa
SHA512 8fe29dee6a0356c3c0422f06bf1bb097df33eaca98a9f4c0e498390bcb1a29daddd0fced23887390556cf428fd3f2a184cfe56012f70e817c1a580e9e7359649

C:\Program Files\7-Zip\Lang\hr.txt.tmp

MD5 c4d3d1e73a381794968c2b7127924675
SHA1 d89f21c056434024aac54bbc0462dd54f1e70a7c
SHA256 9b9f36db1b28b9776a28a9e69bea793f990da73a0b27917494ef0d82efdf1616
SHA512 7b76ce2d51b1ea00bc691376bf2fb5becfebfd7f94feaec67b932142e0a048480b6229a3ba6c03f912e1c3eb144b490674988b42fac455df333312a171c929a7

C:\Program Files\7-Zip\Lang\hu.txt.tmp

MD5 3fff86eaaaeec4ff78f50d61adb90c14
SHA1 4049dd7839ff0ff23231316df07ab78abf85dff0
SHA256 2c48834758b62c45462c4c8e29ef1d05c74855a71a7c36fc67072b7d767d9134
SHA512 7a374fc79aeafaa80a920e5fb1d96a97f335df4bc87a6acd767f58476f654b272d3584856ae1653cf879f34841a9e59e98f9a981aa35355687914cedb81b1a32

C:\Program Files\7-Zip\Lang\hy.txt.tmp

MD5 cf17e3efdf6833b4fe6fad795bb14c3f
SHA1 2a0bf2e67c17dde91960549e9be1e20b26d14d8d
SHA256 01e644fa693348530b6cd1fe3682c14bf4b41915adbfe8339a6d73aea51e4f89
SHA512 61366e2f272f13798d3620a2a0808cecde774f64520d332d3a3ffae63f74bed709b123a3e175ac9962188384200a0300027729a64e787cc89174ddfb0eb807e4

C:\Program Files\7-Zip\Lang\id.txt.tmp

MD5 4e40c56447643e6c652fd9b2ce04edb3
SHA1 12c626ab44783a6fe29d4feaf9d756bc1cfd4281
SHA256 adce4f0719909f676efeba08e21ad5905530202e36cc8e81b057c855e7a57e3b
SHA512 5b503cfd0a483676864050ec7b2d87e1f2f092b44d602eb2af613d78ddc7574e3603f52cf509322d98d562b80afb6f0b7fe7ef35bcf644a97a373218402b671a

C:\Program Files\7-Zip\Lang\is.txt.tmp

MD5 f600a6e92bce2baa2a0b56c904727882
SHA1 6d84c350b90fc2527b1146ba89622de2d8c28822
SHA256 e16eb49d0a8910d51ae65b6d7c553199b789acc62bf15569848793743aba465c
SHA512 f7494ef48016f99aee5b6f13c659ede2a1f864f30673945833ea82c18dc0e484d9a66f1279e4c0dfe6baabf8f785b42525c48038b2858e61ea77194f32330e4a

C:\Program Files\7-Zip\Lang\it.txt.tmp

MD5 538b87541024669b22a4c553461b76c2
SHA1 b3b4784d5dd6cc4c31e64438c40582314025e0c7
SHA256 6dfa80c5d61e90f22a7d29a7ef32bd2c68ff643896ebc69b8084387493567ed5
SHA512 934a635f3fdabe01f03f6fc71e8cb3d8262252294af68bcbb18972848351a8d9f497b13902a97dd38cc770a3c6a669214b4743ac41be95ebce06510ea8fe5997

C:\Program Files\7-Zip\Lang\ka.txt.tmp

MD5 1f76414493ccfb8235816e1b927d9ea1
SHA1 4688238b5b63e02bad81a7a011c4a26ed2940bb8
SHA256 4accfde501f109685822f14c21dc67c3ec81d1daacae36a723fc76036e3df9ad
SHA512 54275dd729a11709b2630aa686a2469c31329c40f598387abb5f6a2fc081c7d6a21c1fe48fbd0c5241b243f71770804218349c1cb841fd71581827d27868fa97

C:\Program Files\7-Zip\Lang\kaa.txt.tmp

MD5 3e1a20b9dfc252061415d7c2bf24d39f
SHA1 9b8ad379a747be7c71bf6ece7399b6b05798602c
SHA256 071d6c4cf2ff98ccf0a52b3fd18fee2774c6298c4499bd4febda10be37a23dd3
SHA512 036608acc3d55acb648e9151a82eed8adb8b22950131170e7d07862ece036e2fc21029e5fbe601b3b52382d38bf4a71b135e6fd2a63f2b126c8fad6b56e429cf

C:\Program Files\7-Zip\Lang\kab.txt.tmp

MD5 c8ad27c760eed4933e251aff79faaa21
SHA1 1ee050424bc9224d6970a25dc5c42f00644bd7e9
SHA256 f95013017e8691aa9aae4a943efd174b7457efa597e0f7504ec08421eb4cdcca
SHA512 7450cb821df05f5d4719f6935e08d5a165803d175b4ac2197fb92cfa14bba000cd9fd185bbe2bf5df715a40447f1bd5a8ad7229fb4c10d212b7a1062fafd3d06

C:\Program Files\7-Zip\Lang\kk.txt.tmp

MD5 015845147591d930f2fc502fd723fa6b
SHA1 8e7571656147a35fb7ccc66e727b11e9c8345ac0
SHA256 8f81497dd791a172e6738e46e8a90414d26b747f4aed11cae9a1acffa75afb4c
SHA512 1b083221d1bce7a3b10d6643caf96f22be62c1afd6232f745def1e4b54723acfcb52f6b0ac04d76ee142697a6c96957d299a3cd1f6197653b9e4917eb84c8816

C:\Program Files\7-Zip\Lang\lij.txt.tmp

MD5 7dfea7a33443354250b0e62a9acf7e1d
SHA1 714d1edc12f5ba4ee45af7fbacebe83abe2a439f
SHA256 0c85f80c48e7866d31230847647a47d60fcb1f31a48da55a918c4fb73d041cc7
SHA512 1ec551e7e9eb31d2e0322393d20721dda77f29b5cd942521ea2314c2242840d3ad38cdc93ebd23662225647d557490fe387ca162a004a0096fbc69c736ad2ff6

C:\Program Files\7-Zip\Lang\lv.txt.tmp

MD5 fa20989910b90904b479e3d9c92aa669
SHA1 f694c54ef64a2d6f4afeb4f1a555dd11e07919d7
SHA256 6103ecfbb2460a8ece22a9790b921b4ad03d37896212ee2467706a65959299cb
SHA512 94086211f9bf4b35dd54ea1460a9724cb86e82bf54fa79366492d9270a7a8424be24061d628a2b6ac5bb07009c80a99376041dda2803d50d8e694537b7f574e5

C:\Program Files\7-Zip\Lang\mng2.txt.tmp

MD5 bc7b6566f0ee404581f532fcd00f5d90
SHA1 0ad5f52946378bace0d7d99d44495ceaa3bf9c70
SHA256 9fcf9142f70f44e2b3a295c0c6eb6e3064a9c433961db844426308d54eeaa5d6
SHA512 df6f451a6f4b57ae10bcc1fe2ec32c0c10fa6def1fb5d55ece53812f236c4a4230a02c8467f19c9bf584943370eb9df4a82994d184c8c3a9b0aa053df52603da

C:\Program Files\7-Zip\Lang\ms.txt.tmp

MD5 fcc9ccab0f44508bb5942d5d1aa740bf
SHA1 c0df7f2cf592593571b9e9b198733e3064693a07
SHA256 7b959d846f95f6feb686677e24a987c5a5f8a63a61ca801e2cf011b884e9d3c4
SHA512 295c96ac43764619c0da7eccef1d6defcf666d58c20adaa20cb8cdc5bbec4b55c337d68681232a35f9fa76609d15ddf0a1d75c048fe99bb514e4fd2f3b588ffe

C:\Program Files\7-Zip\Lang\ne.txt.tmp

MD5 0c561e958c26080a0216dffc5ce96dd2
SHA1 5149de082b0220e49bd51bc7f15c84e6dda6c818
SHA256 91b2391fb79ff8bf1eab122d09edcd719521599156526fb94082f91fced68e6d
SHA512 3e81c5de76ff2b01e84d03901b30a4c42f52bb4c0d3f719ce7a9fa5361cf67d94e1db6eff0a9d9a132507eac6a0b4e2980c844a170993aadb21403131b0cafc1

C:\Program Files\7-Zip\Lang\nn.txt.tmp

MD5 6775007475e5e0bf9dc1128ea940095f
SHA1 969b658068ee192e09efbf416657806409cae030
SHA256 3c4eeb378c4df5b65ee868778defccd51dd04212f8e8dfcd9c4b0d7c04525c34
SHA512 fd851b4a85ac7c5f65f42e98a83884f3096588669604eacc48f14cc13fa5c2915468221b7820f03f016c5e0a7a8c5694cd572bb17fdd0329f1de5baca852b6fd

C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

MD5 d0f30e98d5f4c00a2a8442bf91fcab58
SHA1 b40fc07833bf3808f377fba091c53ccb56abbe57
SHA256 beacf78b9c76f82d71c699398a86e2da97ff9b236cd443f2ea0f494128a25665
SHA512 e9d54ed737c5f6c1f016996a0a362cc172f77c6c2c3120e29c7e41a6d6ca739b7e623faf3df03e68305438485ad1453305f1eedf9d8bf2b298c04e934201ea05

C:\Program Files\7-Zip\Lang\pl.txt.tmp

MD5 e3d3315dca846cebab99201bbbc89893
SHA1 dc2cd761b27123f52506dc0138953c5d2f480528
SHA256 7f70d7a37bf2d4d543f90e245067ba6c86897fed5bb983d60ca61b035ae00b87
SHA512 f7d26995dd90ad4dd59a119ffb35ae34eaf84526294f3cc6a13cd234b6e47c0370a9c0eb8d34df0f86f6047bacf729dbbed9e8cac5e34e347986b0e924487712

C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

MD5 8de32cff20a78a2b7a0dab79cf521d8e
SHA1 52c10e638be0c4f46239f3ea7014175d9700c7fc
SHA256 e7eea27b938fa273985901283ab67f61ee5bdce98dd03ce49ef435519c7dde40
SHA512 ae6a362b51dc26d78b82f7a60b1fdb1fdaa3077f87d72743d555fcc27554557497df84ad51bfd7bf08840e1ad80e591ebce49433f0de6eaf4a28a3445c80b6f4

C:\Program Files\7-Zip\Lang\pt.txt.tmp

MD5 a77291fcc23d2f428f30de4492cac278
SHA1 05fe1bd148daff3a86bcb0f6fb9aedcce6bf3d6e
SHA256 9b9b72a07bc9d445f6a8c5d5bde6507d14f9c5c51ac5ac339cb4ac834bbd5973
SHA512 7dc6b0038019479b30d9ed8942da581e79d2545d76d3eb7f2ba64903580382beb817dd605173fc2e31fd9ab6fd4918a58622a680fa82ae85cdf78c9fdc464443

C:\Program Files\7-Zip\Lang\ru.txt.tmp

MD5 5d961c20c13fa7da99a45bcca69210b4
SHA1 9c5a546b3c29eba2bd1bac9f787fc8bf77c4804e
SHA256 3ab2efec452fa352eb4f0b48c4d4b1225e3a77824b98a1cb4a4c1334eec230a3
SHA512 bf944d3a58a65befcb731c58e0b1c071ee42e64f441e3e9687c8fd270f243a346f8fa733dde5d95b153565dd29aad565649c1b76b536fa1dcc6cc19854f029ba

C:\Program Files\7-Zip\Lang\sa.txt.tmp

MD5 e6fdd3510eeb47bf8c00c688a579f358
SHA1 b7faca5a6e965fffdc0475165426b1f45aee8573
SHA256 fcde189b5c68e3b2e75451221daa394ff4ccfdd739db7ab25ad21c45aa1f9c3b
SHA512 7cfe5e907d5434d79ab3ee0b1a373cf37e9042df7cdec67dd0088854921cbe0e85955f4942e4d89c14b98fda7b9e68f55d1529e351da8e053ab9f4d1d1b83a31

C:\Program Files\7-Zip\Lang\si.txt.tmp

MD5 971ba8011a2efc027708836fc8214b60
SHA1 1ed3a15b61c3d3463f264ba1e6dc9d8fd7fe142a
SHA256 e8a97f1aeec33361b7f4b7e456419172c319e1fbc322c7380da76e85cb1246fe
SHA512 5f7eb771b694c724f55bc948a4f76fde4e31deb28f3ab4f97cab532f661d9fadac4752ff56e604449ebd2306aaef51aa8f9c56b684f78731ef4e446a04017291

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp

MD5 e458cf11fe6b53519ff13f6043e1b9b4
SHA1 b42fca698943d3e19d7aab5fabd9bf575b684340
SHA256 5d319da74b0f3c52c4e2079afa32022f3c82aed53b8709ffa6a42cdb56e786c9
SHA512 0b6f27aee31c49c7054a62c987e824cf8555d5c8e6a7645d0ba2468fd44ce390c817cf7c92841abce1e462268539467889fe47e884fddd5da23abf4201f6ddf5