Malware Analysis Report

2025-06-16 06:28

Sample ID 250529-l3amaszrt5
Target 48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d
SHA256 48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d
Tags
cosmu discovery ransomware worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d

Threat Level: Known bad

The file 48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d was found to be: Known bad.

Malicious Activity Summary

cosmu discovery ransomware worm

Cosmu

Cosmu family

Detects Cosmu payload

Renames multiple (5140) files with added filename extension

Renames multiple (5072) files with added filename extension

Executes dropped EXE

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-05-29 10:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-05-29 10:02

Reported

2025-05-29 10:05

Platform

win10v2004-20250502-en

Max time kernel

150s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d.exe"

Signatures

Cosmu

worm cosmu

Cosmu family

cosmu

Detects Cosmu payload

Description Indicator Process Target
N/A N/A N/A N/A

Renames multiple (5072) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Zombie.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d.exe N/A
File opened for modification C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\UIAutomationClient.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Forms.Primitives.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Printing.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Windows.Presentation.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\tr.pak.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.IO.Compression.FileSystem.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\StoreLogo.png.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\7-Zip\Lang\pt.txt.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\sk.pak.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Timer.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre-1.8\LICENSE.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationUI.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\PresentationUI.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Locales\zh-CN.pak.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Zombie.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d.exe

"C:\Users\Admin\AppData\Local\Temp\48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe

"_Remote Desktop Connection.lnk.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 c.pki.goog udp
NL 142.250.27.94:80 c.pki.goog tcp

Files

C:\Windows\SysWOW64\Zombie.exe

MD5 576799676b759c8ed333cab1272a8b60
SHA1 86b7b9e01dfe812fcd3879bb0d2a12bacf068644
SHA256 0186f1d25328309e4cb9d0731c94e25e6555c4c809c4464333f6561d6508ed93
SHA512 deb0826c069992f6300fa6d396d122407e9fc1ab4aef6f927de6cca436a68b4d9b588e180b87229db62fdf3c62552eabbe8bf07b802abce8e23af772b7b36d94

C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe

MD5 0c590732dee4cfc6ca5a08913c6bac6a
SHA1 ef9e2c90b4546d8645e43f818c34bd4225218fc3
SHA256 1cf069be84bf804fef208d6908554873ab9a9d9c0531bfc0a07563b388094de7
SHA512 f8306241c283fc4f6861380f8342a3f53a10c352a3adf31d456491dca24b74efa44e22fa904684f4c13b22b76eeaf88c8cf0e6ff366d5b37bdb9a89ef78f5c75

C:\$Recycle.Bin\S-1-5-21-1153236273-2212388449-1493869963-1000\desktop.ini.exe

MD5 30308cc53cb5a4f87d3c4c6ad34866c9
SHA1 185692baed5f6dab5cf495fadf9b25bedb628ea6
SHA256 2b3892ad642ff355e1f55e84de5749b2f5681d52a529facdad671d76598952e0
SHA512 6521c8231f9c092ba0e44efff3c30f9d4076dfdad603db251d663cde731d69a5d9279c349a0df1abb76852ba9ab6fdb0d7ee1ad735bbfb00dd954bfcdf10f103

C:\$Recycle.Bin\S-1-5-21-1153236273-2212388449-1493869963-1000\desktop.ini.exe.tmp

MD5 d7978e3858ff417f01cadc2e0f4d93e7
SHA1 4f1f444836131c3a2518758785be1e88fcefe857
SHA256 74c20285a0407f7a23dceb784c87c02b6362697be53cf9906425fa73a529a46f
SHA512 548402b662cd67e50a8fa2433464a9209032c2560aadeec2b33e8306cc3845a16ab99a17fcb85dbd9864c9824ed94040c1eb165c5b1be4caf13371673ab89845

C:\a806a7f7e634bf7796\2010_x86.log.html.tmp

MD5 55a8fd79f85230541ba0abd28b1bbb04
SHA1 5a4a6c72b1f45e4fe5cb474495d390b3cc0de41a
SHA256 bf51f4bcf63a54ffda2a66b9f8e49e766f2ff74cef889b8bcd0cb14764299bcd
SHA512 c17deed85e5a305abe2a12fd5a9dd2c8ad919adebafaf8bdfc5a6a04a498c4589d570fa651e2979d75ce6f3c11e9da4b5ac46da6eacb5ce7272a3eab9683d947

C:\f518c2ae32873fab6fcffcc19027\2010_x64.log.html.tmp

MD5 7f0d2e9c4718fa7a4f8d0df66ce8c6a8
SHA1 4c4061303c0920181b88c0880773e77a7f7f43e2
SHA256 1650913aea2ac778f4f14a7f8b7eecbb62004c9875f7030521fa0b90fe17e22d
SHA512 0f14b657c2fdcb2d142d8cfecbf2b0000e6162a20aa1dec3b841bf5a7a27e019666badfa41a3d83b6a0f7155bfce070d5b758f4fc2129761a2a8540814f00369

C:\Program Files\7-Zip\7-zip.chm.tmp

MD5 54b697e7878995d617a1a75d3d309c33
SHA1 fe4e26d8d311565e11f01e6fb6768e26483cc5aa
SHA256 5c295d1676148cf8a9ae2d0e7599b8421c7907794b0dbfd3bdbc9d4b93a27eb7
SHA512 4fb169a5b5188bf3a91ccdac79c37f78b3703eed7ae278b63782fdd9571f2f9dcd6b2e70074dab479c63090b16f039e157222691c968720475dea6b793725b1b

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 f53042d42ff145c3e31f6f5297921a21
SHA1 31fb933adcf3342f7d1985a7cc04d80570b1cff1
SHA256 5b66208be7ea272fe80e75f7b2417803a8539080332a11230dfcf024675b1eef
SHA512 25337de9623202fbb3493e37835ed0559922ccc1f00173f07d6ca113971916b96d9541fe8d04a15879d64d4c922b839903b3fec2e6ae177260deb3b25cd270e6

C:\Program Files\7-Zip\7-zip32.dll.tmp

MD5 40721bab17dc82ecd95d5347ef9b425d
SHA1 bd59d1e6167726da8f8f8c72c50890ba3be87d2a
SHA256 c1a9b3b5072d1db15f78e8a7e6b071146f97e695a6ac1fa4d558c2b3fb271506
SHA512 6072610943839056938489b1c2c41682980f71789d59d501cc966dfa690b3f61637ec2e339c815c989ff32679cbae6e8def26b2217f4d9d04ee50a8ddbc219f2

C:\Program Files\7-Zip\7z.dll.tmp

MD5 7824ec591f4ba0ddd05ca1ea07462e10
SHA1 464cf34574cbeccabcbdda3c131b9a091807e720
SHA256 8b242cf7d5d770111aef4d3e0bcc156841aea0b30a45e920506aafa1cf96ccea
SHA512 045b93bce7e878aab141f2dd92833b069b222d41076cd6f0e499fb8d1c2bbdb2e02721b17e4f429c6efeb8d079a3ea574038926f5d219183b4403a29c628282f

C:\Program Files\7-Zip\7zCon.sfx.tmp

MD5 ef0a768f797c5b9024c280bb16622505
SHA1 556268ada2c67fb4aa15eb9c0f91f6314b62ca94
SHA256 6b4fa8a7400b44c8328140efb08c501d70caca0549cb27813688116623ae8d61
SHA512 0ee9cb749a0f9d57c8dde60496aade4c9e19e58bff17dba04c0a87422eb858ba3372cc1f57454bad98b0948cf1c603ad039f22bdeb9324f073ab527b655949c5

C:\Program Files\7-Zip\7zFM.exe.tmp

MD5 896c1e5eb5def2b61b36f051f87a016b
SHA1 e0f54195a41bb3ea6d6be406276a0b9e50849894
SHA256 df8be25811a14d5ecc670a52a00f73f14c84d5bf463ee596847302dedd7c4a96
SHA512 6f33e08992b139899f98ae057b7b0b76350bccd709746590ec96861865b4057f96041da3a4b6e7a70ab2a347a54e5c6c3da747603927143ae330625102a7de5f

C:\Program Files\7-Zip\7zG.exe.tmp

MD5 0137a0bbd20f5b0ceea3a48070b70d07
SHA1 406a2e2b429a8b4adec2de3d719f7395df6c535d
SHA256 e94de044c1cb1884a95a117718d7c52c049b3363ae17a19b22a761f9b5d62040
SHA512 7a538a96b73dd3ba9492751d2853637d4b1ed080a54dccd712d616f5871dd7880c55042c8005af2dd85b0c97485466a668b9a69fb14417508047fe727b44c2d8

C:\Program Files\7-Zip\Lang\af.txt.exe

MD5 53be25f14e72e68390c6e09dfc719740
SHA1 eb48ce85f3eb80211bf10de2d505d110069bcdb5
SHA256 8ce9b08e9703667ea02c715f84a326fe15e1d15e60ad7f20d6002ed8f9ea8190
SHA512 e48755fc336d2512bc987e58e24ccd3d130b42134ee91b2dff2c4d8ea1a7f5e406e6e9f007ced158299bd08f4f2882d3f00b5fd15ec84e79abffbb45c88ab210

C:\Program Files\7-Zip\Lang\ast.txt.tmp

MD5 23f93b9cc77d77bf30d32c7487684180
SHA1 f24780d88a2a476ad87a51ef3aacd423313b502c
SHA256 02a808e0dfcaf35b8fc1edeef1c8ef1951f6579af19d0762b453edc5655e724e
SHA512 376f0ff756717e6cf19fae31501e9aae9ca3a63de6af11d07676c63b999b01ef89683e5c7b299a6954b278c1ec55007a3a750bf7c7c40ccc4a8204741498cf13

C:\Program Files\7-Zip\Lang\az.txt.tmp

MD5 5ff7879a67c36da0215529c8c838e5a4
SHA1 f4af7b5ea817b100ca6d7d517a603d698fe48297
SHA256 7197a29c8e52b35620912133d71eed986923c93ab1f3304024f70bca765912c0
SHA512 f06c7fc49e2ac0a22cdde20b0c277d686aac201d024bc1a75cf54ff5b231b81b5adfb51826073dc4ccf7c6f89440c1ca9a03c812502c4b736cc0dbf8226f80d5

C:\Program Files\7-Zip\Lang\ba.txt.tmp

MD5 ee89c74046dff2f00a8c06c17cac8ba5
SHA1 8354a1f0d075fa7f67308b87b18366688a67c527
SHA256 c7bfea21ba4d3e5e6b8b483760697d99eac5b61fd0eec724b98a51a252912a99
SHA512 b73d73438f170d00ca0d2d5b7b10f05dda97807828e47469bb2f332f96dab3fe61c6974d62896976d120a7bdd6d427cc02405924fb946abb4c560b54c61b48f7

C:\Program Files\7-Zip\Lang\bg.txt.tmp

MD5 04a794cd596f46d6049a69d13c47110e
SHA1 d6bb5564f38e792572ae161aa5c8e7e4a6252862
SHA256 9b5295b6131312929a8b8e094af4d0d7c42d1a7bb2c0328b1317c43166c46c7f
SHA512 57398453ff89d68fbeaa60e3f152a8bfe3d71b8635177b53e435d4b3af3621d63393ae89652ae2cde1bf7d03c04f1d01b8909fe7dc92a2cc68b67ab4b72e7b51

C:\Program Files\7-Zip\Lang\bn.txt.tmp

MD5 6075d7de2a411afd238e3e5ea21a65e4
SHA1 dda23ca42c1b7fe00fe5933a053845734705a532
SHA256 44fa16d4e8dfa6aadfbb05c36238a36ad2e414a3d5ddc7038a3f70764fa77ecd
SHA512 9fafa6040bf6b6c3c7cf5ee0013448e663f557561fce1ee359d8d76ba5b860f3fc94a31c03639e5ea972e047fe6754efd793ee2f754fd055728ae0f7adf17bcd

C:\Program Files\7-Zip\Lang\ca.txt.tmp

MD5 b77f5fa57de11ef5030d286fc9b2ba50
SHA1 b94bec2c6e717bb8ad4cd2ac8bd9bb0e30adb686
SHA256 f9ded071f4aaf288fc1983466a114bd71de5ab2f9e33f44bf38340ece5ba527d
SHA512 8d13e43c9a3ac05c2ae4cc01942749bef8e1944119a2a92750def00f3fb7f84a22453f9bd196a875d88d863a4566cd2b18c6688bb71382adf1ef95b84265ba6e

C:\Program Files\7-Zip\Lang\co.txt.tmp

MD5 eb34460971c81da0e8487d23fda694d3
SHA1 a4902319005312170ae19f79a6abb96b8c0b715f
SHA256 bb42d85835171d429b18bda3a69bee1c745abda49af37f6ec1c8240bd25b8057
SHA512 041a5427ab9d137f46c82d0c36516636284284cd0b08344d40e21ca26a5d56e866427ddf9b33e694cdcb605ddc740a711ccad2244327bef29c74dd11153f09e4

C:\Program Files\7-Zip\Lang\cs.txt.tmp

MD5 f4eae0c8e13bd2b8d56520e949560ad4
SHA1 2414ef11b6863d82950e5012bc939ea580256cd9
SHA256 ccc129748f5869be7f0a833bd23eba5016ada47892b1e630b11897e8f12c70c3
SHA512 2c49c043df3cf757c87b95d0f534e5d96e9245c6d7142d8210d76904388ec945b2cd5ab26e490f0716b70124625133acc85758e58a0f62611b163c1a5f4b66c4

C:\Program Files\7-Zip\Lang\cy.txt.tmp

MD5 5097e37bb9ba3ca7b6c30f17c1b52317
SHA1 bc63c55f3826f941b0b44c1a72d18641fe015973
SHA256 dfa67d7d43f19e617f4d56c07613414fc61850f57d7c2b1a974fd1607f6f1227
SHA512 0bcbf152c1b2e7f3b65d0210e02e18143c1529dfd2d18bb7696825ab2c1fa079af4c3648729275108e799bb4429b5cac86f8ee126772d66f9ceeb5df7fe7328e

C:\Program Files\7-Zip\Lang\da.txt.tmp

MD5 988d496ce506daf809a533e7bb8bae3b
SHA1 dde6dfdd159d7946c48404ace275175ebcd7d7ee
SHA256 2c451d46dbde9c565df4670f41d9f346d20cdb8ce5e11522f9ea1439495f6788
SHA512 6355cd4927992d9da0208ee8518a49c286fcde0b487276316b9a1eeb987d853764546b983fd77b0989efca95729144196fef2a84c6980f3551f09fb0f2b48bde

C:\Program Files\7-Zip\Lang\de.txt.tmp

MD5 d57ff0ae7b390a986d856eb60c336f9d
SHA1 39fd28eb0fa03dfe3dbc40c86579444d137fb22f
SHA256 8ebf6a6e694a50fdd851eb9d19a913568d6ae450ecb381dbd282819fbaa29b7c
SHA512 35f0d1731dbebf53449b116cb0dfc435ca86b58d6ba62821dbbed2eca2b774749b290059d546b5837a5efa688e5071ca26450facf1b9aa225448f17cf81a772a

C:\Program Files\7-Zip\Lang\en.ttt.tmp

MD5 8169621ee140bbcf33ce744dbc35e7dd
SHA1 e2a5e420092bd19bc73c34f6a1fdba1026c9ef8d
SHA256 5dc310524f1a11534131be982a42a81dd35f1ac507cade30375dca5a4521c4a0
SHA512 52abb3d0df49af7ec42264b97284a19caab019117c94ec58d5294b243c153559e0135a86bba14505805d78570cfa00b4b1dbb3a07ac5f346fc9fcb2283cbbc2f

C:\Program Files\7-Zip\Lang\eo.txt.tmp

MD5 d10c40f6158197ac6a5c42e12ea5ac84
SHA1 aeab7bd8a93ad3f97352ddf5af7b86d65f1c205a
SHA256 adf74fc92a71a678b27af5951633fc963862aa0175c6efb839e1e81372ca16b9
SHA512 a0a6c05ea648843d3faa1b5d3af70fa45bb1b7791f651ae467d2b8ce2a969bf4d9a51d3a63a5335d98ffbfdd3d4b415e0d1472471c906b7cdcdda891c9b1b8dc

C:\Program Files\7-Zip\Lang\es.txt.tmp

MD5 6a25954927ef0d4e2f1b08c99a2e839b
SHA1 a968856cde482040d73cf01c6b67b42a3c30a167
SHA256 4a961724d4442881b5fa71da36b692315e021ca62a94f3c675ca4eece3e22e89
SHA512 d1c8b45aff2ffcdf71f17900031ae457a3a9ba84a41be1d5ad4790bb9c2ba4be82e8baaad7561d3256e5d5a0b276b7d8164759bba8a3fcff20a7d62b35d8a815

C:\Program Files\7-Zip\Lang\et.txt.tmp

MD5 f0c52a820b4e365fadb41e1aeaf74f18
SHA1 84f8e75157f592ff6145d86fad8cf0a25260e901
SHA256 06abaae00aa46cc4e14614a9d54f60e94e4c565d7b38a40828e78d3cfc088a86
SHA512 48d5988443e75e6dc0cbd56250fae5e20ded8b9b93434aa4c931d8f88d062a3aabce1ab0225d90b95241d250ca07c81888769852c0054fff42be874bbc4abb01

C:\Program Files\7-Zip\Lang\ext.txt.tmp

MD5 731765b9ae7e1241f9b314e6684c8ba4
SHA1 9e2392515a0163eb1613e1a2751df5b12c27ded2
SHA256 cd9a432fc5e0815550aa4bde06201af706b5d1a5369346ec9e84f888318b77c9
SHA512 b3d000d04554e1da879e89a465ca69fb18fc2afe948c96cd91af77956492df42d7ff98a986dfbad3a0af85fea53bbc8ad5a6eb239c7e24173b29335b39770fdd

C:\Program Files\7-Zip\Lang\fur.txt.tmp

MD5 2dd84bc6c842d47eadcc61e6ab47d5e7
SHA1 a03e0b3202c010cd2c054a7f49e8490fde53df5d
SHA256 6cb6cc79a1a4ceedb3e2a575d5496b1b75b0f16d13b232269e476a0c4c9f2bcc
SHA512 19d3754d51a8ca25ed862404258d9bda6dfd99404cc24a877d1e15756ba59f14f1e849b8efa64b7db5ce8fb92964e8cd5907ec0c9574df35348136ecde23d075

C:\Program Files\7-Zip\Lang\fy.txt.tmp

MD5 f5b2bdafb138e66219de385ef34c6675
SHA1 17e3bcbf06d5cedc5898ec3717b3d02905b398c2
SHA256 5b4cd903172df9b1ba666107669cd444dcbbd0c4a645ebf67d85f080cfecb467
SHA512 45bb53b11ae346cbb9aa3addfabed809057c5b97b9a936b12d1cc5020f5b140add2bfb9f11cafdd6c60f76cea44e8e2f685c48f4d5b411f59e7ca170a39a3dd5

C:\Program Files\7-Zip\Lang\ga.txt.tmp

MD5 aaa2368a4abdcf6b8b2ab272354b0229
SHA1 18bd650d14a9881c18eb180adc0cd2eedbceb065
SHA256 52fabd9f1ea105f1df8d74f64238153c4015b93cfdf4705b4c62563ad58e97df
SHA512 fec713d1420f3a501d33ccbd27fc12810ef9b9cdeb3180a5abe59baf537f0b8b19a5568c27c666e43f2ba26f67a4c5430e5c6a5e2e70446fff424c3125e55e4f

C:\Program Files\7-Zip\Lang\gu.txt.tmp

MD5 fa8edad5848ff3f5601f5dd6ec0b3de9
SHA1 804343ad692a892b3b9b42fa200ee7255e28f843
SHA256 c0f73f37669d1015e7ecdc2c517acc4642d92a6f7a3ec366eb885f18b46e4210
SHA512 009af87dad1531e222ee9702f3d6dfd79e66fae09dede7fe2d0c47c6d66d8ef3b2df206573916696a78c07ceba02f31d92970a484759e384b28b5884f7d13d4d

C:\Program Files\7-Zip\Lang\hi.txt.tmp

MD5 956971ba2bf4c31dcf59ab7cd0b5dd0f
SHA1 c60e3eb05de997e79bb0999f763451e627b51cfe
SHA256 46d59a661b85a9e9fe5eeaf7103103012d86654295286339c5641edd7f7dab19
SHA512 505b9180a25fb11fa8feadadf2b50b4f2f29b1b8008ba8ede5ac571b4ef8214175124d53b8dba59b3f5ec6efcda9baec41337cd18c06c16c5d54bac71f51b720

C:\Program Files\7-Zip\Lang\hr.txt.tmp

MD5 d68cf2ea2fe75b84c731962ee0712d0b
SHA1 e8b2a8ac0d5e794b85fb780c1f00c5646762db9f
SHA256 4837fc138aca425fa9061f14209688c9035046e13355f0ea31a2e2c06537f67e
SHA512 ea5ff43acd06f8593da0afe8a1dde536e2c458fa6d623d786dd1601dfc87e4b21d889131f10a0b473af8d8dd91317285c3d29fd8baf0b6cab61c5433dac02136

C:\Program Files\7-Zip\Lang\hy.txt.tmp

MD5 cb819c979b80c5802adaabc915b313ef
SHA1 dcac70492c17de0b404f49cdb6bb74d66d5c4810
SHA256 9d61b90bcd366e736d246e33ac315353b65596e420cd0bf79ac5c63024453dc2
SHA512 0b411b55733c02b666fb7b2508c51035c783d12f8918782bef92541f3f48ed60cc267cda50ed2b25f49a687d3c2a9d4d5450b2116bf7160ee8cc92ed7b014f04

C:\Program Files\7-Zip\Lang\io.txt.tmp

MD5 ed3695ce2341b66c870c94e77bf40724
SHA1 f712cc10e42922a247db447c4844a3dd1424d4c8
SHA256 3b191bf6811e71dafb48d3ec9e2a9e16ff29e150c2278f62cc284d040dd4b018
SHA512 63ec5c3fbb41f71c1582ad7a92af2ba7623ce6d035d9ea242f4a3f3e3b3bfcf932666bab8cdcdaf0fce004cfd00da8eef5c512186a26fa62ed2abe2c88c376c3

C:\Program Files\7-Zip\Lang\is.txt.tmp

MD5 d9c4623489b99da2551441f2d536f187
SHA1 896bed9a86b03d0e428244baff402d5098c4667d
SHA256 aa207b29356e86256e930a3cc08412a291e0041094be3190468ce0d514773b81
SHA512 14f0baa9551125861b94ec8214d8445af263677bfeba05f41fb43cb8d7f1bbf367f757d7730258b5cebc8eb6b012414c722407bc53164a143047ff60b1a86b61

C:\Program Files\7-Zip\Lang\it.txt.tmp

MD5 60d66688d4352ce3533097fcc525f0ac
SHA1 3f16675f9e553be6bdc470ca6dca0cb203155335
SHA256 87fabac54db0055acbe2924583a298c1faf34f8084f92aeb1a162fc2ec7bf2d3
SHA512 1fa40318fba15722fc3311551ae18fcba21affac331e02c4c43cc75f5c5c1d8a2d5e5644fc9116db0a1129a557bc9ea5cac4421a4e21aa3df56029a88751bd44

C:\Program Files\7-Zip\Lang\ka.txt.tmp

MD5 b1a925707fa3400ac5afe4a8b6fea926
SHA1 cfe9a9e9a528f450842a9ae39eb9bd7e1db28a42
SHA256 bb5ebd670351c13dffd69213884f408b015e9274f86a48feaf937be3ce4bc29a
SHA512 caab0a2cb5aa5f08c98d8381f6891e55cdf2d178b07fe5983387a35f1bef37222b29e3a242865e81fb8a06f32070da8dcc1c0963424ba7f116a2168c439b2760

C:\Program Files\7-Zip\Lang\kaa.txt.tmp

MD5 a5ddae88d0aa84ed9202690903a61d5a
SHA1 3f840bd94d61b4166232dbaa2f088ad304f56ab8
SHA256 68982a5e131c0427bf76fa7ae2943a737e35f490b788b04fe02f7c4a544f0d13
SHA512 8b9f1cb2a8847d6463225fd03b47cf7ddc002a19777d8a7ff2f1b5e429aa5a4d0390f4fd5ab5df3d8e48e102f886647a17d79633289a968953b077d1838c929e

C:\Program Files\7-Zip\Lang\kab.txt.tmp

MD5 05ece3d0da9dbe906ba726905312de37
SHA1 daefd0d0734d5287af56ca92997bc8f765744612
SHA256 52542392454a0419b7291a909dc33b0f29e37c17a06dc6c6b96181468d9a90f9
SHA512 e2406292030c812fb9007949fe6db233b825194d68a8eda0574b8def25e4dfc00dd2cebbbc574afb900c936c955ac93b966a97b9b89efc79ce4d8ec8dfb15c1c

C:\Program Files\7-Zip\Lang\ky.txt.tmp

MD5 02eb3b3c0bd76daf32f0e5d1d9b757de
SHA1 90dad4f9efa080489bfb0febad08a5bb8db4c65c
SHA256 52e5b221c92635c450985a89a617d8c22ed83f55ca14fcab6e3ea0206f42c051
SHA512 2908baed49d23c6e71c11825eeed4fd6423523ad4b90ae2e570bc7906a2d01d84b0b799e5b5ffd3423ef90f377e5d77e67d110d4e796272cdf034313f4501eb7

C:\Program Files\7-Zip\Lang\lij.txt.tmp

MD5 75d568261084f16bcd40622a913d4660
SHA1 e1958d6cdb0143e709f88355205700d9bc00ca5d
SHA256 b18c3a5f574bcfda80ea5999e1771662e035318aa048ee9fcfdfffb6791065e5
SHA512 06aa6669c7b72a3a12ecf080de129f0c128bb511b615229bbbc57ef0243a2378892446e7331e5351749c0b0df2a2a5e948c84a3ec040a25767a738c682e30b7e

C:\Program Files\7-Zip\Lang\mk.txt.tmp

MD5 02b6ed8bfc2c5141abd816bea9d9ce4e
SHA1 ff24b0e2c1621861875e310125cb1d20dc26bfc1
SHA256 31f334017907e47afa3b7261ad2fd1f1df032918153bbf5f29a5f4d76fbafe24
SHA512 b3cf5c9703d7efe3dbe78d94f8db42922cbc22d782d4e8c33ac4477b3c982f983dede7fe4ae2bd8dc65474a3605094ab4499b1521920279fe1853077199f893c

C:\Program Files\7-Zip\Lang\mn.txt.tmp

MD5 d83149df9fc17f2fce5ba6276d022c68
SHA1 099279f486afa8a47a97294e429780bc786044a8
SHA256 404f9a2037c6c532230ef4f1cdd16968b66ff12884141cc8607ae4a1e33e4c14
SHA512 9e7de36bdfb63f3844d151bd89fadc06dd9a75f39891c64f5ec91b268c123bd0cc3009b19a417ad0a3d9a0c6d6f0c518919ad1c53040805b531fb60985f44d79

C:\Program Files\7-Zip\Lang\mng.txt.tmp

MD5 714d3344a849ac08e4e6819724b385cd
SHA1 6139bbbff675689589dd9ecaa773287a6ae36b05
SHA256 a2c50b095829c36bac8f989524f1266ac5d5f8c9bb3c02c4e3fa5df58e5784ba
SHA512 7e28440ab3f7f8057be8934d027954c1e5f41f1293f33f3cbc4f42651c673994f449ecc69685f569b94225d9a149817cc7da04e925dd363d89aa5cbb7f395428

C:\Program Files\7-Zip\Lang\mng2.txt.tmp

MD5 c3f0e8da3b1f223a4c1de6b8e719eed9
SHA1 9447db4574546ce942e1dac4cd496353d9e328b6
SHA256 27c0f878ede7a915725f7d6544ed9690cead893ffb324ff9e08f3fd684c07eb4
SHA512 1ab79cf0537948e45352d774d2076602138084ca56961d74cfb1c1bb7473ce2586da6a39b1d78eb03e11363b6f07e164f24632afcdb02ea0115310bd811b91e6

C:\Program Files\7-Zip\Lang\mr.txt.tmp

MD5 7b2374b462f01628e007dbaa829bcdc6
SHA1 f45f53007687e8d37f32a7eb36c6a32491a42196
SHA256 82d97334522843e4cd1d898b6589403ba8246b1f43185d415616eee83824c962
SHA512 c462fea79a24a9110783e3c61c05ab9d0528f1ebee77ce9fe21f25a93fc486101002f55f9deffc6c7e1f10731e81fe2eba2cb0a9a73f874e688caea65af9e6fa

C:\Program Files\7-Zip\Lang\ms.txt.tmp

MD5 6306712dfc2362e11f22576e96a6dfcc
SHA1 cde9c7a8bed31e923a78bef014030f98f583cbb8
SHA256 ba9f5446e6bfdb314cac08c4e6849b7a91aa9785a4326f69a67af9bb73ad874a
SHA512 e632c16a4f2bc3852684f3cb174f21a7efdbc61d8965c9aec9e8279d75c6b2a1c5bc842a6e408311b38b222dc1e73db02129805ea808402b918a2c43f1039b3d

C:\Program Files\7-Zip\Lang\nl.txt.tmp

MD5 d86b107d4cada1a313550f78737b534d
SHA1 351839af4790648992b7f3da7509a9d44d3853f8
SHA256 d268fb9ea7b2a2d050f98ffe16585a4063e3200f9bba9b0dc8847c3921c59d98
SHA512 4620e3724f30e0eb8f3ab27c2ebb164bc839c866ac00dc020df78cb37c915176e2286a4a3d3f4e820d21f0c2c9f99693cc1705647a4dda212341f23aa023f0ff

C:\Program Files\7-Zip\Lang\nn.txt.tmp

MD5 c95c1d0b81753183cbec4143b3b482b0
SHA1 62db908ad91103f91934e6810d9bf4df017df8ca
SHA256 eee9bced44cb10a16216a7dbb67e37eb51f325bccc85a155ed95c98f180fb78c
SHA512 1e72d67a0d8c292792902cca43ccc63bb69640fa712ec1418b74b3688024204900f7273eb7ff18bbaa85a33a324d21b675ea43b1cd4e0652314e53887da825ba

C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

MD5 8593ae3af5d7b10ffed3d398f43df6b7
SHA1 464c1e18f0416f71d4de7d2268a4909e443f1da1
SHA256 633d71a9c16ca37a910d9419bf478d9b73a12e6fd623c76f8773bf8542cb8464
SHA512 df53299b7a7165ca77528b277b89db2e6d6d5131a9032a0112253b72052d2102317f05c2fd0671b95bfcff35d369bc9b174dfebcc59994e9953d2b978f56420b

C:\Program Files\7-Zip\Lang\pl.txt.tmp

MD5 9ebd42be51c3669cb3dffb8a2499f8fe
SHA1 2a6c3aa2932c4b70eec703bfed1e9fb6a027aee0
SHA256 980ac291313ea9691fbc64bdb18a021d88f2e3dea8f0fde7e2b6aac2777de7c2
SHA512 0b2403e2fc0c63a5f1389195c593043391abf3511ff7c42931da362b8f07b2bf2270e56fbcab8d52e81bca37a013c69171d217ec190fae0014773964a5a0880b

C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

MD5 cfe10f153773b9937c5099e793c15cdf
SHA1 d1740ddc0048c08d6023ced7b210a25a4cb3781c
SHA256 4f148897beba09af743e5ca71eef66b4fb42c4154fc0dac3ecde8178a8a9ba94
SHA512 1e1c0ac334ad23427cff011d2072cec3240dbac7b3352b76bbceccdddbff46afcead0caf38a3628405967317520af9dc340f66631826e04e42e542bbc4352cfd

C:\Program Files\7-Zip\Lang\pt.txt.tmp

MD5 2d7a59d0cfc273a9872593ec84bde0db
SHA1 54e5a280d99d057c859acd01790524b992d8bf8d
SHA256 94b3c6c6505b5bf72f1cd9aa648ef1d84428de564c2809fbcc166711b61c168d
SHA512 d21af9c5274ac3d85c18ee324c7a1018a5b06721f5202a76e31f4435b95963c0df80b41ed7ff713ce5df86117eedc90d884ac1feadfbfdb3ec51d281463cd404

C:\Program Files\7-Zip\Lang\ru.txt.tmp

MD5 66fedaa9f89e92115e5eaeeae89b53e9
SHA1 3282577f99ff414d2e53f5206f8dec3318cbaf51
SHA256 c2b21b79b27ad2ee40ab4b0be87ab028748c482bd496e96a949c52dd2583fc73
SHA512 c0b259c9374d983cade869dcc770ec6bc142d5a6ff842a76394112439023377bbb2b79775a8f95f9f967ed28a35651adb9eac51ebb1cbb18ba2a240a5d3814aa

C:\Program Files\7-Zip\Lang\sk.txt.tmp

MD5 507717872917e24de2b10952c501e6e1
SHA1 687ddae4b3ba427db19242b3e2f5e38161198c9c
SHA256 336437b95d4c2077786e4d3534a1f47ec6bbd52479b68b8c1821814e337ef14f
SHA512 ca63024e5fc3279c11b0ba58692a599eaed8e9c4c6d1d8b0338e1ffec2fe33cedf6ac25cb015af82f6982948dcd3687acadfe4b8643edf780aba9bc1a86c1b31

C:\Program Files\7-Zip\Lang\sq.txt.tmp

MD5 04c92553ad68056bcb47576e8974a93c
SHA1 ad8dce5d67c392245820b7ba86d48f3ec09736d6
SHA256 a822c2d8e44515fbc0aea478acc8eea37c3ba633c00258a9e7900286699cd838
SHA512 e28bb0884bf388ded32eb96ace5178a1c95dfac4a1ae4d5de5978c0c7f210432d8afa3ae9777ccc0c6b68d55ae6ce531a66d9b279a709228ad23e080a4f0a186

memory/5780-1170-0x0000000000400000-0x0000000000407000-memory.dmp

C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp

MD5 2ccdefcf29908e93a7f156ed8e6e10f9
SHA1 17f32f1f338f0935a9bef112ed7163210ec6d0f7
SHA256 a1ce57dccee55bccb9bfd5b1b2d271783f472619c398055cbf4acc168043b409
SHA512 9c0a55276c6a674fb6d4eb771a39cb895b0b40d59a5cc62b37d7b939dc8a09125c2163297ad70eb9a6e56e9b6ea017a6edcafbff344c8d7376c3de92298fa12f

Analysis: behavioral2

Detonation Overview

Submitted

2025-05-29 10:02

Reported

2025-05-29 10:05

Platform

win11-20250502-en

Max time kernel

150s

Max time network

105s

Command Line

"C:\Users\Admin\AppData\Local\Temp\48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d.exe"

Signatures

Cosmu

worm cosmu

Cosmu family

cosmu

Detects Cosmu payload

Description Indicator Process Target
N/A N/A N/A N/A

Renames multiple (5140) files with added filename extension

ransomware

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
N/A N/A C:\Windows\SysWOW64\Zombie.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d.exe N/A
File opened for modification C:\Windows\SysWOW64\Zombie.exe C:\Users\Admin\AppData\Local\Temp\48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Text.Encodings.Web.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\WindowsBase.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Resources.Extensions.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyReport.dotx.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\PPSLAX.DLL.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\System.Windows.Forms.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jre-1.8\Welcome.html.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\msipc.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Threading.Tasks.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\System.Xaml.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\PresentationFramework.Royale.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscordaccore.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Google\Chrome\Application\133.0.6943.60\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\UIAutomationTypes.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Xml.ReaderWriter.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.boot.tree.dat.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp C:\Windows\SysWOW64\Zombie.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.tmp C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Zombie.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d.exe

"C:\Users\Admin\AppData\Local\Temp\48a08a1147af246551f4b7a9dda7e02f305bac6f53e2f0b9f37bdeb53213177d.exe"

C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe

"_Remote Desktop Connection.lnk.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

Network

Files

C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe

MD5 0c590732dee4cfc6ca5a08913c6bac6a
SHA1 ef9e2c90b4546d8645e43f818c34bd4225218fc3
SHA256 1cf069be84bf804fef208d6908554873ab9a9d9c0531bfc0a07563b388094de7
SHA512 f8306241c283fc4f6861380f8342a3f53a10c352a3adf31d456491dca24b74efa44e22fa904684f4c13b22b76eeaf88c8cf0e6ff366d5b37bdb9a89ef78f5c75

C:\Windows\SysWOW64\Zombie.exe

MD5 576799676b759c8ed333cab1272a8b60
SHA1 86b7b9e01dfe812fcd3879bb0d2a12bacf068644
SHA256 0186f1d25328309e4cb9d0731c94e25e6555c4c809c4464333f6561d6508ed93
SHA512 deb0826c069992f6300fa6d396d122407e9fc1ab4aef6f927de6cca436a68b4d9b588e180b87229db62fdf3c62552eabbe8bf07b802abce8e23af772b7b36d94

C:\$Recycle.Bin\S-1-5-21-3518521428-3897247806-4080064211-1000\desktop.ini.tmp

MD5 5313adfbf8e0fa9837c159d02ecab8a9
SHA1 109b50f5320169995e21bda3cf48b58fb3b5461d
SHA256 3430d95dd09462b35cf70df7d2fb27015de433fdbba26f150141f13a35068777
SHA512 656d37132973a35c68db7bea2a82ce2ec10d971a6fb91ec3620c724ae27470135f0c5ad9eb8effa77fde536ad54e89bc467f343b3f1fffb8a3877922beaf1301

C:\$Recycle.Bin\S-1-5-21-3518521428-3897247806-4080064211-1000\desktop.ini.exe.tmp

MD5 e4c5b44af00999ea3107df33ef63d25c
SHA1 a465be1a7711bc51b42876609cac4ae51b45f4ee
SHA256 ee5cd3f57b4067b73939ef5beba3433c5a02dc9195bf5ede207a6ba16300dd6b
SHA512 e6b8a2f1d44f9d4c990fd1958359a3eaa841d0eff4bcb655a60dcdf3daab8e646334f278ee552903ca3d8e2bc503793812f10c70884bf899ff189a1036041e7e

C:\b078f08d916144063e\2010_x86.log.html.exe

MD5 371abc7439e7baa282ce40d9c87ec0d8
SHA1 ddd9fa999378422551a4da1d22ffe0fe07a5fac6
SHA256 811c34bf7e3ae39192e6b3f1035fac505798967316e86f6beded9b6923b36e72
SHA512 390aa9bab72f78ec47933d3ac9f21e28a798a7b4ff23a9b6551fe97d88e8f2726de07397b9002a166c834535e2c0ce001b9dd87dbaa85621d015d6ea5bc486fd

C:\ef24ccacc0fb7a1128713900cef14716\2010_x64.log.html.exe

MD5 08240962bd390f532237e5178dd6d4e6
SHA1 2d7ea5606efc4f6982cd744276b775370135e8bc
SHA256 6ace6a1ffc1db3a29d697ca50dbeeea6734c11c38085442daa681653933d2c57
SHA512 36561d3a49888c17a1abe7e0d2fee4a0c7b180559c37050f845891b3594a7fe12b0c92bebecd17510ad0738e977935e9cf9fb320312cf02d9c54bc173d14ff02

C:\Program Files\7-Zip\7-zip.chm.exe

MD5 4532ce2ca19d86a88286dbc2c477d31d
SHA1 45ab4ebe40e890a2d44af8d75aac0a23aebc6cb3
SHA256 d82995d37c083d99e35e2a13b88bd2dc14ae93008bdcd800345e6bf18c14bc42
SHA512 237f296da6cf525473e04ae0cfa8de8bdf8153d6188a4363fe7c5f7f460698384900dbbcd63fa3980aa69968646aae9aa8d51ece1d8e43bd7a8bae9ec11b3e6f

C:\Program Files\7-Zip\7-zip.dll.exe

MD5 17c7854814622bfe21c0f0b68c07853a
SHA1 8921b30a538a7df999a4a9145b1066dfb53eac25
SHA256 1050cb862644cfa21c6800438ad58366b9a56993cfdeb50c94df3c3f765750a9
SHA512 d66c3f7bd0ebd72c5b79aa21adea87de7b85b4c57b2aaa81bb87746b00499e58ba8ad14df6a9c308b6bf664ecad5953782067da463d27750fdb2c1d574ae8037

C:\Program Files\7-Zip\7z.dll.tmp

MD5 3e2407b85973586a4ca14383893aaae4
SHA1 b647dcfb7a171bc6bd8c13c0909468c8c726a502
SHA256 1ed8e7f10558cf5d2259c3329a7b3248405dfd56f3569e631515c9e217bf7ad1
SHA512 89d6bb4f0d609daf34d222943200c9818dfec81553da77dfe61ed02422a17e3ff2f52da07d469d6a4c281b4c53e28571d8824e834af2be405ceffafc86308242

C:\Program Files\7-Zip\7z.dll.tmp

MD5 75a723e9ffefc6fac3f360c082c6bd30
SHA1 fc37f85ef5e873449397b0205ab6032f5a1b508d
SHA256 de12bc647ebf94444af96aa05729ff8d6e90f42accc4750a777acb1229c419d1
SHA512 ee682e572369aac3a0f9b7e4564ee9d3790ddec654568e4323febd5988895e7d5b19fdb1118449e5741029142c2394c7790f7cd0f51e24b96288cda3ca85c2cf

C:\Program Files\7-Zip\7z.exe.tmp

MD5 c3efac423c3d7314f7cba8496267338d
SHA1 302f905a96a19c3518c4669a5499d83c3854b207
SHA256 c840fe55016e90554ae52269e889174a2159ae6aae66631e1a52af7d7087f75f
SHA512 7ce35a687488b9e9953c2eebbb9febc9849bbcd14df5b2ba2be40d43541804751fada35d9dfbc24820c6ac81de7db5855ded1f673dc834f290fc64c38c2e84fd

C:\Program Files\7-Zip\7zCon.sfx.tmp

MD5 b4bed8ccbaca39f722b92b1199773e7d
SHA1 f83f778a7df5e8bf96a229f16bb0e6ed44981f0d
SHA256 560b3356cc55df188bdd41fc26abf361f54a9b69eb4be38781696221e00d4c96
SHA512 f5dd74e322f250ecaca3e48702767ecd9ac0e498056c50cdb06135333ecb2ad3f16e1acee2177800c249916d8a387879010be446a3a789991496c607500357a8

C:\Program Files\7-Zip\7zFM.exe.tmp

MD5 3cac1d0f2a7d5f9eb2b18a16351e0fbc
SHA1 536dc6d53317e0d594c452fb35b4a6db1febfb48
SHA256 b719ee50c29cb033b05449b93b975836bb73c06c13ebeaac6c438664ee215f04
SHA512 4393099b4510552bee800aea79e3ebdb7b10c0bf2a442f82b9a8aece47a4f2952cbebcc8e04baa1e6d6d78f414aecbcfac930916335c145bb3e04a801e2246ed

C:\Program Files\7-Zip\7zG.exe.tmp

MD5 cdbc96a4f94fb5c22926504cf7c3c08b
SHA1 10f6b551faa87eb9d4d595c5daa87fbc9fa6e830
SHA256 7cd07204225dd329bc0dbefb246f9c54505d522fdb93c324514b677e5e00e752
SHA512 86f393f98e64f52b8eee9245e34be7d2e5b148bccc90711d20df09862f90e3639f3973e82e3541330ab54165a9f64a4905e4e1dc611f69dcc6766e29c93cb0ce

C:\Program Files\7-Zip\Lang\af.txt.exe

MD5 ceb994e342181c09aef011b44c4b0eaf
SHA1 55c1f7d1657ac7baad4536bbd62bbd6d50e9a9a2
SHA256 8532658f4877a2fd8ba8d663eb096397636bb49975a2977572efbff5f3808adc
SHA512 d0572a94afd1aecdde8bbaf062e76b3b50b98e4d5f1c509eec24b2403f11eec3b0217d0d05d1a095aeb3fb691e7961bd43fc09853e740d1c105b2a5c8e0c8380

C:\Program Files\7-Zip\Lang\an.txt.exe

MD5 2d5bcd34ac15f08cbc35515377bb8d73
SHA1 522c6cb10d15ff7dbf84eded89ac33be6b1b44d8
SHA256 f9e37473890d0a8b617b8afa58489298307b9704bff1595e6a0726e564edf3b1
SHA512 08088ae6d1801c65ae25a729a24b5ec0db4e1de349912bc776bb7abc365373df150b1532a10ec225b9cb2f0ecabd57cc6c17f110f4868fb104d8a1c2e945e37f

C:\Program Files\7-Zip\Lang\be.txt.tmp

MD5 55fee4bd11e970b1427a564ea150fb8c
SHA1 0f90cbe88e7802d5cbebf9b74ba75146deeb35da
SHA256 d9113dff6b4436b69b84d7854bb529a7380537c9621e52cafb65e6cda1a612b4
SHA512 f11ce215a52ba1bb5b814a8f0c61c30977c1c5ddd18d2cf5ca70867a1fc862407e2ba18a5e9858302e525cf965b828ea90fb5195d8ccbea12ea612eda501e5d4

C:\Program Files\7-Zip\Lang\bg.txt.tmp

MD5 970c79a66c0795eb4def22283eba920b
SHA1 73556a3b4905e299234b498ab4556dc84b7d1d2b
SHA256 b8f2086c06c95387b9ca6f37eec62189992c1ea68e1253c2bf5988d295345d9c
SHA512 3876eefcf8f4eb38544456c3f6ad7bee13ceb8d95007801866dd602f31c980ed47c81f665f31de4d56c1c1f736a67a4d597da9fda5b49d6a7fe576730a90b7d2

C:\Program Files\7-Zip\Lang\bn.txt.tmp

MD5 06903b8305d86bb3bb75cee7312d1f38
SHA1 5e84ff0b607d597de8a938597e54e7c88ade30ba
SHA256 e9d56c672e6d2356a2352a169101f633734a5dc7f3c23b72c1a86137005fb45e
SHA512 33d2dddf42508e138c3317b63392d7950564d734e6416ebba2329e9fa6a890a45aa51f3ef62fabd69cfc97fb16c84379318137255647791a2ace48f2ae412b52

C:\Program Files\7-Zip\Lang\br.txt.tmp

MD5 223d47d7ceb48901d4f063fcd18a26a4
SHA1 cb57e577975b8e49c237826a495d5c87c3cb47e4
SHA256 ca6697dee6efa7af04a08d7105a95e99e00888a378ac0681a8c7336ec3210792
SHA512 d760c0b00e6b1b9767dc85510c9e64cbc525ee3759e2a21cfa96026122f0f4f1cb15dd04dc46974fa0ad6794f63674cce0db97d3f22391f2e2c8c6a61584cc94

C:\Program Files\7-Zip\Lang\co.txt.tmp

MD5 053ccddaa611d3e50dcbf466eda6aef6
SHA1 c42ca987d4205ce69947fdbc156779ed1f79d72a
SHA256 3bf130c9afcbd6021d69a8cd5570c29f7cc02fe6928580c718645de7a2451dbc
SHA512 d6ad69662f79104f03d047619f6e96292f9172a285ba896edd7702966b59759e5377bd5bdb3bd89edd2a8e09627369afd6f4f349f698e37b1a34f956e98b7c93

C:\Program Files\7-Zip\Lang\cs.txt.tmp

MD5 4834677189001b222069005bdad1f05c
SHA1 7d149a5b2a122c2a3737485a9abf127b5846ef18
SHA256 2094869c2d1617811f53033109598c8dc9336aafe19257138569396683b979dc
SHA512 f243a90b3686a513bfccbe5d562a740ad026d34ad9d217bb38307af346253baf6fd244839c2e4f18585bb56cb40e181340564160300a6cd051acd440044f74b4

C:\Program Files\7-Zip\Lang\da.txt.tmp

MD5 7e4dbc7f452009641baaf2fe4b036d85
SHA1 d94da632a2d00f40ee3b9532d1bb22f2e4efd501
SHA256 8ce1ad0e6b7a747af8fcd5d1c37405e5cab6b5578fc76561369dd119048a3ab7
SHA512 00a91e03df95d0e08eb59ee1466c84b64761a8aab4b536c576c47374cc9af5c52629281cef47db3a3efe1c5df690e8b2ef9199ee2e9b89d4cbc11a6659dc1ba7

C:\Program Files\7-Zip\Lang\de.txt.tmp

MD5 554cd7fb7a214ee6639d030b9348f302
SHA1 234ccd4be0e84314dd4228cd72163b46f59b61f0
SHA256 79529f6ed857a324c5fb3475532f2e59d1a6e180f5900b293ac2e297c4b45f43
SHA512 7a44e9224c54177f20e08b70bccd49d1fe7cb26f17dccb22e834d6c0b9901389290605468e1e92aca58edfd21ed07b72545602a12e9b17cfd819094ccc5a36e8

C:\Program Files\7-Zip\Lang\el.txt.tmp

MD5 eee9665a448107175b23d0facc4acd77
SHA1 c23b57e5ec64af4acee1bc500bc2f91589788acc
SHA256 54ffdfcd4a276a3efea7eee419242d650ffaa2d2e1745b79f01e5ef814c8b772
SHA512 4305648e44b9ff75336278904af08ee567b591f666d7151a30d30a2bfa72f754c53ce3f7ef5079db970be99ff6fb05b46cb6273438cc0dd1e1c9aad1760551a7

C:\Program Files\7-Zip\Lang\en.ttt.tmp

MD5 711fcef3f033b273310c654bd720335b
SHA1 cf1a3fefb81a1869af3079bbfff4f836ef843759
SHA256 44d62158fafd0478122067a1eb57c5bde6981544f8766f5b4aa22718fc71a91f
SHA512 c032080124382d45f1e744e76b9805681a6e019275ad6f4b7c1d4bb21f271d9465c70d33b43a1f33d0a543f50b2bf6902de2bf3aabbb0aa8726e777dcaa72fb3

C:\Program Files\7-Zip\Lang\eo.txt.tmp

MD5 753a441106d9b758ae19b24cf1dabc4d
SHA1 ec88ec036f134ecc46722de093511b22013f5f4c
SHA256 354deaafd4d1007416cd969407268b2ea1a0755a409bdc098ce72562888f6e03
SHA512 9a21205b721b50edf8788366a988968e38a02a1fbd1b6c02d9d575bd26f0c62d85acb95a40544e503050881518ea17f59edd813dfb07b327b60dcdaa2bc8a534

C:\Program Files\7-Zip\Lang\et.txt.tmp

MD5 d2f7171e69f527cb03598472f44f5ff2
SHA1 23de99057ec3d25960e31285a8db57e9a12847b2
SHA256 366c5baaa3303829b2da3277ab392d1e702eddbfb513e6ca542a1c7bd09f7d42
SHA512 493342f96d635ded3e1edfb994f9c857172cfe81e8166cf828d2f10c3453a42e7a7bd027c1ab260f8c4238415a515e8e9263d7a236ce1038145882b313d2d4bd

C:\Program Files\7-Zip\Lang\ext.txt.tmp

MD5 a61ff31caff291fd879350a6babf7a03
SHA1 fb0128e7e29ca6bfe5c03ee28aa26f247910d25e
SHA256 22a5fea3b493ff2c81714ba2555472c4a1a8babf639b9c341419001b041faca0
SHA512 0ffdd80235e8157a4776f8faf497864921ac6752ff7b626b646ca9aa9d84a070960e04a6add2cbee432236b4b6713e6e0ba52faee426e602c0e1145f652e470e

C:\Program Files\7-Zip\Lang\fi.txt.tmp

MD5 b0aeb0319469fde95f60a018daa8101d
SHA1 04fe0892e0e3f84e8220fcdb852b317aaf2c0160
SHA256 b74db9b95f7d89ede3e61a429d14aa2211f0893523bcf570c0da0aed88b5f937
SHA512 30ae12b8f79d72ee2c54c78c31eb84a8427f63363075944a105464f7ef6b7107a640a9b209ad050117d8fd38e35c160fa02d7b5e2974a7635bc77d24758f8c44

C:\Program Files\7-Zip\Lang\fur.txt.tmp

MD5 177e0b378fa509d6fd6f68667dc36b8d
SHA1 2c5d69ffce59e4d3e683ffcb1da08bfb5ee3accd
SHA256 3c5c9b1d40943c007f866c7e3e0b8ce53d34790c98148d278e426ef202d984ce
SHA512 50b9ac5c57afd718e5ec07697b82e014af2b51c3a1d1dd5cc7af6c919404caa0484b8c950a60e2a40b5f2c551e93cfec80fcff07708d2d59430b7abc60e9945e

C:\Program Files\7-Zip\Lang\he.txt.tmp

MD5 402c573d51e9aec0a428ae99eb4ac9a4
SHA1 af38813745a862af413a2f49381c94c8923d3737
SHA256 bd2381cf45e9bc9851b72bdbdea5064132bf21997cc6956a4a13102e1ecbfd04
SHA512 05964f5ee1f47764b4be88b8662cb66acbc81d96fbd3d30584f2801bdd9b486a25f1ba8115eedc99929e04217b81a26922457da96f6e9ace6c97642d3047dd67

C:\Program Files\7-Zip\Lang\hi.txt.tmp

MD5 325f8ba8f5eef3b54976bd46e12bf01b
SHA1 3a08ee795597cd206671bc4f830b9b6df20a4fb0
SHA256 3eeebe7a9cd252bcb109ed01e29155f46a1b10058d208e93f056a15268d3671d
SHA512 a0624e3f4af5ff2ac0bd3c146432028eb15ec2b2e9ab42c43cd2ac3c1bea11fc52e6457b27886dc005764e9ff9360168a69264d4ab78f58b8bdad6b031b3e009

C:\Program Files\7-Zip\Lang\hr.txt.tmp

MD5 c19a5a1f72618dd96295555b4e5b7a1b
SHA1 13f8352a3d91031deac697e18b7310bf47ae8321
SHA256 d349bb0d460a22c934cc78e826d2fb5c341925f1740051d0a52130482cd2a329
SHA512 15b5ac5201f31b91e5cbd47c3cf335dc6c33f409e450b05fb26cba6a2a33e7680fc1dca2b8c35cb148e3a199f36de67e91c762e009646ea29370c55e319810c9

C:\Program Files\7-Zip\Lang\io.txt.tmp

MD5 1e4dcc0fae318965d1b2aa3b087eeb99
SHA1 a320b4c161675559ab3a4a87bfabd084f8c2157c
SHA256 6c085183fc8680f3b1325327dbd6d2fe6fbba03fa669ca46dc2ff3b88fa705fd
SHA512 3ffe5899eeb4a961835c6f7f41100e8b4a144ca9cc89ab45521e612b38466d667a73b6466db9012be43484c221036e17dc33a7686a192a1bf80788dda1419740

C:\Program Files\7-Zip\Lang\is.txt.tmp

MD5 49a5b1860b32262b4a68a5841424edbd
SHA1 8531ba3a70de05b235920d6c8480878338876d32
SHA256 80925ef82872d4027185dbe4c48574c338eb5a9221681cd92746f4203f642ad3
SHA512 c978cacbc7f2d8451aaf46c2f945e74eedfeb46a582c928f6d1c9f9f40256c8fd5b4b084ab7b4fcf585e493ff1933c871d855be3db2aa7a73886690331d837b7

C:\Program Files\7-Zip\Lang\ka.txt.tmp

MD5 4756c506315822fc30b21ed8203e47b1
SHA1 a93bbcbc8ca1e5cb91d16c82a74adcbd110088f6
SHA256 6e69eab21788337ab725c35b5568c31329d521afe3c8784f6ed76cee44e9ea66
SHA512 ff6ea4ccd332162529c85dc06df4f5d0d9b2f4f4346239cf36d2a41965d2609ad58fc127b01bf07f5e7be261ac4c24312b58034b00e633f036376dc131a0aafe

C:\Program Files\7-Zip\Lang\kaa.txt.tmp

MD5 08624b68a1de967622df81cd7c525974
SHA1 824efc089f6d05c2ce297c1290e76af939391d65
SHA256 6c26099d224508df16c5d609c09c5e645e4a6bbe3c64e45dca896f0fd9e1f45a
SHA512 bb275a2869751c69e3c7cc87c7b17229dfca56b71e85c2aafe9271fac0bbf960148a2d2b7394049297b441fd2f71379a8952730f69546c20d2a5ea2bbaaa0d02

C:\Program Files\7-Zip\Lang\kk.txt.tmp

MD5 c453e1798110185f66657f857d97fe54
SHA1 7687dcafdef59c393e48c54273f16e09633de633
SHA256 796924d731b5d750bb6c6fabd431411fffe9eb6d450511154d43bdcf8eeec0f1
SHA512 55335fa7e3c9095341bc26d787b508d84db95355e40cca6732fc6cbb1c8487c9443a41a16d9cf8af4e7fbdb8832f3a9dcf40f1bd7f5d0c0d31cda73c0003fcf5

C:\Program Files\7-Zip\Lang\ko.txt.tmp

MD5 ee648f9d7a7d52df0c1e264c458b669c
SHA1 3f87d0985455f80e400ec0d7f794b8c9235a40e8
SHA256 03ed6ab88e48fda931129a1e4db4932e728dbe3e4470010499d20fc893fcb503
SHA512 334816b7f9ceddc115db104001af47ecd0c23b18706d6251c047ed76d234f0df7160d8011df26bfad5d750234975edf655282cd9f55efc436b0573d43314235f

C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

MD5 80f028e39c6d7cb37c2a22c4ac75f8c6
SHA1 a5902dd68b10821f5247f4e84c40a269824f261b
SHA256 7122338add350c5876feda2ed03cb8b90231f0004f3efe36e072af2d28d0d63b
SHA512 e18ca40ad613c757486ee147f0b560ca5562dc2e4456c5fed9fbdb87a4f41a23d031e58abf95cdab0d21da6b48407ddff770fc6fa424dde80f03e15dafa919c1

C:\Program Files\7-Zip\Lang\ku.txt.tmp

MD5 be0a8756320b075b5230cf72d657bfb1
SHA1 6b426169d953c1a61e901776d8897a7d541590fa
SHA256 7258c5e2042995ca558fa9817900a6f5cf2251d78a15469e205c8cbc7de33d95
SHA512 1d75c4d2d246d93d156478ab82aeaac615aad6c92a18f215eeec676cd90d186947b1f799dd6d8afece7dc61253a64e266215a42d3129fe1e5afcbecfbd623acc

C:\Program Files\7-Zip\Lang\lij.txt.tmp

MD5 53d2d013ff19d5320d4cebe5c9f77c97
SHA1 e3711726d2b6d8475b48b504b00726187ad66891
SHA256 e0a0cfbfdce4f079c73f84478c9f9a0411114a5b42551dc9e62c12da51472d74
SHA512 5ee9d455cfc26156c0aa781ae60282b4e2b323dacdcae4579fc2e97550e7200f65652f57122bed88a486706576669d86dd65db5f26282b28249550c631bcf009

C:\Program Files\7-Zip\Lang\lv.txt.tmp

MD5 0f9ad4a2420a8873618427f86a3b0959
SHA1 4f1f14be0354d882e31255ceab294d88f092ed2e
SHA256 a0041c54fe05d135868c0d1054443a31f7441b74a4f6e1db529088d1e14b3941
SHA512 7405c23a334919b827dc537ac3b36cbe580117800f0fdcf8d22362b33205ad4a72a1b378d1bf4762a099e749b34425e2bfe7a20fdb59c8aaec016770a3b0debc

C:\Program Files\7-Zip\Lang\mk.txt.tmp

MD5 a77af7d315ca464a5fa98e78223d48f6
SHA1 04b5f581e64a70624020c60c9382b7aba7628212
SHA256 1d7b0504d4fb17a2fe8fa4be3254ebc439542547130930363130959a4cd2e645
SHA512 5bab6b20262b7b6a60631d63eb796d3bcce034f6f7dbc8444b04bfa1dd88b02b3060c9c3030bc484f5db7b4da76348b37b152888bd86de8740f8f26accca42e4

C:\Program Files\7-Zip\Lang\mng.txt.tmp

MD5 56de56229d60cf8930246bf4bebd01c1
SHA1 44b9122adbb3abd19e6265cfb46d1d361330977d
SHA256 b0c69155c84f63bce466032a471d29d98e95e4eaaded7f9d5966585202be0205
SHA512 70538d8c27bdc905e7b7b464e02e22034f63d13535516f0e213d169716bbbbdf8e74d386d70f7700d6ea91d39412718c59e94868fc2a4736cd8085e2afe0025d

C:\Program Files\7-Zip\Lang\mng2.txt.tmp

MD5 f61c8fc81b169221b29120f58c6be8a7
SHA1 d52aa0dd5533807951f7c7d7500f7a873bd57595
SHA256 0959939ee9ac5dfb4400e79032d1539a5d8ad1e5a517d3839046b287dce3abfd
SHA512 3a66aae84bd912bfb15198f5e7c7907528eeb0941de7317376f99c85e4e792f475cfd49d57d0694ef04947bb3c502d1a0a582fe37724f4eb6a15558426ecc8ca

C:\Program Files\7-Zip\Lang\ne.txt.tmp

MD5 0f022ae34dd819c57a3089cf47a4915e
SHA1 441c4c1523603b3d676db38266b9012b57343d63
SHA256 8bfae376f7f9f2d1c81a47ebc7c1c5f464e6c9f1dae8ea63c71d5e1a7a39039f
SHA512 b2126fe37cf1e506c6f49f042de36e7d21358be613062a8305f244239f669af04f1f1153733cd5fec35a641a57355c7519bf088d118e012e2cb21d727e8b79bb

C:\Program Files\7-Zip\Lang\nn.txt.tmp

MD5 3e01969634fb0edc9fc95ffaa78c9530
SHA1 d03fed106f031582cbe629fd002c93c97bb79c55
SHA256 01730d5044b7ec385beed433bc8d50ef1b7e3becfe39262924e206201e6038c1
SHA512 5561357ba6337dd704090cd0d8ad379bbe39def43ccc730ad438bb10a909dc9a4bdc1bc9ce2d57997f809a9b7c460a7e93b5740c0ff96eec1d2872cc308415d0

C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

MD5 449524d8bffdbedbd7b213f489531f3d
SHA1 b2d535de26f65310b9e85a5e20ff1ae3c04cecca
SHA256 3251a678fcbc942aa1b7e283f7a16df452459d8be1eed316368886ecd873172b
SHA512 3bdc691c1972b92e90ba9b28970ee78d5d93cd51c82ebcccac24e5ff75baff0daeec39b49579226f2ad13a6dd8a9c03ea61ec49dcbbebfb609fb2097041048db

C:\Program Files\7-Zip\Lang\pl.txt.tmp

MD5 e0ed1afbe7b74173c68015be885eaa0e
SHA1 f666c22674c8d7aedcf5fe0193b38450427a8ffe
SHA256 3c204cf9dc4f95013b950031fba424513e3537105921168c327841920bb90142
SHA512 2060332d424008a9c51212396a1bcbd8a413b9856a53f39e1f72cfe76b97705ab94b6d37cd7d5a36bf550902461a2a891a14dc417e753ebcbad7b429669bb08c

C:\Program Files\7-Zip\Lang\ps.txt.tmp

MD5 86da4fcdc48f62cb5590c8f0d037eea1
SHA1 a2f7832184a2ccb46df84c8599e1bb5df773e4a7
SHA256 23515ba5a9eb340db42b14f825bce29be3df15c7de693838717ec571b080348a
SHA512 2bf8ca089fdbde38db7ead31a94101b09e67b2539808122cebc29732ef62e28ff7318ad927674849dca5320bbd705837a55be2d369e20f0a081991113a368c5f

C:\Program Files\7-Zip\Lang\pt.txt.tmp

MD5 4d12fc313e1278ad66da4bca944d232e
SHA1 2d5764e27f33dbcba645ce2162966b7e7d292e5f
SHA256 624681246ebd2b2f73598afb55a805b520976b325c4533e94652e64cff7d6b25
SHA512 dd2a207d59bb8bae212cea364180e18ffe9ce815283788564354a1311bf7f27a1dcf1daebe2665f1697b5cee83100a64b086ffc8c8c33c6c66ae09b776a7b911

C:\Program Files\7-Zip\Lang\ru.txt.tmp

MD5 21ff48ecf2e01e5563796a4a303bbd02
SHA1 bd714c65af759c6167153e51439e1ee681e3c4d4
SHA256 fa7207332b4e10617dbd82dde89533354643b32348749acb65c20778893f2a52
SHA512 5342fe61a65df75d9b6b546b1b197d2fb6eec8dc244aef90cdc3346943728d26ca8784ab67ef85b3b0ed7488cedf9147111b21983233846ef5115195334e950f

C:\Program Files\7-Zip\Lang\sa.txt.tmp

MD5 583ad9ea4e0d0fda31595281e688e27b
SHA1 e29877d2bbedd7e2a3b48d78da9a2ead826ee308
SHA256 b5bf65704eb10e8f039ee80fc390a651853e9cd1ca84a6263d00fdd93a936ddd
SHA512 8aee687d2af36b415af04271040a770de763b4b03d94737754bf168c85f0083d6fab813b76b91d375d5813d4e9967727de044886a3f6abe61fc80a78f81f023f

C:\Program Files\7-Zip\Lang\sk.txt.tmp

MD5 2e182414a1ecd57e1e4b4899c11ef702
SHA1 b43494608510694e85b4fde2d1df015d372b204f
SHA256 c5d9332dbef73163a841b35ab2000804dede3f011b212a66bd339b8ce3ea9b86
SHA512 90102500185f072996332b934b8a485ab7af936921027d08a6e8724d25e25d48b48c9c5805a0fb4ff1d2a9610856374732b4e5c52e580c4630a455348797346f

C:\Program Files\7-Zip\Lang\sl.txt.tmp

MD5 3259fb6c611ae97225621f1e07aa0085
SHA1 9476095eacc1b042fae84d353973ef0ed4ca83ee
SHA256 4afe39e73a4258e88d7035e1a655a58529c54a465e1a80b1716f579ff1013d2b
SHA512 456f19c9be8182a0902b45efa756bf9c97d9a8aeaae104d1ed31d9e31bd4c2e51f916a88659b52c9aa965bb68f5829d027fb673593349372759adc2452fdfc27

memory/5212-1585-0x0000000000400000-0x0000000000407000-memory.dmp

C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp

MD5 ad7ac5e5174c404e3437aa20adb997bc
SHA1 6ad37f2bab55cb1acf238a9c5e45442596d40c0c
SHA256 1473c274e30e20b02224044e4960cf99dad3cc3036e434d82e1b045f754f53e0
SHA512 ebc79b76ee73e7be966aa59d392be39b04aedb44059350fd3f1f9ab49d10de913d9ce0ee99dec9053be08469a69696303d9b936e088eaf703af2d4d0d79bbaa6