3d84cdf96a74214e15cd2b074b79f0fa5863a01049dfe1b2f687ea788a882b93

Resubmissions

29/06/2024, 00:44

240629-a3tjmazdkk 9

29/06/2024, 00:40

240629-a1qpyszcmq 9

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d84cdf96a74214e15cd2b074b79f0fa5863a01049dfe1b2f687ea788a882b93_NeikiAnalytics.exe
Size

144KB
MD5

2cfe920cd8c5eecd65559d6cc89b8800
SHA1

d974c37b1058e2a5692704404085b2c955ba6326
SHA256

3d84cdf96a74214e15cd2b074b79f0fa5863a01049dfe1b2f687ea788a882b93
SHA512

925d370579234bbf7066e04fc12be3eeb917b08b6609a4d20048b92241647a59837c0757b3815494119543083ac4e6fc0b3dc59158d9723207b3c68e4e8b0612
SSDEEP

1536:W7ZNLpApCZuvIYYoYoN7n97nYosbos67ZNLpApCZuvIYYoYoN7n97nYosbos3:6NLWpCZLYpZiX+NLWpCZLYpZiX3

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5245) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1768	_Add-VisualStudioWorkload.ps1.exe
672	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	3d84cdf96a74214e15cd2b074b79f0fa5863a01049dfe1b2f687ea788a882b93_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	3d84cdf96a74214e15cd2b074b79f0fa5863a01049dfe1b2f687ea788a882b93_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sk.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	_Add-VisualStudioWorkload.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png.tmp	_Add-VisualStudioWorkload.ps1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp	_Add-VisualStudioWorkload.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART10.BDR.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-phn.xrm-ms.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.map.tmp	_Add-VisualStudioWorkload.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp	_Add-VisualStudioWorkload.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp	_Add-VisualStudioWorkload.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	_Add-VisualStudioWorkload.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp	_Add-VisualStudioWorkload.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	_Add-VisualStudioWorkload.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	_Add-VisualStudioWorkload.ps1.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp	_Add-VisualStudioWorkload.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp	_Add-VisualStudioWorkload.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\libGLESv2.dll.tmp	_Add-VisualStudioWorkload.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN092.XML.tmp	_Add-VisualStudioWorkload.ps1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 1768	4968	3d84cdf96a74214e15cd2b074b79f0fa5863a01049dfe1b2f687ea788a882b93_NeikiAnalytics.exe	81
PID 4968 wrote to memory of 1768	4968	3d84cdf96a74214e15cd2b074b79f0fa5863a01049dfe1b2f687ea788a882b93_NeikiAnalytics.exe	81
PID 4968 wrote to memory of 1768	4968	3d84cdf96a74214e15cd2b074b79f0fa5863a01049dfe1b2f687ea788a882b93_NeikiAnalytics.exe	81
PID 4968 wrote to memory of 672	4968	3d84cdf96a74214e15cd2b074b79f0fa5863a01049dfe1b2f687ea788a882b93_NeikiAnalytics.exe	82
PID 4968 wrote to memory of 672	4968	3d84cdf96a74214e15cd2b074b79f0fa5863a01049dfe1b2f687ea788a882b93_NeikiAnalytics.exe	82
PID 4968 wrote to memory of 672	4968	3d84cdf96a74214e15cd2b074b79f0fa5863a01049dfe1b2f687ea788a882b93_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\3d84cdf96a74214e15cd2b074b79f0fa5863a01049dfe1b2f687ea788a882b93_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3d84cdf96a74214e15cd2b074b79f0fa5863a01049dfe1b2f687ea788a882b93_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\_Add-VisualStudioWorkload.ps1.exe
  "_Add-VisualStudioWorkload.ps1.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1768
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.exe.tmp

Filesize
144KB

MD5
476bdf3c1f3765e049158b4a07a9352a

SHA1
5541b1186366323fc7eebf85cca356c1091514c5

SHA256
acea70f31c209b1156a9f2c0decf902e09df93bd7e3108cbd3a7ce1afb2a17ef

SHA512
15c96365ccf450913521d0d41863379a7fbf571a2eaf8443994945834d276a40f185f0d52ce87b541203584e86c73db2f90a8369c8c945f4ae2ef8652653829f

Download Submit
C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp

Filesize
70KB

MD5
021befc1d225aa6a0de98f8d8eddf341

SHA1
1ed7024517ec6c9680760994c17a5979a3a763b5

SHA256
dc86a059a07dbde6031e9dced0cd0f570fa8ea1094bb7a2129f69d28bf0bd386

SHA512
78527e4348791659aaa08f0676cc74a08d82c78dfad09f071ae0575951eb94a542d4271ec0129be37d7409fbb4668cf3fb2393b46632e8d7e2841fcb867a8c8c

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
183KB

MD5
8d395572a2ec0d56a51f8bd4f048a24e

SHA1
295899f268d38ccd83a6b01d7bf837b21ec7499d

SHA256
9b20148853f08921590b235b75faf0f21db2f8050c28ca80b1116855b6bc92cb

SHA512
6e1f79ac48192915f6f3f1aa13a3a939b2457126e8ea480c233c5d3b64b1c2233eee5f9563d57b9009fca2fcaeed26e0c8ba5fd2aebf593b7ab3c0ee8093f17b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
169KB

MD5
46d81530e37b232b1025a98a7f9203b9

SHA1
a291c63b31e650164a0c7a8746574c54b757a91a

SHA256
766b21ff9fdfa1ffd2dba80e15461a756f9db3ae7578ebdad427cde8cc794630

SHA512
1d0fc6853c641666d069624163778bfbf2517f6de4e99636edaa7c5b7281a690519b421dc93f71f980e756a6aef4cc6a09c05a26665f4d495cf7f8ac1af53b06

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
135KB

MD5
d0bd147c381b0545d2d58213d2f0b625

SHA1
064c1d08b4a3c85db25d29b2de9bd2a54941c069

SHA256
fc67982987c2250242cd7c31f3a11064b4557cd49f66187f4aaaf8717f684a6f

SHA512
e1bfefa038323ea4f8666135fcf7086671ec4271f5f4bca692d2b9190d2d432d0d7cdbfa6a47fe9c18fb7a20d0ed43237861a4e42f91cfeec55f3fe04750a46e

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
b96b0016737bca48cf72f2455b7fbdf6

SHA1
2258bd19a2c456b06f8c371a8de4fb45e6209f57

SHA256
9351b28eaa2c4b58478de121ce622a30f6f33c6a3ac35ae41777f8ae08f0929c

SHA512
2be10b2953d138edc7ff1bd482e6fdd1b08a79ec44a60248342dcb0c2e24c4a9bbd0c08e32842faf3429dbb6978b93f2078e516d3209f0889781f29ab1791e72

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
614KB

MD5
6d595838590de71c1456adaff2acdc81

SHA1
95b550965f0e8ac78107c8d9baab75544d708c15

SHA256
96e6a538eb9ee8e6a8a821186dfeea6b4cb83696adcbd4a04845d17846065014

SHA512
3a1def73c1e79cf014fdfa3d188553ac65f0d5da0edb14323b632d1315a424e4282c8a554a59625f74af155775a424687173ce4ded90004d65288b177f34c533

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1004KB

MD5
9a3ad2c5b8eb4eb21826977b4c1b0154

SHA1
826ce17174cbd382bf5d67aa4d498c754bd0d966

SHA256
dae66ade09631ecf11693c19f3964fb832636d206ec498279b12bc2df843ceda

SHA512
ec1d8a385daafa2c65b4bae6eff9da360cefd103a18259fe3a214b562f1bbcf3d73eba926efdbeec97781eb8a0a676abd72392304271bb5a7797c64291ad0b5b

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
758KB

MD5
1318845b0730c8ee644b3ead53411856

SHA1
6430d83d989503202f649995fe888af88e77a152

SHA256
649ee125721bd7405f13c65a5692d8ec9d6480499478a2606385f66a2a0f9ee2

SHA512
92f41752c2ef78aa68d3c505594348646bc0a74b472e3d5d5f3605936e3628fa32829e20db1b3974253293f1d74c3f1f8dcac31aaf7cd9c09303db4d44d6cecc

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
83KB

MD5
e1395264f097d16a535b98262bea9011

SHA1
936bb6ca423adc27c767c8edf34e48922c22491f

SHA256
ed213c8f9e478f63210bfe855d18dd36e596606887022fe98c13dd8a256e6487

SHA512
5fd677201fb8f90cdcb911b55fa9cdf3f0b8719b76c6d924a02b0be3dcc34626ff6ac766f4b77b59493f27e6267048c5ecf5e9e85289bd858d9b78be589c2613

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
81KB

MD5
0cfc3c9c29cebfe9beda5ab421011319

SHA1
5a9f0d4dd700052c2eb08cd4bb7552d2ef183548

SHA256
1f432f47ec154c2bd744516113fec2c23ab55cf6e3d864aff93f3c609cc88f6b

SHA512
ceef852414f3b3146ac3b24b1b080f2a9800acd6b6374e0c57318e7ae472be3fab8861ac41ce0a8f03db2d93d87f01ecb3347adad4fb87d91b1de5e89b27b504

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
86KB

MD5
f8feef6945019156bd2d383cd36f530e

SHA1
a827f74f69fa8095cafa39bd5e3d3f5cc8bafcb5

SHA256
98cd3118e1e5c2bb8e9fc13754c19f117358fd7970ddc78455bec8ae705c0451

SHA512
0d4a25e4cc3a92049e5af93c60aa73d463233076b2649b0a652c0debb609a1983a5b0889b65a4854db070cda8878300db6d88bf04954dbaaed0ab180c5498921

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
70KB

MD5
fde5dbea9a050645dee8f6529ae400c0

SHA1
478866ecf17235c413db0720121e2b709fdf0f0d

SHA256
babcf8897a3e4cfae2010fc2a89e2dc08c3967f0a404a5c70b320f942fbc4d8a

SHA512
79453866f2389db55b5656386f5ef64a22e73fb4907638bac7cfe4b830b1dcd6705618a67b09b4f5303b32f81bdb06f9bdc531535b6b98b03249456b3fa94e8a

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
83KB

MD5
26c6d215a854f250cbcf0ef8b845931f

SHA1
391a31e53782d9d9d83bb6f2401fa782105efb48

SHA256
afdb3e557573f0b5ac6b7cdc3d8ee1328cbb1b7629c7a3dd6112b69451a78d00

SHA512
aaa52484b0a61e22fc21533687ac65f8783df5665d102147d232f701aa8c1863b99b5409fcc861f642c575af891b8c705fa7265dd2353040618f64232908a36d

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
85KB

MD5
dfbd005a0166f445e6af729bf801e661

SHA1
ed7c2a29e82758c1fe2fa08fc66ac68f663beceb

SHA256
6fe2ded3adf88577df89061ebf2ac9bd81136d307957cd1fcc28aaed66be64b1

SHA512
4dd1fdb4890a3209b4d41cdb7ec39ed1b5ce37ea9399e20e9af48cc1bf05c047757f3f52ee9a82fe1ab479b53e046135878438dbaf2dec97bff03cc5e09ffd74

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
70KB

MD5
86c07e008c21a278796ddc773e6a6908

SHA1
20ee9d0e01a3e3a86c8119264b2563f2c27a98ad

SHA256
4ce66e43bfe6d2f038bdb285011727f1fffc14998fff37abda5e85630a274ed5

SHA512
7f6bae90a63490cc59f4fc239e59591dbcfbdaefb6814619f9fabd64337376c3f5dfb36cf192c75837ff9c10ad0cf8d2de3a1382381f5ad4122e69b22142f6ec

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
88KB

MD5
55708187681b61cd174231d62af6f9b8

SHA1
41c7b8be5756798216732281fa817e186b270e8d

SHA256
1f87b0d87a083e10080c23866f1c256cd04b73e553e7b1dff13669ae33b96334

SHA512
cc40797c1a7786449763994ec8ae1381e7a77737022352a3b2b7cdaa7e71b21cc263823ee86decef4aebfcb3846cfc5b6351bd6ec0b1206b7a90a2b42cf5fba5

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
79KB

MD5
338e1ecb1b8ce53982b802fe40614e79

SHA1
bc491033a2dd99104206a266b6b149b6b2fca141

SHA256
17ee84129c2ab00a2ed611fdbf9747550972200b6667b3ddee02c50c308dc7f1

SHA512
1ac71e42fc96f5bda6cccedd66bc34edce6cfb61af2bcb5194ed8d32b2b62702c74ea89a1f90270828b4a4ce5798ea4c5190b4530ee93d2457789542f7d65b9f

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
84KB

MD5
8f3b9c56f17ef8efb0caa4d09bebea2e

SHA1
bb75c6cefa74eb03ab35426e497552cac93ded4d

SHA256
a696c3f42d4823ac4b3d6a3510d05f719a93ad9e9d33abcf97327bdbca4bd0b2

SHA512
6a54e9ebe424d264bc7357147dc2685630711f327799377ab09657ee038acabe99643c8c21472a8238a9679dc21c8bb2ffe50e0b01b8b2512a246254ff18be01

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
79KB

MD5
d7974158e0f57ded442089c8a64ce92c

SHA1
25e5256346485da015e32c601d6856ad5e61f891

SHA256
f08049ef1dd67fbabd269dfbc558b6509bd0310327252e5cdc9283702f45f37c

SHA512
98751f63f57abff8a4cf8002a3fdeea87ef28d4d5b30c0eb70d730479b5ae7ea7b12e4a3b0d9a1a46c10a4a8b2f38db8d6e1fa5d95b4fb8381a6d924d1e1615e

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
75KB

MD5
ec70408a7b2a222bd6bc9f7b08457489

SHA1
fb51bbf77c39b37481fc30e4ad5d869ce66c57d8

SHA256
2f0b5a76d23f6593e997135b16ea1a150aebaa895aa0a981c0174026f45abad9

SHA512
4e121f636ba95f55488023c7d4c93c3f5b4adb38dff5da34430651f4501eaeddfc699433132af9b20f5a396aa32bde1b6136fe78bcbacc08f1968dd3f7994e5c

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
78KB

MD5
8a1e929ff37288a2d33401f434d173ee

SHA1
a4d920c0a06061e2d45fe989f473c898f853c5b7

SHA256
a9effeb49b2e7ad4dbf2714874d70ec629d0513ad1aaa20626a6f40d7ec65640

SHA512
0b63c4007ebd275d395385a5b42c181e432d4078def4398d93de7bd18d34163588a4a1763bdb8470ba8a0a0f9efeccc57066026fe3dc8be0245cf335ff1f401f

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
79KB

MD5
c0da519421b85417e30ce2e69de02d2f

SHA1
79bdc7be20b33ce3490d899428f7e7ea678f1615

SHA256
ba93aa854533a55cfdf77d0a116481c2dc0cfce307612d9e5198424b5080e814

SHA512
f38e0945d8fc149068530d1a058d29063aa74c29319647773d870dae7275df9fbdb89c960c723d1dc64b491316960d38c16dfe8f64bdf38c4863545014d4521e

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
87KB

MD5
ea5514172da730a087b5d529621a4d2d

SHA1
a6df38a74415cc73c0ebbc1f5dc7a6c5402fda4a

SHA256
8386ace75542e163d7277a67e56affc8c537e099a0762003e1075c5800ea91ec

SHA512
a7ab76a2a98456eb83f6af3a31c85d0fafe235a76ba76702e38c5f66933a5b81a690efb82ffa2a6a56b46523639e7cb79252fae090f0b1bfd008981610b3e1b8

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
78KB

MD5
b3b879fc6e53accaa53b59587b1b9547

SHA1
b255253a570509848abaf150ea9e110030572112

SHA256
f7ecf28d744a35bb74fce5a74eb4bb076df11675d4268e7699e4b6cc6e3822bc

SHA512
60dd025d87667ba843157633f9f07b9ca733d0e8f414005db36831decefb4e0f55c44e7e1b63b59a93c86b51c39ed4829ae3444e1d3095e61d857e59fc969381

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
80KB

MD5
e4caebcae632c0327cd9ba561f0edf1f

SHA1
775e1d7a4679b9dd5d989fca71810caed223913f

SHA256
636ea27802e28fb8da63ee6d08d3d008f289931d21d0fe41fb5a4595b055bb4b

SHA512
4572198a4c1f8f649f91fcefd588ef0631d39ec1da48229010cf3af973ca242dda2b221a40708e4362b6ea4bb69b30b675736d9f06e59cfc5ad9128c94ea22d4

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
79KB

MD5
312e4044d42fe24eede9550b3e5529b2

SHA1
350c8cbefb5e2eecfb775405e8e1e7bb4ad692c7

SHA256
c6566c92fe56f0add04372fe913ca2e11c1e4e064b884fed0abe6640f351d174

SHA512
435dd1a2be61fb3482772fc4a745a4497d53ccdb7352c45af73148c75196ae90f01b0d65c3b2fb549790c06277806dea5f4ea29f91e07d5cdcc3c13d23e11795

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
82KB

MD5
ba8022ed03e5ad0a07b30b30e4cee5e4

SHA1
ad2ea64d1b181e7927b71c3e0e9b50b8e5850c1c

SHA256
78cf55a065a33ca42f01c8a8570448418aba1d2a9ab8cc160680e9000ded9778

SHA512
e3e3c5f764ac07bd6dbbf414fc301d61c387fb202eca054ebdaaeff65984f4eb7f471edf3998cb98f5c3c9463645d99221149915ca1951efe4cd9a4880ba1758

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
83KB

MD5
f00f56e05f3828405db4ce668ae57cd5

SHA1
2c1eee4fab1d044e35a0118ea033dc64344db4a1

SHA256
79e50bd6b54ad00a0ebc53e526b4bec9c2612d7af05d7bfdcd81c12c0c959942

SHA512
b1e17d7c7b0a4f25b992b9dcb0e49412450343a82e5c3e469839b7db107f23324542a022f9b5a3693853179318de42147acf5ef6182eb5fc7020717d62a7b6d3

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
85KB

MD5
c60c546326bf9db6fc9c80af7b2746b2

SHA1
fdc6b485023fc40ca470566eda61be0aa80d4239

SHA256
130eea511f2ad55955137fb90b50d2223b468ce174bb4eee9c705fe08c047708

SHA512
20e6d3267d197a5f316c97474332ade0dcd771ae24aea5c56dfcb455c0aafec2cb7fc21825f2a4c1defced0a1987aac592e4ac2cb069fb9bef18e1e5ed4d0303

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
88KB

MD5
8b8a5dbda27e9484ac96e2cfd3ab21ba

SHA1
4884f8ddb284a19eb46545a0da1b9241c5b28d28

SHA256
81cab17eded32682e1f82fb7b8ff04b9da76f98a95287d2c6f1b9acb10ea427f

SHA512
c2ed2ff674c59242b948f9b54cef403632480ebeddbb8b929165c518a84c54ed470ef9fc934589d7a973ab22dba239e197a59f41c63093483226f9bfa4facbdf

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
82KB

MD5
a8173b12cdfb010e2dc8e533abf7548c

SHA1
2bd366abfc2b6f66ca76386888d9d7fbbbb16928

SHA256
0ab93dd5bfb2ea0e07288525af3c520666fb046678ef54e17059147d6f3cd2dd

SHA512
613b5d65545ece1e1f8791753a2956e3a1253781ff5f19b993cb91bae54c726cff6badd9ff307b2f38e970fc86a48872d3a2dbe54eaefd85adb2c452ac63dd6e

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
80KB

MD5
6daa9730b12e4404d874d74be64a09c0

SHA1
b1b62ac2eebe3a1c7835caa61b25f338ff53af4d

SHA256
e2d3da3fb740e6dfe653c7d24ab88438c8c7a39853cadea3cc9a84622c2ed759

SHA512
8d94af167990c0d58622cc6406b7cc3c1a5b3783f8539820fab90fbfba8ad6354b2787b4ff8a364a4648dec5e6d0bec41136deea2b8cd2923150d174528e0b48

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
80KB

MD5
bc527d2e33d959e92fb7cea6c9226f9e

SHA1
5cc17db0f97020c9e9867f3f6a47dcb71a34c6bd

SHA256
ec320864452266473b6f3e02c44f5abce4261ea7b67c77e2d7c71f7bd0ee2d40

SHA512
64bd1537aee3dc008a2f41cf2166d30bd16e6a976486a71fc4d2bafbe94900b0024a896201b5a39a28051ff8097355335a5b9f364568a4e975c1f2b04576bd32

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
79KB

MD5
f975ed8302c940fdfe9edc96207e3e51

SHA1
266fd1d9212399efe94e61852934aad3a5a55cb8

SHA256
6268013232eb48bedec83b37c16cbb5b025a56f511ffad78303fa579b21babde

SHA512
e8343a844b5f6051dbb1525239f96124c70a087b73640b5dc1ca945cf9f9c7fa994131147311d07af7c2405ac5c4cfda632a70b6c9159a82ff7d0b88626be5e8

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
82KB

MD5
cbe69ddf09e00a2aded97938c8a3849e

SHA1
54c6a8cf3c88a7e6f558ad7ce8138ebd830729b0

SHA256
87e1e12cb4f38f0fcb3328c3eb9ea764dbd8a6ac4f2efe711c315d795a0fd68b

SHA512
9025fdb2106b4a1a112d9cbd2f5a7a634833be91e8618b7fc379a08415dd35cfecd2d5cc2905a6e4a64f60483bc708bd5e4249f0ac3eed1c31b697d0bad6333f

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
88KB

MD5
94b4e8c82cd3d7099448d05cf9da5d2d

SHA1
a61c1a3b0a383fd7d1920077a05392d21c712586

SHA256
a313d09ff21bd9f73d7715fa6309b0e027dd8677f77f898583658c04a45c8788

SHA512
76746b52928678b040276e62d513342cb5b20df962c0f5d900619113d840bbaaf0551c7b2c2b3b1d978df58640803a0072eb93cc6d0138f85e89783823d3f102

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
84KB

MD5
e8da55a18e316d133555de628a83233d

SHA1
b5c61d699045e6e07a01fa5785f07aee66e9b401

SHA256
2790c7313559131a6e07ed3fee97510fd1813c5c15b0b67eda21fa3f2f06b5d1

SHA512
6c3198168a9dd33d6cd6c97e7f2f21b2c24426940953aa03142f2a5b57dbae0a416d53d03778d820a7559608612a75a7486a5a87dcba584ae0eac997b5bcb9c0

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
84KB

MD5
1775229278866beb56742f501fb5a999

SHA1
129b24a99417cf2fd86b994eee6b493e30d2ac48

SHA256
b0df25988b4ab36b35ac33109e64d2288b95cc7a49e4e824836f5a55a5d25146

SHA512
da10e61f71d4be90cdcfdd6270d2ccd429ab89c9ae5c0e1b5d8eceedae4f2e11f98126bc914c46cb24c8f8f33cc8a6ac49ea5b1b11af392ea18aa95c0cdf910e

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
79KB

MD5
d1e62a3976bb7919dad20ad379af1bca

SHA1
f477bb749d2c7677a7c95b345f8871b2d2b84537

SHA256
9e60ab8b2c3f4ee98c5b5b66b79cf364f464cb23e9a97ea65e72ecff96eca639

SHA512
ac96d669ebc1e2885cf05b74e0ae110e08d0324f68860e1ef04e6293a4793866a104b59f8a6bb7dd77380588ace43d50372446d5fd79b27a375d14b8206a9020

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
86KB

MD5
c447dcac41ae46cbf15c70010ab41920

SHA1
20f2de7663a28d103700b47a0765ac29a8cf3661

SHA256
3aadebf4217063b598e72ddff7b7afbb330a2f9addf357051cee3d58657f1f5f

SHA512
722bec3ce72033d2241c55622a6f5d2de06bd59d2d3e70e92f337f4cc8d114d60a4827bebdca06d4165047d6db3591eb8c998321770f58f1e458287b0e94cd5e

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
81KB

MD5
ade696560c8f3f2552726532060e8676

SHA1
69fcb338ab223435568dd0507a634a3eb8d15cde

SHA256
2fa6049e473ebea99dd9a102159a0e0a42da768f268181bbf0a255d1a6f17fda

SHA512
a5f99b9b242f0efe410426e48c93ffea27cde962f5c4de2ca1fe6ab26de2fa130a419a73f0aee479794378abc418e9fa2ec09367ef63bbfb892df38a630ac1e7

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
79KB

MD5
46312cf64f006e3a68c91525899a4408

SHA1
11d560baccbac00f72c9487449b9819e46bf9ccc

SHA256
5a3399d6d5ea676dc8f34b5c61ce8c11ad692a9965a5b9d78e1547aed8c65945

SHA512
9642280f22cb79093f195eee414d1d1a43816d0b36750966c2c96e286554c145de966721f9461f7053505f8776bf7ea4696236ca02915bd8bd236fac1a4cdb9e

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
79KB

MD5
0119e2d09659a689bc232761bfd2d807

SHA1
693bf94b4dc7b396fcb0c57a4107325c71dbbe5f

SHA256
f47df5e06d81a411965f8edcdb5b9667171e205a7e144b4aaad79f4e2cbcb798

SHA512
c34a27a15331bd05539346e0a974ee0db37ee560bcb5af636273983266eda6ffee6241e94aed04b376e03f1890229bac43e46a0ad0e60c6b4ad9237af0cb11bf

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
78KB

MD5
74e7eecbba54ba748b16ba3e367d706d

SHA1
7bd1e7d806db3a794bed6ad4a352949bade4fce8

SHA256
36dd0f435e3ff1cdd555d9f3dd83ecea4036d569c02ad6f1f2142d97f515c0d7

SHA512
5b6e8ea86af43ca9ba720c59a4d765eca3e6af90ec766ffc33b398d108a6ffc3bc6cfd9ff1b767e387c2832b341a1db581805c4753da491b9b59d193382aba53

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
93KB

MD5
05adcb1912eaa146c22defc8310e832d

SHA1
75f5ddb26cc8db0c85264d0902c1a3b2c06fe56a

SHA256
a06af5161f4648c356006330a882ab0df0ab29044e82c43aa73ab0babf57efab

SHA512
58c1e2b120b9103f58f1a6f804433d46689f844f42ac8380e16d947d9e3bcd814f5ae93999f623a3e77d2711ba324d6dab3d5abf4e0a8e40910b49ec8875c122

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
84KB

MD5
87c6c98e2abb4fc6d208ebe36dd4503c

SHA1
bffaadb7af4dd997711cd9afde063d60ed4d753f

SHA256
4ac96f164fdd7174f559b70b6afd02f146b1ce2710fe4ebb663094a2d34d2b38

SHA512
f25be91fe51de4ddde4161c20a689ec4b109cec046a620d2ac9dcf7906acc441670fa49aef15f826e52fbab5d49f6b4e5aba100e0cb5c4bc73894bdbbbaa431a

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
79KB

MD5
910e215426b6e1ffdb64e721da6daab9

SHA1
ecde2897accd5998d13b4f6e4def6ed89e8b968b

SHA256
240c49d70b7738f54359f43123e451082036d71a8e695847dd991123f01e4bec

SHA512
5323e947d471eb86c815961a2ca950b5cb89e7582d10e70bbcd182a6b17089878f4b290583109c29e7bf48c00c8364b759e85de26dcbcbb1d775a3620914a026

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
70KB

MD5
dc7c0e5d36398b4b2e18724a75704c56

SHA1
bd8f112fdfae376fa0e456dd671e34738cb41add

SHA256
dd6f8a4a298564a4757565fadbe377d1f7b9a7b14e262dff66425bef9bad0d93

SHA512
e4c6080461c2d266fd86d826a1709eb3164a974e85e9c81c076768f25854b1b7245f164124fd2a1bde1e8292bc10d04cfc16e8645d70523628da9f2c0fc59a5a

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
83KB

MD5
ab75054ca25d752d55fdd5e964d6ca91

SHA1
4257fad808df4d7ee38e5ca0fe450918aac57f97

SHA256
a60c2ad28a00e6748dc8b4148e11c17e7e5380cc621e2da9b18d5dd205575ef2

SHA512
83cebe3a1b43948c908356154f56e8d044c1808cbf295b0d6220025ab52ae0d1a2dfacc1d3b3abbc5f909cd24a3686ba2fd45841c5fb7c0bfb47d18364343210

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
76KB

MD5
56682f74a159620f983bb64a02196b0a

SHA1
b250b10022db685d253971153ffea01269cc12bf

SHA256
820f91a3ea718be406927f16ff03cd71b2daa90f829c98518b7be8590e818760

SHA512
f20d46e59ab3a72fc065d5c7eeaadef66d1a5c8210939117d9f32e6b017dbc41c43a66511ea98db41e6168df12ab6e6af1dd7e880e61f220fe3aad45e26bda85

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
84KB

MD5
66cfc92889d43621d46c5628cd1c9ff4

SHA1
c0420ced8aedb9c4ea02ee294d5d84bd48f14eb0

SHA256
38f56bb36afdce11ea1c87dfd549f8a9bb4f236977c21096474005180c3ec013

SHA512
6d1b8478b9c67d255df2a8b09bf9b8d2ad3a3bca677b23d25033452862ca4b1cd26de8d49b57f3e4380c16cfc211078372115bcf6972ccd056155c7c0915c48a

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
80KB

MD5
b10017e82cba150de9883ee7546d4c09

SHA1
937ed0c97a9105beb5f28509e0097f8888d3994d

SHA256
c7d64080520ba31f31b5338b79345f21292624b01adf01871e2d8d76a96c3f5b

SHA512
53a505c6203f325c5ce6538ff9795b71bbb19908b4b7595b5204eff991c218ad0fb4b76d48178d610e8670ae1cef225e974941bbf561c3156c2902db4522e0ca

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
74KB

MD5
495c145a9fcb13b434aba16f7fa608c0

SHA1
13c66a326f1ef05ab54287f8680047517f1e5ef3

SHA256
9ab226893cb22145accb0b3cd79654d363314720d68ae4635d7a22692f50d5a4

SHA512
e741124885bd7c437c450420c9a63fe7561ef4016fa80c3079b9ba89f5573e05ad2bf3d724a00405f373da3ed2cea00717c0e0a8512e57a90bbecfab40fb2557

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp

Filesize
84KB

MD5
75b330991f6282707171eef9a1befb7b

SHA1
554cad32af6415c8f8dfcf1d4f80a6d868d34afd

SHA256
36e98b6cfac39cf5ac5cd128ef7f89ff84df4765202b34b8f7bfeadb84bf408a

SHA512
e8a8312b5ebbafaea966be946d688ccbb4635b5abd27e1ab3d90e91b3fd95bf6d9e5d3911199e5d07326e46dfa683c6686073e1182b85bdf54d4c6e7b29cf4e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Add-VisualStudioWorkload.ps1.exe

Filesize
74KB

MD5
c522b2583b145a0a3a60a05c463dd84a

SHA1
f3873c1a29db4812a8d58c31433b947ccc9fda93

SHA256
d289e0279c76d21f83fac42edaed8395f6aec5573902aa615ba4c3f5d3bf06ba

SHA512
3e591e83b8ba48dce2e9b55af5da88e1d9f8b7a01e7d28c109f9772bac2d360905e4e6cee3fa5a324144974a04925cf2469260af33275bdc24ef6b7154ccd7e8

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
70KB

MD5
02b9209ef92e5165225f268578230559

SHA1
0024b93a98d762461d4c35524cd6040ff6a965ff

SHA256
33473dec71dfd630169086e9922824ec7eee852dc8c59ee4e803a94413c5ffa3

SHA512
3ea60f62588a8f238cc6bedc6f5908376c8a3af33850fe6d66aba9b745dc73e932fc3196b8342134e57b19851081ac703be7cb6abe7421f36d34eb0a6659f5b5

Download Submit