5a55077e6d6693d4fc72080d3394a6b69208dccb0a3769dfee419a2e655359a5

Analysis

max time kernel
120s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2024 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50d72ac4850ba5da6163c45cb6daf250N.exe
Size

67KB
MD5

50d72ac4850ba5da6163c45cb6daf250
SHA1

85cc8ebddcd957bb13c19e27eb963254f2071300
SHA256

5a55077e6d6693d4fc72080d3394a6b69208dccb0a3769dfee419a2e655359a5
SHA512

4d68c4ab1773a50628fe5759c286cfc4e47b28eaa632022abdce82467c821b357aa7f27f1d2d12a9fe6dd5d8a0b860c234550b695d430f62764e72e240234326
SSDEEP

1536:W7ZppApBULcfpHLcfp47ZppApBULcfpHLcfpD:6pWpBwchcypWpBwchc9

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4414) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3940	_263.exe
1300	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	50d72ac4850ba5da6163c45cb6daf250N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	50d72ac4850ba5da6163c45cb6daf250N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms.tmp	_263.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp	_263.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp	_263.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp	_263.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	_263.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp	_263.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp	_263.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp	_263.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt.tmp	_263.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	_263.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp	_263.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp	_263.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	_263.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp	_263.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL.tmp	_263.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	_263.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	_263.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp	_263.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	_263.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp	_263.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	_263.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	_263.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	_263.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ja.pak.tmp	_263.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp	_263.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp	_263.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	_263.exe
File created	C:\Program Files\dotnet\LICENSE.txt.tmp	_263.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	_263.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp	_263.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp	_263.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	_263.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	_263.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	_263.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp	_263.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	_263.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	50d72ac4850ba5da6163c45cb6daf250N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3940	2840	50d72ac4850ba5da6163c45cb6daf250N.exe	84
PID 2840 wrote to memory of 3940	2840	50d72ac4850ba5da6163c45cb6daf250N.exe	84
PID 2840 wrote to memory of 3940	2840	50d72ac4850ba5da6163c45cb6daf250N.exe	84
PID 2840 wrote to memory of 1300	2840	50d72ac4850ba5da6163c45cb6daf250N.exe	85
PID 2840 wrote to memory of 1300	2840	50d72ac4850ba5da6163c45cb6daf250N.exe	85
PID 2840 wrote to memory of 1300	2840	50d72ac4850ba5da6163c45cb6daf250N.exe	85

C:\Users\Admin\AppData\Local\Temp\50d72ac4850ba5da6163c45cb6daf250N.exe
"C:\Users\Admin\AppData\Local\Temp\50d72ac4850ba5da6163c45cb6daf250N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\_263.exe
  "_263.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3940
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1750093773-264148664-1320403265-1000\desktop.ini.exe.tmp

Filesize
67KB

MD5
13a9e46bd74ec68f893432eebf9fe154

SHA1
fdc559411ed44ee4b83b4ad3ca03a4ac6e70e88b

SHA256
9ba584ddaf2dfb44ba0f84587bb0a74746cc95f21b7070b4f9b1c389b8d639af

SHA512
d2415eaf5277b729a8e81436f236ed3fe322b2f309863904f0a8d9da11468c8610d175d2c37f3505cbec199059cf29e45aafaa70ebb8c3f10d0b35e2ab8dfa91

Download Submit
C:\$Recycle.Bin\S-1-5-21-1750093773-264148664-1320403265-1000\desktop.ini.tmp

Filesize
34KB

MD5
5a9f7d42a0766cba45b03dc30ae5733f

SHA1
e11feff60970444da306050a8d42c3508a36af57

SHA256
18e963949ab14d96decca3337514f12e49a84fa3403bd70cd039bef8c1eb794c

SHA512
be6cc07d9804ce924d5f995aee288bbde46e308809e6b16849603580dbfd3c7fe762cf76efff3450da2fa3661e70f2076b74fffbf13e5393c91f3c46fba176f8

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
146KB

MD5
936fabe9f8bbe7e73c47daa55db4d880

SHA1
24e766472efeb005c6e8e0a8ea14f5cb6a6ea05f

SHA256
5fb4f222af09e37316a7694eeb6944b6f3e10542ad526cf8daf19f42a0ea9a45

SHA512
b6779c0d1447b5f8f04ddcadb0b68a7dabd9aff95de66e504403e5be2b31c4e9f4694fe60235c34a5f2099925187ca6320b7b2ae010e3e5b10abde4790650fb7

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
99KB

MD5
321acb3d826e663996d8e58030b2d203

SHA1
90222ee3c1f856657bccd6cdfe55b693b3acc66c

SHA256
861b01570f98f8859269f13a73ac42adf77b15ef42f89777815c66877be5902b

SHA512
a1f93dc082aaf2c7b04f87248744e71325249c05b4652f3129c8c1cfd975aea1741963ddb18557010be3ce7e627e087d28c4a28eac913ba65795f69b978fd89e

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.1MB

MD5
ba742570468bed4b795e6001293267d1

SHA1
0e235d83464942a2a9507cbb8c856cb7f57e58b6

SHA256
cc0e02fa4f36286a7f7bd5cd9c3a11f3a4edc4ea8559992b11836895d7dbbdf9

SHA512
c12b7ef26d1cfe49e1a2f78e0a1011740c560cf96c8325107658ad689c40c35165da42c00394a5c334247ef91e75baaa3796ad6ec09c6da7b88522926c2735b4

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
fdb9acb2a8798a3a725425dc596166ac

SHA1
e1ee60d3c28ef58bda5d988eb1f97314b0fa556b

SHA256
89ba5a9ff0aa808de80efc67008d8c9e11b71044ffdb929088b3b905d27518d3

SHA512
d21ce65c885781815c0132751b868546e22e77b1010bfe81d09b98e542ec5390e3f58548baacb68ba62f2c63ac30e0ef520e08eb5722a4ce37ead8d0c0e7df0d

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
578KB

MD5
fc8822e35db6bc6a8f0482ba4e2fc277

SHA1
ebd9fc1d9d051c29a7109443cd38a55c825dc70e

SHA256
5a48592aed7c8e051de83d887457fb14c0eefd892badf6302136b9323a0c0ff4

SHA512
9ae3f25c14a645c04f895421dc3abf7b0a5258cd38ef6d6418b3b4571a038677661ed125f9217eac518b2591a4e9fbb6d0959eb89e5f0c6ba1a71812fc331c01

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
243KB

MD5
a6956fb2140507caff709311703e2f52

SHA1
52da149bd1f281c1375e176f38bc7699e856fb61

SHA256
c7a52fe0f9e30fb8fddfdb680f4859896298cbffefeb08aff42b1481aa3369a4

SHA512
24d5648a2de857b7e712e545b95124743ccb424463a6301b0d17c96c24bcecea8662cdf22f46224756fe9cbb6ba44559eb3796c25b954b69cf2000c8fb501d3a

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
964KB

MD5
ffce37e6e20a7dda707cc723694ce658

SHA1
5a409db7e7bbf805b49b33e0b1e1300d0882ed55

SHA256
a64d3dacb62d7988641a9749a13eb92bb3a29b75324b84a56ae4415abd6b9239

SHA512
0486b890f4fd1196944750409765ac57f12c27519c35acaa7789fb57ce6a6d45eb94419ee00f16f77fd81995df97980317eae4a23d576da895458bfced9dea25

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
718KB

MD5
46922d31d408d562aaff5e44e944bfce

SHA1
9463fd4ac8b3dcd17115c0b424c7cf910f3f28e7

SHA256
4eb3ffbd758270a2a7292b24c5671e4208eb49db3eed9596e2d99f292248cba2

SHA512
b3816e421128f63ee765c3a93e3547cd0f9da497d412d5ef29cbdddd27d33cafbfa4be891c3d1b8c2bf771ab4c903f1e22074db151f46c0d2e34d3f2793868a8

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
90KB

MD5
e174951e37658a235ae671b2d7c83e9f

SHA1
b5a8b2dba74ad935845fcf58546ece031c38c319

SHA256
a29d09bfe01c61524f55803bc3f0e276df1521353af4a11821f5522aeafc3b9a

SHA512
48245437478601c590c5171c3c60fe3fc799b5474dbc109f722f8597d553da039a250f5e3e56bb7d3ac162c1bbf480488df5c17121d7e070489b3ab6e59bc8c8

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
43KB

MD5
4329c47b1e3d63e595b9370d471b102a

SHA1
ace7a5ff66d6e86b6009b7f6c6082c52d21c0017

SHA256
3971ed39096fe2c7b4f642b8d0c565ba7705a8032785f28ad76db2ddb0adea07

SHA512
3c3c718d38dc6388a06748ec571e200a99e57b26c2b73d9881973c104f19b703e985a9af14a076308d94a95c755d5b0fa4055ed632a42eedbf5829df15cfd865

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
34KB

MD5
08694af3efed7d718da663609357842d

SHA1
d84335115bbfe8c46af46ea48d328ccaac2e553c

SHA256
a35468d366761a75a6080aea33ebac83792ba69f75caadd035968d4787b83aa0

SHA512
f1d87b5fc0d91f0e835e6e4ee25bfc776dd0747ba45e26ae0a6d205f6ca03dec5176cf2336192d26f93d4d667cbf6905857b271afbdbdbb3d0606a144b61d904

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
39KB

MD5
e9e532f8181a63eabd12265b49244ce6

SHA1
3af4458bb17284086f798b48498cf26ed121280b

SHA256
965e446dfe71cf8434ec614c2890847583d21da8c363b7d70a849d05b3c7136a

SHA512
28d2b24ac6e9093da4f9e6f80fc6f14ef9261d0555765785a75ddbd073807c7c6dc42e7a8e42429ed079796dabcd08887d9ad738fdea3f52e57581934558aab1

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
43KB

MD5
1be44d13a4f255da386e8860c9702b15

SHA1
f332ca4a5fa793a23df5c462311c379e0f48cb3c

SHA256
e572fddd9fdec8abe4d3006a407e8239e2e5031c84535fb74b48aecea495f045

SHA512
2f86aa706bcd0b156d34f16a6cac4bb40bdcbdf043573425decc7616ab8123509abb5fb3c5a884cc5b2dbaed7e9da3b03108c1bec8910bce848e370e54ef8cb4

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
45KB

MD5
40532d3f06051ea6e10f6712ffb5d3bb

SHA1
71aa233d8e010072c8c489836e2c1952e17ed399

SHA256
c836432e9042cb31eff4ac6442f117fdf3c8e7f7313cc69c632eba3a4ce4afda

SHA512
40572b25e4161a860a924fa65f78277dafe59b0f8407a82608f2a479b91bf18b80f5e07ed619456c145d7194d114cecba48791612a0b67347e606b9ed556cd68

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
46KB

MD5
716b6382bcb61fe7d4f11f6a4d451363

SHA1
9646ec34f78d17cd51a643576f6d2f42b0f7c323

SHA256
21918001047c212cdafbbe153703e9ce5030caf0a4ed7fa27e1168e559cc6e77

SHA512
b9f5465a56ba85a3683386911687705184aabcd89b7f79948ba56009a366521584586bd7265045e68e16a9311bfb40ee495ca41cf44ce4736ca4239a78eaa238

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
48KB

MD5
46fcf9f19b40dd1085398252c6c06640

SHA1
1cc9f5211319555bb47952f8a9967c070d95974f

SHA256
948e640155500ce0ccdc1d8864a759a78e83f4ddbee07206518ec4ccb479f6ff

SHA512
e1b69d3d38c99b7a08df20fef7d06754db6ca5aa15de89bb0f29bc21034f8ebd4614d4ebc8abce322f8a8f83cb43ff9e83770dfaf5eb0b4337589b0b69edc8bc

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
43KB

MD5
1e4b2e0e9143b811c1b7b4dc9c73cbcd

SHA1
b7114926293dfde34d25f3258e48781bf09b9f0e

SHA256
7de2600aa0b6437fa3b2322e0da50a7a1e6454419dc5acdde06c5fd3b5d813c7

SHA512
275ccc2bf9651de0f1ebe54f63b5580cfdca7ee668dbe7f0ae1ec192f50cc8df7d8770f985697ad09227a8d22cc35045d2c5d35f4f9fd135c5d7b0256c9e9d1f

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
42KB

MD5
31d79ae05c94843fa0d72983413abd75

SHA1
6f44bcc7a13cf8010a76ed9ec432b7fce0c86e53

SHA256
ab7e086e2aae9719d38e5faedc303503af410f6cf8e803b96824527b4896bab1

SHA512
6215e893748f36307f3c5696198a74099f36cfac5cf7d5b5f847fc96c3d6650327419ac48e8163334b7ae500fc872714af665bb14e47087dfafaee76ee79a636

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
50KB

MD5
5f21cfe5237409deebd0a429560f1d99

SHA1
29431a60503dc988ec0757c08e6e6989c27aaac4

SHA256
1ece10377136e8540187cf80bd8f4e96d0f39627f9a1beb65ca73a160766e5c5

SHA512
5b3eabe497c3391f050e56925a04e7282136b7e80a821615d4b5c25ca57a850591fb5ba4169a571dcb6b1bd25dd9242a91789f0c208181008caf133950be1cf7

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
38KB

MD5
2d1e357f193c33a2e6cde75592b8e10a

SHA1
d55a3a248f0ca5fb1c7460bf2373f70ba82df6f3

SHA256
508b08c01b1d368c3777a6bbd4b224ac8e2b862eeee74aa58a9751e414a42590

SHA512
2df0a6ab5df61cd5f66513e1bab812b91b60511140b08ebfd216b5d1a72d748846bd8a8618ea2cacb62de4528283139c9ab7789445c57762ffd69e79f4ff7cde

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
40KB

MD5
0e37d056699aae0510e6a1a4dd5e8073

SHA1
07d0a3bbe6cabbf2ca3cc1ef1c5412ae0b0cc08e

SHA256
239926f623252bf9cf2094dc169fa7dd5bebaec3c90c2fedb908fb62eeecfe41

SHA512
5520eaeb429d02b02e4537180e0b87fe38edb944dff1a6f07afb640ed2d4585d3d8b703ef619805f6910bf2b59aeb8d8b19edafce95c88c62bc532029ba37888

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
41KB

MD5
ca83e62f3203f578dbe37b2b0149e697

SHA1
0b18dfe2497c4980adf117b55bf028de0a6e07ae

SHA256
8ca581941b23fffcfa901c97d90688d387bea5709369020ce584e9cf3128f237

SHA512
f898cb3562fe914217e3820883eedb3ee0e6af8000872eab81cc6d2853a391c330cf6ef885fd56236d4cf9852494e7c6a54cbf37c7657ef9cfe2b83dc9fcba00

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
47KB

MD5
72a2cf0030fb6f0a59b539559825fba7

SHA1
b03f09676bce793ac2cd8659e746c0ca7e6b3d5e

SHA256
78555e1c9bc585619320bc33393ba18cc4187959d79c720a5b1e4d150e216c3d

SHA512
eb3455ac1652bce5de0ecd995698058d3efc5631901b962fb31d53b4898b11161401f425e9bcfc8f3648f5e8f5f78a8e5e7bee18c84b4f7dee2a45324a92767a

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
42KB

MD5
d24d964f5c5e0fe9818b5081af3b2633

SHA1
5f7e464131b24ca6f5d8692c44c6a06a5ba6522a

SHA256
15e2455032a055feb0615ca434ee0ba564e4adb04409e085f62c01325c5f3881

SHA512
1dcf86c95ab3a28820d16671499f1e9060b09e2be89f532be6ac39b201d08fd95db1c12c2d1c33d7c3f0605fef645ae43c6c033d9a5fef7990c23d68d8391b13

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
43KB

MD5
4052e740d7f91b212258258597917c4e

SHA1
fb3ca32aad8eef226366fcaaf5c616342e575138

SHA256
5bb0adaa3de6752a83bcb7af37929aad55d404e1a59a03010c91c73aeb5326a6

SHA512
5a0a9395ff8415f28cb2128784596805ba96b00d0a666ec454257a03e75a6eb5fb3b5de8186a0c8edf9a6e996dbcab065092109214f5ac11fcdad1e582973cc8

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
41KB

MD5
2112f613d2f91ef1e1c329d3cf49c64e

SHA1
2294309491f18483d7647278b55ed65ad69ebd68

SHA256
d5a5bd1457f080ff2709ecca0d9b4c27accabf6fa92a6200ce1a6f06804b55f6

SHA512
1a29de46ad0a5beff5b12c395f0c60960c728993830444cf30fd755f049e2583259aa47ef1eb7534a751bf068651adfd41100601540157c28994a10eb71624b4

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
40KB

MD5
8b634ed6b56d19924e1c7afdc4300749

SHA1
bd6e0d0ec78787052893ea801e0b27bb8e8d360c

SHA256
db613efa65787e7d2a096161c330a0c94d0be62ad23381b1420f8d22a139fdaf

SHA512
2f968297b5f03272eea7cf9e0b4968de8fa2b0c13b23e95fce66ebd21170b6bf9929e913ccad4f2165da627b74baf41226fc5c89161fc8ec85607b9bb1a456f8

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
40KB

MD5
9d4f107b9431e8de19630f82064c9e10

SHA1
a1c655e1bddc9691890a0e40d446ab43f7410a78

SHA256
d333c63f4bdb2dda991fa2d4adc754523feb1d30d7045d9c5ed2145fdc57b794

SHA512
a8c7cf36b6782cd47eea7b3da84e83edb21d4ada3752f7bd8a24a921950b6ccab825bab15e1eee856df2b23128a922aaff2a43e122617c0c789a3ff90d3db019

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
42KB

MD5
7af1dce0a2ee49b2026ecb63e02c8a11

SHA1
ee54a31682502380041787d298b32b855b307b4d

SHA256
3bce3d4da1b0fe86d996512e39edcaee62c7684e86256851b1b8a6f7dd8e5200

SHA512
3b7e96efd289dd40edb761167695d64e9fff5243079e3e482fb5006a0a1c70b06a70aa96e7d064c03283037b6fc650f4e90aee5d6bfb7ed761c671923187cd0a

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
45KB

MD5
94aaf4aaa1dc5cd6a8c1742362f335fc

SHA1
0f9dfefbcaa235d6cf9a8dd95b752a3946401aec

SHA256
ba6906d7eec69399ef3e5f381244b1b98f4ddec07bed91f2a5ca3069ce26824c

SHA512
d2c7f71a32cd834cdc1449c8c44e5b5b15c158bc33e48b28943fbec218bd00dfba088a3bc481c9af0d17881e77f0b55f245840b8de2b57a198276a357f89e261

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
51KB

MD5
95e8d21a359d0b9005ab8ce5c74d7a12

SHA1
710c7326719cdaaa3e49468c295edb775b50a4d6

SHA256
823924a1c902b28b8649c141731d011b4acac43883d1642f12d79bb759926c6c

SHA512
74dfeea405959944c5bc6be04d28d2ff34d1bbfb1cb36d5ed2c737fa9b29a69ac68f87dbe159da948175dd85256921d7e5c41d416ee035a833638b1c33024ee2

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
42KB

MD5
7f2944117bb3c91ef3babc359e20a133

SHA1
8ec9789cf39d88b9eee1e88befb446905155788c

SHA256
be1873fa11e6db3fe9695abd6a590671489ccfb9a2c3831fd75c890569d14154

SHA512
041cdb0ece3066e25dc6d89662c0cb12ffdf7dae6acb83d2b45297ebad023d4bab3ecc646decf8db9bac67182d0aeb137c79265ed94ed00a8377edb775468bda

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
42KB

MD5
7ab86d40ce282ed6dddd2b67284278bd

SHA1
c4f2851f7bd2a04f5b4894e2f83d149a2a7b71c7

SHA256
0009b24883724aa07a7f474a073e62be419b632776b1f61644d572e6ccf16eac

SHA512
faef09bd9216cfc3d53d1a40f5055bd304a87372ee9ec73a2d541fd6fd83a27ba65732064cc5e4b049cf71a779ab570c8397bc7e9fe3d4583a01fc525d470c55

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
43KB

MD5
30965ee9c0668799c65bbcaa2f3c112b

SHA1
9cc1806b5fe6420d857ffcdfb574b1f4b91f19a3

SHA256
2d61e04417b55b172134b1c055d49ea15c330353c23e7b0e91de710e75420ce0

SHA512
0406899f6c17238a6296973f5d73054de63890d4dc76938c07af8f8087e7d60997b2458f4671a9cee81ddacd9a1411d9cdc49a23ed77e58ed53c9c10bd9ddfc1

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
42KB

MD5
f910abebe313ba95ffbea296a31d7329

SHA1
a06d37afd52205d77b4c0249ce9faccfeae3e464

SHA256
5e2bf2ffb99ac45a445545a9fc87f81c96821495996352869f9b3ee72cba5472

SHA512
877eebd967f0ece9882e1cae644e94c2f5e20b06fed3c84f6eb39b6758397a23afdf8fd7109917d2199d435767e3ef2a19e80d90d787a592ec5dd6793382f441

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
43KB

MD5
35158d82b10f7d1cc24aed3ecabbd70d

SHA1
cfb5f18de3dce3b406dec39735f3bafb0f0d3593

SHA256
e18f676ed339d6f8a8d97b377adc2ec9809beb70eaa5ddcfb01b9bd02ae51a94

SHA512
3345dcb066f5fef5ebd1b4c70c343297b10e5399da0349757e2653686c0c359c1fce85aa9fc3bc353158c6ca2149bf07f4c57a068b7373b7206d01cd5c45b3b7

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
51KB

MD5
429dc1bd1f3e0577938c6c1b82a14ccc

SHA1
4813648739b87985654cc92b6b9622a45af64e0f

SHA256
06876effd4060b6987e1dc2bc38bf85cd8a2e04d67507a54f045cf72aa132a70

SHA512
b20ee254e8b23c39b5a43195428be145c3947c3179ddfa0562a355951a93ca87bae0eb84223680ca9e5c933df6b044c9488d5d0a2018733c769f982bb43ee443

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
41KB

MD5
d5d2b8a10963f3433e67ae4d6def16f9

SHA1
36c1428e9b1d9745e6729746fbd7665b1183fad0

SHA256
0042929feb6f7a3d445918a0efa3f8c297d7369b44731dba5c3edc3d43531d88

SHA512
c46e74e1fbac281287db2401a6aa7444845d7175af2bd42f9bbe2c09294a524e3b846b3f78ccd4317cd705bac0f38291575a6f3b9e16bd0e599c31b481678609

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
44KB

MD5
d4af43dee679ca7758906a7508f5c279

SHA1
eed8e7dc32909c916524d275332a62f740fa4190

SHA256
60e3f41b512588bad4446d8a2eb5d7052c77b00908a7d5c8eb7fb8b4c6e5cefd

SHA512
1900891440134fad2edaee5dd1c044f0136f9c3be247dae6862dc50b31edfce079b0731cc82730041f3f6037253232b37ecfe4443c5d9f250152854a32303d60

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
46KB

MD5
992f71ca5af8c106ecac06ec57fed397

SHA1
2bc60c5ee08e49e6706ce23137ddff266434d844

SHA256
ca47fbb76e90864e6bd44881ee5491f65a4c0a3e198447e764657916040e913d

SHA512
955ca67c1cab103d2512290fad22158313726554e36737d16155df5a9e33544e9ce90d7882aab6785fc37e348bae0a8c05b040d6fe804c266bf4ac9d146c98bc

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
45KB

MD5
d09b88b0930854951c6ccf6927c250cf

SHA1
94e921e7191e495019bcb632d3ac372afd6605d0

SHA256
01ac4c665e6f4a47702180fc485c363828b4216408b02b2a787c586c8e92f940

SHA512
95b5f56485a695aab41340d7a4b7d989072e2f186ea68114f7d50a30398b4a08ccd3c350bbc8743d7dae4dc93dade871e79090f94534e8bfa1faf00c77d2ff00

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
41KB

MD5
40f61209ddc9259b68e96d8f1d15a921

SHA1
5620dcf35d1fec3a24e99245ca0958cba5ba09b4

SHA256
7d1010c27490413e8a4acead0849b30a169efd5af835e6130011020db8455312

SHA512
e32dbca529b86ee857858d9f4a7142db172e3d5542a1755839428af077f3f9b47658bbf646f7302c2843e3ca0eb7048e025592f774518fb4b08baf39f4259050

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
32KB

MD5
8a6e845a85114914a1707800416b9638

SHA1
da638dafca552fa9723947e650866b440208d6b4

SHA256
479a3822e7162628bf443a52d858832681d311880e76a0fff93b6bfdb71b8200

SHA512
06927ecc057123a5e81964dd9180189f13d1cbd10152848dcb2a2402bd3073c405b5c81e9369bc4db9cbc519b591c8c297bdfc2145f7cc6a24cbcb88d1075605

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
43KB

MD5
e2847b3775ac031fec40aecc47bb0e02

SHA1
c4108e059d0227aa625819674e50773a958aaa20

SHA256
77905316a7b3e89467e439506900fd3570c798bace628bdd047752e7036a7781

SHA512
5faebefde401d7c299f80bfa33167afa89249d34ac06a154aa5b609a1c2ff0ac1059c56079706775e4bf60578fdda99b02a73afc4cbf43fa4a4a9d22d3c3bd8d

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
38KB

MD5
63614e2406dd68d7d060477ba8286bbd

SHA1
2fe394ad0d00286fd6601022207d2746449cc7e1

SHA256
ea8a0257562bc5aea9f5bcda1ad48320fa95a1a83cc62dab9ea13666896a0e79

SHA512
3ce13eb2c21e9c8885352082e615a30a11f42ad69ada08454e5c29457ab69e809f905b7957281e7493ad9464a6020896d0ba865b90c7cb3d2d71ecaeea106a61

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
42KB

MD5
636523bcfcd78a77a5f3d2c230ba6e1c

SHA1
d67fb20becc8aaf81f6e25eff2e6c10bbf4fd501

SHA256
1c1d71ef628f85136cec117043ce00a289a60fb75db1f8beac4721d9f4f264bd

SHA512
6d06ed8132859db90101479ae57b492baf04ec58ef5931fca2a2b128e5b9b820271e48e8edc4e0d297d959094572c7542fa05a7d6990546f4cc7f1edfc0d435b

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
42KB

MD5
0d06a73428901bff7f997ac4f13c3069

SHA1
4b0ce42794a6b3e0b89815d1b6ebd0b0dde8f011

SHA256
2496169c82a37f1304dc24fb82cb5261b418fa450c3f50c47477dcc8a95f4c70

SHA512
e4101d1007c2bc6083e39b84ac92e6c15c6dd313d1c4f7bc64d6157d9e59d761853f5380c073e3d172d96b5ed11cda985e30d35933c77481dbd3dfd2f1235ca6

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
55KB

MD5
a8e67e5d7957864d6a9064c0333c8b79

SHA1
dbae5466858ebbef8f134c0c31a237b1f3719ab9

SHA256
86ef7fa7a3c751648b97b2252254b9a9f1d9453d9c5834c8e9e66fae5374cf50

SHA512
2b16730720329cdc665b327d3cc20acd6a11eab77fd80e78571523f8cb149058a64282090cdad8d081838debc14871f9f5d3d91b7e25ca1344d088baf86b1c05

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
44KB

MD5
8fbca801b6a730e0714f84b895a83ff5

SHA1
4a6c68937f573b700cddb1bba88cad1e38a78df9

SHA256
c9922f5b9eb3c75ec61aae771223b7029fac61e5a3980bda93f4a09a0a179f3d

SHA512
afefe3c4166b8b22a95d5c69233a13e054a4a0200df06327afe9dad32313df58250c4bcb0923bbda319bd245c1285c140f0b9ac883685c396a68192d7367f3d6

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
39KB

MD5
3735f5ed9897f038996e8affebfa9e22

SHA1
1f127c46784305c4449b7a8df4a0ad23a3360f7a

SHA256
c12aec79ab0c1c040978d0b0dad4f2de857dc84230c2949e74b859b3172950e8

SHA512
ad86c03b52fcb6bf3350d33d1eaa451dfbf0841660a46f1d1c2f5f37e896a099f9ebdd43f48cb74ede2f5216ef7a5af5797e18896fc502d0e9c454ee77025fdc

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
39KB

MD5
fe63a15edd06846999f565733245d829

SHA1
6ed0de02be3d1cf0fa7d88750bb9894738d8c21b

SHA256
5f384deb88ec7d47f7acbf364455f6ef294325ea9343b556e99351897180a365

SHA512
103a27fcef80696ff615868d85fe5a74d9b0fe09cff399b853c02792b2857b58e0753a1811253f2cdea67bd4600883f463e9091c529b1791db752f01370bc0c1

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
46KB

MD5
adcbe7323120a1815d71f0a3fbdd5d86

SHA1
2dc1ea2f6f0eb2b7401f0fb08cd99da841166c36

SHA256
7b6cdac75528d16f6bb874e57a39077f7fed8ad8c324669d090e2113c7bea1f8

SHA512
d349d274929dde4fd9896300ea21677e518f1108b55009ed00ce2075fb3eadf6d718a6773bdba2c8900d3087275664acd4e9d6922c477ab85f6f11e2106e5e5e

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
34KB

MD5
c2e5c3997d52c873f3a58a424a436163

SHA1
76e2d030932664df993bb02a0c908f4628052f58

SHA256
ddd1647e0037066fab1c867bb39b19c59c3f9d20cc3db00480f231750438279c

SHA512
080ec145182e39953bb2d108bb6a6e535681541c0bb50526bd0cb706920b60ae2dac902738e8ab498e18eea08b2db3c240d9b3a30dc8c7ea32611e028874482d

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
48KB

MD5
e3b47467af5b4a1a3626e5ff6901e402

SHA1
542dd56666d75a043c56ed942755e017b40d2958

SHA256
852def6f439e360c6da93f251117085d5c85eaa6aacf3b10d0752c00012d470e

SHA512
f3a6b06e19433e0508c2b975d33a73aaa0b6ed9cc36ea84d2a5c9beb0bda8f11cd0760997e8aa9466fe0166bf87390d499bb23734ab5a440a98425a6ea87bc75

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
34KB

MD5
a8752f20f4b8afe01fb91703da7a5e81

SHA1
94cff2b45d9bca88eee0c4ea0137a1aa6eef3492

SHA256
3d2983477bda6788118dc96464b27cb4bc925b9615d98d14e67bdbd62965ee55

SHA512
bc74b9e39b4bf3fe2da458ee9199dc73e6d0d65891e3e62e15813cca6eeb9c9dcb253e6d7a80fa25ddc058b9d2760ed09b93f0c3669f33ab7dfea4785bc1fd11

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp

Filesize
52KB

MD5
af1a07bcffc5e40e86fd545d12a5b9ac

SHA1
5e4c54573b4bdadf525b1a1d96170a10eb6be318

SHA256
6b4dff215cdb31f9a5c0e60424ce3dc453e9553a044e04768b6ca556ee64d103

SHA512
f87385a9906ec6d862a78f1193527999182d0a1ac2b49dd6fc25bbb19197d75b13f8d90565fad344b1474090a8e5fb01fc448f74f881e671601584c63cc59dec

Download Submit
C:\Users\Admin\AppData\Local\Temp\_263.exe

Filesize
33KB

MD5
b5158bfdf09eea6a54ce0bf6b6a79abf

SHA1
a0f9cebad17f8a9f63d62cf2f0f32411f53596e2

SHA256
e0a8e18c145e4bf476617409099768b3c6da900cd07ca42381077f85d41aa503

SHA512
71e35221c1f2dfdf51ed0950878764013219467c61a293012b97c7368999cca0f3266df68b78b5ce539186bbf837d7bef6c4f48b9702cc096a7f8fdbf9eae5e9

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
33KB

MD5
dc1de759f43c6a41fd228ffafd6aa299

SHA1
80dad21bc2b42bde73a29964d14c4195c11f7294

SHA256
325e6d70a53140cd69919f59e8493902ef8fb1b3b33b10dd793cde3db0e6a975

SHA512
0d46e817c522d44a7270e1577920274b63d92d427137a9dc345b2ffbcfc55aa3b0064dec6ddbc5079f6c38e812f363d1a16d7881688f43fdbd18132887de986e

Download Submit