0acb24b2973767e4ec58c33240c5cac0a5ec8e8affbaff6507f0f6ee107cbba4

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc262742e699e4ce3b96245c05829070N.exe
Size

168KB
MD5

cc262742e699e4ce3b96245c05829070
SHA1

c8c83fd4a8feb37507da62b655994367d2d683c1
SHA256

0acb24b2973767e4ec58c33240c5cac0a5ec8e8affbaff6507f0f6ee107cbba4
SHA512

849eb53a8c0760d27596b4db7cbc759cd6b196e13ea17a4b28b078319d75ff1ed35994b401dfccf33f9a230666bb6aaea12196a6bc264d1211d5cebce5754049
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eGGYe7WpMaxeb0CYJ97lEYNR73e+eGGm:RqKvb0CYJ973e+eGG7qKvb0CYJ973e+d

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4360) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3772	Zombie.exe
2900	_Node.js documentation.url.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	cc262742e699e4ce3b96245c05829070N.exe
File created	C:\Windows\SysWOW64\Zombie.exe	cc262742e699e4ce3b96245c05829070N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	_Node.js documentation.url.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-pl.xrm-ms.tmp	_Node.js documentation.url.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp	_Node.js documentation.url.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Metadata.dll.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp	_Node.js documentation.url.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-TW.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	_Node.js documentation.url.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	_Node.js documentation.url.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClient.resources.dll.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\vi.pak.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe.tmp	_Node.js documentation.url.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	_Node.js documentation.url.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Luna.dll.tmp	_Node.js documentation.url.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzdb.dat.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART3.BDR.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc262742e699e4ce3b96245c05829070N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_Node.js documentation.url.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 3772	3936	cc262742e699e4ce3b96245c05829070N.exe	91
PID 3936 wrote to memory of 3772	3936	cc262742e699e4ce3b96245c05829070N.exe	91
PID 3936 wrote to memory of 3772	3936	cc262742e699e4ce3b96245c05829070N.exe	91
PID 3936 wrote to memory of 2900	3936	cc262742e699e4ce3b96245c05829070N.exe	90
PID 3936 wrote to memory of 2900	3936	cc262742e699e4ce3b96245c05829070N.exe	90
PID 3936 wrote to memory of 2900	3936	cc262742e699e4ce3b96245c05829070N.exe	90

C:\Users\Admin\AppData\Local\Temp\cc262742e699e4ce3b96245c05829070N.exe
"C:\Users\Admin\AppData\Local\Temp\cc262742e699e4ce3b96245c05829070N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Users\Admin\AppData\Local\Temp\_Node.js documentation.url.exe
  "_Node.js documentation.url.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2900
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4188,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:8
1⤵
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
84KB

MD5
1baacef08c0cdab5c3c5668fc27e6eba

SHA1
4e2b782c79ad63ef646d6ee9a7771d8dceb5b8fd

SHA256
e660b56cd7df94f68af508fc06127bc627fd44ae52d5763008b6e3e87f335812

SHA512
29da5fdd5bd4303167190433a5549f7c242e006dcce7028ba02e77133da1df2596125617ebd76017dca5bef870b2ee8850bbb0ac3cb41584263c5bbca7ab4aa5

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
196KB

MD5
c2571f94c6510072bbc96798199ed7ca

SHA1
751ed4e414fd841455e21fb0d45ffb5b2037276e

SHA256
dd202540e745f7588fcb88df130e94188c3ea2a60735dec7be038388192c57be

SHA512
9a22f0a66c71125b10fe549f422dd5de6d46cac15b1e2d2dacd42b682b8e11916adb2423d5f1f3c6e52462060aac7f3f1eb6edeb6c87a3df0757ec4679ed145b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
183KB

MD5
f0b344433d830f4d1791f19829fa9889

SHA1
843d1df0747aa05403e6b355c105b1f06ba5b909

SHA256
bde9d3bd745baefcb95e057072a683619582d417a7b35e4829447e499eedcf2e

SHA512
dceaad1a51d62585dc1954df35678ba8f8f3d7471893700cfdac8590349cf8f60ebb2f8d965d495bc54bcd5afdfdd3a359ac7e3d077bbd175e914dbd6a26ba42

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
183KB

MD5
0ea251149ae9e2a89a31fd605baca64b

SHA1
a1d7c513df8cee9f0b7dfc31609458e1183a7ddc

SHA256
5d32a708680db116468b532992519a2716d1832872b1873692a7d2d59c143eb7

SHA512
23927504932338dfb2ce9f9b5a1773a55158f050618ef1fd3050cf12e6215588d4c1c31c2ed6240f376895e6a8a28deb29a01aaeb71925b096e691945197e133

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
149KB

MD5
1b81f783629967105be7326ec21248f2

SHA1
f6ae9a5073c7bdb89f0cb73c4495bcc464476c77

SHA256
f73c8fc5c09d9b305b8087293fa69cdcf56f6ba63f1ded42a95af734a4f597bd

SHA512
3ed2fd95d2262605459f3be3e409766a028dd56f189416f27e3bf7776b0cec397c1cdee4bd2ea364226ed96d1563ba3c371b63e7dbc855732cd41508dd5a2749

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
4242cd0ef045b039b7971ca7e8538543

SHA1
a27be2afe492667e95b2b737929e02774c4b598b

SHA256
45cf5dbbbff8c0eb1b847fe5255cea795f22494918d2a04e0d0287640b5e32b9

SHA512
9435ebf70cfcfb452efdebf5fc493d4285c65bfdca2142f9b2efaf92d268e7d39df4126cf5a30e0da0e7853a93937d7c5e89c79095e8606a0a118e4917173237

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
628KB

MD5
61db67d5c87601b43e07bd21efb7ce19

SHA1
3a5921afb372da98d29ba8fcc6d928aa89df096a

SHA256
dd8225fb1028f336308a6e4f1800c54f5694c4bf629e707ba3127a8a841217d6

SHA512
b090c9e003e205418749a3e4916d25e5c7ff4f1896d7ad279328f7d6f2a778f326109bf3e32f02b087e1eebbf9f5961abeb15142ab22b0ff9aa3912058c2ba37

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
293KB

MD5
162a44043b7d91b1d1b5798aaf791cb9

SHA1
b0228c5a92185df91418109b6997da72bf9d51d1

SHA256
424486b6e8fb898c41507a86f804834d382a23b9f8ed53f0d3e632ec5d2578a5

SHA512
0c78e9872ddf1be6ed926246bdb7796a856e54e1f7373d112a831c145ba755b5a15f77f0b4e3269f53c528437daddd882dc9ebc108cdb30776320840f368ded6

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
272KB

MD5
f9b757da75309db0d4791637821e8c35

SHA1
65666905a9f983c0704b7556aa37aee0b8cb540d

SHA256
d6b42d836cb7e49f8ed2ee72e24b17e4bae1017b83442290b9661b09bd9442c6

SHA512
f46118005dc22b1e1fdb102e93c20fd3e89c0e8890e1f008a405ed17db12f5379acd05eb10f6db6942ec2638f841cb8adc684fec734e6c04176fb912428c6be6

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1014KB

MD5
93a48f685f5b9834c7cb1fe83efbb5bc

SHA1
ca094db8fba54167553336cd228ae61653714e7c

SHA256
7f76ebef308c3c8b626af9b35bd045cb738edd5ddf4437a6a7f5d1070808e547

SHA512
90f5db6213e41abd5defa8a84c9b5155fb743b5e2a5a4564ee4544d179c385899ebf804d0fdd1591c3ce1b36703b932a3bea5a1d1d5f4eb991a03241b50a5731

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
768KB

MD5
804e86bd127065e15929d76f67a1bb08

SHA1
8dedb00c3b208fa36b6d2f27c470b2618638882a

SHA256
14495cff942017c687b83c222ef790a8f9b8737c9bea6733794c70ecb3140a13

SHA512
e50dc90b900891bcb700d79e18429da7baba9863302d06ce9c36529487960bb9bb5e9898e54990f46e021cb28da94a0b142ae2bdbf9a4a4638add3fa1972639e

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
94KB

MD5
1a339c0d86c5a9a2db1fd8db5727405d

SHA1
8d2581c23a87834ab998e2a65a2a285f59d237a5

SHA256
0e270e228db462aab0d1e957f5626f4171a157d305403a1f081ccbd253ef88de

SHA512
97fb7375096bf025f1ca65198edcdf347658bcf4402e6a0237b85b303ddf0ff25ba7e8b1cbe4b200ccb712d338f87c1bcd960212dc4ad8c3d4d2fd7836daf94a

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
96KB

MD5
95571cd75a365cf0a5a1c0897ca5751c

SHA1
5c68e3ac67664183085cc50302c6e47927796a6a

SHA256
5cbe53c0d74bbd3e7bc411927c170647a6c6411646b840d895c1d6a9b668a990

SHA512
d0d5514cc4c194c4370e2465ceee5d6738e471e367611a7fc9e19121910e97bcfcc81e8c98e7ffdf3317658da043884a599ac309614d0200a8c46606741eeae7

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
95KB

MD5
3bdf14b3a793c47379f7b7600ee449df

SHA1
cfadf3a8bdf2de9557174a610a8ef403161fcd5a

SHA256
af17d222554aa0d9c326f4fe7ee89fc123cb9c6b9bb2413365f1119c392525cd

SHA512
96b46fb1f71c491f5a248fa202a256d5bc05a21d265e94a0f50961fc6029822351e9e5f372c6b46f84d948c7bd6afde7db92cd132f353c7ec235073c64a33f36

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
96KB

MD5
8002535273bedaeb4ff45ad31bef5618

SHA1
372782ff80edfe3015365810be0d9fb8769ed74f

SHA256
893003afb6cac980a5daadec082c1d2fa3e6be5a22feb50be335b271dc7f958c

SHA512
05b0764a9adde26367b17356971e5982799c91815d8029b03f8bf1bc58a3a88eb653c470d50504ce95d053c6ea8b0ca1aa087a592ac854f2ea6a0337fa8a1948

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
89KB

MD5
f743305b3ecb94e8c320f4fc8e3d4f10

SHA1
365d14943cccbfc441d50f755cfc3c953cb27782

SHA256
987e95ac84cf1bf6ba9fba65f6c2e505c2c67468132c22ae7014e1a3f4795fb3

SHA512
b57c891d6577040b4affdb9c342fff973ea2f778b22255054130b2f1380ad2ce57c16c960924a86e6aadf18243c4f5a4970e02dda7f9d9448312458eb0d4084d

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
95KB

MD5
fc0a1e40d2cb653102702a25c33bb055

SHA1
bac16e093e092ccf080bb7d5aabc024d910caf0d

SHA256
de6e8b6917238bf866ac6e17d16411d31ac8b93504f20b1d1c0686fb3a92e975

SHA512
5eccc0b17fe44932cf5a29e03699cc3339c49b0a1a3a96af2be6fea5bda8b2b2d6a408ac5875840ff0ef7578c1009208b425ce22584e4ef40e958ff54f78ed87

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
93KB

MD5
b15e18a17324238544695fbc38eead40

SHA1
726ca9aa4281404010cc2cf74060225dcad1261f

SHA256
9f3f58d08a0c950dd50ac6efeef67ebb52431b75f72cf3af5292a9fa737c199a

SHA512
abe177fa2e7c6636fc49c61c1ab43faf2ee4a5f1801ec0e2f57c703ac742d4e1f87d6ed9d6d51411160cf3fc120e9a9b3d58e38563c34a22d26118644cbd743b

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
92KB

MD5
8b578e86b6f1f41eedb9f2a447742058

SHA1
27134a2ec59f225f2b63c36211edabda6bd020c6

SHA256
5ef901daebf78b5c8dbc558d285049587c148cdfc1def4fc7bf4662aa16d3fed

SHA512
6a0f24fdd60e5f570c6b65ce2a8190d043d086e1b10a1c38ff88efc4763d5e261a8e9bab152016ae4d5e9af56e9e097a10155c694d0704f1fa6979dde0fdca91

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
93KB

MD5
d56a8cd474583e19e0d9c66088909a1f

SHA1
f46b9ca1468acabaa337755aab748c49437a62be

SHA256
40799f93d7b7b75df02c10ad61dd74a975ad9261f8733e04e220516940affa07

SHA512
9e521931f47a2b0323bd90ce56ca84804cfb1647380ad563e504ae99cfafa342de17aad0c7796fabb3b17f2cade67e132f683c146b6a3b02f381045c73403dae

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
100KB

MD5
4f71f028cd847e7df81d2d520eff2a91

SHA1
974b1315153996e8c26af514129e2fb2d411a97d

SHA256
6abe50668407292bec00a7471d8ad795537a8b0715fb88b3c582cd9a9fa4c9e3

SHA512
5d51458f0a4afe9597876dec5ae088a698e3bb360b201ee5ce715e1b02212e9e5ae0a246acd04f75f16fdd86758ade46e9fb40a1199c25cf8cf07b391f6cc7ac

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
100KB

MD5
fe89d91c739fd096c3bd4a4b21bea034

SHA1
6f293d1cfea4c436b90033157e8e8893d04e74fe

SHA256
0043fbaf65d012c37152f8b1c2b1600cb85a006c4ea7c6519d72d3a138c348e9

SHA512
a185d457d0542dc4f495019e8ee7e13ad757f800d7148f2378160b7ccbe3deb039f1ceeaae41a29ac57e48e34a04afd06189f1a1a013f36db52d92f5a02c54b4

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
94KB

MD5
8b2dca5c33c99018f4c95f408ab5f563

SHA1
a156e5d7c72e6ab5219f0c3a28425a099583d089

SHA256
918bebf4c238a6b6147fadbe3c3b2296b364f049f331b723b467f43f927cdfb1

SHA512
0f90e20901fbd8ea7e9a922e1daee1b55b79b3bdf6db9f886bcfe03a2a85c50eb75b9ef345557d4269c29047aca24820e331c2c0b8c80a47dc1c14204c3a3289

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
91KB

MD5
4e064c4fb2f25b5318db1dfa99ab3c4a

SHA1
b42a70bdd4346403c7e060c76a846c2114b2550c

SHA256
51742ef1c212779c29b213e0a4bbe738a6bb51ed908687351bbd8fa2deb74bf5

SHA512
455e30864df8ae865232847a84b5d01efbf495e11038e10392c105d1f4c43a38379ce48e4e6d61441e37fcb0b50ae3a875c1e1ef6d3762fdc14251bd49e2f95b

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
91KB

MD5
72186b2fd417651ee1fc959c9308567b

SHA1
9cd70609711d10ce9de4a32e7d71483c19938367

SHA256
e1a3526d703b503ac81a010314f319d788ea1e241002fd199569cce650b51bd8

SHA512
1f06633b667d31cc7b13946f2a4c1e417bdedbe904e95186b58ec7f81ebd64c7339e932e7a5bb150fa7fa538ab003fab27cd3489ed4346a024a57002517dea32

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
97KB

MD5
07182d50245ae7a163264d1b8b05c67a

SHA1
1428e89eb6d37f82c4e8325b0172eb662d24d91e

SHA256
fc5218011b483f8d783ee13a04d1ff18da33205b70ba96587ee04a03f3585625

SHA512
14330560987f2a582c895078f8e7ec92f1ee0e5cfe865bd731fc28beb84f442e288488b473a5fc679cb16cdff7938c4848768c13ffdd7454048016ca70d72a74

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
93KB

MD5
5870ff71f65f6cc648e78d486308ddfb

SHA1
40c1cb218ce6e1acf828d616959407524f505a45

SHA256
f81200733085f8e46604f385aa18ef78d579a6f9f5fe13ff80e0b74739aac9d8

SHA512
2954e52b77a95de239bcf116fb51b0e79229b58da95065b24a833a03eed00223277eca3a909b7fecb99a3860a6d892e414e20db45829f665847b132c3b420433

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
84KB

MD5
9446f8d3fb67bc0c27ac31c77ccd7122

SHA1
bbcd286465c133728901c812bec7249cbe44a585

SHA256
cbce1e8469ffe12a70ff5e2e20f9972b55aaa136444db199656c4fb32a1ffb54

SHA512
494dfa3d55bd9838671bd9ee250fadd86126e94bf348ef9dd127177d8ada51d549a4ced8f6fb8f0225b8854a63ff65c1dca99e474accbc27aff19b2ae6f4e8bb

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
92KB

MD5
8aef55c10cacb0ff8856f9b8634ceb3e

SHA1
ee8dc7006ce8de4cac9ed31ca217a7ed9b7a3efb

SHA256
8c4ea87ddc0ede575cce4c9c797723c3844a98faeb95a1f842d19e184b029da9

SHA512
b7b5f3e5ca0139cc210edd982f4b4759ddc8863472118f2e4db2d337bd6aca0e0c37ac02fc4daa48aef8b67bb760635a5c2a54a0a00b04578404d097190765d1

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
93KB

MD5
12a6f7e9f19db6eca40425b553571891

SHA1
56d67c1a83a5ff9000a388b52e8792e9489741ac

SHA256
f074ef8ec3f0db9913339dcf75403a6140e9a74edcdd25e547db3e42733c5b10

SHA512
b2103742002497aad1004e353bd1488d4c956b5a41fb55896d5ba210d8da32bb16c7c8a7a0f804f95b91ac5c49f72334cb8d7e93a646b23b55c1aac9c42cc422

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
101KB

MD5
ae559160d9f6d3ae8306c5e9bf371b67

SHA1
bbfe6fbed4d03ab338c1723c04b8e1976af41c79

SHA256
04f02d98101345ed38949820dc8af07361cdca105b27694219b0b81e4956bf58

SHA512
25d4516b81302f1789c36a4d0190739696fcb8ba5fd84b4cc16a00363e7e64ec6351bbd5bb4b4807420d7b51869ec35c186bb5d9f628281baa290b9637e175b7

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
94KB

MD5
43067309305582f3146f10a69b368129

SHA1
b65a4bc69e4270aead7693b613290fb1385776ef

SHA256
048c7d75ef5cc74f34a8e42d09870c3a57386be592befabc19923b29379ff90e

SHA512
78f1006e39abb7ce80749c3b245289934915c7289ed631511fb5ddd3673761c110f1bb6a131fdf8e05e9053e106bc57678533220d9e7042d4cd9989bd738ef7c

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
92KB

MD5
bc4af4d9fc9fc550ac9196d1c432f97c

SHA1
ba58218cf0b348179e5cb405406dc2320656ad26

SHA256
cd1f9a3a5817365af8a301db40e0b7c3b29f700abe2da329b7626f460d55eaeb

SHA512
a6058b913a176d13c7c07de473c525e44ec70f46fda31dbf38b2be405827222a737408c766ff999f76c7919f7104e3e3413326fb25f712f696c1d4566d4112dd

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
93KB

MD5
7318e299b5797125fdd6e01b9bced699

SHA1
5117b59786b7d612d2775fd67d9270899f014950

SHA256
fbe42a9c70b3e7b73f677cfb858a25d06ebb886a056c808312054ee5afe29752

SHA512
49adcdf4e19a7f6c83eec62795b07e0ba567b69dd0bc45b29078826e924304c37b6f86f09acd141bf55fab8804d2cfdfd8b4b359858f564e86ad52db72f32a1f

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
96KB

MD5
3b05f46f2f1e2995e535ca464dacacec

SHA1
078f5fb7c8c6507b10eb3f3c76c3ecb02a52e442

SHA256
9d3e40333b4349771b447352200632ab6c90c04456e1ea500b085be1852034eb

SHA512
c916584af0d6d6f1ea4a44ae9d562b70ceb6bd67660f17fe0e49fe9eb5f66aca8329997fef1a3e3dc0f7de0b2ee9460d4126091a0935324d0cd5b847e575da48

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
92KB

MD5
88c18f8e2069f770539a54210495498c

SHA1
9c44c62dd2347a11ad74d823c659976d381608a8

SHA256
b5c1f5c46f1dae7f444c493791d72fa81a9608960cba8057e2a8b6847012dd4a

SHA512
5c3a85057371bf11080d29a28e08842b5a755857678ee6551936f6c0be1fae276d61fda27729f700a5b7f92dcfe81e1c595756931cfa8dffef8ac523cb23c994

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
92KB

MD5
66fdb298c5199fca892734870ee97197

SHA1
8dfcc68402e4f4b823947513477c304ae50511b2

SHA256
d1b16fe9a3adb22db6a7f6bb2e9db489879727a2d2cf5839ac6bc63241c90f5c

SHA512
0943cc11b2ccc21509111152d604ce0bf70c51473eb59ba5f354c6c76469a5c217267a331bdd578a28e9816cf0415f3462bf973e4ece1eb5a7c0ab8f132938bf

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
94KB

MD5
de9cfe0fb685c40751007151ab22b6b1

SHA1
ea77dde9dfd0c782a0fccf5962e243e0866751fd

SHA256
fd5d0bb5c3e1e8dc177edc274879bf58772aa89ed862ec5769ea7c7b8280ee9a

SHA512
77af5795c08b9d260581980213f5e6670120e9ff8139cf8772e29b6e1452e7465249136b901f37e3e5337a50167941fc9389326fb48982705e612b3e314847fa

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
90KB

MD5
e6c1f8a7b5f78e228003dd95e774c09d

SHA1
c094ba1d175682d844957780e6380279a076749c

SHA256
246ca3c085273164470e2595a614485cb12ab8839add5f256e43a8021f1f7d47

SHA512
b2235f48c02069c90f553ca505da627de39bf5347bcedc96e19d5f1384c7dcdd8ddf4945709b48eea8bdf498c5ecb559b045ff09512560fb9b55a6266a1954af

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
96KB

MD5
ae4017863e2da1119ab3e216f6538643

SHA1
7b0ebd83d4a1389a5c420ab9f6c365ba74b7ac63

SHA256
c0f0132b25888a0c27b998fad06550263029829f92f5565e14982ec41bf9e1d6

SHA512
3520e9243830a9eef638f2daeedaed10f0b3a1e32ead8712851f37caf13e40dc92c53da4ecf681656e06c2256ba3c5f18a8cfaa5fe02476bb295a2a4d9f34c48

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
92KB

MD5
08d26c6cc7378f7ec1946b7781620f31

SHA1
4c8cf1b293eea5a4cab0890e37fe7a85c15768bd

SHA256
a685f5be135d938b33965759b3f7d795769b7644622f1d0304956720e930e2c0

SHA512
c7eff6c31a25fb929e1af22a2ecc9d9dac3e389c19276fa06685d8e784a8ff61d296b9bc9db07170e32c47fb26f26ade2a38c20a21a90640073f1ffb25524c99

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
92KB

MD5
c92e34b70f9533a55f35dcac26911985

SHA1
458927f26f1551f7cb4feda79e2cf241b5edc6ff

SHA256
e236e9f6fd80b6c28712362928addc6baf321791f4d8d4afba8ce0fce1374d9f

SHA512
10623f593589dbe31c153a74bffca85976e1c37e453e6caa5308e536c9bce4c7c0d256615e44a7e878cc0efea1a5abcc7f1a112cdb1f8a090797024293a89e0a

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
103KB

MD5
d3b493273b4b7361ac0f70bbfd3835a4

SHA1
11567ab98899f4ac12c7966d8fa5bd82533e7573

SHA256
d482057dfd795eae3427d66b0a08dc340253d674c8efbba178894993a2383f17

SHA512
1edbe0d7fe7bb09fc10ec247b4c9aa9bda52bb8cdbe6e5a5f49062610d8dd23e07ad3a2dae6f8b2b588a7e5b8be6ee2233d6bea0a04757d9791f0d01eb94b89e

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
94KB

MD5
2a66f529028e0a400cad23e4475af5a2

SHA1
e0051f04afbe06cd77cc9b36a56809528fd1b017

SHA256
808125da6eb22c66e7e5a2e914147f04a6f482b325de26bbdf2435a114819a1e

SHA512
f69fe67756ce8147b0be27bb7581b48639dd2f3849b037ed4b8d34574630a371990a4170fbfd8ab3a5c300294adf5d170382074f83d74dc047020c21b062c3d5

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
89KB

MD5
c4c4cb2e3789038569e88fba64f7e087

SHA1
89723e61ffceef4c9e3ccc977039e2b3c8f3d328

SHA256
f68885d905999fc0f82d6724e546194cabe7fd5ac450544fcf6346e7c069726b

SHA512
c39142b4ab4dc3b16744a7118e59a20c9e896e71479b66156fd99933c4e165e458b94d96e9bd1ee54c057a3405af9cbcc697289cac54b500258b7166b8cec968

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
97KB

MD5
64e56927de046b1904fa499f92720bb1

SHA1
67aafe6846589e902628383c9903341e9895170f

SHA256
4a97c2c724304ca4de975dc264ca1452a42c96bdb3ffe16074e2c3da118bc4c3

SHA512
80a592a1e9efa3711d46661ca04baf3e1ac7a3261726c8c1ca093a7c5044b4f94b055e5433a07deb203576e8c186e9715aeee81c23d69a3f03f311c69ca38273

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
93KB

MD5
00297beb94180ccd87d4d206c076220d

SHA1
7613a38cd60748f028236190b3c52b2505959341

SHA256
afc542a44c84be51b9857143d83ddc507b26c7aa13aa43545d63f69a9a7b9b88

SHA512
d383325525502a18f79f6b5e7a6e5b0ed440c2580178e6ccfe6ea38d9058db85662c233b28b82a68c922259b6526ebb29def91e53ea694bb404d1373e7c398e5

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
98KB

MD5
4ddbb833139bea3957a5d07fe27ea386

SHA1
a508a3eb6e3b69b05b4d07c6d64002752fb509bc

SHA256
ff97a8884da64c1c0c360f228f82eade14e1ac0b3bd15bb914670c9c33f1e033

SHA512
87f45f384c189ed6314a6877bd399b3fcedd04ec0bcc97854b35926180b027a00cfb2e6ef0166aecb410dc58ba5a4997c39a46f33df192053f598942f0b7113c

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
94KB

MD5
bcfa2ac10967f82b95dbdcaadcc33e3a

SHA1
e603e1c35dc3989d8094eac18cc0da2b728bc1cf

SHA256
130458b30ebd86342dae879e99df61102d09e737104909f2a0e473a270d5ddf4

SHA512
54fd02708fc1b6141d4261d35c50ae8be246b347a787e5708858c1cce5d0c4e6391ae46d98c9b4edc666ca4d5161513744b33e093e0bb70716217720c7a545fc

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
91KB

MD5
7071a83d834d3b8f95aa5acc47b41bad

SHA1
353b8d78689f4731521440c6bbe44511a1ca439e

SHA256
0548a350c0e8e607d3af64af4d42ac50e750d283a30e921aae0c577054fdfb54

SHA512
757b96265d5471bfd68b3c6476d4b5c3595c933fbc012ef306aa0d4a07c48d19ddfec3e68659422112a01d0c00762372435088ba80a5635a3b465e1b8dad0a99

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
93KB

MD5
17f9f57246cffdb65d5ef12ac13b6c96

SHA1
03fafe157518ab2f507c13c4a9a398a6e03dc1ee

SHA256
d8acb00189fdc8f50c8a812922466afbbf0935f417244e7d4624027be760e440

SHA512
317a9ab8c91cd4ad4aa9458774c7bc38e789a883cd97cf0a26c431dafb3668564f48ae6a92ac6c07b6bd2cf44acccde1d0a7ff50f0d4a60eba23ecabf2484819

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
93KB

MD5
8d5677d9b676965e895e6a3bb2e9588e

SHA1
f8386eebcec320659009997263df3c42721e812e

SHA256
912ddd5e496babc2d18f895cdd29cac8dd0786982acb2c22c9c3ae0a8b4d123c

SHA512
b8315016e55ed88c588d5295f67199927217cc6791ddd4f6790c045420ed4c84cd482ad851d0344b360f63905892fc1fa7552acbb85e3e14ab70e993753c2ad6

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
90KB

MD5
a2c277c538bd1a2d6c7dcac4a9ca73cb

SHA1
f21e139cafba52289ae5bab37fdc646db946888e

SHA256
b23c1789575a2bd99e8a4fc0ff9c67caf51cb5e1c2d5d7d9060969f7220d1271

SHA512
0c38c7c2fcb4e0b87b571f709d4ecdd1ea91e7086f74424898de98114d9a57a2f84076fe845bdd47192b78e9d543ff51ff21d7d108a3315cec6888014d8bdcc6

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

Filesize
95KB

MD5
686656ac29cf15c1ec5ae0d781e1b5a5

SHA1
f400f28427f80aa5a13a3fdcd9baf3e974b83383

SHA256
a4c2a70b20949bba0aac6d5c4e64dcb68c014055ba941fbf93a05c30d35d1cfa

SHA512
e346d1c4615fb3399d794f5d231bdc1935cf4b247c948a84ab24e8d004ce980f71712a747ec16eaf0136b6b3140864ec1c04ae124a7afbace3fb4c57e463053f

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp

Filesize
102KB

MD5
1f2e50a2b80ac7181bd8700e9c2687d4

SHA1
7f7c4d31bf7be24661e9b183891d833f7df257d0

SHA256
1f31d8a42a8349deb99e7ca8c3f91a1711b496131a5af4a574ed60d66dfce7d0

SHA512
18f7d2327204c798697274f6291da12dc19d41eb132d10d5e96dde188c8a33817e1257e1e2ef0417551e1bfc04987a13cb500a5d83e3b65acd75e96b4da20030

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Node.js documentation.url.exe

Filesize
84KB

MD5
b2edf18375fd2f1a00b5fc67f7677f72

SHA1
0e4e582ac8f06eb02fdcdbd2b95d060340a8ded8

SHA256
097470342152f0a01bc9a3dc5f85d7f7a72498e138c55e6f65b7bc9c179a34dd

SHA512
af0d11b4bbb6a83cc11c9abcd056f2467cfc00cf73e0a808f60e8768323831bb37b03060c795c57f468bbe100b19f6c6d3f03f594ee583329c2e53af02814456

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
83KB

MD5
9e5b052c9627db5177c395d8f61b4353

SHA1
ab453d71ca2e7b96932cea6d184f3c72fe8b8791

SHA256
c6050052ab8bc9fd037e7971e8019e7395deea60f03eba126d9f8a9f8821704b

SHA512
6c48bc0d184d8586d24a279f0094cb8e53fc0a740aaf08c125931cc5dc8144747d2f90b151dbb00a2c4e059f9dadc581e94693534fe3ddca59e97973362f2f40

Download Submit