38851e21312690bdaf5da49f3d03dd4d717ea6346fe0f463067027d4209823d8

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 03:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46137a2041c664962717918cac7979b0N.exe
Size

73KB
MD5

46137a2041c664962717918cac7979b0
SHA1

dae8673653fd5954dfad6123b9966fca4dd95ded
SHA256

38851e21312690bdaf5da49f3d03dd4d717ea6346fe0f463067027d4209823d8
SHA512

b4bf0c601a00ecf0a1da41c9c4a8de77877edb28d479f45cc28b4ad93059d4d93668fc68f4d9864955ed918d72bf9367a7630f22b179f9c4622fd9c027a19f17
SSDEEP

1536:W7ZppApBULcfpHLcfpR7ZppApBULcfpHLcfpP:6pWpBwchctpWpBwchcN

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4401) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4992	_7-Zip Help.lnk.exe
4536	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	46137a2041c664962717918cac7979b0N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	46137a2041c664962717918cac7979b0N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	_7-Zip Help.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp	_7-Zip Help.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp	_7-Zip Help.lnk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\dxil.dll.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp	_7-Zip Help.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART10.BDR.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp	_7-Zip Help.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationUI.resources.dll.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp	_7-Zip Help.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	_7-Zip Help.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	_7-Zip Help.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	_7-Zip Help.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	_7-Zip Help.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	_7-Zip Help.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	_7-Zip Help.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\wab32.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp	_7-Zip Help.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46137a2041c664962717918cac7979b0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_7-Zip Help.lnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4992	5080	46137a2041c664962717918cac7979b0N.exe	82
PID 5080 wrote to memory of 4992	5080	46137a2041c664962717918cac7979b0N.exe	82
PID 5080 wrote to memory of 4992	5080	46137a2041c664962717918cac7979b0N.exe	82
PID 5080 wrote to memory of 4536	5080	46137a2041c664962717918cac7979b0N.exe	83
PID 5080 wrote to memory of 4536	5080	46137a2041c664962717918cac7979b0N.exe	83
PID 5080 wrote to memory of 4536	5080	46137a2041c664962717918cac7979b0N.exe	83

C:\Users\Admin\AppData\Local\Temp\46137a2041c664962717918cac7979b0N.exe
"C:\Users\Admin\AppData\Local\Temp\46137a2041c664962717918cac7979b0N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\_7-Zip Help.lnk.exe
  "_7-Zip Help.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4992
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.exe

Filesize
37KB

MD5
7872756905b647229183c1ef80e86f20

SHA1
6a922abf37a0dc5a680f0f844654ab16827fb51d

SHA256
d8827ba6b0820ac96d5ef43231c333cd408c1b7126e3038d612163fbec613828

SHA512
d0c2ad85ad65803da75e68c1e6782e05f489e377569f24d5a2f83d51dee8e8eb69c1356274e80ecfc40a99c03628ee1826781f22f941a8c9e367bd3e5e8eddce

Download Submit
C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.exe.tmp

Filesize
73KB

MD5
922e864c0660ee20912e73db8e0603ff

SHA1
59fa4722023e6304d8354522bff34b20b52d9f8e

SHA256
703959d7363046f1597e49171f5ca3ba955b15d601a916dcfd703ec05ac8da0b

SHA512
d301f7bb4ccca0c809e7fbc24d2bfc6e4f9f788ffd5d23dc24c2813c3bc8737a9e4445de427e49c639638b19f326613c8c786c0f3da5099665011c5a80b0203c

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
150KB

MD5
0004724920b1cf3b44dc4e3b39feed40

SHA1
aedc7399ed2caba7146598c87a4a95198380cd08

SHA256
8d130d36b9a1ed869ed35bd4eb4f5a1ea93ef9668b733b78084dfdfd3079c2c4

SHA512
34780b4ed8d729efd83b177c86ad21158d5cb4ef15e4200c85c62bced9179259ce493a97af2a652a19117305fefd888ca267e12bc3c720ac0023454d9b88d9c1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
136KB

MD5
cf05260861bdb4b302c680b05e81b162

SHA1
f49be53c5cb050473454458922b9e7385349b149

SHA256
dc3c7ecd28c50f44324806b4498bc727f194b3a2f535a8df8428e7e59ec33458

SHA512
0def7077f05160fcf1ab87725333dff86b0fded0dcd32962b39d18c7d9c90d5e3df95aefb81cc772c3bc7d86f07d62a660225cf2f963b7ab8f335d76d755c290

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
136KB

MD5
083ada0a33fb20d34d02674e18ae4a15

SHA1
2e19f084dba94cef91a36d280334020b171e69fd

SHA256
eb2eb7c48b156cebd799a719b4ee897b26c17d1d5047385391f4047d6e74d18a

SHA512
75ebe123f6d917abad234455c792cd54ea7bdb3fe8fd0a0e1dac6b647a0a905df5a64fe747dab0e81815d03991b36d6d6792174f27d69a1364fd59dbbd2843cf

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
102KB

MD5
f607337d0c00f6cc74108b290fd80867

SHA1
a965478657a56d822318d0863b358bc7ade91292

SHA256
ce7f68c5f1e1db8d4f231b2beee77be064d492f5a9ba27e338dd466d2d14baa6

SHA512
4f57b5deba7bf3bd7ee223628a29c9ac0aefedd9214a35d16f4b6678bd550bfbdc7736ec9f69d2001ce542a786f6dda7fcba816a9fedcca31c7e2866d8df7da6

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
8f0f88f991ff9e394203c9074147b59e

SHA1
27874ae08c1d895e482c7f0af1efb0422f97e4ee

SHA256
b449624e626cec9fea9ff4f6ae1353fa273deb5323d8ec1122d6867cd3558b1a

SHA512
d9a2c42bcb77d008f519bd74c46f9be23d03bb814a77500d07c2763bd0b5a9cbe60602b9aa9897478557d4dd862b36700425ffbd6d0e4b71c1d1a07a89d1da8d

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
581KB

MD5
3b9f1f7ce0d3812ef8ec0430ec45c6eb

SHA1
a68a31051e46eebacd38df21bc88f756507664bf

SHA256
e8aa992f72ae0ecb20971239f71b4fd886debbfdc5d85f2be4fefaad2e28dd76

SHA512
0360e8f4afc606c0a12d03eb53b1024194355dcdd857c4237e5dc174ce5ab419e28bdffd8c34e71d1f1bae79aac2cb85dcbe421de2fabe95b65d0d47e565bb38

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
247KB

MD5
bc9a3dcf214d6beea795adae1e0c5328

SHA1
d8a224dfece414eabe72a4643af8ae7de0060f34

SHA256
d6f5c74eaeb6598c2e62989b693e4a77d05d84a80daa2af8d654a9d47b00af81

SHA512
9affbf1cdd3e974ee13a346a63f1a14f069f91496cb7353df3c6f39d7beb0ac7c92e50b892c13d5b5cd435b6d9a3b680d75979ffa4f0c90376f47f68d75d4d14

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
968KB

MD5
b8eb8a516105a6ed49342fb1ce170780

SHA1
428bba570d72bee28fe83b8d37ada4d681b6c22a

SHA256
7253cce382474dec91953ae95825b7287c5bc5ae431ede78154f792cb16c05cd

SHA512
21633a38c5eba891dd122898ab4d8304a2cfef693eb506ec0f6a5af64d69d3dbee65ddeef45fb0d77eeff95c39e3ff6cf37f4889dbd2f31f335e8f1abd7ad87c

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
721KB

MD5
78bc63ece5a558f6dec8393ebfb61c1f

SHA1
cb37947028cef7a176f0e7282112f11b050fd8b6

SHA256
169e15440956a201646b5632de0d2849c9aa74ecd53507ddd2490f9acb3ff61d

SHA512
219cc25caffe17083968cd92c1670dab99ff9134e03ab7ff746aa1c9eb11533c7fd851a701fd9bc6f05fc35a37f3fb105a7c87bfb3017b93e59c32d04b21bef3

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
94KB

MD5
201d0abe0f70a06c0861f27c82ef5651

SHA1
b9fb026b12da5e63cd86c6a5795102a49e15b185

SHA256
2f3557d63e531a75b92eb452e828a27e4228335791364b08a0154f55b4c1d9f5

SHA512
bc46d4bcf1c95547ff8f86f00b1108f128e48fb556e4b9e4e01da2d784a153a0dd4358a1dea006875eabf37eaa91a43a5d63d01592dd3604c0df92f417e6b805

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
45KB

MD5
8630e9270e193728d6bab4d56ea78cd9

SHA1
913c4d8bfac9747bd6771e45e6abfc13a1608d98

SHA256
13d9c23f472b7e8e562c91da8d89fa769e522a1fb5315a45b3e8295c99b83f4e

SHA512
c4515447fb88b887701e16f29599081ae7c168a9825ff4560a9596534bf307cbdb00255f9cce3e9076888f1b4f3613b8277383668edbe877dbeb8baa542a1121

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
43KB

MD5
4a5733383de4c79a153d23cb1fe9d15e

SHA1
ecb4bc046937732a0e37f3d08247e845d99bb590

SHA256
da05c696e2c05dea585137c4711a225cd8f2d889ee2b76f00d00550b518193c4

SHA512
fda9785b9fa0eb76467bddc8b6be34533484f5a4327a559e0a876de445d012fdc78836dd2e50fb2150ed8499435a97101c535d0721649425778054966009edcb

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.exe

Filesize
48KB

MD5
ac67f42ca773e6b1da55e00180b9409e

SHA1
02a8dffe588b5d0e48db6be64b2fe71d10eecc80

SHA256
0bacfe7a9d62a7392459f65ed7a3067f7fdc39bfd0f596e6c3900810adce6dc0

SHA512
e460b5dfb1b2db9c52b2352335d15a9673b839b5e296780aa6663ce40faf4208b1e3aeaf248c009c91e53d375ee9bed20133ac2a8b63a968043452a7aa109b31

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
45KB

MD5
d9685e6cf5276186194309d5e79f52a3

SHA1
7de421fef50cfb2660697045d9d450facabaa2d4

SHA256
d988fc7a89c6e16799d4f26c497897d65ca03a8627681c451b9c49dca656f4f5

SHA512
5cbb1542f4bb16a53601074058a93fd42000b406ca5ce1f409bdd5eaa2a89573a9e470baf68970afd55cba54697fb861ec07370a3de0adbf2e81b14bb075b61e

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
42KB

MD5
9e9e80f17c40cae8ba64dc9a2f1dff12

SHA1
776edca365e5e7657979ea3c44284566b17f7939

SHA256
89225f91ba4f1bfde513a2bfb006e11a4faf096e2504c25152318db2d266f503

SHA512
942593443e70ce878c6184d9d28b3d304362a63418c25bec829e16ad2ec1786ea1d445d0290e48241a72aab5621081daa2223825d96521de01d33e1bbb0c7222

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
43KB

MD5
020bb56a2c291a1b5d79b1058ebd1771

SHA1
ab8c04c6f11db374b96f53974cec288b06a9bdd8

SHA256
e4e53e52267aaf14f24f172e4628dc3d8bca7dba3a641b24d4b3d9439c175ba5

SHA512
99bf1d3b03d0e39f753ea0662528719281b9f428224f716184388c714e7194430481ef2730561002e59eedfa25a7b340d670c9fe2c6f93674a486bcbfa73f2ae

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
51KB

MD5
1d6447f6755f9aafe4fc0f1f9c52a0ed

SHA1
3df931ee0a67eeb9b23f522d7e2432d957b08d9a

SHA256
efb6b6cab10cd5ecbf2660cfad5757d2143a6b521069ac618e2f7388c408bb79

SHA512
46943d26d5567c0ad49f5535ef2eca7a671a9326bdf5e52f38ac25c9f2bafc09e0efeebfcdbf449b730b41c31b44176bf8adb330a89784336a5fe0ac316eb6ac

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
46KB

MD5
2ac861cd0b9d95149ca9c8ba79093e70

SHA1
de9ab029dc0ce13f5f80d9d645d6edb57cb69559

SHA256
58d3db44bb665e6cb1c5dfd18b12b253cb67d5e2934e076c21c2107ee83c3850

SHA512
149c7977b21c88fd7538ca80dde519d8886d168de7d7d07560430607e5b6cc9b1153a7897a364467229365e7d502bf122ea43ef64c8b876738342d7cd2b832f3

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
47KB

MD5
754386a037b77498f892212c608d4fb1

SHA1
7d11dac3da51bbd8344fc96a4ef780f8f9731fc1

SHA256
0be6a6c18c5acc4a382ad473c18dea0ea970bf59b0ea2c8df805924752953963

SHA512
bb617ddc80fabba8cb83f784f571e2071104d7d443d2906e3601f7cd3faea190236c11f191704922139141854df492a62512f84f12eb20a9a2f7f623aca0db22

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
44KB

MD5
1435ea4ebf2366ab574b9b4ec3a523a3

SHA1
de2d2f8613bc5de4f58940da9cb997c093cd93bb

SHA256
fe9b0e7d3416bf1f86f862eac43bb64a755232f56f968d7f7a71489166191c8e

SHA512
6c124e28d463e8384b5ac3e4e4f39e3ca6994595ed89aa30754790eb7166ba1ad52ce1e1aaf3a8cf4cbe383328dc6caecc9b22a5124d5e8b221ac25c84d69d8e

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
46KB

MD5
e7f8302447006ece8225f937b98fb6db

SHA1
3701b1a14e9110d2c7bf2a6a4196c9625b74f6c9

SHA256
ed4329e8b50b4ff96dc831f0be7ebee30b50290e96bc47d685f7d9e9d13e70d6

SHA512
5b6332545cacb7dddfe75e26a515c2dab1c61ac9543349467186e13084ce62db4126f3ef9c53e10bb4eec34e433a1131f4497fced07c472c381200c0c525a399

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
54KB

MD5
cfcac46b43f5c43be94f3afd18713831

SHA1
f27e32ff1426fac420c706debd1b350dbcddc41b

SHA256
a23800dc174d89e46499f1a3111a1b874330c2170565ee131e91fe99fbb14a5a

SHA512
7471696035b5720d197084158f2d365fb84e7062b514011d1c7bd5962b908e2c51360b80ba4ab2ac53d95dea107a59ccba9b4cc27fd07a43eba4019173aebe0f

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
53KB

MD5
4827fe4fff2a1e7e53804a84196075be

SHA1
e5288d0d8a9b55c6a2cb455d2ce1cecea3e28eef

SHA256
8f560f0ff20a17b5cf9fefaff54fd51c07dcfee09cd8c273e0ebca698b45da48

SHA512
b7de6a52f207365285a641bc9faf6ee6e602f562fab18265374a24bc51150f88dd485fd7aa3a29f04e5a4dada5fb10d7cec981091d9729491d99a7325294c25b

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
45KB

MD5
3b1322e7a4728681561041b03a5f2f1f

SHA1
3af442562e0d1ee611b9dfd38e30e81030da9341

SHA256
2a5b6cc89e572ba92a38800a4de67e16e732bcedb64f4140a0b2129611e10067

SHA512
ac2ed3756c67e9be3f51324191bf9006953502d6c5c26f97b246777370f23baf3aaac0526aa77c4d79c98d83fcf331677ca5c915b622eba912749b21ff676b1e

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
47KB

MD5
15c922fcc18a801a5e213ea03306e541

SHA1
4ef69c8e2b758c6a5ce86f90926a92ff1df6d729

SHA256
83508e6fbcf6786abe9c501b1789322777e950a309c13bd94c95a9f04efd9650

SHA512
b15f808a47d01953c4d9d287bcb1778dec64b4061891e06b50870e639bdf373a9cb0ccb1eb05664d2d3586edddde8375a5095b06af401c081b0cace49f343e2f

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
44KB

MD5
9c52a7028cc49e1d1ead3be78427938d

SHA1
38c546c79475b2dfe5c6907d4d358ca7cd103bb9

SHA256
3c1e9de814588cf046141cdd91b48d1e8421e09eff2cabeafc2fef11f9118b57

SHA512
f34774167382e4ea4f9faa999b270b5c4edef4f8bb34f10bdf15071e9e5c87dfa481a5ade6d7c3f38d154eb8fc6487462a6d7db77b382f2fe3b4cb90f1ce4beb

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
36KB

MD5
cc162dcaaf8477e5f4a3eb711e712e30

SHA1
601f9d3372589fb5e47a7c791205e10a58095e85

SHA256
7614715bd0ed689a0e16a375e48909c6951c2315086de05548f529d26985d76e

SHA512
0bab185971aa17b4c34b6a79f12a6034a6496b344572d085dc646a0daa0f9194eedf09a5725cd0ea53a5e3ff31f566689a6a7e49eedfe5eb06fb71a325e2e8a8

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
47KB

MD5
64fa05432bb733b38d757a0fbd21b165

SHA1
f3383d3d729726926238ff5ef9804d329d65a91f

SHA256
b5bca05870ebb9ef30694608c76cdc0cb1d9c431842a60dc0106fb2897ce7291

SHA512
7af3a452217fd240d42421a2fd9c6135dcd9a2565e2eff5a01820b16a2a0743eb8eaef345b4af408477204abf8cb56a27643715296d8e76babdbed52b8e107f7

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
53KB

MD5
4031de243147c95622b808924ca05e06

SHA1
f0cd318a1d82333e639cc3781e648f898b62cfb0

SHA256
ef1383b63335c4a2c3b3035b50174b074a8e42b401eccad0ca44ca549bb341c1

SHA512
b861501442a43d94f5359a3e7e9b3a0b57d379f34ce55e05655c51ac74d4ad1b2570bbcc92b7ffc1896f455b89e54b684211d8693417c5292eb845a156f65f41

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
37KB

MD5
db4b95b1e6627c4d664a733f3c021f47

SHA1
d256afd2a8fd5354594d8661bde148a576d9c484

SHA256
634ee4ed9ccb7a10291b79865689a49c683e2f75ed5d18121ea495cee2ef4072

SHA512
4d1e44da260ddacd414254882f28c54f6c028d077994b28d8a4bc3fd5d88b8d26fcc3e8f0e3e7dc28ca80d6d8d7ac63a313e9a8a22f98ec628ec594a60118070

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
48KB

MD5
9987a82684e0f9beed8ea51b18f43abe

SHA1
7830ea48c1a3f609b469879b6d8bb0d13fe5157a

SHA256
31538ac5aeb0e12523154bb01031560a759f6b3c4efe76f6586045ea258e3b33

SHA512
8be76cd2989d17e232e8b79b1bccc06f6173069276e2cf286584ae1abe03aa3ac1be62c19e1a22ad2856eea20a7a2c4ef4172c3496a71f8a84b6ed14fd20fc17

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
49KB

MD5
26245f0d77e5784d38bdf4c6fdd2f148

SHA1
778157dd76cb139f6f709c452677809c8e85e5d7

SHA256
ac2c7bb226b8228d9c910d5807f20ccfc4d524a8ba7a3af86ae1b1f7fa72f160

SHA512
df7d457726d85681d50786499ec5d6cf9495f9244aea5e04c834d4387a90873c8250d4d082de566d9711024e4f8764365bb8132f9d19d105869219269c11f8c2

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
43KB

MD5
eae4e5948cbef90660d12be78d7eb173

SHA1
8c19d081ec3f1adcec9470a96df940f0dc46b685

SHA256
283700be3832a9c89d47f01d96cefe0c0226c775ffd163ee0a573116b91a85c2

SHA512
368d19da560b8d38e196d7ccdac3c310716a1e1b37eefe2f8b4b42c4eabfaa45528d64e2b43cbdf57af02925f000f3bd398a5508dec2ec3358ef0e4c69c87483

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
49KB

MD5
fec0e03843a732aa06e3ea39679faf7c

SHA1
b22ae0f86c385f2b2e1f4df70806eb2b08bc302b

SHA256
08cbc15ae89a87abc3a6f1932a5a277efbcad599920732b213a2b41232ac8d91

SHA512
21ee72d463738a98e417a5f87cc6f66a662d54d1b052c456cdb08614ff93382e2045a6b6559157bc3c2014d228e386c869aba49cb242337fc8f43b30127dc024

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
45KB

MD5
accd11d7555f84e3971741061a355b80

SHA1
344c923efba564b1556a9b6bc0ab3ec5b4fcb08d

SHA256
54e900e69e27a348932b32ea1a032e16abbf77f58e4bcf41443ae89992bcbe45

SHA512
70a7e49c2743169cd867e47de0500968c832ba529ec287c51c560e2e3dcc21d2055c41ac7d3984b5c9a66fa4009d1ed5968a87dce6cde40fa0ef7175700507c4

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
41KB

MD5
c6ea0d45ce19fcbf17a0d2fd3c6e671c

SHA1
cf8debbb9fc073370e700bdae183796dcb211b1a

SHA256
d9a6745e2140f9743fe7ed290efeae333cce30068cded4be5ed7c4326a690736

SHA512
c3ec7808421e50622e5b4e8cd60416123a67347a4eecd7bb8c56029b3d8064b582a15ddaa8735c2addafb1f340093b4c54f7c79e3a16602de558553fb24f6cf3

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
45KB

MD5
3b0c7c6b982fbb5c0fb741f0cc72bc04

SHA1
3ad141b0e20b7939c5a8b71315c721a8e879cb64

SHA256
0bc16a3f086e35dfb2ed8a2a5159468bbb5e4bbfa26931226b9f814e29bcce9f

SHA512
6665dea2a4640f27eae97c27aac35dad4cd10df57ba3e679e7d2cfd75676eb60a5580ecf620618cc675630fcb01a7b74613cc87ecaf733f272e1cf26285e07b8

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
57KB

MD5
35f2ff838d968d150e9d6d75343413e6

SHA1
4e5d2451774f44a7c09f573743330d2e24a276ac

SHA256
b1607b807fce28c6a84a52ad889dc9df4aea9d694b8e1223a6caf8ccf3cb7818

SHA512
2df10904bc13e0b7e03585e262aaa331dcc2cf2b58b3ccbc00678d8950b7818b9038c1d540917c2ec69ab9f2c9ecc07f04d57e7119741511fd4dc0cda2f77d5f

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
58KB

MD5
9325d66df347be963e26b2547fdc4622

SHA1
538a1b86964960ac864c01b08f7e2bc6e238b4bc

SHA256
79ec6be31c3f6103fd2e8aa92e22a3cfc6ebe704c1ef795b2ef3e170aaefc213

SHA512
5c2e5fb8e889a1e9d43f9078a36db818191b76c2b1affda963b54d3261253541e7db7e1c29b4ca765e438d6ffeca5563f7e9ee005e92dca8a6e603539cec2aac

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
46KB

MD5
4caa09727220982e35d6a0e2bba9a210

SHA1
1982a59c7e04a405074e3bae3d288dcac846c46b

SHA256
8bc3690b170062c80f790b201c0038a906bd9a750a2f5d2733403375969c25ea

SHA512
4207d8e8237545dae5a52a2247ff8379b521e5f6deb0ab8e8ed3e1acece71c86330eec0015e0f106da5c2a7b8f1fa89ae6f8b67b362b5c215cacc4510ea55599

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
46KB

MD5
b6c9f16e0c43d8d34a06a36f6731752d

SHA1
2a073800f85ac433dd026ce095435bdf7fc938eb

SHA256
2f30fc52f035f94c5fd07b1e1bcc3964bd4365ce17fd23309c0c3e2e80b1d2d7

SHA512
886c12cb073db65f1e66ab4eebbf7ce76f0872b18d2103e8441f53c988d06e85f8234f76b7464a9e4e84e06824e1b3e0f250af53491dd9deb1722e271e3115d3

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
43KB

MD5
710dc90bb73a65bd93094ba9d2fc7999

SHA1
37cdc5a2354b97a1ab73c79ef4d86d08e280e06a

SHA256
c897a690ba98e991dbc0d8f435cc82c4cf580a67173b7712036e27decf0ddcb9

SHA512
62a9929f21df37eaed7ca4396d1c5b99be6fb7b0b7c137dd9771f86c96d5511ec109bbd009c3c2935b4d6ed857a832fbfeab99cd87b4bc17a7f2a6eb340b2b30

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
47KB

MD5
c6cb91e37ac368c395d93154e8f281c5

SHA1
2971347869ebcb6691442ba31ce01cbd4391c435

SHA256
18859152be9407653b94656f280ca3460fbcf4686a9ce1ba53fe49ffb1283ee2

SHA512
6bd675b704fca19e8b867b0a3f96fed77d728e5a86dd4cd7dfcf4e45761291eaa6ad0b51d7d49dfd1e3394289ac7dbff418f33693b1c27f00b22d37476d11ddb

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
46KB

MD5
79d1df564d75d5aa7a43db5b6bd32b14

SHA1
8688c25865d96c75b33e652eb2b2fe478193c6bf

SHA256
f764b0dfab8404c8dff21a515d0d4d574fd672ba45a3101ec03e442f98841572

SHA512
999a647fb3a9692bb19527d8bbc85f679e837a12c8598530ec4646521d816899856e6ee2d11b9f4c8f42dd79c30adacbd904fbb7e098c217a27c31b7c3c79700

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
47KB

MD5
820ce16b3130e5c6245fc6212b0a7a63

SHA1
51eb614b268bcad4b2bb2177dd637f57b780522c

SHA256
a7c2c620d8aee15667deada47fbd4d2029620e2e8efca26eb5a6d9e1df1db162

SHA512
cf31acf385a576931d805901b68b5d8d9113a211b1e1f56aefa87350b4653bcf15098e0553d33f9d85e948e22f4f1ba9a0aa03b7be1dc44b22bb061b668e1a37

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
47KB

MD5
67829420e14330b19b7d285cd830b72e

SHA1
c1c8048cc586b20c331a152a83a5285ea0902c3e

SHA256
0759bd82e2c3fe8930681f5daa501ba02b07695544c911cff645c4cd2dc96b17

SHA512
d7ddd31bb14d3afece30428ff59d78484d41f9c05468029c9725d2b04e8a3547555bddb0d13bfb1441330b5a97a81956a2befc3d71d4dfb152fbc93ad4221f16

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
45KB

MD5
1fc0a1bc67525b304a71bdba558194fe

SHA1
d7b0c84c6ee28f720c2f065c0309843400419ef4

SHA256
77f7ff5728440018fd0ebce3025d60c3c265fa2160a9ec408cce202060bb1888

SHA512
463b11cffc4849b1cab8ee5a2a61707caf3aec7ad7ee43e09fd42168eab741329752694aebee8d3688cd866cd6215397594dc76d6eadb5f088b23be1f95f77dc

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
52KB

MD5
3312fae5f9dae351c5504cb964aff440

SHA1
948c038b840b6127f98f220e00cd5f2910245bd9

SHA256
de8cd36c77fc04405662c6a95553f88e956abe0175a5b736506f616c6e0ec580

SHA512
ee469e6d1b8b1297922f8f8cdc01c42601ce4a19c464940a1fb377bda1f3a3102adb5ff78ff55c4560d74a3bf494683d4b2aa197b9677adcd0e9d4f836acc545

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
56KB

MD5
8a0514256214fe30f4ba39bb49b2cd29

SHA1
de40216201ca9aee5cd38f2b49a5a4025369f937

SHA256
81b9ab1218d229b7a6b870b5e10b4cc53d17df1ef846948dcb129e470f8a4e67

SHA512
b1c28659e7d82c817cd8978399113296fd1484f25dd0ae8a8c1dec1bd8ccda113dca2ffffed639ec592271b395b42b7124723b1eb4fe55086deb0dd7a51bccb9

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
54KB

MD5
1de226075b998d0c6369cca757b05270

SHA1
98f9b13d54bcd8e458d873527e04bb9517863a56

SHA256
2be4539f00dfea6383717b7ecaa5ece371c01282f0588b7b4e27768ae6ff4ce2

SHA512
288b7c4a6b256335ebb40e89056be00946492b6e45fff52ebf50934bece87927bdc8dd05770a546fb51adb66d234c0b238d955c201f1e32ce5634aec5690903b

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
45KB

MD5
a3489faa8bc5b6b3873d85d2a5c63516

SHA1
47b18f4ae5c938252d6060860568f31ad507df8c

SHA256
8780170938ab356ea0be1b71550b5a84214dbe63efc1ead4f59284bd62789d29

SHA512
a40586df3b485008a73972056f25b4021cac38c1b8fb5cfdd6a18e29dc664a1a2e5516c00b5a15c2a3871b0b8b00eb225db97f3fb7298c128dc6fe8a6fd6f7f8

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
44KB

MD5
87f709aacbd218eeea9a71e554c0c5e7

SHA1
012a7c41d81acb1c15c3092ba14c0fb1df3e17d6

SHA256
b7df9db370a7188f9bbdd6d63208c82cacc3efb87d8ebfd14fdaabe1531fd20d

SHA512
7698c8d09512832866acb46778ad182e012d48a542246158bc014fadff0825dc822b498447ed235c58aa45d53632415a0f506694e3b8f262966c0feb46c63bae

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
37KB

MD5
bb7d096ab2188f6ad0e4b59f32618ef1

SHA1
38ea6aaabebd30fa5fe5b331fb6ac5d7a577fb45

SHA256
68870ac8dac0b8bce85d14447766c20115bbb78e3de99e8157f03e57ee7746c0

SHA512
de308f52aa3cfeaa429df78d268f8a85f05b5e6fa525e8ab923beecb9a32780b2c6108b40915ced6b6650a3a7f2258da95cfb9265e38a860fe4b9165b0919e3f

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp

Filesize
45KB

MD5
a6f2cb219ccaf0d8b8b0add249f40610

SHA1
9c2cb39281a05bada861569973fe073b56e020e8

SHA256
e5064a70b92c1330b41b22247bf5d916b40c2059b8ebdaaf3bfa93cd86eb2a22

SHA512
ea12b0cad4bc34cb2da20017f377d0aff1d2de5f175c791bf9de79caf50f8ffafbb4842329bc9db5742f96b0649c82577f70d467a42d3cbcb94224ac12ec5d13

Download Submit
C:\Users\Admin\AppData\Local\Temp\_7-Zip Help.lnk.exe

Filesize
37KB

MD5
f6695355f89a650c173fb0d4e85ddeff

SHA1
5114c7be5d5d5621ddd3656d58610b56155ec4b3

SHA256
3767cf248986ccfa8e3f4e28f1df258bc5e2e07cfcd12324d2a7287433657be3

SHA512
c5943043030f7e71acbae36fd4dad10a0bdfe42024074957e8df9aa5c0106eb81376a6a3181329cd527775c1fda4d8b4e519657d789f54a8b1b9146414e89271

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
35KB

MD5
bd85ec1e35cb6a1898560037a5e862ef

SHA1
8b61409c8f4bf72cdff6fb7e43e976898f244152

SHA256
7fd465a91da8463e1630883aafaa541e28ad05a837ccdec522c20975ec849394

SHA512
48869d9211e1abc9e12ee7ec797c6a2914d4e1baa25c19f54b9dd45e9c390ee7e1e04874575267186da4e26f1ea77f0089f753e894d1ca468ecb35dbb00893b2

Download Submit