c6c47561e1c26cc6c64ce30f863a88057863642d2910e1f98d22ca1f0f513ecc

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4317935a49d5e4b32792904680b7edd0N.exe
Size

199KB
MD5

4317935a49d5e4b32792904680b7edd0
SHA1

87f0bbcb1d6847a51264494037dda49b59862139
SHA256

c6c47561e1c26cc6c64ce30f863a88057863642d2910e1f98d22ca1f0f513ecc
SHA512

d86a28294df0469f969f776331ab35f0c0e57d8463eff71fa09e7fba8b6dc3724d94d07c9c1653aac15cf934d9b1dc431b413b4560ed4010ce94df94e864e24f
SSDEEP

3072:6DWpwE7oL2e+efZwZ08i8z3MLJDWpwE7oL2e+efZwZ08i8z3MLe:dN/e+efimJa3MLQN/e+efimJa3MLe

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4541) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
456	_Character Map.lnk.exe
4616	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	4317935a49d5e4b32792904680b7edd0N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	4317935a49d5e4b32792904680b7edd0N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	_Character Map.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp	_Character Map.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql70.xsl.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	_Character Map.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	_Character Map.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	_Character Map.lnk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp	_Character Map.lnk.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	_Character Map.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp	_Character Map.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp	_Character Map.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp	_Character Map.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\hostpolicy.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	_Character Map.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp	_Character Map.lnk.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp	_Character Map.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	_Character Map.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp	_Character Map.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp	_Character Map.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	_Character Map.lnk.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp	_Character Map.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	_Character Map.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp	_Character Map.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp	_Character Map.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	_Character Map.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	_Character Map.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.tmp	_Character Map.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp	_Character Map.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp	_Character Map.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	_Character Map.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp	_Character Map.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms.tmp	_Character Map.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.tmp	_Character Map.lnk.exe
File opened for modification	C:\Program Files\DisconnectLock.cab.tmp	_Character Map.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp	_Character Map.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp	_Character Map.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4317935a49d5e4b32792904680b7edd0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_Character Map.lnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 456	1460	4317935a49d5e4b32792904680b7edd0N.exe	83
PID 1460 wrote to memory of 456	1460	4317935a49d5e4b32792904680b7edd0N.exe	83
PID 1460 wrote to memory of 456	1460	4317935a49d5e4b32792904680b7edd0N.exe	83
PID 1460 wrote to memory of 4616	1460	4317935a49d5e4b32792904680b7edd0N.exe	84
PID 1460 wrote to memory of 4616	1460	4317935a49d5e4b32792904680b7edd0N.exe	84
PID 1460 wrote to memory of 4616	1460	4317935a49d5e4b32792904680b7edd0N.exe	84

C:\Users\Admin\AppData\Local\Temp\4317935a49d5e4b32792904680b7edd0N.exe
"C:\Users\Admin\AppData\Local\Temp\4317935a49d5e4b32792904680b7edd0N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Users\Admin\AppData\Local\Temp\_Character Map.lnk.exe
  "_Character Map.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:456
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
100KB

MD5
c98a490fe63054a45ee10d78f62281d8

SHA1
e89f0f1cabcfd816d57abcc3632a3240e38d24c5

SHA256
fcbf318fbb9594327cd690c07059ab85d187b79f845452d54c3ffeabd1b81fbf

SHA512
08690e1c0d338a299b966697bd5b9654dcd5734f1129372cb3e25128fe711b8506ef427b5875cdb3d3b606369eeed4bd66f72fc18813badf9c8dcd7b2f22df05

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
213KB

MD5
9817768ca1ed37faab4e2310b375b8e1

SHA1
e2a7efef598e2bed77ce7ac8f794abf0dbf8b0e0

SHA256
960146082737860d4d356191fdb06faa5b31657618ceeab4b366399d8e4ac751

SHA512
ca2101cb89bfbf7609ae7be8b017cb05fb6eb1fd8617c299198a30805dadc23e1df06b5e04f59402f94d11fcd1d5e9d80b071636b4b901124c7abfa074a68053

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
165KB

MD5
6360378166aa2eeb5a328d65f09e6534

SHA1
44219e88c1e73bb83a697e8356b09a6e85eed431

SHA256
08b32609698ca9d5b2a024b2f94f9f3cff3952fd5a7e7922f5e7584af7795785

SHA512
8badfda8c1749a9c8c7a0e3b9c2ad3e83e955184e9dc1493e6b0eefed1edc631029a061c8e7f9d359271e8171782af9113e4b2d423de33346535814414eb4792

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
2bf4e1f54dc87b737079a569fe4027fe

SHA1
41d7085749619f24aa0d9366e8bb1991c7a043e7

SHA256
99b71d979ab00e8a1deed31f33dad3f0e1a82c2c79b472352c670be4e3650a18

SHA512
2b46ba7acdd0c193526c53fecb00dd0ac56b4eeb82290ab4fa0e7fd91b57582605f58b3c2355e8cdd6910695d4b0c4cc7e1ccfd3830b9c9ba688a75ddc190600

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
644KB

MD5
c0eaebd6e9c03edb6de34122b281529d

SHA1
88fcb71351764a98c5a86df2b11db53e562bf51b

SHA256
fb6b54a56dbadce1ceec3cfc7e8fea67e032b0b2a87e9d121b4f7c6566eba74f

SHA512
e43cd45c047efc9bf4868a164609f3a685392d06388615ce6e08186c23cea558c4e815f384f86e174f329a44ef4d20e939e1527d683372dcb1015a8f30b501c6

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
784KB

MD5
66fffec561e265458b30fc6382073be7

SHA1
2c94ae58ee57f867050db2c881af25d51daf22bc

SHA256
ddc6f9e8df218a4917a96b47994f799b6b35e46938a5bb0aef03d8b7daad6edf

SHA512
068c7aa34b7c9b4b708a7167b0943d54658ec93bf21035b29e41be57f5742e320f6a1d1a41e95ad1f9a699b940517124f6aaa36618a3797423673540546834ca

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
110KB

MD5
ada1d9b6df05e6edadd884bc9a54846a

SHA1
5a684d8a362f81775c1c7240abb5c0b9fc01d190

SHA256
6e3b6de431490e0abbed75ffe1efffd77bf352b49e2e550154cd642f8cf00cc9

SHA512
7954bb01299dce5a0bb6a346c2af884ed69cb358cd59989668fad1a5135baa18842a9e7ee0b3382caf1a01f2454da25fb91b68c1fbe6a2b17599c170013ba710

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
106KB

MD5
58fd3fdd5d500ad5463b1c577de498cb

SHA1
a2952f868e18b9ed42d934fd55b686962bee839a

SHA256
c9bc57a196a619edb7acc0f3484fc65bbdf60829a607a9eb8c8592b6a1b09c22

SHA512
fbbb1e95e1ebbe83716df1cbea5eeaba6e48c9ec1de78007cdb087987d70a09220e2d35f096c1b7156f32f9b3fa9a9e10cc9ec4f692e2bb6ad090272ebe153a9

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
110KB

MD5
ac7a4b92594342bc48a4c653a586d86f

SHA1
d1667f07f155d9719422ef47f10cc2bcff1bcdb3

SHA256
6d91689d2bdcef95cdc44b19c96bd6a5d8d5f171654a968b66f05b58f2304941

SHA512
15b3307fa524d382518a3303b5bcb09b12c01b749383327650c7c90977c1ace110887abe8424d9535da31b87d49323079e3da72c2e49a9e931ac65dcb743ddac

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
113KB

MD5
dc00fa9859f8dd7c0f0bbb3328dc82ee

SHA1
689193c37ff62c4b7247941234027c0b475d8257

SHA256
6ae4f6fafc9ba5c8af60ab8f2adaebaf941130d0bbb7d5d9beac3a5b483825b7

SHA512
fbb9dd3fbdf3e5de8db8230d61d438fd4d4704c7f0671a2431647e16ac799fc7a54ab777f2aeac1e222aa5497b3f0ad5beb5948799ae448946973be214f81020

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
109KB

MD5
2eab1f032947e88a816dae69c7cf7d5c

SHA1
eb265901e6f8c3dac9bbf8f9f7697d51f7ba47b0

SHA256
8fd16e6106c78a143ccd0deb059436317a9614664423e22933040624d454f3fc

SHA512
a21dbdcd8890d5ec6d90f8845159e3bb61e7a732c0275da5748fa9076fa1d2068b4a7b03ebe762b6dd4970e4806b25c9a2a02bbc878cc5e020ca37b6a6c7ba95

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
96KB

MD5
682d2ecb363b30eab9fa52aaefc56181

SHA1
f7ec72f1a757e61fce277538fe00727d487179df

SHA256
723d804479d9dcae9a1007c6c1c704094e23436d51eb017bd39d8d8255fd7c04

SHA512
e318c409ae63d7000408d36787dd99a7c5bc5a45b1611ebc9a4e09343d153ecbd2ad92ac34824a45856012493da19c932a36532dac4d969e81ffa80f1c7fbbe0

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
106KB

MD5
e25dcd520904bf7ed5da85102fad834a

SHA1
533053e360924379abae83a79f35edc42328326c

SHA256
5a3fedf81b12a4594001b73d67d50f5bcb2b7c3510c746fa31079a08c57012a6

SHA512
691e355799d2c758c8e42159896628ea1fa4c8506c214f252720e133ab90d3d280bace3cf092690b710faf734974fc5f63d6bf4b11b5281188341d2b8523ce1a

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
110KB

MD5
4a4f0f8e368279d2efe30d378799ea2d

SHA1
c8d09b98e5292cd24154375f78b02018e58db2eb

SHA256
aeb35b044360ef4543a07c6dba4b23cfa2749e0d1f3f9030ee7a4036d58a7830

SHA512
1048ba206cb27aec598650d80e2c1aa71c672319e11ea3d5fe76746bc2a690c853a733bea5b7a75436bb160583f8de72db385021f932cb61fbd91aa07aceb934

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
117KB

MD5
ce5365ad446073f8b964b453f072f8f7

SHA1
ecd4cc397affebb0e463fee02ad34a08582f81ad

SHA256
3f9ae3dd41b5c8a44d1cb2615b656bc2688d2226a4c99f172adec8ec1ee9409b

SHA512
be70053deb05c78bad68c2ca2a480fa54b462192bbaa0fe2bd2e64e83219dd9d633fb76a5301db7d902dd38560b8b0b49c470b2f7e09cb4bb23b975a5ac1975a

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
106KB

MD5
b55f37fa9e10951f472a003e389fa8f2

SHA1
79ad580d3313d6457fd0b6db397b556f3206519e

SHA256
4d342abb1b469b0c71eff836611137d3b23bf363d0c4662c0ad7933e2761e909

SHA512
b15f6db12e84be247f526c20faba0f53e12c96bf513897f84557cd78408d4687eeeda74582d142bfe9e708fe9599a39f6b21858c97f084d04243ff032026730a

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
108KB

MD5
83c3a707cfb06fd89acb2e0100fec23f

SHA1
3367abeeb3ff0c22079b328f134f1ef10579183c

SHA256
11dee2c51e01c622fbd4116a5daa51dcc32df8008f94c2b074acf06b3243c128

SHA512
71d8ce2bd468bfd4dbd3214b0949079cd9f30eac231feea79294a6ea8f61c2866c3f3161d0904c18698d32c1b842045e3aa858fa6e67292cb7c4d173fd581b73

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
105KB

MD5
96c97f8e87734e10da2f4269cbe8b3b7

SHA1
be678f4eac56bfad76f3d69da5199f4df3c73df0

SHA256
349277262501512c1751d535d5f9e151faa30ce63733be677b34a1074792cc0c

SHA512
96f0a172ad4677d0ee79d08167c6ba4a82fea966b2e59946d3274c417775dbe86956d060f7d79252ac36dc4d95db6d0ba05f42296f247e7ab8e6cc0cf2df6f3f

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
109KB

MD5
2919acadf52d86f25cc767d743d26afe

SHA1
ca13c873a7b64200c2877796e76e7dc0b5b6eb04

SHA256
6dd7ccda76b065df821ac64a80ee8f606ceebd37d84dbe7c2a317ed4bd760f1c

SHA512
9928bec57b02bb0660c7b4f96a63f7bc81f0511ef3456afa9d2f944583545852fce14536577cc1042db46fd2f3c217ae751134260d4471bba049822350451d73

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
108KB

MD5
668e247ae5d3e4024ce1896c378cf44e

SHA1
20bac2fe6abd900e5d678232918b9407ffdb00ad

SHA256
2fffacc119baab073b613eba8e78ddd42228240e02aeeb0010f9642c775e9448

SHA512
51d85ed6ab753bad0c5dfee207fcea52ebb4204f86193355b1b91295326ee15e938d3286aae93323f83acbf584d93a434dad133e6b1c350508134537a6bad077

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
114KB

MD5
41a980b198335005c1c9dc0fef768f49

SHA1
ae9ffa329a267822edddd71d7fb549b826745bdb

SHA256
695f1a3b95f304f20e22ec769d6846a2b1943514e7f24e075fbd3bc41e661f25

SHA512
ae156ca3667a5639bc74b084605326627d5468bfb9e916e5fe3b16f1f9a8c4a860807b882e3bef8a948a845f8e74ab667292a9d0168a4e7bbf6c5a6c6bbc5d49

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
110KB

MD5
cd0246daec3dbea0ca1573d01cc7326c

SHA1
ac77b0d41378cb7d46589a7a7ab84af8ea6b2329

SHA256
45301a5ad990578ad27ad9f25117cd3be073973794af194ced3a209d978c74ef

SHA512
6bbae0167547b7b9c76cf9a1adbc2597f43596167f67426d7f30dfe8ca9c8b97fc23408cd4a3d068ae08713ad1263d2d5f329644ed7577541f37e4dd963d16ca

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
106KB

MD5
462b53e1e7331a5f2dc7c235d6422631

SHA1
32c05fb9a4f3e7dc779e2585a0e8f0b8b8ec587a

SHA256
ce2bdd3b39dc91b17899b089f9cac06705698522a3f718668c7d94dc9ae57809

SHA512
cb7ef6ab0d2049501b86538c6aad8f268c17518a693cb60f994503e5e65e32b35801dacaa8629567ed864b0ea5fa19ac6103ccdfe17bf96267f68e92622ea1f4

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
108KB

MD5
4af2cbbfee6b0facc3df6bdcfb0491ba

SHA1
088f71ce89430a803ad0a59202494e45ac47d316

SHA256
ca6390added3cf3b78ba046ab52fc0ca97d0d6b363c5052988d337d8e7b198b0

SHA512
7fb22226be509fc2ebb615d4e024e4e44aaf48210a653b9e3be68dc68f133357f29e53e19daf1a2feee7df9676b43517f340883447d49ae77c80e629e9a395af

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
107KB

MD5
f6014bdf9808ab8a67acbbe727a4d0f3

SHA1
415aa3a2dc6c67e6739f086ed1d514e37780b2e4

SHA256
9e0a9668f5a73c7ba6a587f161bf3483a1db51337433e7db6dc02238c9587a4d

SHA512
2f77fbca867c7edac0c515ed02fb4d1f68cf7707bda62b04759a49716f65ac0e34f66fa7eb3f5c3259693791f57cc92a8f0901e670722b91a78f0631ca187857

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
115KB

MD5
10845cb8b130c1f8acdd2793ef5d9efa

SHA1
abf34b7fe44486e6a9f997f4fd45c9c83abc782e

SHA256
587f7dd0d497d7c0475bf13ad70e171b4501a72d4f56ccff50c8f6bbcc39e65d

SHA512
45a951b73f2a18b00cb2160ae5ebf4ec2ffc7bcf84f9586180d05064463c58d230f898129465fe5ed38f744ab4894a2c1935362284924b58481993e0754bddbe

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
109KB

MD5
0072fea43d2f37779385349284c6a982

SHA1
ec26488cb859ff02c6f2c05406f7e308cefe9383

SHA256
f130e7636410f23a3b037fa9b851c9b17e6563710f4962c65436b9351a9a937c

SHA512
51549b4434e427935f71ad4a1651664d457f68d8307145f91b386632fece0c2063897ced0fd32279f1cd9b8450f54d28b287ed577daac76aaf9f83eb5e304da2

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
112KB

MD5
4d127ee79a208585372e3cabb203094c

SHA1
8b124ac67060fa33d2857c4bf06e12ceda6c2775

SHA256
38a997bdcbc7390db9fb07fb0540dab4396604e1584bcd3b35f9846c564aeb19

SHA512
4cad7c72d00841080e80222b743df7d8966e8fde4637f3f4f3ea595ef4708d91f71dcdd5bc41c65ab7182cf71a4aee87312b26440c1254ed56e57d16ccc84c4e

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
106KB

MD5
f895a0ab26fd9afb22d27721ce1dc93f

SHA1
8d88c0e04d2ddb5ca2080c957ce1d3299791b181

SHA256
825edb87f7b972fc17f33e794460d57fc1f4333ccfe45c93a04fd702177f4861

SHA512
23ee15477e617fe6fcf80cdc67b0f06ce83daf4921e3ea38ce65054d39a6333f7b60f5cee6f5670464101cdb943f1d357dd494cc7acbd84d4d8c991149a46328

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
110KB

MD5
e4289a7e037e12fbb0b4933610e535b3

SHA1
d9101df8e4d9bf8c2474892d58792ad1e0d0e4a2

SHA256
0b1530b99ce2dc0177618f7a7b6055ca6b198cc2769ea96f325dd6d6ef63bf55

SHA512
dfe2ef5a3314ec5ca8c58924eb1e16f062e396074d8d9eac9911b99d06a83f9b9f6faae2357e7711173be3fd71b475e303f1216c209437323363cbafcf2dc9fe

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
112KB

MD5
eec1bd9c3acde08445c2f4a785aeab7e

SHA1
cabba282a726c129589f18f03d95e0340d4bedca

SHA256
3630476c20984fe5ef58c351b713beec2a70c4b3fbae25ef0a78ad975dc76c4b

SHA512
fb843f93d077c71511c3c69dba9adb85d67bad24967a2bd64364779872d19ffb22af8570448a7fd599808f0a4eebbe6907e2f745e6dc06c053447fffab78099a

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
108KB

MD5
a360fc9f278c2dae3e8ccca7ac4526c5

SHA1
635798869354f6d948c5977242253542b93b3f4f

SHA256
b657ff44a5633a5095e5cf1d11487a2634bafcc10ceacadff6c2a959dd23a710

SHA512
50911c9bf8942ac3a6e6bd76deb4bc5babf55cb65f3835fed98e0360f84e07623083778bcf0e23769b8b1588443b83cbd312d68a1827e7cca3246f7f06849f95

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
32KB

MD5
5ad8f50ccfb53f57792dc84cbed91f8e

SHA1
3887498966e7c707559c96126b1813b8befdbc81

SHA256
dcfeb9b4814dd469960b6024e91182bbaba292cdff2f304b9829e90d930aab6a

SHA512
97205ecbb22f2b5502361e35bb26a385adfafa52859abdfc5f97a5ab18d315aa9d63daea925e59a85370718c8acdd0dd9450e05d57dd37aceab3d6bbf436b386

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
106KB

MD5
718d16649d2c0e996e52e639266427d1

SHA1
31cd5668da049bd71d8f6090279b3593ec0c74ae

SHA256
016e3e6f746a72d52c5f2cfa6b9dcf80bf5731f4eccc39cd76d8ea486283fccb

SHA512
3327d230094dba8eac5684ba599d2b856016c2b82b29ab1e0b65c73db933c80c8b63723ab1dedd48ebe2803c042d1c599f5eeb815b7f64f3b4eba18e99a0975a

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
112KB

MD5
dcde3d3ba41391b17760606f691030f0

SHA1
b152aafb3f8b58f942117e85e8d0553cb17a85e5

SHA256
1f30e03f3f8a27ad7fbaf7472410cd91cfc7cafed767711c04a0dba2032bfd5a

SHA512
6905403b53e85763156e5ae68ea21678b4b8a56cae2db6e1c82b6abc535bd104cf02cd888167b87e2e8436d2e74f287c6fb029e00510fdd66910feff6546e731

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
106KB

MD5
0e6f7385340753518bb88641437387c6

SHA1
66f02b5db2a58b38ef296691fc80499c89ff2970

SHA256
fd4f152136daa26fadec152b213730972a11886c34bbb8ce779b4345b5ba992a

SHA512
e8f1e2081b73e7cf1610659c710eab7f256f9c0ddda11ea8f7dbcdf4d9413d8d0a5e268543675a2243176b73355e1f46e59c8facc2558c8c717c707d50a591b6

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
109KB

MD5
e1311b43d1cc93b4e808b1b855725d32

SHA1
150334e40e2ea22dc3b47c8aa92d6b35987e4bb0

SHA256
69b347bc496b2a5ba96e9d1f07472cbff979e66ef79cb434759ccace21ebd257

SHA512
bb12e22950e4509ee2734b93dc6a633a0bc91196f4edee6631058b587fe3bf223fde29edb871b86e7b06390884d29e462416bda9327d74c882e71776caa1246d

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
109KB

MD5
453d22f832d3dc8580324c8d9c1d375e

SHA1
0e1d5db4bcff237c8c7eaa62f6fc636717f464ca

SHA256
9d8a2a95bfd5b3df2ef2680cdd9668f78f837db9efc57f9416924a99da09d30b

SHA512
afa8047be7bcb77b82878925c0ae56869413a852c88294c1486b51f447b3a713196b3212cd7063e8eee5f290d496f7a2434cb155a22f7ba978eb3686339d6e60

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
105KB

MD5
d249655861af52a216d833ccf0ad8f0e

SHA1
979ac3c408416e6d6e1ac8c019b513ab34f8d90c

SHA256
c34d8437a61b091e790d8e1e7cc1535059d7dd361ca17cdb8a60e4451c8bf20f

SHA512
28541816a04604d592ff069b2a61fff7c0e509bd2831a17a45892f265e95059d71101d244b8f6c5c7569d4362cd1add57c87a9e2aee6585f83bc918b87c43460

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
109KB

MD5
3374145dee296ca0e767036bd27df577

SHA1
38dc56790e6daa97efcda48dfb99e060b6a6bc4e

SHA256
d1b50784b15ff9d910e71c9d08246b47f3a5a3849730690da3109d0f20fe1a79

SHA512
173d4589312e1b8818e5876b61b03ab6811c1a8b61ec65df7723e75b8a075aac5fd09ca7c865afea56e0c191cfcebf46321d53be6a81d8677da1e3fcf1708bb5

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
120KB

MD5
857d95869fcdfa11527a6a106ed1c7f1

SHA1
bccd8958df488a82c9745878a4fcc149fe84cdcc

SHA256
103b4be113bfa639738c9c451cd79becd82cbb4b8b8a4310bf1335935cc5ec48

SHA512
9210ca0295e9bd788a7ba229c4f78460e3add5b14461151fc0f8ba721f5f2181f4c8c7400b6e0363f793ab1021c615c62161c9360746f63b30d1eba9ef493db5

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
121KB

MD5
6998a86a072d96755d66c00138051ec3

SHA1
8ebd6fd994f8b2abce57db3a1dbc5a345a615db9

SHA256
eb7211c628836a55487fd96bf50166916917fdfd682c09da96081facff6dbc0d

SHA512
c9a7b30d52e1fa4d13c5c81a67efdfd8ba223af6289d58731c32fb2fa8289f3f7332e6f6bc12d87c16f983ab7e70ba24dd82221ff1ba30bb59df0100a9dc4eb7

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
108KB

MD5
73ae7ffc4441f16a18e29f40b7212518

SHA1
a1ab6ac66c1a1652d98e2e28eddcb98ee98cffae

SHA256
e2b6e121b88db72ac65660c617d9f3829a74ec62bbd343bd364838922917528f

SHA512
2138fbd17724669ef1beb3ed13cbd38ad88db0cbdf35851aba29dd44f776c5ab46e3e6490da16fa4544b7e3218ecc1bd36d5e7ee7afd43b3a908eca7cd83afa1

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
100KB

MD5
d5375101f434dd97bad3ad5494bfa0bf

SHA1
c117cc31a2f2742f890f9cb85d130dd920d47f7f

SHA256
0321f866a73b26b0ad203daa2aaddf1a35b071a31375ad86da717ee1c83884f3

SHA512
7cfef52a3b6543320a0f5461a2c51db062773bd93e1fcbc5d55cad3dc311c562480d95f2215527d31d1cf6dce25a53a078e9ee593f685349c52e2f361e95fcd1

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
106KB

MD5
08c70fdcd26a4165ed54bc1eaea8a598

SHA1
3109bfd7a01268dc49550654793e06be920a38cd

SHA256
e11dbe9b1ad00f1026c0091137fca846938134cf98592a7ae66ba3d7d3415317

SHA512
144368d238ff226bb2f6c70f5867bc4c5430d01e8c0902c874fec4e2ba482e9e3bc1afb5d7f174eff843029e93304875ca05428e23fe828ea524750371355c37

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
113KB

MD5
a565e387767068378412247e132cd418

SHA1
d23accdfaa0421787d5ee4d50e2801b7319598d9

SHA256
3f0ec319c8a7e2ecc1e7ea3f1534fbcfbd50223f6e3d7af8a826834bbf826761

SHA512
16b0acda03480abd17d530966610018ee808e1b887d188f08fb742ce8b1192be2aefe2d22d96788249a437e6c9bd6e8112109426a0064707d13ab80f0c5b719f

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
115KB

MD5
fe768d58f216be5193a85152cc4d5cf2

SHA1
a0194ec21cc7c77f8dd1b40b3ccd74aec16109b7

SHA256
7a07b13273ecc07bb296d4ddf1568cbe8293a41dfe4690b7cc0638870cf6763d

SHA512
420168a6bb172d611a7af93b199d9826af598b0d9f34ea66407226a8ceda384dbfbc0803e1b1340ae6fc6b1e3bfde595892bb6f975e7de0cb0ab7039b5de8f63

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
110KB

MD5
f2ad241807509a74cd96d2438af441f0

SHA1
0fa2ddea06fdeca67c21c9d50f2964d1d0f856cd

SHA256
52f58d20e2c886e3c79032f510f28bc8de994259cd9e15eb5bcc54defe204a76

SHA512
7b24d17401be52a8167b2946e0ec7244f0d0ff3413c43d265b7bc4dba417eb8a1921265a8a465006f793f3e66bebeee2abf887e946e7120a5c56cd5639bc2937

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
109KB

MD5
99337636031d5878a61a0faf1086963d

SHA1
bb8746cdecea6c08a2aedf7ce757ac7fb67bfdb0

SHA256
ccdc4e7623237390f772de5ed7f0909357b775b3d0429f41d196a343a575ebf9

SHA512
8967104ee39f75ac0162fa8e809732c918fc6bcca546040790bde1d1c06ecf9d4a68ecd04e83ff0f250e047a922cde6f1ca371f77fc9d1bb4b1e95c0a7431d80

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
110KB

MD5
99c7cb68aa717fac9e2c898be2c42e08

SHA1
6340d2d5cdf3e94bd73d70c6627e992b0df145f4

SHA256
ab91e9a3a1832035c473bebdf3e6333a8836d6c9ba91fbbb3158cf187394e45a

SHA512
257f98ddb993e53ed03d6d8a1b3b1faff68cd0d1ace396eaa432ac61354854c57508c586308a4519c18505d664c95192df8e0bea9616b65516d22e5b59df9b71

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
110KB

MD5
250d41de7fe97ba4d268983dc3adee0b

SHA1
bf60e622a8eca7d3d6428e12687785dadf540f9c

SHA256
90589148f2b45edb6593b8ccc8479909a15d082abc5c99cbc027cb5c242c534a

SHA512
1cf81cc3f88ae3b7e388e675644cebe02e24c6b79c63337d69f769bb07fcd9d8c03590bb067c75e6bfe693d705d7c3a48b345949550166ae3d946f5c85675eef

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
108KB

MD5
8fcdb65d3e8d6edf945e86cbc37f62ef

SHA1
d77eedc59cd3183e548dde8e2df09f9d9e9320a1

SHA256
2e8714fa3c451af0ba1256457a2b2cc13f5802f0ba3e0a96429cf7a9bd9331ec

SHA512
4a3a9ad7ec8576a5b8276ab3c1f1ebee832dcd72e063358006bc39a4c4bafc5a4c67bebd4c894807e9b9dfbd33283d320485f7836c0294fa40e3ea79c93c0dfb

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
115KB

MD5
3c49f8fcdb28d3b836ada94f28ec4bdf

SHA1
b2a29e6873aa91fe501bef898d543754439b686e

SHA256
7fa64b0cd81866129721c253c0a1ee1d27b3204e6189011c1594c8c35870f6d8

SHA512
8d2bed19a8613b8f0c0b616ba3551ee05e8305df9bb40ca4eedb790449101da0fef38022a5e8f7dbd1baead4c46f327c43558bc9b5f6b2a472be6aefafb08bca

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp

Filesize
113KB

MD5
3e6d74de384880b0abf339214cba6540

SHA1
48b5c56666c1d59cadc1f298f27353a53b6453cd

SHA256
cd665ce007c4194d6511e0d320c493742badc1c50f7bb410bc41c5ec72e7750b

SHA512
4e778d453261b5e3632d74693c3518a3ba4ebde8c7611ffb9c48e73c4e270f20391e7037a7f29376b96679cd6eaf8f8937cb5462fe43e8a497d2b06a41b9e211

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Character Map.lnk.exe

Filesize
100KB

MD5
9b05fc4fa5b7721f97681956d7810e48

SHA1
6a11f74d725d49399510739d22e1327ae76a0e7f

SHA256
bd3701004d1732c263300df7881288d66f98bf9ff6382bba0fdfd4139332d09a

SHA512
476fe82e2afc4704cad573d1357ec79aeaa4b16145a9b7927bb9b4786dd0abcb80e96d8133dbf6e583e8c4086755f3e161f847b11939bb2e2cf5d90193e60885

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
98KB

MD5
5b246a3ecf7ae62d19b2fd8af681751b

SHA1
4203af47e7536298b71891816d99bc62aed86be9

SHA256
d626062b36f1c730c91b1296505c3310ab8c48c0ff02dd5e25ada0dbe78e86d7

SHA512
d57fe885474d906f499fb2f5e3f06eb8aa66c4fca65d8242d2dfb8d0d81bba25362776696c424c73e03ffef4063a5d2616ebb7c404e21fe5abd884ff471024e6

Download Submit