a1c92afc39fc1248eecaee7ee1d51720c40e13ad6495e249e640f99435724750

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f53920e3c87faa4383f48b2c5630db0N.exe
Size

86KB
MD5

7f53920e3c87faa4383f48b2c5630db0
SHA1

de1cefbca076b9527d5225fb1482f0ff614a21a5
SHA256

a1c92afc39fc1248eecaee7ee1d51720c40e13ad6495e249e640f99435724750
SHA512

d976dfac340292c8fdc8f6cf8eb9c3d1fbc874dc865310602707d8b716e3535f8b80fa293ac8b650b5e512879f51a8a729db87add52356da9366c2a9c47515f0
SSDEEP

768:W7BlpppARFbhbt7Y7wTCnBJ7BlpppARFbhbt7Y7wTCnBm:W7ZppApk7ZppApd

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4805) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1648	Zombie.exe
964	_Get-WebContent.ps1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	7f53920e3c87faa4383f48b2c5630db0N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	7f53920e3c87faa4383f48b2c5630db0N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	_Get-WebContent.ps1.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp	_Get-WebContent.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\resources.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp	_Get-WebContent.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	_Get-WebContent.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp	_Get-WebContent.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	_Get-WebContent.ps1.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar.tmp	_Get-WebContent.ps1.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	_Get-WebContent.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sr.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f53920e3c87faa4383f48b2c5630db0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_Get-WebContent.ps1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 964	3592	7f53920e3c87faa4383f48b2c5630db0N.exe	84
PID 3592 wrote to memory of 964	3592	7f53920e3c87faa4383f48b2c5630db0N.exe	84
PID 3592 wrote to memory of 964	3592	7f53920e3c87faa4383f48b2c5630db0N.exe	84
PID 3592 wrote to memory of 1648	3592	7f53920e3c87faa4383f48b2c5630db0N.exe	83
PID 3592 wrote to memory of 1648	3592	7f53920e3c87faa4383f48b2c5630db0N.exe	83
PID 3592 wrote to memory of 1648	3592	7f53920e3c87faa4383f48b2c5630db0N.exe	83

C:\Users\Admin\AppData\Local\Temp\7f53920e3c87faa4383f48b2c5630db0N.exe
"C:\Users\Admin\AppData\Local\Temp\7f53920e3c87faa4383f48b2c5630db0N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1648
- C:\Users\Admin\AppData\Local\Temp\_Get-WebContent.ps1.exe
  "_Get-WebContent.ps1.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.exe.tmp

Filesize
87KB

MD5
0d879543d7522190eabe03a5befb7521

SHA1
1edd0f3cb8a5cd2d91da62c744e64c75f746c38d

SHA256
ccefa8ae91fbb2db1124b2df2165752676fab24537762351163c5166a761c3bb

SHA512
4c682eb93bf563c9d9fc0ded0dc350d0edf0fcb5cd290211fffe776cee9f4338e5ddbd98c88e0664ab0492fc88026801eced11ab77e06083c7812baa207be1be

Download Submit
C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
41KB

MD5
6a255133f4624b06e38193a2c166225f

SHA1
20c4b2fb4ea6f81cedcc9e2eccff39754b7ab257

SHA256
7994b0292d99a5b09044320fdedbf20d81b6c5bbc57a08d4d4ec1d8de32b6f16

SHA512
097c825022a49994ce2c292f123170c72b9debd68dd3a742c2032344e58ab0878432f5ee720d9e40193520b8d9265d27b625df79524238108203ccd1306dfb9e

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
154KB

MD5
12009689fa2327e0f2922861db2bc17d

SHA1
6b654a3fbab942fac7e663bae5278b88b7f2d544

SHA256
5877648307ad5f0f43ff650848a9a5ffd0f4a3be4b6accce73ef328d9b55e54d

SHA512
9cd623ce5508e56a566da9222baf178911a305098e1604e29702a7eb472cfdf270cf4ff80296f6df74249020cf3969e858e4790c22d18fbe1e717102d457f173

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
110KB

MD5
c7a9962dbd455cf97772883fc7aa17f2

SHA1
a2210ebdee8a7ea1f9a7e644bc35153c33153464

SHA256
609f0770fc09db1fbdd4a7ad7930bbf2b19b4c12734d171e16d72365e66182be

SHA512
77cfd763452fcb707b534c9ff53eb02dec5aa8d65c3b847c42b67d81700ca0dc319b3515b26ddfa80d7bf8e440499f09fa9a72a4f0cef45c6e2289691264fcd0

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
85e53c3b32b83eb6ff62a242a14ae6a5

SHA1
51e5d7a3f4eb6cc113cc684139b15c5535d106ed

SHA256
c08922e8b344dad8b7b835d5fb9b238d369a0d9f2a09f4cde5b2092d5b6d0036

SHA512
b7a3290a75d68213485255036c69133f34a857d7e0ded2df3b353b2e05220249597e5ca55dc99de42b4c5fe4ae162c34f4ff09da9c2a9b527b06e2aae1047423

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
589KB

MD5
6038c2d38efef2782bd2c6d6d32d8cb1

SHA1
cfa94b01bc4564e77e0eb40fbcd360f94baccfde

SHA256
6523b9e9a8fb6c09f238b3db1053e2842e5dd4db9c810a81477b392d87750645

SHA512
6ef1a6c1e955bf8f2dda094189933515cd7ba732730dea217f0581d5c01178fef521cb67375efae0838b0eed61c1e6ab41a7a68f70a19a103d79c22b14121a25

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
254KB

MD5
2e58f547217f659e175f8d9c4d600e87

SHA1
21306d5c3edd808d429378009cde2194d896d58e

SHA256
2770e604dc91ae2e0fda5446fc494ec822d118d316910c0606f6e468ac49e7cc

SHA512
a3c47666e859a3ff15fd813ae53d7ae9eccdb133f860283c35b5cbf76d7439670e65c4d33cf5040aa5143cbba015e23247bcf610fa61d1915acefeb0ac3d6261

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
972KB

MD5
64c24994b8b3b9a75dffc5e67b887e7f

SHA1
81a027e9cd5a6d19658eb5c25163a6626f6882dc

SHA256
ff63b1faf66f12b30442992d587a62ed5b3eb93d684977ac29486924eae6dc2c

SHA512
aeed5f2b542fecdd27810c12e13aeef7c028ac165e45a76148ef3d1918a37cac182dfad77fdf950ef7cb11468dbf90a173f853deea5c201eebaac3905d00a0ad

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
725KB

MD5
6cbd715cea520e544fbdae02049933ee

SHA1
3d93ef1fbf06eb576cf9df6148a0774eb333cd16

SHA256
c16c0c31dbd06110de362b247ebf760d04fa79bd6ff1e4a979efa8b3c31fcd42

SHA512
7264c0864854cf252ad0cb6e2a0ec56f3a7d148a028a71178d7ec195a7d5a54d553c05e62ce022a946f3cc80275628cb355213c5e207617ae5f0b46c3da28e7b

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
98KB

MD5
b4a4bc705759684bba842ccf836c9b38

SHA1
122bf069da6b43751bc2f32ac30ab10d7fbc22d2

SHA256
ed3ec40a58dd3be5d3fa279a46c59ca7eebce30f51a13983e59c140a5374be34

SHA512
70dec8014652c6a917f992441fb664457c8bc159b7801c2a0996af4df984f6ca90a9815a5bb698caf5b1ebfa6a412eac5ad96924ce33d32d209200141e523f3d

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
55KB

MD5
eef80f47e0142d3d2afd90122d4ffe52

SHA1
9b658da0821b40c4825d7f782be686e0ea597b46

SHA256
3f37a4bfab26d8db9d465035c76b7964e1bec9c108c428eff18913dfdd4c6a24

SHA512
e27c80605addccba10d47aa1faec5a5901643cdebbffe21ceece3190ce96e6849a41b767fd250c1dd0f47e355892910a101ecbb7251614b357ec54b5aab96aef

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
49KB

MD5
ea4e763f4c3fb7de61bc83521027b4d5

SHA1
2662feb1771eefe32bc24909557a2ec8e43f9b27

SHA256
a717c2b478add06690d2ed2d77f8e595b145f15dd1e1df853869db5447d3f29c

SHA512
0942a30f30c7c8365a54ebb087d86094e9a3f919928d2979e401bd8025b33d32d14fe787fc68dea707984e2a8112cd03ec641a7b9496431c91efa625e7039836

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
51KB

MD5
0c6e166bf68020cf76b3af3fbebbf83f

SHA1
4aa0f36d5704b5ab772d7865ad004095fabd6cec

SHA256
5b5248a20f86e96d6e0b2b7577bbcaa9982ff904b35a10a5b20e7c9da6235c30

SHA512
0dd8ba8a609dab5eaa096ba343e6d2482a924f46803287e647941074f49d6b02652ded516ba1da22167af202a2099bdf5c52645ce375089b1fdc8e86ca61b202

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
52KB

MD5
b148a9251ea66313f07eb144a73a658d

SHA1
977b8a77146669c1bbd1cadccc087734f2d6af59

SHA256
2515538f7cd7f88a59a218149274b40550cdfe39c8175ea84091c8ec0e979334

SHA512
50b440c387c86676efae29cf0320bb642e3f1a0fbc5d9a999a3e103bd807c8e81126637dcf72bab6ca22a0ad7ea8df9241354ac110d613aa3c572576a7498c8d

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
58KB

MD5
9f6426f34060059897fee2050178b152

SHA1
30d35695e7dcf82ac5e965b78a748b72647ed83c

SHA256
ea1630c6f4afd8da42e29c6980152c0a7e78a4cede065ac89e672254757c5baf

SHA512
84d875ecc38026e71ac78afca2f6f47d1f9937ddbbbdeca600b9bd887774f1901679590eb609b49bb74639214395f1f40e4c1a7979091fe04f628ed06901a450

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
60KB

MD5
40d9a326ab323c76d0b2838d5922d0f3

SHA1
936ad4d4f5abe254b5978bf8d810a024292c916f

SHA256
7c04b4d828ee0ec07c8498a9014fce51b24b70fa89fac5744393d593bd26219b

SHA512
e00bf466c9f3a1b080ac2d7cacd2c1533a408f938c196c9db60c669e20ab97e526b1a137a7027bb626698f782b925189b3e32e0cba236ce157254fb67ec1bca1

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
46KB

MD5
41868855a1831cdb685336fbbaac2343

SHA1
0ed2727dce99c6485e13e5f14d487a87567a4e68

SHA256
defe401ff45202c7b887aacc69cfd6541b582a778938f84bee57b021da57dfde

SHA512
5623be63f6ea092f80291e14101746a4956a722860b34483c4621012997540346334770ce418739b4a5d4131f3b0b6eb71474d58a3c5eae8a3e61562f8833da5

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
50KB

MD5
3f4bd5c17bb6251a187d2a753709be4f

SHA1
d7b33ecb1691bee5940a40a173611b65d06527a5

SHA256
6d77a46b46bd88a358a756ebe798eeb5b0ff430667fcaccfd46a150a9a76b760

SHA512
d7aad6b97891ff9c8def1438608d03bcf14d67d8390158f13fffc0c53d92ff86b6f031c8eeeb0890fc19261aef6a0caff82b14591d89667c101eaa538ee83050

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
54KB

MD5
a3aa3d35b93e439a6e71bafeea7a0fdf

SHA1
44a4bb383fb59dfec5c0717ce91ce2c614232ab9

SHA256
dd4979eceb21c7cd0574ce6cb3919f69c23855b422f0ad27ca2108a2566ce4f3

SHA512
13d559299d046b96354cad5f41987d1f315bae354f9c99111ce7175b1ddc9f1eb2e72e7ed514ff51b26de5c5785e95b79fac16ee4c79569496db6e217a6aa184

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
46KB

MD5
27f75adaa7ce77b3d0688a63eb7d4ab4

SHA1
0ec29595a2b3bb57c6031fe9bb445d181edbdecb

SHA256
c44fb169c8bfcae3afd6d0bc463a8f451907fe0210e681ad00224ae0e188fa1c

SHA512
f18c8e01cc8418fcd1b20dbd20881e8be02938bfe58ee41b2d6a73fe393e462436b124728ce84f9ab009efd7443b25306392c2776053d573a0725227f22726af

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
49KB

MD5
913c5a02ae20a50dae1a2d89d36e37af

SHA1
fb382b7a026ca5e75493cfe1035aa0534eeddd75

SHA256
18e90f6e69be227a9886cf1039542d82b11a0fb21f9607b386b022e8e02ce2e8

SHA512
5ef0835052e1fb6605264cebb5076acf1bab8a5d133584a39841d940fb3c1c9924a53080ee5d9c78c65564ea1d4fa10935f94b339ac9ec67cda09b95f8ee569c

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
51KB

MD5
64f2e4fd14cc40c90984277c9ac39b1f

SHA1
94f04d60c939175754d6c4fc2c006d1cb1e9871e

SHA256
5a2f22a602204ac259afd7e391a60c8b023a582a3a717dd32a237fec8983223b

SHA512
f2c7a5afc3246ca8324f5d0a8ae79a1984cf39a223f1bc1aa780bdd0baec354c4e3fe28bbbb0b7e62a7bcf85567b2be5256ee46e6694b1a6ed7e10224da7bfb0

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
58KB

MD5
4b2b43f0f129841b905c2f64f0565f03

SHA1
b7416f4917298a2e2b7706261b826ddf7fd2fa72

SHA256
ce040235443d0a88f5616e00507b6e0665e23ccebdee7f6821efdac818671966

SHA512
e5ec20de1cef06b5930dc75cf64df5185100c0bca64dd18928331732ba59eead00fa4930dc8f4cfb5d46c7399c5a1f7f2e8f6971f9b9ab4756c2b224211e1010

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
53KB

MD5
f1c4d43458641a483a78c585d78c2feb

SHA1
d5d5ce742ae558f901a1db0033e0f26ce03a6b3d

SHA256
52f3d836cef1e2caa00a789060f63ae0f421826e94f327d6ff50c2bdcab20241

SHA512
72a6f05ce83259be40bd250221418c31a15e901d9d913a0f89e38229f1eba79d853a352ae649259b36512a28fccab5eb081f2ec36e9f6e2df56592920e33c76e

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
44KB

MD5
93aae0b68e9615cac1af5680434ea010

SHA1
bda64014f00ad945fc3a453d740f6ac28e420ec6

SHA256
f1708b34638c8c227141760a1cff8c7e9a3f3dbb6373c1f8a7cf833a25b4ab65

SHA512
80e66572493d49f9c6f6e0ca6d788cea6eb67038718da9819808b69cd5fffa4356923c829ccf65cf7fa6a2853f653f2285f5c0c7499364f78a33da46f43d20ba

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
52KB

MD5
069d459a9ffed677c2f901d0f5e4abc4

SHA1
27b2b87447d528ba1109e6ab6df5694207f1fb98

SHA256
2acf7a02c43300fb99a2946fbd32cca778f43b561bb224325693304b518b4406

SHA512
81cc6921c84e59f3b525b8bd5408a0db0366e93b4663d24519ce239ab5ac67c42705fe824c0b58e7f61191934fdbf04cdbeda37e26010b00280a017ae7ab5ea9

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
52KB

MD5
a4395519cdf7cba1cddb8fb983c58f89

SHA1
ae8b01535f9068f4d27151f52c6b6429df506b25

SHA256
7e148a1b788059dc12b083ef3ccfd4ec097bc48df96da6d88441baa39e82b56c

SHA512
b6b83b05abfc5fd9e02b3656df5ba69fd487034a69047e4a694b0625090e74c64b90d6fb980b7de18b177ef39bdf669ffab8a5f575bac4574b084013bc6eeb9a

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
53KB

MD5
676e63160bf9bd89d2e1c6c2f015200d

SHA1
dc202ea88000a66dea8467f1d6cd1def53ab6bfb

SHA256
28a2bc54c7c0424913b3c7419f34b3953e0d83de7c73ffa560e147bff57e6809

SHA512
c82eddb828f8ed3f12bd8be8e90bbd32060b4d3138682cc7f294f282999222742bd81f61257cd8524e3604d2ffe384508bf4e88934f12f3f9d20347df400358f

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
51KB

MD5
9fcee097cf4fd6810c50b464da8de73e

SHA1
d9e86ea866194ebbc0ecb0575e43f47d5a578010

SHA256
ece1e17c93e5d414af21b87b3ccefc889c06bcd32d6d30fec02b24bb348bcff7

SHA512
b29ac4fa8be2f0012200df5647fa865e70148facbefcb668502db9823eb9e9044eba3ee0bf313eb9fbd3049ea9b8776f00afd761f04ad93b2e8ae4dc5e90ac53

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
56KB

MD5
41118a40f2d218cb56cb06a3e77d6b5a

SHA1
83e6e8ae8737a6f4b47fbd043abebdef1f7c1352

SHA256
32e1addefa77c9ba82468f6ae83dfee383d01b6e70a7a3551fafc58b6f4494d4

SHA512
4e62bfda6c28b72295e4585d7228fdea3f29def9da0508cab6721dc04771901972b7fd07a99fa52fd0d5071a1a8ccfd795d362a25c3f61c16eb87d08876b549e

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
59KB

MD5
5cd5349ba0b42fc653151b83198a1af3

SHA1
842e62eaa8f91a1c144349aadf9f95e60383bc8a

SHA256
e03ff8c88d40190cacbaf731feed615a23d70e156d0d93322dc97aa6e33c1e6d

SHA512
3c2faab0e2590083613bafecf92c6756772261efa3a55b1b3524bf0b15fd58ae9ae8a5a60650133b4638eba84c06a36a119aef07d0734a019e575c173f075939

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
53KB

MD5
9b8663ca26320bed24364b2a0f9aa78f

SHA1
8eb8c5e7e9efed8807823a67ab8af781ac046a7f

SHA256
178a05a26a0bfd9fd014ffd36fce81b28b205f47ca971fb2e4d531d38ac3ceab

SHA512
396a19b66f9432faae024411791c0cbe6586f5bfca1681bfd38373a72912fe86f3d096b8d71d5dadfb4ff239f5d066cf56f436ee9c38a4e6cb604b909d86ed84

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
55KB

MD5
9a8d4a20270125f1603328f1f042c9b1

SHA1
03687360ea7d51a77f4c4267b8656c209596fd2b

SHA256
5ef79d0dc649b2b71a9bef7fb244279cf8f791a4a1e0749f05350844c3aed479

SHA512
59e7cccbd9f47338c0e230c66899099efe6751554a474f67b235110f576bee3c0f976edf35e6be346d14a7c2ea5270ee932a9d4a711c0e22ad6fa1f1add9eac6

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
44KB

MD5
7900d4d44d162d227d955e66cd580517

SHA1
2a0ae5c11a03b7ee9b8200a6eadd6615ea0c06ff

SHA256
3aa2fdedd68bfbd17fdecc4391093916871e4097ddc58f9b03525788cff4a0bb

SHA512
68260ca6dcc5d35c682f3e79b13372ad48216a9833b673be550f366e2333d57236659851773ed0f6f133b04264b0e92d75cfb6588c5c4fcad394f80ff99cf1fc

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
50KB

MD5
fb6aecd20ace26a1348511d78cbe2c46

SHA1
84876678c055bac10a3a98acab52bc516ce6f7e5

SHA256
8c2f049db81f87b14ed16592794cced674c3b6b5e2ed5c3f3c3d5772b6632b5b

SHA512
bd6f323e51e4dc1f90cd1408330145705cc8d3ea0a6b3f8ba2cc33572c55054809ad5ff3963c20f76df0f469cba039c686f00ba5f4986c472084a77e002c6558

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
54KB

MD5
59bb4b91d78bf7acd0e392b6c6ddc0ca

SHA1
c62011e458d330d021b1b8456599cdd3429fa376

SHA256
c7a3db944a9b85170ac4bc60be41818f03119ebc40f92f4b029531dd2b4b2b30

SHA512
cc871d5af2a67c9fb0dfc19c87d68e7a00a2feb214f79f36dbb07edb8cb873af479745918c97a21ca2755e49306cf5a9dfc1d9075bf799a6037c4eda75c03f59

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
57KB

MD5
cd84179e9e808583ff22516b37974e9d

SHA1
e01cf752dad92477b36c1f1313ca9a885d82ebcc

SHA256
6fb6a3559d3847bc024884ea68a993fa64cebf37059e3e1d881f52d612600d99

SHA512
04f47a402eddfd1abd28250cbf9c7787770d3e49744316a592334ab637b7563fb84b061631ddd905478a62e09a473f243841a6b99900eff2d5b5eed339a5fd74

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
59KB

MD5
b706d27c4ca8af7faa32e01260a650dd

SHA1
42acef31b58a7aa57040fa258d37cb32ce399b44

SHA256
3ef4f071cc9c758557b28b325a8a9825e0bb53b45423bedd7c660c01c8960868

SHA512
5daed74385002cc3d91cacf3d8950474ad44b172b21fa57282291623d033a231280cc0a10631b6be43021869be5dffdfc6a6533e1d71c7d8a53934be6e6ae651

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
49KB

MD5
3e7075f2a63a8e2aea89fdf3e22872a7

SHA1
770e15bd50b8c0278f7a9a64a1c28e64acb90b44

SHA256
794414fa80fd7bbc429f5aa50cdee6b7486c1175d481cb6c1a7d61d4e66ce261

SHA512
b781aea7beca44517d281ed8423e72423343daf8deb15da68dc09a943b0bbfdab9a53eb4ef43f1fc2dc664b1e8c7ec0a64ad79cd8fcf2332a2c80254fb94ed7f

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
53KB

MD5
9142993d94706e47dd8432f6a51c2623

SHA1
3576bd3ec3b16a29dd75b4377112fcf78383b6d4

SHA256
2fc9e7b184084071f1814ef0cd3163b571af24688fee94a3835754d534331412

SHA512
afea113423b079ffbe227b6851e5000c38e7de69358d6e920e805599ecbcf959763a7ea6161df1f488fb83176307f57c583f1f9132a6bc277e47ad253a573cb8

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
45KB

MD5
a8983fe48b3c552b1325cb2a30cb3489

SHA1
9dff968485d5835eca1235470a89b0e3437ca950

SHA256
778b814d055526ac80949799d66cf0cfe7797f4b512fb043c14f0ed87c55faa2

SHA512
288d8ea9c207f0c1d6611d1b9bfddd644ed5cf096c48d5a5b0b629dcba2802e894307c2d71763ef596dd0598eed23c4947fd8eee451228594394f8dcb53d38c9

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
57KB

MD5
bcbf7887d4460381c5a5827a080ff98c

SHA1
f559a0eb53792429de4d8cb47ec7e7ee38aadb5e

SHA256
9fdce02c0e8faba48106d4d87c94c2f0661376e6b585d8d8dfaf2b6055cb7f80

SHA512
022d93f5f9811cccc3a4800fa34b86e93d81bd110f2abb9dcd58cd3fb75fed070c2a593d5469b4324eb39a8646f0bc9a451f81d416941baf079767899ff1a6df

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
51KB

MD5
45d5040c8c94c586a14158287e2edaf0

SHA1
f63bee49f2dfde063e6f7c8555300e4fe6479dc1

SHA256
a63b048772346bcd8fe2acf7ba497d643b051cf5e3beb6c460f105993b2e7630

SHA512
73655f90a9aca5ae3458c15d6936b3ae1245af2d1ea4a4aff0c010920e5fd11bcb5ff9e019ff2c1fd990cc0867c0ade2c62742fd22947d07b51d7c6053069b08

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
57KB

MD5
7f02af056d7c65c5cf4df21d9ec405e3

SHA1
b99620d290fbef53d44352a1e570e86c4e868733

SHA256
8b825e1ee1511d3e955fcba8423a962ea9e7d425ca71f45c3716479afe60dba1

SHA512
b58eaf8e784b1f4c2e61916ed7db21ebd389e4b539cd69a75dcf23a4102622b982e549cd81c223aa1e7c7aa813097eb94cc329991a4a05a6fd0c1148cbe6c0ef

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
53KB

MD5
e067729ae5cbb624020443fe345518e1

SHA1
1d7e62f2c82358be5afe5c5f37b8ab0fdc44159f

SHA256
130efb186e03518af5432aa823c60b98de272b5464bc19083044ac8da9fe963f

SHA512
a3f4aaed4e48ab38bdbcc92ba0834ed6f2d44f6ac1d7eed51f1fa62ef480d500ec7b46eed562dbd04f0de2e47f0e52c58ed7d198d24028b0761170ba03d10f97

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
41KB

MD5
35d80ba87570d1b8beeb77850077b703

SHA1
c9997e5437fcf9892b2593ff9444bdfd446cdcff

SHA256
f9462287c38af65368db513dcac6661bf0189fffc2d2d562865b9020e789d53c

SHA512
3cbe45827246df0235bba29850bbbb40c3f26f62d7621b3baab0e0848e2847760b98a43bdb6d53c1feae3c58393a58fd160007529297127b4e16b2e974f72bf7

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
53KB

MD5
e81cf8ba63b923219dbbcfeb4b332554

SHA1
411523fd700ea1973f19afcb3b9424df3c0d76b0

SHA256
3c1e0ecc3da033112cd8bae928afe81bc8be20a7009a0604ffe4a72ec3f7ba8c

SHA512
f361ef30301b56023de2aeb65e0b0520251645e5a9001354ef1868170993c196419f26a26c98b06761da9f806cba28ece68156d29fdc7fae6bdef1f77549804f

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
49KB

MD5
3ac6cbe9a2e6bb6aa2e9bd754f01f5a4

SHA1
052ca8910f8fdf7079b7dcbb371ef37404089af8

SHA256
248135b544e0f2916a7205410eed2ff70e16994964a999a820bb2f22e38eb837

SHA512
a67fe268b8f6dcc4a59bc7c670c8b96a46da5b65505736ae6dc84043aae2a15d682f38d9bd3244141a01ecd351913e754be5913017dadf5220bab67089e781c7

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
65KB

MD5
2d4030235089e70efff1c4199dfa9cf7

SHA1
6589fe53ab2c2c362bbde1b9a72bad8042ff8d83

SHA256
e64eb428ff9231260f3ae65778d9af2fdfb886b63c7a97761e7b550fda6d8d6c

SHA512
eccb897b377fb9cdb211d5356f26334db131152d9a34671c4dd830896faf11300252509d8df880c504afccbc0141f60c1b4d145620cd01c01cce3dc96d41c750

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
52KB

MD5
4112387613d7552e0b41f91959430136

SHA1
381c6cef43ec47e69e7802de36ba7c21a87459c9

SHA256
d58ebd74af3d27ae654f5c419dba668c9a6eba63c811c0f5f4df0e68f4e91099

SHA512
ea2101658ec4e45e83f4fa8c94ad68ccf637d2e91e5bcf08428b1423508e8388b0acae64e4ddb7f14bc2a5a70c7e0ef997a6864c64502e752eacf48f9ede1d1c

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
58KB

MD5
673d1e6adf622e741f5ad0df75524409

SHA1
cc45194b04c7643f43a796c41dc7c984d65fa925

SHA256
065b29ef3a77f763c47188ab8b917b8df6d3c2a5c827cc13c1d66d7a5e1a72d7

SHA512
c5b0d9d632282487261bfbb6afa6832018062b741cb340cbd2865e8756618d5a102ad817b2f1245355e088f1507ec5b1ea238fe3ab24289bc23dbbff1ed58ee4

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
54KB

MD5
e33e52536252bdc6dc63a339799aeb10

SHA1
2408574433263187eea913d389386f01f5a29402

SHA256
05550499766da36b243edbfc9e140ce2a3710e2507ad2c03b377490e3a5cbb35

SHA512
af2b34ead48b16de00f0c6ad46000b3459b939830a1550a98010e0b0cbe7dc7304cfe69ec312004dbc0af82c0c1582b9791a8368d149245251153c120d96dc11

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
51KB

MD5
8dff472d893c022f524de8ba27625f9c

SHA1
3294a0ea8b29fbc90a7cb389eb06a7270a856a44

SHA256
b6ccfe43db4d0f3ca824725e65900dfc7ba6e2de572317e157932ac6e4a70d02

SHA512
adde95fe6c9fffa0b0906b05ff623e2d84cbb2e75ff4e8d07e4a14fb9688969bb4f45b34965d0024392488be8fa2930230684272f26f8ea6a305a2a18b218d95

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp

Filesize
59KB

MD5
7ad7ccc2836f8b96cf80911742deb7fa

SHA1
86c55db015ff682724b5847d4bad8c1440e7e95e

SHA256
961205e74b43fe6825a9e2b9d83f262e85151866d6d5bf7f1de87867fe546e4e

SHA512
d904933317143c1667712b04761dbdbf6e6fcb48dfb0d560a90daa51cb572948518f2f493d4e001eb7e531a111a0124577ef437b25e29c296466f0ade9ea2d91

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Get-WebContent.ps1.exe

Filesize
45KB

MD5
23f8d32dedcdc316354cb1f9a457322c

SHA1
8c0aa21e5a6976adb2bfa633c12fb33f9a8e53e0

SHA256
fbfcaef1f1141ebd72106947eee84984a502e32880335745a745a128381eb32e

SHA512
4e4277ba402358a08d0ecbce092334dc7f6844d0204d165d3a4f9128b532f444e435bde9f79810b042adc483500a3a2e8652fa74f346b297fdd94953895da482

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
41KB

MD5
08d13d367180b1a6f5a12b130283f86f

SHA1
42cc79ceafc7481cb268993ef7aaff7121fe0467

SHA256
cfb6c753c0bcf7adf4da76bff333141cbeb1c52655bf61b4eeccdd2f4142c250

SHA512
2037d2f3d9cedfa151042118f8f7df1b07a2c5eaf5d5e9b83c6a9c9fdbf978249dfab1742e657c71a394547c0d1845fcf9f38944547a3dcd576cf27ed159a1eb

Download Submit