51926d7689d3a4b2338811392123cae514bdbb2b3b94d9831b4f487100ef99df

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

352375a5d391aa8b8124281edf737090N.exe
Size

100KB
MD5

352375a5d391aa8b8124281edf737090
SHA1

b3e38f9df8a6edd714b91695fa177eba83fac86b
SHA256

51926d7689d3a4b2338811392123cae514bdbb2b3b94d9831b4f487100ef99df
SHA512

6cffc50e0d0eb9fca6136fb7b76527130851a64764b8660bdb0830d0baefa5f700e869ecc37bbd824b17aebcb386398a275d3cab12a064a83336a4b448dc793e
SSDEEP

1536:W7ZppApktshJYAJYDVXxXk7ZppApktshJYAJYDVXxX0z7zi:6pWpktsUVXxXkpWpktsUVXxXqXi

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4696) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2660	Zombie.exe
4988	_active-update.xml.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	352375a5d391aa8b8124281edf737090N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	352375a5d391aa8b8124281edf737090N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationCore.resources.dll.tmp	_active-update.xml.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp	_active-update.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\lv.pak.tmp	_active-update.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp	_active-update.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp	_active-update.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\JoinWrite.aif.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\nio.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellLayoutModel.bin.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationCore.resources.dll.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\gu.pak.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\libEGL.dll.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	_active-update.xml.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll.tmp	_active-update.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	_active-update.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationFramework.resources.dll.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	_active-update.xml.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp	_active-update.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClient.resources.dll.tmp	_active-update.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	_active-update.xml.exe
File created	C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp	_active-update.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp	_active-update.xml.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	352375a5d391aa8b8124281edf737090N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_active-update.xml.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2660	2880	352375a5d391aa8b8124281edf737090N.exe	83
PID 2880 wrote to memory of 2660	2880	352375a5d391aa8b8124281edf737090N.exe	83
PID 2880 wrote to memory of 2660	2880	352375a5d391aa8b8124281edf737090N.exe	83
PID 2880 wrote to memory of 4988	2880	352375a5d391aa8b8124281edf737090N.exe	84
PID 2880 wrote to memory of 4988	2880	352375a5d391aa8b8124281edf737090N.exe	84
PID 2880 wrote to memory of 4988	2880	352375a5d391aa8b8124281edf737090N.exe	84

C:\Users\Admin\AppData\Local\Temp\352375a5d391aa8b8124281edf737090N.exe
"C:\Users\Admin\AppData\Local\Temp\352375a5d391aa8b8124281edf737090N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2660
- C:\Users\Admin\AppData\Local\Temp\_active-update.xml.exe
  "_active-update.xml.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.exe

Filesize
49KB

MD5
a5946b9a94324c1e01a3c14a6c45112d

SHA1
0f5ff5c710fad4428f216c3bb586f84e5a9557d5

SHA256
0d9748688ddf9fd8795399b172546201598b945012f272e4f379c7a715364b35

SHA512
330d63e65fad4f6ff34991f6f18a3c251f442083ffd411ec450698ec90d6a916832dc725477b1fc265ace1ebbe0b94636218d62a89379cd48fa59500181ad577

Download Submit
C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.exe.tmp

Filesize
101KB

MD5
558f6cdee7b0d79bdb6292fa307a5cf4

SHA1
af1e3863a6f84582a09a47be9b2bdf1c263a0bdf

SHA256
385de137ee01cdd25d733f216de27c4df7bbfb95e4546d3c6d9d4a5d8013f171

SHA512
74e95d1d3919367a0215602668fdc195e1fbc34df84fcad60541bbd804b2e194d3c86d585973ec599a4e96db6ada5f0b2ee64713c1411304374190a48f1333b9

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
161KB

MD5
2f4ed93963760c0e26ae46895d122439

SHA1
77a3b55bc683e513e19900b6f9e031c54cd192cf

SHA256
e7f0d0c9e010d98ad7c03f05aa8df56cd45f92974695dd8e18a109590d0c9fea

SHA512
ac5810ef264283cab08b2a4a5fe0e9b6ada07e566b6add2b65199fa87b433e5f670143b417c791a5c9f81b0f0a911a3c3e58f2390286b6dcf9b8e8a3eeafa413

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
52KB

MD5
c8749ed0d4036ad711c23b5d4a6d8ce2

SHA1
9320b8f2bb579b5dce3137109810b32633bb96cf

SHA256
4f00ff02190c78033ed285b491f6e54624ab475bfcbc85fdef40f77eca91cf4a

SHA512
06370d8cf4c44f14e82d37506353dcfbb4dd50af5b07ddd4e1e10152a3457a696fd10f8e30886281809cbbee9b83e47aa5465295efeba7f51e6795ad348f4f9e

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
e2dbcbfa583c53682faa04efbfcbe1a5

SHA1
c1d4ee47451311c949029e4e413276a37afe08a0

SHA256
60c46e90440463a6d123e52ff6c2ef8de2f7d35e03a897e5437e74f1bf7fbd6f

SHA512
0c6b81c1b971e08f3181c58f534ff8767408854c47761a037fe4ef796ef8415b836777a011d00dcb8cc89c8fa992811ec6a4d6745231207ee6bbcb1a87547553

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
595KB

MD5
2b8020fb1266d7f96c639c483b489375

SHA1
454edb7642c307c710b92c8c846ddf8568ca991f

SHA256
d753999db097f7ce7cca5fe9a87f523c00a06592efe39ae8ce0ea45a2f5b9ed5

SHA512
6f43abf8e6298edda3c453c1e4c0692cd6f3b353bd34e541183a836434f0ed4a00d1b81dfe0bda722eba68d40b3e30230d67298d0f2411a5f6c475221f880f91

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
261KB

MD5
55e981b97fcbf368fdb178a2332eb2fb

SHA1
29d2ab8c0ffc5c2557bcc1cb8d1e90d64e5f23a3

SHA256
d43ae69babe4ca880f67253f0eebafafa1a227f0c027501b5a102924bfafd879

SHA512
925e24b1ae765858aa217c8953145d71c2a05b941f5b784cae80a35527f6e5328f2bdbe37abcd80737a3affd4e0c6423e262f81061c55347afe6f1802d0663d5

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
982KB

MD5
b9ca0f4b42b341473d6c11fd6f8e186b

SHA1
3fb9874dc23dfe3aaeeb63a06c49bbd61a22a74a

SHA256
b08d1af90ab5014772b9475de3520d3e2eadedd00c20aa04e1e757a35550f0bc

SHA512
892812892d9a148bd54106e399a30e493cc13596f019caaaad5858603484876013cb85a16edb718c289b787307294416922c3782ef93d33c94bf365a833914c0

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
735KB

MD5
f9cd5db245a697f318ac635a8f98d9e6

SHA1
e793359595082d5d4a9e037e4809bb5699c8011b

SHA256
2a1b13cf0f0c2f237a5cb4a9ebf92e534099ae1611a7677f164608d62870e01f

SHA512
8a6d7eef0068b21255e0e2e6e9f32b3fa341dfa1afba52b13c8eb2d55cf268b091208f138fd0c7db3aaf5d96f941b6065f259bb000989a1295da0e5a3d45b3b2

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
61KB

MD5
075b6b446d68f6c2555a96e66c7a4716

SHA1
44e69f81311c8863d60295aaba70cca95b73135c

SHA256
f049a02f0fe45c38b51b9be88800f0f283b289b320f5e77a896b38121cd581fb

SHA512
850841e981a87bd61a49e63aa6f2b0e4f390bdeedf82788dfea6eee225545a9b643de1b5b6166f2c372bfc58829b241111fa22a521a31477ce6accd3d4b20c6e

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
59KB

MD5
dbb5f7b4a3e2fd883b6a41c8f9704b3d

SHA1
998d31ec32f3db724c8b9d441fe7ab06c8f68174

SHA256
51bbeaf3c3a727ef3bdc02aa85be1c611946f0aedeb53793b2602320ceec3c42

SHA512
2718f19aafea8f60e301a53359b1bcad94c2049cbe52fd73a42106ce5d0ae836f12439d04434b5a616f616a65ab960f403fe1f67a7be5273e29afe3cb739c23f

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
64KB

MD5
e266450355a0639fdc19c7cb6c739031

SHA1
88421e4c65db44aaff53ba5b42329b2b4da2fe19

SHA256
48d204f0718c3ebd6b85d12766ffb8b3baaff53a1c64231a75b159fe8a68c20f

SHA512
2d5ce008f619ff9962cf11a31933f4f073fdab203f4fb465ff6f377ccbc2f8360c2b23835286fedbf751f25beb000ed01a0e26f56c3f80bc2783cab02f33ecc7

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
49KB

MD5
234e8ae10819052b8b05f6a587ee2cbc

SHA1
0826ff36c098f042f7a25063abd7e45b503a28a5

SHA256
e51d119642879592b5730ebf89984afe9a509f40346fc516ee3293d715cf9551

SHA512
676b09d5a961801edc5e3eb594ee3ea4805107854e1ea85eebb98e0c46dfea711556d2c0492908de8d616acc0c16180cab8645a1dc6576a0ae6bf102550a9d64

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
56KB

MD5
fe0f5d442d97af9efae1151d0780b554

SHA1
dff872897b579ca76427461d4527422720880463

SHA256
2ac6890b1c3c4cb6a0c80dbb8deba9a3e63a6569e20c035cf0d79439b5a65aef

SHA512
cb232fb27768d2490eb99ba43a43561354e0048ce35bf7cd5dfb0f46f57c0c9140ac67b2b74314b4271ac295d58acc7c01ca4317fdb5c49381019b732170399e

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
59KB

MD5
4aed93b2e6859adcd900872fe6dd652c

SHA1
4b20f5dbfa66a4693bf1b21647bf11f6609c5855

SHA256
5b546e6824677f4e75f3121e8d6adec082454205f7944dd21c76433e5242086d

SHA512
3b45693a758301e103539d4ce5fa7dfcb651a0d4ef1e8978800c7751ed8bb27bdb5dda10dbe9d926f2c67b904071bac23bdbec3d98cd1dcbcc595c25a5c9e713

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
56KB

MD5
b7615c4a636c9a12a6982b5755ea12db

SHA1
f0fa3e023e5a47d7ac7aa3d17c8121103031af64

SHA256
e4b3b9b98fd84f775f01b3981fdfefd28a7122c022cc25595ff8264474b1d683

SHA512
ce350475995fea82d3b5c68e668104babdb51d5bec8208293a4f175ae035a2369da8796d4eb26ef3af58375767ae98c3537a5208de19a890894c676c8e35b64b

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
59KB

MD5
7ee0bc552e3e673b5ed299a1e24c8a1f

SHA1
ece6d9773fccd951f3807f74344215a0d3ee3b5c

SHA256
f718c27bc6b4940873c9721bdbb11504546e4cb7a1477ebc551ad5985b891191

SHA512
c2ba8958a31a067742a060a17c454ccaec3c934cf28d1ae4c2a766668fe7bea14970a863ec338a6dea98c02a5db2a17676e797574913d051f064655f00301b47

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
56KB

MD5
800240fa6cdff331ee82818e1a352396

SHA1
6e76fc37b43773c4b3d069ebee43bd500225203e

SHA256
4fc08bdb576850b41814f5feaa891a659c7241492bc2e78740ba8cc6758881af

SHA512
0304859ed1fd08cb9484bcb08c762f155353594beb133005f469adf1d8826309d62e857a1f618726edaecc62692d9897cf8f1500ec2cb1d2690dd308e65de9c8

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
61KB

MD5
66278e8c09884aae04a87c3f0c234e5d

SHA1
60ba7b99bc3b17ea1ec2a2ca1eb4816064bc4cc5

SHA256
c145d5194380393d02178d35fb93595978bdb58db20ed0580a74097afcfc0b17

SHA512
2a4a684c1ffb673786c408bc68dd050baefafa21711269be599f8f3c9b0b7c55a9526d135e5489effa63036de76a65054b3bf139e4b4ac8a90fc776fd491cc9f

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
58KB

MD5
2f62fef464bc704260242fef48473c9a

SHA1
1e589af2c2402f49c8ffb45454818e1f122efc97

SHA256
98d69c21ac59d017609a6626596204aa70708c801c237372aecfc0ad785c9c46

SHA512
e0154afc281d1b7b14e10a3ae6abb028f1fcd7713775a009775818ce23966282180ad976d280a14c91fa7f8212ea785d926c03fdcd8b5c1634e506b5eb23140d

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
62KB

MD5
e7ce801a87fb735f298c182ea714d48b

SHA1
b46a8ca22fc0e3cb3cd29b1acf16ac0a7a2d9685

SHA256
2e335722e6c20bff2acdaddc5ab51ff7e4b5973723c53a25d03b7c73131a17f3

SHA512
83a5b4b3afefa04d42d368ffd6ce8e56ba4f264ea1db7fd16d98324585e8b80c4edccb87a7e01a6b1e8ec78b158039c31b598166b26cd923f778d44da481ef0a

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
58KB

MD5
c921e7f29da435f720f30c3838e7f718

SHA1
78910b80e9577462741ceb33f34629da3ebd6522

SHA256
ad65af5b56d401b605f0a61e7a4dfc446b55a239352a7468121fef4f8209db39

SHA512
542f289ccfa5ec54e9a1654ca2f7c27bec7762bcaf6dfc3f437eda8371e49896b05d672995c9153ddbe38870c91388705766cb1a9aafd35ef68f51d85da31b60

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
51KB

MD5
7c42f234711429f96386f5d5beea40f7

SHA1
0fa4ef7b8ff417ae93ccb84d494ff93941a14a62

SHA256
d57f23038a5198a106f02636298c010076330ea7ae58e2a89b0cdd5ccac536b8

SHA512
ffe472604f8f18b2e30bb14eddee85a74dca9a34baa962077ee3d68896b36fbbb08060b0907c321bec74f15dffd61f59c4c6446073ef026311a2c1dae423bc52

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
60KB

MD5
8a3f2bcf252e1fbe356e8436645b965f

SHA1
f8574de2a1f55e3b16013c8128ef2ea18354c9fa

SHA256
dd408d35d7cf1b5c15e23844b5c4ed1b35576a4d3665b838357a05029a5e1ff5

SHA512
74ddc555712ea43a4159b70229b6fae112818117bdd6aa47f10a5b6963950dbf8bdb702be1799bfc84f9a0f85426a40a14c1069db12ce7a5bcffc03aaa9d10c7

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
66KB

MD5
e9e2d7e8f1271ccfae3c8e67e0809767

SHA1
1ebd64b43aea9914683cd1e65198dd347a2c7f87

SHA256
a90e9a2f0d34c08dad181603174f1992708e82fa331b55ff97ef803bcbc36789

SHA512
e970aa3a807e19aed0900a8ab8384b426c2c21256c6b475ef99921933b39294c30e4cd4e65a232e31ff759f89f278cb05144d41828af1ef6706485a7e3d00684

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
60KB

MD5
2d98da7f65c112b73fd28a341d775e06

SHA1
5e42414a9800e2f36f32e6c0944874869b7cf6ad

SHA256
4f8587bec4b4a39f5585c46cc4a178dc7a88e7dca5f12bb657f20ba25fc2f360

SHA512
696d7c2fb4d5d465f00378dbed8e3fd21fbed5edd5011e6b23173d428ed6ce4fd3c24a240f7dfb5fea23ba5ee7d8755f287ddee5332cf7822f525c810d1b87a5

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
66KB

MD5
6aa09965ff3aa54327a745cd478e751e

SHA1
3f0e97cb483e20eab93de95236ff2cdb3f330fd8

SHA256
417fcc5363936c117a478b22b2bec41dd580aba22d5b9ea1bd9daee113db41d6

SHA512
0a0083070a98a6995a7d4964dcf7d5375f210fb57c69206aa9d98d6f61bd76438fa559e7c000a8d93cf7df6f3cdb7db3dd42b0e4f05ea6bcca382820173c0689

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
57KB

MD5
02f4247180553f6adc98a5dace2e9006

SHA1
d0b96e8e5b2e1b05ad48084ac00feddb0c14ee16

SHA256
c18c87041b1573df46080434f98c3ef62b75bb965bad63003cba6540e9e18d83

SHA512
8956daa6039b390d1ad0f0a830990b3a8f6b0a4f88082ee20c08bd74f9fb38b21676aa124792ab572ebf1c1f253945859ae1087b094b9aba4695b05dfbc18881

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
61KB

MD5
3a96138b057912226b543ec6c365d240

SHA1
d386cb0a7d155e9a5c74a7d3e3a79d1657c6c876

SHA256
e173f8705f599ee6cb7aaa1da64c11e348fd0fb9ead7e86748b5ee1baa5cc73a

SHA512
74d4b03b73d20d2cf466a632a5c0f06a8a0168e2eb12c7862cd91a81973f69f5baa89eeb8cb1b782001890a03c9586354ed3d015d5973fd21fec60996c28a375

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
63KB

MD5
d45c5c6e839ff6394652cc3bea56e485

SHA1
a0995e380c1255ecf03370fd31864b266c240a52

SHA256
2826dd4f4ce8b89c4442ef7680d3bf868d4342794e25354913833f53c478e2b6

SHA512
a9fb1b890ef14312f1b606cd40a8dcfa1d7bb048f6dcb1ba130918b674212c53a96d6e2a9792b43d34863eb235273b5e3b076bdf2d204188d214581451fe70cd

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
57KB

MD5
37e876201340c2c4c98530f42aecd6c6

SHA1
b5fb7214e3052b8b3090bfc7982fee287825b50d

SHA256
d8a19176ed5e54a00b19e51ac62444a7c26898b16402d0dc35ab6f8473a41fef

SHA512
82cc8ad905b0cfdab39894ceffeec1aa04c087350fc3283de70afefa0abe6dbbb32101662727b78792efefbfdc3cca04560047080f80f6adc216bba8501f4c5e

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
57KB

MD5
c16b3ca0b1c3a616a0eba3615afe8b5c

SHA1
c55412836b25a93d4aaa2d7466e67fb704383610

SHA256
709ace9bfcb0b0da8c7ede61785f8b53d0c11f3cd581beeacae3f02734f04609

SHA512
67d7b697f5027103ffbb6e5ca949945d24f0036de2c4e0c996a24a9729f338eb5618679866e23206a6fc4460a633bf7e90c62a9b9685f4c25f71d4b7478d7b72

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
58KB

MD5
1a520047d584b9c435da295d0034b7ed

SHA1
9d24d08a1b00e1c590b94f66a80bce5d6a93521a

SHA256
a47121c8d4a5a1bd951325e07dcc96175a15584e2d9bb636139e543e153f8405

SHA512
e800b04a523f02b457964c4e22fc94de51abe934716e6e88f7c4d0202537f49bf371b691f3895fcc13e1ad76208594f383dc57f8fe24a8e424ad1bb2cf1e24de

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
57KB

MD5
6eb205a2232b5f8524b143a147b5ca61

SHA1
dbf0f21835a202ee28009253dddfc8bcc1ff2b11

SHA256
838bbc610ff9a71e5a277a94122efb7d0d1322143941340183d256e42c113c01

SHA512
80db0fba0a03743656e561a905b4243d2fd3773d39b22f9b3b76f45372b3c483f9812a4207f07b69ef26434cc423ed98d274fcc2cfbd53a18525924293d656ad

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
62KB

MD5
6e1c6d8699a6ec83f138224bf856f3b2

SHA1
b0566f23169677d667cd7fefbd2d62574f10816d

SHA256
e11363d8a656aa3c1ea8006aa0034ae442aa1f8064bacbb7dff9eff1143cf508

SHA512
30c0de53b3354fe1f76fdf8eee114ba0f8836617619183545b592040236942068946da705f98eec1501db0229b124621387eebd05c282b5a241fd518cac045f9

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
59KB

MD5
9b9444be98e14cd6565443359e8e7893

SHA1
029260d204b25029d7db9ba8725f5652c74c1abd

SHA256
c10206ce09940ba27e6389715139e63620697a6c9b13d5cba5d49e17992adf83

SHA512
ece1a16d2cfcdaa2df64a4a3fd1424f9e89da2ff77e8ce4d9372592be97c0992c3b9624e298bd49fdeade18f4cda9097cfc97d711d294c0105bd2f74ddf58920

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
61KB

MD5
795e49089ab75e494c4cc720a861d17a

SHA1
e0bbfce189543e9d46678dfcd782e568e770a68f

SHA256
964d135a99e5bba087aed54fe0fd4dbf7ea960dd90b8a369cc4314bd5449c725

SHA512
d4053d3f3ec330a8b45f20cb7a01ae95c569cd721aac1bea1585b2d5cac7ac3f181cfebfd7d6f71bb7ddfb15dafc54a5e72694a63f0776c6d5e8bebeed42ad1b

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
54KB

MD5
0cdeca8bec3cd587ddf836e6438e57f6

SHA1
7f605ba3600cec69954d64468e7cd69e7847ad35

SHA256
1b88aef21c7ed73e3b718b311f3c71f37e00cd111c2667788be1d35aa64cf4b5

SHA512
6366fe47c14c72595fd62ccf5d3b11a50a5b5a82dc32d0c385744a2d027733de15f7b46059582cc3a4f2d031bf015a7d0353902cf16bc560ea179c4e7ebd45e3

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
61KB

MD5
7f7b6c39361d4420865f1d1e3cb4a168

SHA1
87d69b332bff2a591e686f88e015932b74207965

SHA256
b9fc4767adf850271a1a8935237d1c3a179191b496c778084685f0bbb61002db

SHA512
fa058cf989323637c4d173cae2ae2524eccd07d74632ec00391c706918631eec6bd0a460afda425e5b5dafa1a547150b6d2d3614eaeeb2b023fde65ce4bb9b88

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
59KB

MD5
8fd3f3b02af22a596295794bdb8eee42

SHA1
899d99e194ef852f9c8b6037ac3517acf4570a29

SHA256
9a4d15ee2b0b963b4d6c2c26fe92fc0683a082baa9ebd2204fd3103d55c4aa55

SHA512
ab464ae2a97eee2e63484c9f283a289f78c584a10a2a7d5f200502696393d23efcd82ff2e58d9c67e55896d7607ad4b74a15cb652ded59c286667e507e93cf1b

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
54KB

MD5
6d090e9f6ce5a2b2680fba6feadecc43

SHA1
30b73aa5e4c152141934d1ab874a57eacd146ee2

SHA256
5474ceeff62a6e4ba11217fc46485b254019a32445540f0e9ea84e5f6936f557

SHA512
c115b43a6a00975dccd0987ec3f1c05235446b8a4dc4ef6491ee9a9cad0f78ef25df1d5e975225ceca33399a07ff3f716f1633d13d07a9d1268e2d9283a259c2

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
60KB

MD5
c670d8d7d8c24d5b276688033603c64d

SHA1
472fee91f4319df5b35564618dad989a2da9c3bb

SHA256
91f6388fdde44f9a4045dff74ad2275fa958081fb359b2737e45ddd844b6f93e

SHA512
a9e8aa58dab0067139df2814c534539da1d58a16c91f49ce554fac64fa7a9d725156fa96c9cea760e920431cc5d47ec45c27d6ab40bcaefae95a04d909d8db34

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
71KB

MD5
c10dba2d249a8cb52265df883cabc5d9

SHA1
4e616f28444136e63d1af2d63e6437aeecdcda98

SHA256
47f347a8c76fb51d75685240f87af4c34aeae83df6458c60f0c905760577264a

SHA512
951c820dc86f2bf83ec680138622f1d9080569c884f50c2035eda9a434cb4c8e6e47705c7f5ca855bbc769758b1c5a1a342edb82cb9217813d443b47a34f2d14

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
72KB

MD5
8f8db9bdc2dbd96ad297d91433a6012b

SHA1
c0b3a04c6a2d5e1b37e5f9279a4687bd35ee5706

SHA256
a412e665615c9059141a7ba4c3f133d5f966e040f3bcb631decb41c0b3008114

SHA512
a9ba85f356302502d3fd1ac9fc67c5989ad6a5797992fd58e21fee9a3aafb47de009993502c811138db6cd3435139ee27e58591308a3044a08f67a36403a1f23

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
62KB

MD5
b7a6b387727d4ac3ff34ed3a1b082bcf

SHA1
63d748fa95874e93bf6de01d3627eb5bbd657f74

SHA256
afd98ee87f96cd8d95b612a7f9779f8d0e5fb177c7fa72407b00f75cc4644e6c

SHA512
86e93daf0c7b536b13f42bd92a0ea474ba56d6b12faf688f291013e08fac2e868072123b2d1254d662809edbe0be0ba33912921e0d8faeea2c9d5e78bf432194

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
49KB

MD5
5287372763844db81d72e7a0ef26478d

SHA1
0328812b7e99f173c892d1c2081bf0a6272caf74

SHA256
c4402299d1f546c99a45a7da798c780621e2cfca17e080de6f78a32a4b74d94c

SHA512
819f752e27cae1238a5b4ed421d99bdbcfefe51fc99d28dd2756a3dbca3754eba57face15b6194a4904fcfdc5ced54a3672a5cc82d7ec337205aaacccb8e915b

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
57KB

MD5
37f255f58cb1c0688282296c3b1472f5

SHA1
84704dcf2b804955f463591b45b048bd6a23b857

SHA256
f3a05484f5d1368d9f05935ef8e17e1b9d8b3c52783544274000310018d1602c

SHA512
0e8de2cf08ef998cdeae65e9cc1768c13812cc1e788443df545ee3e32b1212eca219bb887d828699d2bf0eb0cfa9e76af660934405300533d06ed004df3fae1c

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
57KB

MD5
ed149a2274427ea4387d680f8c791f98

SHA1
0817da63a25f18fc7e38d873e8a154c02261b5bd

SHA256
43a9ebc8ed498b4f8b9d4b5fb161f408f69c4ddeffeb49b728fad1c20f7b09fd

SHA512
299bdb8780233f27701f65d2170f78134853d2dd57db1affbeedd7e54de844aaebe204e82a7741fd35542a507a5f45cf2ef925dc9ec9729d85a91efa53aeed6f

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
61KB

MD5
67c5c2f7c8ed2f111c5a0bf267beeed0

SHA1
c67598ad5506615a8debe90ca5456fb1b96f6e93

SHA256
b4b25f6fef8fca7ee243da36fddb10a0a926adb3f6b88435faeed1d431306259

SHA512
590eb5f9b48828fc5a89186ccb359122ec91ffa30f3ae08287b39b086f6e94b9e242d654e433f0d6c5aa66c97169ddf637b2039db7190fbd241a9bbaf8b7f914

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
60KB

MD5
e31c47be3ac2a0c29036e72d4eb31d95

SHA1
3ea93cdafe0d49173a0a95f0cd5b07190b36f1fd

SHA256
2f8f52fe46a28e9306219481f7014108a14194141f8006caac19c8745dbc71d3

SHA512
2a1909ed06fd3e71ef61a92016bee9ee685e7144f36c37eb1b91183dc94298a14a12856d1e7e1fb9d7ebe9b878990391cf99f6b4e060c8c79ec654cf1bf16e64

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
61KB

MD5
3fe1b18515cea7085fd0c8c2b815d8a6

SHA1
e567231cd55d39e9a28f3abd8f9a0d3f9f89efd1

SHA256
f185f66f87cfa1adad1fae709a85b69f0907829599b161e6df4ec5f36b327e7c

SHA512
b34f44aa9616d45f3d0f03fb43e1c9864e2ec95cfd460150d12ad92fba740c10036f39f06a1b505ce95783cd391cc5fd3b31af561c5b299620fdc2f0a04ae446

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
49KB

MD5
2420935953757c40e88e056e8ad878d4

SHA1
002da59ce95e4596843a78e462cafa5ed2c61c1e

SHA256
392ff8e9bf21da7669ef2dcda6c4a04f5bc5ed0ad9e199470a49e9a24aefaa37

SHA512
8f3ea10fa1a7aa9ef48058f56035355eb87f2e3676ebbbb834bd27318ad5f15098afe5c325c291dc6d7d945635dfa0a1c4c4239a41e39c4a9c8eed88189ed78a

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
66KB

MD5
588274e8e51b965300a81d0f96c78266

SHA1
0e01a843f2bc77172ecaab7af0bc0e5b74e83fa7

SHA256
ad73100982aee286abe4125b5f8601e4917581e5d4a1e59a8b9eef0e13d3548a

SHA512
88ca99053281feefe6ca1518ad5ec0e37d6a0c1a5531365c8e6a9e7308068b2f139fe0f29fa8ae1c01d989b2e04e902df6029df2ecbc8d01f0ff91e609b7fe27

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
70KB

MD5
18760861d2780a1ec189bf76090f8056

SHA1
4e512b7caefe66397f47fbafbc9c39f15406225b

SHA256
13a6c81876bc72658501d15a9b9107a65a3586eec6122b7d1985273bfd65f5b4

SHA512
6cabf1ee3698d3381476fcd2e2d51d186f223aa871bcaf4377d9e9c1fcb08083caf73afa23bab3171ce639737fdb019c9fa40e68654c0c62b34f14aa95e72606

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
70KB

MD5
eb6f620c154a777304eff6fde7c4bae3

SHA1
9b507a298c7c90c703cd35af2b23843421f4b793

SHA256
929747525d9d774a49a12fc6d1821521bb6dc1d119063d51e8cca6c51f4b8362

SHA512
b44b463623ce76efeda011391cf927a9c1094083692c1028eef75f32136067619fb2c0c254d76b0b1a448297a8537309d95896ae49b9f6b620a64c2b3a88240e

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
60KB

MD5
0a98c70b77099706bbc1d76f2fc72f7d

SHA1
0158a49e63976bf9b13a034235e8fba637dbb60c

SHA256
8794df5a80be0451958c8e24ba1789fe5dbb7b69b37ccb673d016773c40efd50

SHA512
055ac6e5c405e93b7904dac4aea92dd103d3cf1f64f1c73bb098ab7be9d2a0149ca068946b6c895a2dac0a3df3dd5a1c1a0f8ad8ae2f930095d9efbc82ff7acc

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

Filesize
63KB

MD5
c5654ecee9f91377e4b570f65dcee6f4

SHA1
8adb0955074e2497d3f9df7033114ed630041d41

SHA256
b4ef303a32a02b33fafbf2f663ddaf15180d5f9b3a37ae5722518fd997a4748e

SHA512
b462cbad8fd1f4449baa1b3db6f9d1132a1d413f3292100cfacdd5c447de98bf4c0dac2589f769e327b2b1bea57a525d29ad386289753aa8396caded97926537

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp

Filesize
64KB

MD5
788b2511fd6e892d2a143ac3dea81610

SHA1
c56f4603c4a4626abb2ffdfd12ac78264f3f6770

SHA256
880b1d6375f2b57fc95da88fea8ad51e9926024fe1006316f158819409648fe8

SHA512
53d17afe82dbd73354a0172576b61b075e55424f7d60c068a21a5b65389a20282e95be000e5fb1490e3186d582bdc34f45e2c99ada92f78cdfa50b4072d73315

Download Submit
C:\Users\Admin\AppData\Local\Temp\_active-update.xml.exe

Filesize
51KB

MD5
61508df9ead5fcdd572305504622d0d9

SHA1
797252b10595a5ed4003ddb4f00ea914bc58abd1

SHA256
c3714d15f0dd1a8b4be4f6b103923c060e502d54ee075c0dd338972c12e5e5ce

SHA512
9a2311544f872b44bb0d7a21143f909c29a85441f6b1032b4283e90c02a54ce9421187cf2bd57a48d4a149255823bf9342a92948ad40ab594d2c1289c45eee58

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
49KB

MD5
967ca7bd650d79b4b852911473649c1b

SHA1
cae8acaf2204c6cde7e281e51611fa9a7403d81a

SHA256
895442aa92f8f7646f166d5c79a6708aa5477233b223b67755f84f643f973024

SHA512
307223463db4984e01b85ce0e5d635ca567c3f63227567ae6713826658c1279829b93a62773c65aa7a47b5d51fd5118ebe8e8ed0da52a0bc3a6d280e8596b416

Download Submit