11019b03143b5bde75acf972f2707591fc4ea6fddaa1ab0fdb2620428573315b

Analysis

max time kernel
119s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

76732afdf0b7c13d835b200a85f21960N.exe
Size

124KB
MD5

76732afdf0b7c13d835b200a85f21960
SHA1

45703bf51cdbd6466383700fb315346a530493e6
SHA256

11019b03143b5bde75acf972f2707591fc4ea6fddaa1ab0fdb2620428573315b
SHA512

76a6e6d16ac2f9a301b904900c9fce40f355151a0af4e83c076fefbed9477c9cd6ed4caaf0dee7687924d2da499978333566558fe2d45a32a8ced12bcf749459
SSDEEP

1536:W7ZppApBULcfpHLcfpX2/Nw/NwmxL7ZppApBULcfpHLcfpX2/Nw/NwmxMfp:6pWpBwchcV2WxppWpBwchcV2WxMfp

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4647) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
5076	Zombie.exe
4840	_NetworkPrinters.xml.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	76732afdf0b7c13d835b200a85f21960N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	76732afdf0b7c13d835b200a85f21960N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp	_NetworkPrinters.xml.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	_NetworkPrinters.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp	_NetworkPrinters.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	_NetworkPrinters.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp	_NetworkPrinters.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-100.png.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp	_NetworkPrinters.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	_NetworkPrinters.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	_NetworkPrinters.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png.tmp	_NetworkPrinters.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	_NetworkPrinters.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationCore.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp	_NetworkPrinters.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp	_NetworkPrinters.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationProvider.resources.dll.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp	_NetworkPrinters.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp	_NetworkPrinters.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.tmp	_NetworkPrinters.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76732afdf0b7c13d835b200a85f21960N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_NetworkPrinters.xml.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 5076	2332	76732afdf0b7c13d835b200a85f21960N.exe	84
PID 2332 wrote to memory of 5076	2332	76732afdf0b7c13d835b200a85f21960N.exe	84
PID 2332 wrote to memory of 5076	2332	76732afdf0b7c13d835b200a85f21960N.exe	84
PID 2332 wrote to memory of 4840	2332	76732afdf0b7c13d835b200a85f21960N.exe	83
PID 2332 wrote to memory of 4840	2332	76732afdf0b7c13d835b200a85f21960N.exe	83
PID 2332 wrote to memory of 4840	2332	76732afdf0b7c13d835b200a85f21960N.exe	83

C:\Users\Admin\AppData\Local\Temp\76732afdf0b7c13d835b200a85f21960N.exe
"C:\Users\Admin\AppData\Local\Temp\76732afdf0b7c13d835b200a85f21960N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe
  "_NetworkPrinters.xml.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4840
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.exe.tmp

Filesize
124KB

MD5
0942204b10a6aa25b530efbdf0133d46

SHA1
9339ca4fc13a5e62d3b2a7048fc34d4cb7a31174

SHA256
1ce271c89e9cd4beccd8223cad62b09d3a480d984ebb2b0a45bf6e3cc12d9442

SHA512
8ffb3883daaf8cef2d33c3f12c63f9b1c6366d57e67d1320c45a089eddfcb72e5ce1ac1c3ae2a4bdd891c97907cce7a32546d435751531b81356e5dfcc152d0d

Download Submit
C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
60KB

MD5
25ea2953809cbebd0de6e0cf153beb5b

SHA1
900a034070b838681d020ac6ffd37c2e146b929a

SHA256
a39cf5afe1259d5ef3a66b7300ec302554ad9d6efb4503e7ce0578875e2a98af

SHA512
9ce33dd553a618e1fcb15b092f842d6778e9a8b7ac6a3f7dc223ab334ccd574e9828cf9989fda7db180b8016d492931842749f7c0280a5995b77c9e23cbe3146

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
172KB

MD5
d9c203109c391d4bde3dc4d1f8deea85

SHA1
78f5a787fb25f2ba499f3f028e80d3df74946c6f

SHA256
64578e0f42f22ce07486d0fd5f955fff2d3db24327c36eaeb3ef3883517afc90

SHA512
c093089dfd6bc4955308d1ea12a616d08f3afb4f86ad7362c39be6a46d3b3d1428adc11d2ee205fe5b963e1f527f315c84ef1e3ef244d083bfe4c8c0fc625f78

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
159KB

MD5
c1eded330b14d736fe22936f269c020c

SHA1
3281f25ada5bb06cc2d43ad2529b3da6c8d4ed52

SHA256
19fa532ad8fbab43b17a006d27cd160c7adf23a9b8b7cf3bcc46b2f1b3cb9d16

SHA512
44823962ebb0570548d83f90b0f24761e7865bd0a34c53a8527e99196d1fcc45de9a04535644f321f219095fe4b40b8c37f7b23ef2b656b897486dbbfe8beed6

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
053eff8cf8e89134feb08c0084173626

SHA1
755fd4957411f388656d13c0089d9593a9d81461

SHA256
4898f58d49b896692779d0a6cb1846e3ef06fa1666e3edc523e07320bc3c6cf7

SHA512
b9e7f541bc194f9ce3a500464689ddb4697e0ae80aa12b8ae33cfd93d4bc64df7121bbdeb2c1466b6248601f23146997f59698de195ca18f6d08f6cdf68448f7

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
604KB

MD5
80670d557524c8c38e765da1dc5e9ad1

SHA1
2f49876b1076fb5c912863e12e4e35ad6eb0271f

SHA256
b56b7556c350e2b08efefdab68e8292aef33e4331dc89b8173bd8176ca4d1898

SHA512
11ea62dd73d96566d239f9c50e7ec212ca7cbe4645e726c401a55cf121ae44c1e2eb50681abdb42465d0fe6109d6a365430d6763db55c47703c2db34aac257b2

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
273KB

MD5
35a0e4ecc04d3226042be1bc2b2ec1d4

SHA1
ce5d2f76c1ae5a866afb300f54e50cea3178f306

SHA256
a67ade383f15d6b3bff236f856ee444484a5b879dfd328e50d8735060a118333

SHA512
ff778f30f32d33232f66c45310f92f3373b85cb015c594935f58747565eba51037c2c8f3d19effbf86b9ae9e0db2969586b6535414f96b03f99217e67a0c5a52

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
252KB

MD5
26a30a4a6c1ed478173ff2db26631982

SHA1
aa515a4d9eb4f6b1481ff485039010028adb5816

SHA256
a4691aa8d154951bdc8a4456e5d844cc7611c9b8edc7ca15e1dbe734cccc4e3a

SHA512
c645035a3f3bce2b3b4b0ebe0e96f6985634bb93da87a0b692bf9571e875e9c6c79d0e6ab619b4581b6e69c54266f2011c37d634e6845d01cd10dadeb9386e81

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
994KB

MD5
38ee45c0b5ea9746911df5bb5d21c137

SHA1
82bc2705397d8fb1ee006dfc0e4ac9ecd0e0c837

SHA256
1f7e9c7cf5e5b728d2f3c6ad30cab73eb5605c2ffa5c7fbe09f1ea9e39c4a60c

SHA512
20adcf2ea5f8dfb2e22ce4f98e5ee6e44e834d9a378199c7ee2020d237f23f1b8768befdba4db2b4c48763dcca0ecb25ded939f9ad5188ff887e157e3f959b53

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
744KB

MD5
259fb0d02fa05b4b373962e5556f9f83

SHA1
8012f2e0c9c681180539a70c92370e13f9ff4cd2

SHA256
15e579cd35ffe14248860fafa76b7a3951118bcf9c3d64785cc410f4fccf93e1

SHA512
227eaec7866a85ddd7aa3cc0eadda145f406d4eb1300e4a509b4a315286438d5a6690394cb3e35b068513352af56c6de93ad49f0535e1839df3611eb0147ac95

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
69KB

MD5
022f69a714627189dd7864cfdae1e04f

SHA1
77d21348f90ad470ea235d851b7c5f4a5a13bdad

SHA256
134b4dc95b7cdf667939935313a16f18d1e215d3d4782d401c5954415bb640e8

SHA512
cd1349131864d9f75b1c8f62007c4793066bee2cf880af94b0505afb616b2a4b603e8cd57d639c3509de985a13c047e1799c39849b8082d13f3083e0b2fb5960

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
67KB

MD5
eee6a43c01e2f9e5439f2f24f3e4cb3f

SHA1
c679c20106d4ae0a8b8cc0a264994a7c34508d95

SHA256
4d28a86305a58eb1f955380356148f9e47648820adb9fe64b09138ee4fee75ac

SHA512
b8d71682f886c03a2d66685bb5988100a3885d8f568f2079b52fdfaa9d279b9015a2aeba9e8dcd130ff05b8392928be76a1713924ba69dfb85cda4446a75b69d

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.exe

Filesize
72KB

MD5
b12bc02b16fc6f77fd973bf163f3f418

SHA1
464331836f4dd8734abf871dde0ff9e5bdf1a5da

SHA256
48b0554674b3855e231e5a031bdfad88e4c0707575f92858cda036c14d7ffd4e

SHA512
ad7df8547d2bf89453ccba7a2d125ff411049cfd8c5b89cf7f605f36482138ac9b289b8a0db033bd4c32d438fc6e6c0d615c1bc01b06080ecdad801a1b96ccc3

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.exe

Filesize
65KB

MD5
ebd98f9892ede48b86128c62988f5dd4

SHA1
302e39b37199f435e0460f715df8244c65afa9d4

SHA256
f85508fab54788492ced8b62fd3267334db5908a6c6bd6a444f7998503888eb7

SHA512
b043458dfd32c465f5a6158f9effe3a9187acbee0d19d3f538bff0a16262511227bfaf9d2a497bc943ca3390b784cdf72348bd884d6cef0fc2ad0023cd9fb3ac

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
66KB

MD5
7646ed1e7f008f25923ed3018d07c403

SHA1
c8026ee6b5622957f07382fe0780f12f0152981a

SHA256
540ab31a154ddf2ee2f140c091d2da5f4ef836cae2510e472c081519f3050d46

SHA512
6d569832a3019050a5559c743045f5e06bd1da70efe1d57a2f6cd1dfd38159d1b86c8df149efa7bb1a4b4e8653b1dacb5fa8b183740637d8e74fb7361b574f92

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
68KB

MD5
2d02be2c3def7f89fba01b12cb9d385c

SHA1
668c60c6516a0b3bdea4afd24689de3324654cc6

SHA256
5bddbde2be8c1a649928b0973e67665585b94db7e57ba2c8caac684a4f18cece

SHA512
5cf4a21e58e9d1d628adfa5d5aa6334f156eec27a59163244d9eac752091cbee38a53303ab4f34454190d952e2fe28167a42e00a5a9e52ebfa98baed977279ac

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
44KB

MD5
25118d781f2740ad52d16f20eff92895

SHA1
74f6e25cbea2f2f57e19faf60d1c3b772a85325e

SHA256
fe9585caff5fd6d5aa59d60e208ce81aafc7ca99a0c15e62c1ae47469cdccdfb

SHA512
332f3db3d48ce043c6f6b903cf4c7a02c833113b58b8c2c84d0bf5aba269ee61b7c9bbbe91fb5e4be93c94dbb3086edf4bc85972e7fdc89b4b235da6a88149ae

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
81KB

MD5
73a4f1475574c1b857aa6672c2525097

SHA1
a433a8dda1a98118dfc06c66e844c45d196970ce

SHA256
df508a763352547c9a8fe03fa913bad2ee46e0b1787c9e65a45887b0edc04a54

SHA512
9b4d7f3353baef9b34b7da70018d516e1d5704ba3243048e21c59370e3a88b87e6f7cb176143f70e3b62195f4621dc7a089bab40973c4cf8f4dc19caa122ecd1

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
75KB

MD5
5e7263bf50595a0f32e6e01dc0cb8995

SHA1
195bccd51d4248f7d487a081d01cdec01cb934bb

SHA256
367c69764fc78987e57488190c52314204c7ab9ba5258127edbd0ed71151bdc8

SHA512
ef2d453d1fc2369af213554f63f1585fda9b9cda7272bbe9b451c66ba955db5505de5ad8ad85d80555b97537b7fd4df3afafcf6c99395b1b357d443c997328b9

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
77KB

MD5
6443c8f0442ec04d2ed7a19c09caca60

SHA1
39d8313ee10c6e381b0e14bf02630c95597c8f9b

SHA256
d5bec4881fb5ae38f291bb2bca89da60cf116019a3b8f9a83dcfddfc162a2393

SHA512
e8411f5653f55c8f93b442b2855d1ded176d4d4f144383081a5c285143d4ab888b405871a6393c6e854fdf49bc2e701fcf470e0e5f6247f4fb65ed33f5441ea3

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
68KB

MD5
8ab00573e0ac43cc58e740c8358e542c

SHA1
c52476b69529b0c3f972c26ded30038a1811b7ec

SHA256
4bf2d67c6e6b5bb6befd4df27b0532983aea123359db34a42609d43adef3cc8d

SHA512
d8546dd164f32bc53d8572a9c08dd712dcaf2b01f4bfa3b085a8f75b978fa5a4250c8eb2ff6025c51246913b9ea72878427514cc3dc0c1ca4b8562e2d0446a11

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
68KB

MD5
7bd7d1054fa0fd491c1513b800d3d5fb

SHA1
ee9fab4aaf30138a75c10efb80df2523c93063cc

SHA256
2134c7d4b9c99c243e8a5cbea3c9e498910d4ba7403a3cb81fb0d485520568bc

SHA512
69728982c0b19617e4a84dda541088211af8f69855c6da995308d79a05978f0e54141d4b5bbb286dc646237d97e924f83a9354822916e6d9e215214e84214865

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
78KB

MD5
18e82eaf7b09315f54205bd5da3019d8

SHA1
07a77300a5ef7c913cab860a7b7c58984e8fc993

SHA256
f45ecafaa19df39468cb99141e4995acc0f913f0ae1068e130ca8a99c3095c66

SHA512
c102cbe891d8202d96d305758efb82eb12c3b592f701f12241d57156c164ad4bade6eab17723a353876f3ce4e7bf4f93c12c4475f40203f7d17cb5fd5f798bee

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
74KB

MD5
12b3bca83db4ef85f982ba4225aff5ae

SHA1
5b96e60a6634ba4d57702a38a8f3a12fc3df483e

SHA256
dd3ca7e364b6f92cde2ac1ed3c971e7f3adb7cf8e9f7e3fcf8b4d1752911e2ad

SHA512
bbd6cb45f3116e8f110b5f8cccae7276d8732eb5a43d6bfbdabc2c9b80215d238455ad27fb591f9b09a3a5ae1ed80a8140e2fcb6eaee732ca0a7ec79c74c12ca

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
76KB

MD5
08a44ad668ff819ab91e9333ecb40402

SHA1
31c7c917f9ccab8e8aaaea3c387143c253feb6be

SHA256
aaca05aa0569361738889809388e20c727ee40bac777bf83dc71e0a080913d12

SHA512
062d1e20891184575507c8c7777074dc908f179b23677dc7c2321a1bd7814f0dbf4a2b7468b58509f6177911dd2458a81f8298a1a01fb36d3650d4a37f4bafa1

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
82KB

MD5
3075965cf1a9ab1fa55edab0f8454187

SHA1
86f12612d3f6629d925fcef65c19a973d874bef5

SHA256
b006f958897ac8e5344f72db073ffa045a92259687122129ceab931d0e557936

SHA512
1a50eeca0999466fc9cdc57a17b6a6c7d4902b4a162d7fef4cddcb89b5b21a21ffc3988fbe8d9f02ece13086f3db3cf1df057d48faf997f17dafb8e231524281

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
72KB

MD5
ecbd51943e4a1fee08a29fdefe14e47d

SHA1
6f6bcda7c3fbb7912c7512dc43386134cd240f12

SHA256
0c1cb72ea839e7098ce1c04536a60b5b52120b6d4fbb06d09174d327c4c7df46

SHA512
123f44a9df708871ef6ae4c72edb5cda6d5dc7c49ad92a2d6c951e31ee8ec2fe47b44d0e88e19e3dc4d089592ebd372aeace1e135b12f1ed01efef4cf0c68583

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
72KB

MD5
54e5e8d874806922ea3ccdb3b5690401

SHA1
649057d6487dc769863d47e3d9f83be23298d66b

SHA256
d89f1f1b91b23626a8162fd977f6ad5633e5bbeee709b5d5e887aa7a7c361d0a

SHA512
a00860353f7185c69cb01cdbbca5c5a0c5b71dea27eb477d4ba8b1a44e0f5e85bccf0a92097188b6b2f1eebde41bafb17158b1d49ddb1c40e117f88593fd69ac

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
74KB

MD5
fa593bce1693522a4a932b938234aaef

SHA1
daa69721d7553026ee2aa9d5bc1550674c144f73

SHA256
26930493dabe024d4f44da10c6ea88e4dd6f324a367fc9f78f4f5324c8ee00be

SHA512
654db9f8e6968e24ab02989234812934f42a9516135a523b1cee83e900d2ed7e99d619ac3688c9d70510df28832010aa444388aa748eab2f308176bd4c7ac357

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
74KB

MD5
9125d3ce9d3f08cdbba4be38ec2b6025

SHA1
b78fd274ce2006665d2f96fcf7c8a4e9dbe2be1c

SHA256
8c93f7ffd59ce870fc50915f98001b2601b4d22df1442024b8e0bc29367aed41

SHA512
b2e8a1d9bd10b7ed626884420a657513ee0706a5aa5d40ec4cdcd1859191c5fade94a56c623f8667e66529614577c9952c5a06808be30e7b2c32046e82f6bf5b

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
76KB

MD5
5ab4f4b4ff8703ad19c32941c314f9f5

SHA1
ac3c79529dd73e0ff57beee2a28ef9a646617c6a

SHA256
ba7c1c6eabdb0823c3dce3b4d2d99c0a8f57fa926fe791c9a1883e84c790dc0a

SHA512
ea3a4f29a64b66d55c2adccc3b259cb51079c9c3fb666f02cfa3a28f3a0503dc5fdbf4afdbe75332a1c8af94227e442d553f2d02ba4ec846e4bdc5d927c5bd09

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
76KB

MD5
a3982bc5117ab89f70d43d67ec568116

SHA1
4af962e60585220ac3bb7f54a28437e774b7e859

SHA256
6712d9999e9efddb7aa75c56091b49de526541bcee7db7de1decdd8db41a21d7

SHA512
ebca6a0a460a48952b35e453209175db2b9c3ca480b67078230e503606473d87f01396cd8a05501158c006eb66ac235e8b6bf7bd613898c41bee3072356dda66

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
73KB

MD5
d13ca98b54cae958b8e01fac9e44226d

SHA1
51d69a4fa15540dad68e52934544ad62abd919bc

SHA256
c2c3fca3a02530050e6970b39047aba098817b355b7f5a9573ce64884da2f57b

SHA512
d07ab1df0cc830d55a9f165f387543785c2c33f3cc4b6a9c065e7d531009f3c6cb3227aa1393cec0ae7e72ce5ef299e7de73a5d7dda0f2a2ce42f69d2b1f85c9

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
72KB

MD5
54838f358eb8981333d5f323f5591c3e

SHA1
d4353e740354df972ac73eec45a06a74cbdca35f

SHA256
46c5313bea818c803e7d1b390f6edb15ecf166e78683453992ca2973582ceb8d

SHA512
c3cfb2f107ea57d10b6ceb25f432db1701dd8cd4ee0293422cd8eef7855dd6dbc308d22ef1f9533296158a8e223f8d9167dedbe0cabd5a17e0a499d0e959986f

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
72KB

MD5
ef3c5e0c0d352aae1e41a242c4c9c5b9

SHA1
68ca3db42ce96caaad082cf7e622b4a8d6c43de1

SHA256
256e0c94a3e669c05c967091016067a6f41c6c09d5354e24e61d968b655de795

SHA512
8494562d22c9e18322a51b865ff8252106768780534b9c28acfb26b3546a6b89ff5271b331eac7e7a6c7829ecdf167c203f941d85a6cf91bc91859045ca77455

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
84KB

MD5
414fd562fb68cdd5a4786f7abeeddf56

SHA1
d1a77fb7209f559cbc60d5043a30b81a6f4b9983

SHA256
b2f1a93ea6932baad9603c38a6c300450edb27d6c901284ca3a9f2c642dc30eb

SHA512
2391394232f6fddfcb8e3f381e4691e4229a4eb7ce0a39cd585b959d3c8cc49849f843a11823111e3748e0437913c5974ca25a8e34ecce6f1640dbee9d473379

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
85KB

MD5
31be90bf25c604d4954bc717618cc9e6

SHA1
f825d3759074dd1f690599786fefeed060822604

SHA256
23d8c07ef1d8b2f44a589f37e734f041c292dbaba7770443760db5e6b1cf896a

SHA512
dfb9d54d51bbf9959c9ba37516f023049fdc53f4e432ec266713668085540189a76a94e2e3488982cf92efcef6b7d6d644d5cde738565b55d0ff5e888d1c9510

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
70KB

MD5
566843f18b68a4e0211aa96640c08ebc

SHA1
3b6caf225fda4935ae1711dff25a9adf88840e67

SHA256
d7eaeb613ba7fa6cdcd2123a8c8df915fce2637fe565335a42c274b5b3c34df0

SHA512
90d9bb5e9a54dd5041e15ba8a55f350218637689b2f1655e00882567ef413b73baec1c19fe4161dd7d439717b03659020b4e00e611799c4acba6108e853c6f1f

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
69KB

MD5
9d3aee52bdd1b08c9b4be390ab81f3f9

SHA1
6b55ea132ac4ef561ad37cb94a75aeed947c1a9a

SHA256
f2d9aad8e87339bff6f02473cd92762b40883bbadd3ba8449c17aec5d2ad7f1d

SHA512
dc0f233aab3a07f74afd3ff5a1a49e755156c894a9a851774d8d6984a3fd06b7fdce34d1da8c251340036cac9d579c50d2fd25d40a24a6b8d5629ac8e80a0c06

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
65KB

MD5
aa03548f1a7c358a7ca7449a7828d725

SHA1
42d4cfb0df4fe6a40ce6cc9afda1f50d4aa2e9d1

SHA256
cb9429321cd94db78d3d20aa346bf1f799f59aec1196facb96616bb2d2fd9d79

SHA512
c6faa9cb83caeaf01056e206ae093999ea30fff952a4483805f657139eaaec059b2423366c22b8578bacf85e28976ffc71c53d1e7d53ecaa519f3f4bb5112a29

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
77KB

MD5
ef1235104378bf72c714fa88675ebb8b

SHA1
2c3203c255d9260fbc6a0ca4520d4f7a45f1d521

SHA256
85461f6b914e2f932f791c4c99aea1fd8dee302466b6fe9cbc17f80877780297

SHA512
40fbfc2051adb70608561c273b2e7133d829169b21e1e7d8566e0d54d240b98e43b51d287714424e0e9cb918eab7f54ce7d74dea669d228f1dfd612e16c4e03f

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
69KB

MD5
214e3755b48d7c949eb68a1bcce8b7a6

SHA1
8d5561338ebc9ef9a26a6780dc798bced5b268fa

SHA256
d57e6c0ce88026d611eb97f39feb9d77c1fc859eff6d22258b24afc252e82756

SHA512
bd61cdd5cf2b1b150852d4447e604cba4e2d5ef79e4299971d9786db2f5c0bbbf6c1ce7223ad68c39a34ef0b58d4c893afa0be355c9e65956a9bfe94e775317c

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
67KB

MD5
3d4ab7a3dcec82e73a1e4f67e0444482

SHA1
46bf4f3f4a214d8f0d7ab41f4a5f58497ae0ecec

SHA256
fc2bd36089e5d4a4d80b8712f5e740dd058aec265e93b473f17eee339d1aeb4d

SHA512
59e3a15bda26399d76e9e55586a469d0856d64b5d989f77c5d0658cf63dbc9f3a88103fabaf3891ce8fdca17bf6adbdd8278ba3f0a8f7548d1bf9f49f8150520

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
79KB

MD5
43899f65e2dfa684939bd00c18042bf8

SHA1
bb2667285e571333c1d115dc82febf9b0e22a515

SHA256
9dff7b2484c503b67e5e04cddf89d31f6af05b3a2cd5780e559e63faa84b1ee5

SHA512
25f8db96a8426c79727a84e507d2d9b06af9c74b0e66a31afde69d61f22dd3719a8b53ce5fbf9b2ddab6c1cf6122bf86fe579b8991ada8b0a031bb92823200cd

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
83KB

MD5
d401b7630ce067e3089632b087f8ca5c

SHA1
6119ebeedaf6b42b3e4547d0940d12e995d008f6

SHA256
680694b8793d7351e3cf1a8c12da9731e3c264da12a1c53ebf02dc7f92adb8e2

SHA512
f532aca9ea97337ecfcaf6209cf50925f6b47ebdd2ee1d0bd212e0e8d98cc8ba6dad7f46605835173fe2107e865293c5970673865597f5eb5dacda00bc4e8938

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
73KB

MD5
c0c94f4a7529891864f2b7418c8f819e

SHA1
6f845ce0301d5963e189946555a5d1ea6bd391e2

SHA256
49a7fdb2ca0304deea96436da68963bdcb29384c7bce4b3b06bc74e40a8377d3

SHA512
1f5df5cb4adccf57ea29636d201cd12f55ea33bcefe11364b5ebcb2ab9e46ef94966f0a794867c8313f1b81fa3eacc77e87030a83b15a217c1f37fa3c6ed720b

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
70KB

MD5
d5aae7bd8c994dbe1446aab3f51ac588

SHA1
b54cca2c8a0880594649fc3dd0123d91d003d634

SHA256
dd0d324058a08d4235fdcb276494812c12287b08be2c6007643bc0816c207993

SHA512
8ecbcb149a8b8593a123095476135c258b1248cd5746a5617aaa444ad9f5a007026acd488a300abb2932df0b276c7a84b948dc793080afe0e377f5b01d34d9fc

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

Filesize
76KB

MD5
c27bf0bfa4b5c1d49a912b389d0bef33

SHA1
8b5bcfdaf45ab46eaa520939c0020928d743b37c

SHA256
b567976004f5ebe07ea47f44356b3d025ebc77d43260aca8bae38cd99b987520

SHA512
32b737c5fa1b1dd52d7b409f839d2e5fff48a94a125ce3f98d50466525a93b00eaa1fcf877f1a14ab522d0036f7ca079cb6c13954a55d302a8b5e994cda6b46f

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

Filesize
76KB

MD5
abc61cc54d6497fc223ff0ec079b84c8

SHA1
576a6ff4c9e9cbccf44d47ab30966b239e3af6cb

SHA256
5d975543b2af6e9f8dacff03fce6139b497631c15a5a210829ef949b4c22ebe3

SHA512
32c43626171dbe30c99a83858721e346c8b57a313b4a513d4d91735da466eae905407dc09e920d3f04c5b4db53178be3575862ba8607400c88d6a5f68a7feaf0

Download Submit
C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

Filesize
67KB

MD5
8b6b8226a4022881ba3a33cdc4f4bb6a

SHA1
dab39bc7fe98ec844ea2f702fb870f7c6199980a

SHA256
587b10a5b663ddaebfb5cbe980cca25ebf84f68e9bf27fa555e9258821c890a0

SHA512
0e5f0126d2cbba80a6d482b2341470141dccfdd9df2507e2d0636e1bccb68b307c1a79d2510a30d45ecdb11497e1d6cc0496634939faa914b8d246405189dd01

Download Submit
C:\Program Files\7-Zip\Lang\sv.txt.tmp

Filesize
69KB

MD5
fc2439870b64e3cf9592622921ad40c8

SHA1
6b51377180681abb7d40c312627b5ff296a0042b

SHA256
79035053556827869c93195e2b229c24765570e051bd851c2a9e7363bd5c1eb2

SHA512
30a1d777394e3c928d18976f9c876a9517ba1e1aa0586879e3690fd7b04864d696ff99795ef261a3203caef2f1b8467c17e39d9b8a31b0f2536872055a5dc4e7

Download Submit
C:\Program Files\7-Zip\Lang\ta.txt.tmp

Filesize
76KB

MD5
1b385e448915f0edc937946029e63566

SHA1
d48ac4536ae2dfd97e43441a46b96c81d6f0a835

SHA256
7f0b9d7d5928f270904b4789b1f6fa852c756e75239409b1f4e6ae1cabcf735e

SHA512
cc9b0408f41d7e4c11a4c9bdfa05b38241657d340804abdbfb979ea5856b07bd485457c4adc96cfb423c5c82545d7bfbb06c745efc5044824c8891a5f913da58

Download Submit
C:\Program Files\7-Zip\Lang\tg.txt.tmp

Filesize
74KB

MD5
c459409d566a782c0e4839f02d348f26

SHA1
5489a46c41ab0c47abcd358a88719bdb2694cb66

SHA256
9d4791de7d060bc3249e7a2d030da14c56767a8c7ec0f5ce6931229572fb6411

SHA512
05933971fdf2a35a17d65fa5090b3b7f246c12c6fa01207cee6321d6f2cd9fe6a0e60ee636d59bcc62afdf0932396e9e3a72b291555640eb5e24b351e1755fc7

Download Submit
C:\Program Files\7-Zip\Lang\th.txt.tmp

Filesize
79KB

MD5
04f66dbe361ea3a0e3ce13594fcbdcc3

SHA1
4a0cda06b48e0a5bfc87d603e2d6296628aa42e0

SHA256
76bcaaa894dc4cd575e54d6ccea1ddd08d0f7f37cc4ebd397dc4ae14af325b6b

SHA512
7c9e38d31a1182224026210ada726a1c945b95b6c0c3e70de3ba9d416e22b908610379fba638bb39bba34807d7920f0fe9ad96e5ead4cb0f26cbd15ca284bf4b

Download Submit
C:\Program Files\7-Zip\Lang\tt.txt.tmp

Filesize
73KB

MD5
8acc35e4fd1476bdf198662bc669367b

SHA1
0df0d83603aa39969df0da8a8136a00e1c9b36c1

SHA256
dbb1bae13a2c7b02b94bda325aa3814c4d6bcbe20d787b21840c4765675a61d3

SHA512
a95fd35f3ddb23ca38ac2d97e1ff6c7ae2813da252374377e71d57f223df0a40c6ebb810a44cd72bdfb78746713a7b6d8016a6ab8e84d912914011c5854b94be

Download Submit
C:\Program Files\7-Zip\Lang\ug.txt.tmp

Filesize
71KB

MD5
4391e5afecd7a2977e082d31ab056c66

SHA1
0e1fb0c9e74134afe249318c154810124c585311

SHA256
328c99be072768fd64fd656046d9230b51eb21d162e7d0899fef599432e3f2a8

SHA512
f6256ca63f6cad63173643fe99c45c5ed20dc94b41c900f6c6953f94a989b75ae363f3281dbead9c0c0bffb95025e21ccd618b2bd7a8fca0495aaf3b9aac6771

Download Submit
C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp

Filesize
69KB

MD5
c3468f7ef0f7824c9eb6fa4b9d6af609

SHA1
f408e62c7fc860ce17b7f407aa3d57272961f3aa

SHA256
e74adadb080a99619a3e2f31742ab7f8c18be5be86a605b8271705ef7e860a9e

SHA512
b2fece3de73299897eff601e23a9081f3a217ddab8883bb90e687bc97fc4a3b5f71ca76b1c3556ac316abb3c9a367359bc2bef3724473e805b3196365199e716

Download Submit
C:\Users\Admin\AppData\Local\Temp\_NetworkPrinters.xml.exe

Filesize
64KB

MD5
dfbb50ff023176ba4b99e095aa8305bd

SHA1
2a01b1929664a37c966a53266126226ad3b0be9f

SHA256
b9875a7cf569b1504b51b870f08425f9d264c5cc1a8e8d3cf87f148d3c2d8dab

SHA512
1c1909895bc773d31cfbafadf6aeacf4b8cacf5d8b71cb4ab03a46a40d14adcea4fbf41f832238e088f7abb38b89d2ff19355fdc4f2ca3d210028fc67cb7c6d6

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
59KB

MD5
817c22c4e32d22fbdce43b07b7b3739a

SHA1
3c33d375fd0285775863e66356515f7e823d8702

SHA256
c609df9cf466b2624003547904f22ccf85b9205b6ea2bf51469b72cea2727d4e

SHA512
00124c8c2bfabc7893475bdd7a74549504ffeb959bac4eb71ca5d6e6aeaf05562fada82d51674bfd5c62bc030dae37b8ca29d55a5db249551516b7104587e1d2

Download Submit