0ae98b387545f28972fcaca29e785c1eaaa88e006bbefb074b7afcc13587aa9f

Analysis

max time kernel
120s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c545377f3fd1e9c82f0071dc896e1500N.exe
Size

212KB
MD5

c545377f3fd1e9c82f0071dc896e1500
SHA1

72341c573261168d73a764295bf35c0524acb0ba
SHA256

0ae98b387545f28972fcaca29e785c1eaaa88e006bbefb074b7afcc13587aa9f
SHA512

327a59c1f61c5cc2ad81a6e8f888f38ec70d39eeb57a7a7a98da4ed87ece5aff47657446e4bcf09aeccf20c3f8833d02f9d4d5b30f747ae0f9114fc819624fc5
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBd:PqFF2Ie+effy1qFF2Ie+effyQ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4389) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2828	_refcount.ini.exe
3216	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	c545377f3fd1e9c82f0071dc896e1500N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	c545377f3fd1e9c82f0071dc896e1500N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms.tmp	_refcount.ini.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	_refcount.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp	_refcount.ini.exe
File created	C:\Program Files\InitializeJoin.docm.tmp	_refcount.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp	_refcount.ini.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp	_refcount.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\optimization_guide_internal.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	_refcount.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	_refcount.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	_refcount.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms.tmp	_refcount.ini.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	_refcount.ini.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp	_refcount.ini.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp	_refcount.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp	_refcount.ini.exe
File created	C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp	_refcount.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f14\FA000000014.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp	_refcount.ini.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp	_refcount.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	_refcount.ini.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	_refcount.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c545377f3fd1e9c82f0071dc896e1500N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_refcount.ini.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 3216	764	c545377f3fd1e9c82f0071dc896e1500N.exe	84
PID 764 wrote to memory of 3216	764	c545377f3fd1e9c82f0071dc896e1500N.exe	84
PID 764 wrote to memory of 3216	764	c545377f3fd1e9c82f0071dc896e1500N.exe	84
PID 764 wrote to memory of 2828	764	c545377f3fd1e9c82f0071dc896e1500N.exe	83
PID 764 wrote to memory of 2828	764	c545377f3fd1e9c82f0071dc896e1500N.exe	83
PID 764 wrote to memory of 2828	764	c545377f3fd1e9c82f0071dc896e1500N.exe	83

C:\Users\Admin\AppData\Local\Temp\c545377f3fd1e9c82f0071dc896e1500N.exe
"C:\Users\Admin\AppData\Local\Temp\c545377f3fd1e9c82f0071dc896e1500N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Local\Temp\_refcount.ini.exe
  "_refcount.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2828
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.exe.tmp

Filesize
212KB

MD5
28809241a7184a06d7676db813177434

SHA1
70adbf3f6043148540a786c9e76d72a4687bbe16

SHA256
90ec5bb07c90641f6b0d37a2b0d78e00e808d80c746804f5e977f05958a5c703

SHA512
050180c5916e7373cb891ae92b3051faa2dfbf608f06bc549659bd72cde1a83145f711627cbc5b10c09d09c097d7b879117a5731e58f942b7afbf2173d72b887

Download Submit
C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
106KB

MD5
ab2f91e183205f1ff40f474de6023196

SHA1
a25139b077a18bfb2a417ff9a5217a0fc99d0971

SHA256
dcf4e887fd190ab683e31b68743fc8f8c83591e8320a8235b60aca8795863400

SHA512
d02f74cd67af519515061ff4d1484d34cf7c36df153ccd5a076543190a0bc444c87f40762b46700891898e2d14ab25f3532477575faef22d045bff49b2163d79

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
218KB

MD5
d34e1d701a30050a1c3d63a6d3fb574d

SHA1
19d00a605bba0944f75f9730283270fa77d34f2a

SHA256
abe3e64f630d6f5b019b5a994a503921b90a053492edaf68cd9279a70022ed9a

SHA512
c79ce75c5c8dab1813d5bad8d7c964ded972c63dc2d18748a5a0c6237c17a0d1c804b855ff1e19d27e8915eee0720733939c28e0d77af1c50ea19cf35ae11549

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
204KB

MD5
284bca77d1d1f5115be9df202e3c27a1

SHA1
11ff3f1355523ee36fb5ee7d4ad30ee21e309327

SHA256
a810db5947222e581e9152d77f1eea5a8f246b7b9105105e37feabf7804cf1e2

SHA512
77243cdcdbcc24f46f0b90f6586fa7521a9f542c173e5e770288b36defddafb33831d9bf66a412c7b47e4acc8440ffd8cb68ab0d82a478b0ea3f23ed6e5b468b

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
d6789f434ca99e9e17b174e68b922d71

SHA1
e467340754bca9dd5defab222a13cd40d0c88920

SHA256
eb00802c20e2b971623413dc279d74d521ba2d1baa4ecf2a64aaa6e40fac37c6

SHA512
47c09d33a95bd905cc38325107237352ff6a0272364aeca719ded4cad20719dc0ad8185e8c9f1c2213d4ed6ed8e9aa7e20b6b9cf9bba0209def707ecbce71f05

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
650KB

MD5
61da5c44d61dfa29c8297149d99c6575

SHA1
819f63636c7b8693511e1d067cd4ee1ae31e8a00

SHA256
945f397ffbc34cc8d83bd64729a2ab324e149edfb18138e71a8b1a7874094148

SHA512
f4ddadf4b7074541e695e9caec0d2b5ddfb8c1e732d998900ee62e0fff323965807bb3a425b937bc6f48c93dfa7426df0f5268e88073a504f6dc58e40fd872fc

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
315KB

MD5
d5ef1b3451b7c7009d11ab0933352f77

SHA1
ecadd1ed91d02f7902eb9da5151283f6a31e086b

SHA256
6dfc2ba54d228cae9564f0e75f7be44ac304245354d8d4d172b339ceeed7c60a

SHA512
f2b707ac95fc77dee8b929fe6cfc822943ee039a6630e0dd5f201094562a2cdb836a8af380bb48f3683cf669a7801ae21a09235d57cfaf13d5266652eba8847d

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
294KB

MD5
30bb9622843a76dca74583b955b1dbf1

SHA1
ce45d480a57021bed33b2a76e5b88ccc0d56370e

SHA256
d8446676d1cd124c88f99de17a64563e7ec7ebc8907a3cb7d19d07322b97bc34

SHA512
9f24d1bfa4e55cb6b266620ab71ad97248bf54bdf0bc55f92678d0cf5c50d7c381986096752189ffdc3682e50322573e857659be7c52d42e482e4d0016c4fa35

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
3819d12e9fc9e0a2e3613ef023a4196f

SHA1
7be7b92c16ec4eb29ec0f828e2b275f373d2cebb

SHA256
50ac02cef4cf2332a383bfb0e818d5644e29080e034d828e4edb4ab7dd7cabfa

SHA512
0b10e6d258d3bc01a4fbd17f8147531ba6d89c508c743c33aa74f7c4df3239cd9e0af5352d1385a5184b262d6b0f573ea01af370271b0229d0ded2da21d53914

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
790KB

MD5
d14ea18a8039eaa665795d4684142ae5

SHA1
52fab9229dd48e2e7f4761387e2c9a6423bf1fac

SHA256
8f92ac088eafc31b408bf4c66035a607e2e603070f5c4e43c7a1c290fb797286

SHA512
0ebd9f81760867d806a0e4f7c788bee509fef3e7ee0d639e34caeae9728177f41bdc1af9fa8588dfedab1e7268864442b44c9cff24fd4faa3dc945835ecc8110

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
163KB

MD5
a3e9f7568c474d9df4aa8895f1daae49

SHA1
b1d6219e175820003fa09e00127b0b35a582ad44

SHA256
91aff58d9c82168770853dfba719dd55bc4caaca6c1a79387b5073e6e812fce7

SHA512
df1f071a7316f99d4e53210f6ba23d2b2944f5d6a55b8dc2aec5fbaa4e5f2d028645809a0e02a5934cf4028e8d3e55a8a40e260b66a06ea027cb4ba83b16e1b9

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
115KB

MD5
709a06221a846f3133b1f21ee42755e3

SHA1
20b79ebe39c4745a64d68b1a06f32e1c1ff1ea05

SHA256
6fb931fb808e74327eb4695f207714e413ea2810f99bff19bb7a24a43094c6d2

SHA512
1b7ec24774d90dbd29e1d60d2f6d7f58d97ac8e320ca6c585deee69a425c12c31076fbbd4f2acb22c976201b3d1de9aa6d39c6c739a598ca76a971f76ff11e21

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
106KB

MD5
0ec29b5fac130350aa90cce31aea5a28

SHA1
21cbbd997b30773bd981d3e52e69c9dd73e8fc6f

SHA256
439b46620bb3c6cc1afc3efccaaac3cbdec262ee91080a196f8897327188d5cb

SHA512
d9762e7df87cdfc6b1bc5ef108bfe319d65bb3f287cc1345d10d04ba804efc3c0e508aeba995c31e8d6ec8aa50fa462ee1ea1ab770dc8478a3645ad90a7dc675

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
118KB

MD5
06db6b1f58f5f91a0c3f8a0ae667fb01

SHA1
951525cf6671d47a32078a0bb53dc4fd2ba1c8f3

SHA256
f4bafc253b7a4e3cc5bbd277f6413559dd7c053678c6b04bda90e2bf078f4125

SHA512
60a2c57480bef25b5137bcc8a5d4f3e16869f1d7ad17b2ea66a8fb2424e544fa3a6e6866f35b81da3545857ce56e1fa8ab65b341f6fcc5158615284c1ab1a6d7

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
111KB

MD5
47403c43116c14d3a42c40aaff2ce7e2

SHA1
6aeddac27b00f29af007077b33e9fba2ec7e0614

SHA256
667067304e28e75d9437fd00fdccf5a61637c8f55e1c11ffa85822e56990611e

SHA512
1474a9ed93e348a5cd1b875929b3b070d5c49dd2a5e68092ad7ed9c3a40831d2098f256ffbc2a77738e24770c57ce7f9b0db23caae3f45ab037d7267656fdaad

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
115KB

MD5
ca6dae40efdf868dd33c52b74c3febbb

SHA1
cf6c16ef107e14f18c90cf7b153ebbb24654ec87

SHA256
fca79ac5c3a048c630426a44c299cb0c5dbbbce825a0f30e3bf6efb1bf8b2da3

SHA512
cc6b32356f8b7953c19b68d9315c93139aa6203d0f3efae5d1c5a2e19fc6b01f61530ca11ae9876f825f8705808074d09724448a1ea61dcdf985700e0bb3f8e5

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
106KB

MD5
9d8a36922f92460e90edea44ecb547de

SHA1
2b193153a80684bf9e4ccc0f89926e13eeb652e5

SHA256
0a52d9a08b63556438961b4f0cc6b84243aca9699a4a76b03fb8f9ab8284c288

SHA512
9315b81b681812cd3e07db809adefb8c4d97d5787de7c0a87bd4953b0a06954386434d7b655e4f9720e1d7eb1fa879f112c765ad95b7c772d641d61777c14386

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
111KB

MD5
602a6ee2218fcb2fa45baf4c91a0ca31

SHA1
af0b96679492d5635b912fbb3ed8d3654a8fcd76

SHA256
7b42aafdbd0e2740b4a7f2fe97c0359e0626a35a3b77b2e3a4345a70d9d99082

SHA512
5882b7eb59ba2659691ecb4804bef3660fdc238243db528f71f86c899dcfaabe3246c27c129709761727404f483ad1ba1d1e471faa3b661e876396e85ffca7de

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
115KB

MD5
26b8bdf19847294cc7d0224b2eceedf5

SHA1
116066023a02fbc0e498346a30c6bf8af435e9d9

SHA256
c9ff46dba4568298dd8f1b1569c5a903e604b32f755d1d66a4e4bddac0658d74

SHA512
098e29719016aa497fb4b670cc23109305ed79e9742592e3ea90e3041cb9d67f204a8d3a721be2989f6b6499540564453be622150983a4937569dade530ac821

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
116KB

MD5
4118e8ae5e340f156444302e32c106aa

SHA1
4d80314f8c046e4de4e6a5bdacc171b163b52386

SHA256
cece8bc75a4f9135fcbcdb87f2e0e8f5f0c7232c5859235b1257921b753302b5

SHA512
c078d61083fa06e0cd8c10907d69428415d206a6a2546dcc27ad22955793be2842127b311d078f77ce852be0869bd7e584c4c1bd2fa509b316b20a25d9fce06c

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
106KB

MD5
9d515a7ac7cf58d09477e052c208916a

SHA1
36fbae9a754e5caaf7b0e7ccb0584eeefe97cba3

SHA256
9fb645f12955f28062c09fe53a1bd3a4d52346df0e1f079e211bc87954dfafe4

SHA512
4cc787020ebb078de0d7162e184a8b5d0f05aef5c10b62181c49d3adbd61d18ea4a6e6ab8d56f41226914275667fffb6400472d047d656eabc8b9aa0ac137c6c

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
115KB

MD5
66c986dc8bcbf7c4b5af8a4086b55a81

SHA1
2065b7ac02be62b4789ba30e35cce3671b5cdb23

SHA256
adc5ef50c4296ff1d2d7a311e3e87b456b9a2f6f7a4b5dd069c15a215cb5be79

SHA512
40b42802abd070a69b8de8cf2813c5e54b0cf353f0c06886b9d20b88f2f4c8f19a1c591a11962e94f44a5fe6f5238f2ae406de554ae45fc00507dcf6cd59f2b8

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
111KB

MD5
9eebe8626c9cc6cee15aa2293847d006

SHA1
451fd53de290ef6c23db6272cdf4348ca20ad5a4

SHA256
1a23908ef0cb8c7e232d17bfa09b84b84f6830b1b5e443417146ae462bd28b0c

SHA512
87630a42bdf09df12ef96a47cffeefc855f8f9940592785fad64030e984e3b7ab3719e523ddaa3d8bcd8cecd9c94b14323df0773bab4bb338351d45eb08c82c9

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
113KB

MD5
d1fd222071b7919c952f7635ba8da355

SHA1
2e1558e42207c3dfb67d63a4c1972be4be31e695

SHA256
519d5933a6ad0ee6499222d17e1fee268d27039c3bf70f7d1d287b6fd703adf4

SHA512
836063098dce226ddc47e1444413af367e97b437ab2a0b102a99956e1d0cd14ea1e3b454dbf830c0ce00cf3ea03d2394b1cd282c1065e240bf3fb5de8cf6ee88

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
114KB

MD5
2768a2da7d3cee0a647c6c0c63ca7d0f

SHA1
b8fea3dc059b33cfef6a98a1e2f29a9f73d7626e

SHA256
86d31d29edd2f2b7e2842667c6b62f7140303fccbbe91477a8ab5d4ca2191ee6

SHA512
147a414bda021c8ec57a3759587166691d998f6986d4a073c509755306ffef7c796ca5c3d38063aa4930f3754883ecf808ddcc16c8ad9cba565cb55e77667510

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
113KB

MD5
51cb05f6db18d2bb51ba59b2fdce3354

SHA1
df18279ef58ea31d04ec3779db5b3956cee31d1b

SHA256
7d78f2ee411dea9960c8d21fce1703c8d0b2202915397650114c9b21b742fe52

SHA512
ff460f9f390e2ce79dd0c16515d1f5cc8e35a95ead42567e702b2749eda6a491f159ae68b57d37e5914087372f6342758fefb32817363658ce54825351f5ccd7

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
119KB

MD5
b57e6ab98b2f092a1a08bc7137a4964d

SHA1
4093369aedf33cc254573c3fdb0dbdb39e02011e

SHA256
8f769a3b06d6d114ee3f15aa5a178385e9ed3e38885c10c9a14bb94759eaedd9

SHA512
6a27096a5d0f75f2ac48f4f5429db3df67a73f0118b0f9090df02c6b374c60845175cdba8b9772d362132171cffa9f40f6304b7f07c94ed00e9165ed8096e205

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
114KB

MD5
90458ec6170eb5f3c289ef4b884487e3

SHA1
cb8bc28e718629e220ddf715230a5323b25cee5d

SHA256
991e8e48650c74f8b547c2d3b71587acbe9cbda6a7e4d50f76bbdeca47d49d58

SHA512
4c6ad8309818599867bdf556417258aaa6c85e4bf952fa350b67b06d87f422412ea8f137280fde43c6b9605a53d950b420f013260d019984ec59fda28c1ae31d

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
105KB

MD5
0ee6ba5c07b3d80e12a1db071228e999

SHA1
bd029c33b5129520a21654887ba4776f1436cfb4

SHA256
2387f9de2c456445ef0af358323b0ff1e80359754db7bc7d570c9797648a69c1

SHA512
a7bfb7626411a7f76a0f700be00eae12c30cba433bdc66441e725c07ee143d58c6c4f92fbc3a6df795dd514a4433149ca51c72e13beaa0803af7c0e03088dc4e

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
114KB

MD5
591cf9d3a8cc21a2224092dc6f065506

SHA1
c9ca237a50e150036f9600b098d72bda58025edd

SHA256
2d80ef0b5cea061619dc43ab78d5a2153c3886bead978f75117489a44e062641

SHA512
1e697373e7ebf004aa89d191e619dab3472e64185efda142a9ef674ac1374959a8f8c6aec40929d82d95407a0ab9329953b5719e74dafe4df606c2357827b4c3

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
123KB

MD5
3ac78486796573e8aa1eacae7d882e4a

SHA1
2e15c512eb86b370d5b58158c1bbf932069dcd4b

SHA256
7822ebe5c5d986634971c23649c8403b6240ee4a88e2e2c8b20d161163ef8a47

SHA512
a14dd14b1f3cae05091f390c81a620a0d0bc1c124f82d3dd837c61f6d85d03e28ed1e6c5fbbbc2ee020bc8493570592554c2b3bb3b1c6d597a4830b23d57d98c

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
123KB

MD5
c43fe55ee29aa391f443dd7659425876

SHA1
4ae0d2562b34b93e6d9be8666f8f02e153ae0d35

SHA256
560bfed99aa5acd41f8d59745a8695f7ffcb746ac8326edfa4b8f926aa74c291

SHA512
da46b419650fb48d6fdc3eb7dfa76ec39947191d4c7e1cd1a4a49f21b2c5fd9bcf57349d212c14da4f47d2ba8b715960c802caff7d98a3f6ba39872539339ce9

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
116KB

MD5
ca49fd2326f605bf4474e8ad7783c5aa

SHA1
f087d43456dd5d2fa612535a77889993fad21202

SHA256
f1c63a64841aa969e2a25e9fca89e796e38599c645050a1a2d5279d83823a9be

SHA512
269670061ba6442ad8c0f2dc1b31220ff06ffdb7e764de1b4fcc75917994d3b29312fb4f8045808f5b5578448eea6287093a5d42d37cd1d8e7d6cf867490c3de

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
119KB

MD5
73a222abf70a4db015f51b7e4906daeb

SHA1
6b76329a7e5acfaf13c1c7da286f1f7ccd19a6d8

SHA256
143f425ea85785c566b44f5f06fb3611a7274b5bb9faa05f205b4a24d2a5de88

SHA512
ec51739d2bf48c350d453581067266dba7e34c039d9b524c25fc12aa80cd87ad3f41583a618e74a05a8043c68849f40febfffb0f745b18aef3a0468c6f32593f

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
123KB

MD5
b0b506b725eeda46b96f2c9def561f95

SHA1
057417ecbf01778f8b6ae1d486da03ff1c7d58d5

SHA256
05d7564fabc9d25b68e34de0a44411c6efeaff63c59ab9fc56f686aaf9417a4d

SHA512
db58d61f19b32abfabbd6c77e1661cf4c942ce39a86142a7d6f89046263b3ff2c1b792dc86fb99c3fdcdbf8e300a2d52f142e5e6606041537b2f7a1df6ebc929

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
116KB

MD5
e42ca1cb2b8e03d159cdde62b33a1a6b

SHA1
87beac494964e1bf198dce1f70d6427b78a5428a

SHA256
bef7897feaa8a459b102fe87d5651a7aa7b89c6f3a800925f3b50fd2dc2b9fed

SHA512
48b9fffc9ce15217f894c95ec6279266d5748ef9dfdee791438c4a2216701e51618d2e95c1a3bf51b26cf7327c79b34ad3ddbe97100e24de60210aa201a1689d

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
118KB

MD5
267322da623ede8d5516f581881ed9e5

SHA1
fb24096b7942ebc3f7d4ee2c87e4c735b3ab14a6

SHA256
1e6339bbaeda64ff32be1e8155d07e9d04a3c90dc6b1e77c2444c3446a0e409d

SHA512
df3e849bd904c681ec4e48fca5d28ec6e8de08b43c67abddfda6ab090bee20b68edb7e544dd4b0cd37ffa3ada446257e7c22ddceba34fbbcee0658725da91896

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
111KB

MD5
26442d24f8e4a487cf891dfb5bd86835

SHA1
76230c0b8df05684a3e5a575e9a3b8de10086b2c

SHA256
588c806cce1c2aa87aca82c1bb9df4ba6de64766288e0861fc9a076783913b6b

SHA512
d724ae8360668a70d82aa55a2e401a4a2027623efb6407c76477a33594f6f20145cf33b36eb854b33b57f5f39ea36eba41750a593e8572cc22dd81a4ca333e80

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
113KB

MD5
18ccd0164c0f7513ed8923f285aa9782

SHA1
3606011bd114edfafcbc8f6b62ee290b5bffb710

SHA256
a85eb3e2cd51eee9a307ed718d568306b969e856ba5b56a04b051ec340343c9a

SHA512
6cff622567309eee6bf38e52a93b468d396d1cb8089aae49e1e8d37713945aaf68c7249ab4dcccfee06b548a30db47498513ea4dc823b60df1c45f37dd34a7d3

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
115KB

MD5
691001fb0ceb1247877f528c67cdfeb4

SHA1
2231e70dfa2796cff46dd162fb3d9fece06688fa

SHA256
2388779a27f7e54ee11bd5687a9b21b60bba26a8aacea62d3fa0c8f1fefc1b0f

SHA512
e6853517356b34e6027f7eefd79be465531b26c2dc0f0cb960a3f910e3f51e27c25da58f271dcdd46d2990f4b90ea12d4b18af484bfae2a8aee58d9cf72f212a

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
111KB

MD5
e46c6dd2721e63037629cdb0afb12da6

SHA1
df5f0caf75dfeb35e98b2975bbecf886ba166eb7

SHA256
071c0f575ef33975b076ea8874f45e5d771d7e998d423ec002ca39ebd5e49e21

SHA512
14fbb517e762d579ff6ae765cffc33beda2dd1382d5c5c38d26915b479aa212fdb0e56a4516faec3106d63b779adda52a4afcd2ee6e8840e4f8c1e980cb463f1

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
114KB

MD5
e890dfb81ed0796bd085bb14d9185884

SHA1
755e528726a8734db6462af44f19e4a24cca2922

SHA256
1975915a9492f26baa72395293235146f63b39c5de3f2318afaf5e1192b8cd1a

SHA512
2e4260b830ed0d17475483fe0c77717805a0f7f6b4215c40b90439558eed55f971be03f0b37474c92cb3c74d9dac87be0ffb53db04a0f704e00a9337be6427cf

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
114KB

MD5
bdd4876dce65458ac4b446504e0d8a21

SHA1
4c2f90afbefb09c571ca7806756226b97eb3e149

SHA256
d07633e77092ec5744b001ec6acfa98f0599e9835b4fca0daa31e84aeb8e921e

SHA512
3c332ab9b0840ef7c90d73346da418b9561a879136e1a1a4fe12fe5f184341f6fc9637a79c5e4a23c41de334efc660482978923b777c1c04efbf32842ea1696d

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
127KB

MD5
4ffa3c391f580ac81234b179c6d8f185

SHA1
b2bfaca0dce97208d9c75a4565936402f489bc33

SHA256
2ae4277903212eb5e1ab496eb196de961b2db6259adeb7d9132a059ce4188007

SHA512
fae8217c92e88c1ecce05f0d785e3fcb8264f1537806e69d1b8d6a21d2f86e9afb4b43a7275b26ae303c6227f35f855eeb769fe068ef42c785c5cdb4e3abdd9e

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
115KB

MD5
f6507c312bcdfaaa60a6767e53e04a81

SHA1
3087573fcd370b2e657a2daf45e2b37f404269d3

SHA256
636d5f997d6e954a0d327a833c1a7fed27723681d37a928e6681e20a6ab384dc

SHA512
5975972c1d94d7f8aeb962603ae33975c23a4c3697146be51a805d5751c59149fb020dc26d0dddf178310d1369146ad2b3952cd2ca0a770bbd178c1e59fb099a

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
111KB

MD5
c8d270bc6435d44177e60870a56c0184

SHA1
48d79b3ac8a9ad51fafc5251422aa2fda378237e

SHA256
cf94fae50b3a5063e6e526b561f0503c6ee92dfac88673bbec684ac62e08a853

SHA512
e7755b878a06c1aec22d0a569ce58689365267b5665319c18b57d213670cead749567acf2b01e6dc2f1f3db63764ece87a11f8b9a7c277af29b96b334435126a

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
56KB

MD5
2e3846d06f9601d1f591f46a84900b27

SHA1
ed45a02cab879508801b7ede8350a187f8d448d6

SHA256
57332fad25d1ee552cca3e1954313f1d8753b20bd0904430fed802a465fb2dfa

SHA512
edf915d4bad6e454f060b1daf620d25736bae8ba2374040710594daa2454910b947a76c485ba8451de4ca054d3c7f5377ca58f62fdb1c53f4bcfe50c2d685bea

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
115KB

MD5
34c1f366819279d9b92b72f389a0d644

SHA1
e063dcf4ddf553669edb9ea1e70a712a1bb69421

SHA256
90102de6b7091822a33759b4ba0164ea4c24d3cab4ced7ee7314e120f1b6a1f4

SHA512
a466f5f1e74c2a3776b5b7405496d2c61f26ba998d22471a441698837cc5e1668378c471bf1205621fa42ede18745fc72a33fda7949873a83671b3d75140d149

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
114KB

MD5
6f36cd7046a2f14da5da6cb73aae5441

SHA1
50a916d1222c0eaa563ccb9613673d7c198a8a93

SHA256
f2d57d650d4ff9a53fc7a696d4773b9db163d2ed6310f367154aad41da39690f

SHA512
fe7b7233c0971f2c56b2b16677104a181125e0d60cca9f0848ec53e98933fd6653b4bfab5716ad40ee9f47307fb59f246cfe6ccedd7ca7c1712257c43b94a325

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
115KB

MD5
93ede0b46ffbd46819d5b99f0bcac44c

SHA1
44ced8aec60e21f7d6d246fad4372ea300971802

SHA256
0adf3802383129c71d47dd00c8bcaa2ca63b0d69a3c6d9ed27aae0eb2c58ad18

SHA512
928d75090cc4d32db37f312b9d181077b6d869b3d2aad97e8b79b18679585408ee1150967bf72021e58c336776062f384dc63d20107c26f6aeec7dcc2552bd49

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
113KB

MD5
7ab7a2b41103e44ef6f7fa2af4769a5b

SHA1
ff87617bab63edd2ca39c952d650f8f6a7fa075a

SHA256
ebbdaef2be103ff4f1a547efa927d64305b2a6d5b9f24e37e5456c38814b88a8

SHA512
6a285d5e014524262bc5c7c59e3ac158410d33af55b5ea4dde6850decf09e2873c8cb47ae7a35badf5f2fc9438e48babfadad1380a432d7d50a1242e4461234a

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
121KB

MD5
434d5be6967d1904787df4b450e87bbe

SHA1
12bac7560ebd3dbb4b42f0c82ed07c0437b82559

SHA256
73d664788ca9daa08d7717b48596464d7fda9f32757cf0ddba4b0b127acf929d

SHA512
fc9cf77b99d3f0637a9f9e250e6beb1fbd81a30d2e62d52d0ea7bee030ebf5eca9c12160e5e4c1685eca2a5dac0b1f68789fd4546506ef48d66acd3df5da1a38

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
124KB

MD5
4a966eafe96a19cb2da0226189e103c6

SHA1
a222a140f37cfe805642bd85c42429bce843e597

SHA256
153fc5d6e3d30df6150d54c9926fa8490c9016f54e4b05f0ad27bc93e6916dd7

SHA512
01fa8480b565abbcfca3bbfef37e39e9ac5411a17fe789647d2ff70ffb58b9c4b8bfed5bd95c4546dbac623da39a475c00f6ce6a880b618676615ba918110907

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
8KB

MD5
b70d64abed5a12100dcba4fead027392

SHA1
0db41829607b74bdeff914507fd6c1434f7f8455

SHA256
8273304bbffe3122f8b2b81ec8b93112057f7b0a0ea47684a7c850a9cb119b43

SHA512
cee26943b379eadfa3d00651c8721d4ea0998060377a6fe9ac277c2630e9c4054e97af0071ed498c178751046c49515e3dd6ecacd4e8dcb371e824b45494692a

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.tmp

Filesize
113KB

MD5
f543b519fa46f92c61ca70241bfc83f6

SHA1
3f66a09f0385fd30c162fc3416773da0cd8bb6e1

SHA256
13147be794c26c2703c4ebb48a62030c57f814327c2932b2511d3ad0d9d3be70

SHA512
917face398ead8e2164fcbc4ecc16d578e361d57e95649356856196f2c9bebf1402f8f611587e9bab3a79eac5c784c76b86ace1fd94a8aa75f3d7479fd8c7c6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_refcount.ini.exe

Filesize
106KB

MD5
c07d6c6c3199bd3f9dcdfb1ab14d8da4

SHA1
e3d73dca76ead075e61e326227eebb6ce09301ad

SHA256
eeec31d49fb312408b40cf3d68907d5ec226a5a4fcc321cf9e8cdff565e2e478

SHA512
2d4e22a5cb1117212a3f6b61ab8b09ca741e143666acc18a90d3c275de08eece9fc1636f4c272feb152e2a32a2b7f697f598fa22c6277ff9e4fb495d7fb1faa5

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
105KB

MD5
8d4c78af510b364d283d613f75eec8b4

SHA1
d83a0886c2afb80248a851202cabaa9cff0ea6d4

SHA256
bf9a3891face6a46afef47497996fc63f1ae04d230921ee254b1b4989cb87afb

SHA512
6742a3457bf269ff6493461fef18b19c255067487ba82d75476e6408c7622a23cebbf13406ad72e23467d51c61ccd7cf472863f4bf5f6b4e6b38e60f7b1ccfe0

Download Submit