8b86238eb2034054384a1455b85d742dec15493d19ef70b86bd10ca0d420df0f

Analysis

max time kernel
117s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 14:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a1c0713736b441043cd09684f3b746e0N.exe
Size

110KB
MD5

a1c0713736b441043cd09684f3b746e0
SHA1

6adde1f4060955c803922d9ce7c0cb429e06b42a
SHA256

8b86238eb2034054384a1455b85d742dec15493d19ef70b86bd10ca0d420df0f
SHA512

7d608864f65f505bc2bbed1426cc353f0bbb9774bb682fc1b6f6fa6981efe6174c15a2ddc086e30d7811ec6e6e268936793759d29bf7f10f09469f54ef0a40ce
SSDEEP

1536:W7ZhA7dAynMdyGdy7YRYK7ZhA7dAynMdyGdy7YRYMXx:6e76ynlu9e76ynluH

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4672) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
980	Zombie.exe
5084	_Word 2016.lnk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	a1c0713736b441043cd09684f3b746e0N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	a1c0713736b441043cd09684f3b746e0N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\MEIPreload\manifest.json.tmp	_Word 2016.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	_Word 2016.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	_Word 2016.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	_Word 2016.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\en-US.pak.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp	_Word 2016.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	_Word 2016.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp	_Word 2016.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\blacklist.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	_Word 2016.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	_Word 2016.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp	_Word 2016.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	_Word 2016.lnk.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_Word 2016.lnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a1c0713736b441043cd09684f3b746e0N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 5084	612	a1c0713736b441043cd09684f3b746e0N.exe	84
PID 612 wrote to memory of 5084	612	a1c0713736b441043cd09684f3b746e0N.exe	84
PID 612 wrote to memory of 5084	612	a1c0713736b441043cd09684f3b746e0N.exe	84
PID 612 wrote to memory of 980	612	a1c0713736b441043cd09684f3b746e0N.exe	85
PID 612 wrote to memory of 980	612	a1c0713736b441043cd09684f3b746e0N.exe	85
PID 612 wrote to memory of 980	612	a1c0713736b441043cd09684f3b746e0N.exe	85

C:\Users\Admin\AppData\Local\Temp\a1c0713736b441043cd09684f3b746e0N.exe
"C:\Users\Admin\AppData\Local\Temp\a1c0713736b441043cd09684f3b746e0N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:612
- C:\Users\Admin\AppData\Local\Temp\_Word 2016.lnk.exe
  "_Word 2016.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5084
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.exe.tmp

Filesize
110KB

MD5
ca7a81cae1da705c691e57a071efc1cb

SHA1
43aacbc7d22467a11e4acc8eadb62641cc6a5046

SHA256
c9017fc801e6a125f18424e3fc75f8776e20ea2356cd38fdcfa239ecc6771d80

SHA512
05791a49936c942b90017d513668f3d928cfca4c94740fac84494f48674c75aa71e4c7a165deba563cdf6b047b3af1cc1e5d651930b900b16950d50f94da7c9c

Download Submit
C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.tmp

Filesize
52KB

MD5
41b8cc20e90f4f717e2e6545d2c2fd01

SHA1
268a0d94e16ba562429ba4968c2b510cae4c6f55

SHA256
3d3818f60da21ce5b530c7e252c870fd768879a5d936a5326fdde7157703b5a6

SHA512
f9ef7f4423d8355991ee4d8456ecdbcac1b642b64393c9c701892e5f50532f005062076caafc6f988fd8ddc080eb52668af9dbf400650f799e00b9a00889b0b9

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
165KB

MD5
d02246cd0c60b4f8ec6210f556ee2f6a

SHA1
a58740929c2e1bcc25027417532b3f2b326fe79b

SHA256
9e9b797a913721149a808c6b4630f42646f1ccf8c5cd65c4c647c94258e89b3e

SHA512
d2f47f7198c935829522624e9c583f15e3bf3a9abf2c9f2efdea023b6160f48949f156e0764d7770da18bcfaebb4a73bedcac6c5413d8ade54cbed68d204815e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
151KB

MD5
67d948cfe1a2b21d0fe168db05e7bd23

SHA1
0232fccc0d1ed7be1e2c4f183643ea281d0aeb65

SHA256
4e0152177028a1b161a797abd8c564343400085367f98b53ce699117bfcaa347

SHA512
e13924c3d8a559789d9d55fe50954b4139f30f974dbfef6edb2b0f594c111d4d268f911d37d0a078127183c3abc8490a926a694d860abe410590879e722df796

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
df6b5a63e6b22a24de53fd8bfd6115c9

SHA1
00384c9e5f34c6f25669ba79b783b67f2c195524

SHA256
44558bdd08c85873d34d2bd75202aad124381d42216167df330583238bde45ca

SHA512
3bec629d7f33571de52013e66c89c9002145344e78c157dd63bb6f74bf67d24e17569f41f52f35a95180ae718f54b8d152a1537314cf2848ee8b727c56270842

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
601KB

MD5
5f3ea633700c64d1f4dd574b9159a35b

SHA1
fe8b6a7f4444390f361097d78a4abc816be3cbab

SHA256
058bbaa30ac78be10bd52cdf77763711e01499487bf6c210bc282553410525cf

SHA512
7dc390a3b3a5dfbdf5d61be2a4915e54b92267c5a7bfee8e20d04ca81fc42f26e4a6a54b1af07ce435848d5ab519eb260628211cee3848f0798afbb49bf3ace9

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
267KB

MD5
45fa1da30e04ddc6f4d21d001f572910

SHA1
ddf3cff0e6dcb095b6b58fa6603b5b41557cdf45

SHA256
7cf66f1b130b732050b517a4393e2478427dca93c7b879cfe76e002a3022c75b

SHA512
9241b31da25d77c8bfc7d15027f6ecc0241779b9ddbc90b818c7551d6249e2dd520ee267f8eb3bbb014306580564ea4ffe20e16ff1f3a5e2a75e1b9f4afdecdd

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
741KB

MD5
b1321eeaabe8a4375f00671cfb0cdb22

SHA1
e5bf9523d2c0217960c9174a9c5d646fe2f8c338

SHA256
4fdf1cc64ee88caa722fb7245a49a5351453fdd04dc4debd574e2a46a94c0194

SHA512
e144d7d4ef71a6f59f362b9e358dc580c63889b92ba01a221920a527101d30081aa5b81beca014f9a0e91569496a884c18a940d22718284c623741e4a446dacf

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
62KB

MD5
f1f70e6e00c7e18d57548520cab63773

SHA1
52625747d2ef901afc43df15197d259d0097a8aa

SHA256
018e1802c37078eb05b410df7e7f0b3f5b411e28aaeb04da931f8481b7f46c58

SHA512
0ffa7cd458328c9550c4e36ee245ae7ddc07c31805f4341884e267a96ad468af41f228fe70c3ddf41fe9d1474ee4b5df7f50427a3c65899529dfa7e657f59e0f

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
60KB

MD5
a0fabd5ddbc3f1fd471335ef603ad560

SHA1
7b4a453bdd905db763ad5863534c9e4d6ea5a0a6

SHA256
c3cd6940e38bc04bad92540169ad8ac0b258d29b3da293f414a36253a3c9fd5c

SHA512
b1d0d37c5d2c5532cc42a0091d1583a9829da8f1eeb7b521ddb4b7afb4dd2f178711ba595ff6029ba1821d480a7beeb27eebdf751250da065b82fc0a66dc910b

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.exe

Filesize
65KB

MD5
2ab6f4095ee1c6badb7c116f0783801d

SHA1
30da69da3e003cbd1ed50c4a60ac4f9c67e3d822

SHA256
5c15fa0bb28f3d1b70126371427f29be8143ee6c24445862b7466f567db5d003

SHA512
a98cbfbb0a6f15b13a3f85763931975a835130af0428924f1ab5e07caf01a67a4b6a60e962b8066698014b2cf681e513ace9ee6a92f7e0cc0a349d4b1d028cd3

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.exe

Filesize
57KB

MD5
574d7b65c115b30348c79c01c21539d9

SHA1
553c77e6c39161188d25d207c16348fe86ecf64d

SHA256
c0f6a51566ac1b570b88621c96d48f2bea3e33ddb6778e3b183ccbc22339cad3

SHA512
c7d3f3c86e24ced9b5a560c147c3053140b74cc1e76411bfccb7aff2ca6cf01944a85b0d3e262eb586f050f55cfa79572ccfa8845a1b9ca9e1cdad7eba8d899d

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.exe

Filesize
62KB

MD5
4a58fc5f2ada75fa5a610770e8279164

SHA1
f2115fa7bbedf2b3b0f59e0f0c70860b17447f64

SHA256
8b33f71f89c78057f4ea1f0b4fc9c06066b4bb12343e5a69b0e134f059062a0a

SHA512
37f04e754bff564a0baed538383043dba6f62b17318789e12b6b64dfd9fb3a1a8805ea0c15904141df67dd43e4751d8091cb668dc18b2e148107b6661263f443

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
57KB

MD5
1b67c9c571a2f54bca660a06e7ee5ac1

SHA1
b1e6238ec063257ced1eff17ebdf72177aa6bf26

SHA256
85c7f3e688a1f9f0c94991d14d593cdaa0ff253c310bd8c3edf868244be60123

SHA512
f3b86a23a81a74365fabea76c4eb8f9cc56ac1eab188f8a4d019db45a2a3176c3c2c52b7dfb3cbe12284456ac37482797376ba0a3d94c09a5bf14badd937ef8f

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
62KB

MD5
9ba5ec56fafd80d45a76960f844d3f34

SHA1
db36449e2c59c05346a8cb60bf25398c711b3692

SHA256
d059c213447f9906c8aae6f6d60247a733bcd759d4f2ec051a1400a588fdd415

SHA512
39a5815b5c4173438da91a50033e2c2c49d7bce0c2326f81619b82805e213540e30abfba36fd0a76da3833bc3c9f9820c115f214db67b85c02d7ab847f0c5a71

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
64KB

MD5
5445d168ac279099efcc2198f9c21710

SHA1
4cac560890f53ec19fb2adff8de0a4f5e2604cf4

SHA256
e018e0cdb61949b3b3824ca16a9e0dba80a1738678db907165fb0dcb4a950562

SHA512
c358ce5cf454dd396dfa799508cc0e53ce765486085ff7cb25b0c2037ebcea48b2b040d71b432afe257a412a39243fb136dbcd97338db6f3d2931bff6ffd9939

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
66KB

MD5
ce69da9bdc28fab471eceab31f50d400

SHA1
c0fdcec36ab82b013736d601364e2fe11c8b41e6

SHA256
cc0a0830d81c5cac5389ad63d758020d2d13c0bd6cbef8f9910cf378521fe9ae

SHA512
2f0908d3bfdbd58f5d860e5f4514860a0b42055b82b5d2743563200b125db6e3aecbfb39b459528a57f13a77e917405ec1c66ef0c5473bbdd5cb2af3d4afd863

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
65KB

MD5
eef768f250e4f32930d216b22ee64a27

SHA1
33cd0aa4a69baa3139d96ff2c340815fbdcf2989

SHA256
09de935aaa3b7f01bf0ee655b20542234d11eda9933739072872db6b065d2a8d

SHA512
34a8d09e39e92001b6eba381e8c9db6f1984b18c1c0a142260792fbda9ce3669e92d2b4a2c6b9cf40f4edb5ecf72668ac8488f0a3c384785f28819d1cf578038

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
67KB

MD5
0cb84c8a1fb3b947e68d82cf91f87d3f

SHA1
044c9978e2cf29ef85255316c74c4d42a177c040

SHA256
bc552f6b58e6c4b88f91cf7916a97c569da745e8fe1107aec6e4ff7095711383

SHA512
e1001d37e96989ac710d8feccfce88a296e039242030877e9982d6d6827ce3d963db87595900920c3186232084b069e587334918a7e47c15a5b27cc2e27dbcf7

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
64KB

MD5
6ccea80e18b00b202ad0a4cc4d9705e4

SHA1
136fcc912d3761eb37677126a83e8763a6055a04

SHA256
5cb3436a41c36c2d3a3d19fe0e90f02c44ff4fc81ca29b1197aa069b7c54e7e0

SHA512
c37a8ae0285dc4f84a4cc932b0951ccd58d51f8569c359a03a2e71694c31b828c9f65d622dc06afd96586ec7c8cfa1a4752885bc232b0674e72d6a3db9ac064e

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
62KB

MD5
669a79a0c68714332d643ef86bd08e63

SHA1
990c24910e86dec208e8d313116e0813211a1d0c

SHA256
de5d13bac098c988256d3330329a404169690bc1f1f8dbd076c26c86280af3e9

SHA512
541781f3e7566059c5cb9e51045b74612f2c66bdc85f47c829207bc31f9c5175087529d90f7a450ae90d6d12d8ff795fc7c28aa8c897726b0ecbd3fc372cf9f8

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
75KB

MD5
f34dd9f9c2d2c611ed4507cd288a63bc

SHA1
2b8c0fc9fca0f94236adf63a4d57f85563fdeedc

SHA256
83fa2ca1b5d6773f30a7f157a8081d3edc31fc77966b96c0bca5ecea1e4f2d37

SHA512
938e2ca260134b1342a7318f3cb2e1070f5c7a226233fb25026cd3d7f6f760a961d244c23596174039d9d6ef58621e17018463b3a8b07b3feadca6e340d8fa08

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
52KB

MD5
b68d8a2d816750cf94737991c00fad74

SHA1
c0d4024cd1afdcbb499e88fb342bff85ea7e67b9

SHA256
ff11d6a90805aa51cb4cbfebd03e8c5b49735817d5715ee22c9b92ca0780ebec

SHA512
422455671c5913c7e1d5998e20b9391cf0ed3ae9c9e64d3d6f8986b30e66de2bb33e1397b238708f6ceda00474927b808b24769334bc9f90befc34bcea886676

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
71KB

MD5
29ad8f18fec09cafc9e5d42f0ddd6000

SHA1
caeca24c32673765403fbf4368a0f70cf6505a87

SHA256
c783eb537d0f374a18d8989458c7126a1b5ca83ed173693d3d9b930700ff4f60

SHA512
6f9f02653a1cc5abe8034d924ba39d15b74e1eaf4497fc1b1db57790720c3de67e5aaad67556db49f0defc1ed00821189a8abccd34d71fdff188319d8d1dc314

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
66KB

MD5
c9a2c16585d6b8e4ba55a7f8df14b70d

SHA1
1aee8c180b6b223097591667166cf904623c16d6

SHA256
e3095cb4332f55f63eed5c5600c73b85bf7a53cd70706ff519c1dcb8cb3b8244

SHA512
0aa102b5b771f80df51d6e2f221f4c2fd82e3ada3b1d282f83b75e0dc650f00c1f599702eda69857cd6c00bea71ce3997ef431547488af5e40a720d7d4d6fa74

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
67KB

MD5
72ce7d9f08c3bca1ba2133105f1abcbc

SHA1
d0bf37b6af47929fa71f9a59e9987bf798ff5364

SHA256
e27669f70056afed0434579160c1a5a95933fb48219810d836231191dd26aacd

SHA512
6b89b54e5226137e1c9dd3950277a19cc7379a2f81db6f7bc55c4a448e7c71be2836b450f0ebd850bf757c84e3d2b347c89e7880bafd71082678589ee369fc47

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
64KB

MD5
8656e1d255d26bcc5731f5c43104caf4

SHA1
cc2cbd63ad0523ff4f96809e19e556b3258b9a9a

SHA256
def809e2a770f5c3c6b9f212404675190855e7f2073cd2dcb4ba203db2c4e70a

SHA512
891dcd8a17df78cfde6631990a37b7588b4cb78b1420bf8c3d85d11cd2bd2bccf463faf55854020e8d197af1eda5399896894a73443b17645ba170e87d8fccb4

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
75KB

MD5
ba0d4a692ad55829054906d6095eb8cd

SHA1
adfe2f51924a1bab17df054e16529c30b35b82bf

SHA256
240e04aa51b91d6cf887f04cf872843f81f2a6b1ab37d1c8d8012660ab279e6c

SHA512
fddd4343335a50c8fe3789e5e8e2c44accc4944eeb8d38d1c297572eb528be37c39b1f5964ca50b514f1164e7f24b2e0ac47ed9707f33ea24e713a1d3c8b6210

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
65KB

MD5
d3abf667485ca80728291602224642a1

SHA1
7ed16501d3d0a1fd3d84ec95effc1ed3fc3ded01

SHA256
2b51aea3240879f95321dd961a15798dbec69231237c15bc72ff179d816cba9c

SHA512
c04808c2dec0c415c7ceb182f6101395b59f86433da9b939e190a30b4cc8d26eaacce84bad71f9d37b21e0a06c5f5fa4057e0b76701cf4bbfe7d6ecf4cd512c1

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
66KB

MD5
fbb26228f335b00dbda0facb9aaf7d15

SHA1
36fd6435fef9f58b83e7bbcdb6a36f732545f6f3

SHA256
568695f9a07df42f7cb68552c2d01f6933a05714cd53e33d478bd80f1c4c25cb

SHA512
e024dc70f49e8ca5ad8ee84adb6e60c13f9e00a5d49b881c32aeae5f3bf7e8fdb22d558405e7d84414779025e9850fcd899554d95623b0db24842deded22701c

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
63KB

MD5
3c36b01cf076123fd95b359da243cd10

SHA1
9ef8a89f16428852c2d60edc86e5269830a7df8e

SHA256
6f7844bf208047f878b4ef29acde45365fe5ef24e6ffdb2c12881398114927f7

SHA512
4afc59129ab8ce73e6299c64c282521722c55b1abe74f155b11df7977c76323ee936b0b9f5887e54c941f934753c71509c512cc60293958c2c981dcd7adbeef9

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
63KB

MD5
ac0dfb3f101f239888e24461a6960fc6

SHA1
19dc23efb50514112ae282cf356f21dd4010418e

SHA256
43bd42a77830e98ab72db56f41844fa837c0e676586a296c6a03709b766d62bb

SHA512
25b2efabb8ac99b32ea71a8b1a7a77f69c4f3961451fad2857f9af157f2080067d4a152f4086d19ad02fd4b91d192d1b516c7e329f11866f1fe3fcdd990cdbe7

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
77KB

MD5
e77b8ae130af27987bda24cb74fc8a3a

SHA1
904ba59210c7fea23f3251648786505b1505d58f

SHA256
4bee128be713e122a49ccbcedc622d3e4a791b7d35cea72ddb02e4dc12a623c5

SHA512
da19b1dc736d4d10e399321a2a751466adc211f811565e0452b6d08d505921a7ef5eb1dc37fa8fe81f30403653eb4f95ba4ce7787b6551ec64695eaec48b5e6b

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
79KB

MD5
129e838092875870b8d1e04705431b74

SHA1
2c8ba91a3989fbec9fefe26d190e1f97afd9effd

SHA256
e3c7cced6bfbe189967dd36f400f7936fef90cea8cc936e0d4e893c878c983b1

SHA512
ef999b42271875c7c1ead216e3f60f1d5477bb11c975b457485513bd3fe29dfa992d02bdaeac8c2eee3fee8e4e3567cc4c95bfa3c818c70b8d421b819c32ab6c

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
63KB

MD5
f4f9930f3a63719a434c61b745f171ed

SHA1
49ef7db8991ab6834c8ccd9beafb7e0a99aa1fe5

SHA256
0c5aba892e0bcacfd33e8c190265c4c84b845b671e4b2e37e0f8c8dd1ff2852e

SHA512
94de6b2247b82e245847465bf252c293f0989a14039144547a340f822d5b1a9177fc1467bb6e3afe994575e55a3d47a13630a5744f33bba535276564f82d99d9

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
57KB

MD5
93cc7454a9b2dde540febf3083b1843d

SHA1
e621a32318a07428bc27decd9266652ecfa99c02

SHA256
b54b98527789f77bee16c790f0d6d8efca0f2f69304220d9cd777ea8a8cca0f1

SHA512
8fa21db8d5f94d266c152f045c361ac40153e9f67c9d51457764bc9e7408a61624405ad0ecb04221af40d2ae7aa321f178b148f965c9b834312851fd742bafd0

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
62KB

MD5
7d034da400d0e1b57200ce51e2373c32

SHA1
0bbd791f83401c6ae1531807fbaec2f7cb0c9135

SHA256
703df75f74bad594a018fc854d2ba4f1026778d539417f0f0f1e8aa8c37a49c0

SHA512
fd3c9ac79e692ecf78444ca30b3bf0e895796c1182e4ff6d72bf2d879b50ee624734b5f634d05d26d94875fbf9d1b9abb9cf416c23d33e55e3f9a0dafe99aca2

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
67KB

MD5
7cadc91fb597e5913c0dc80c87f7cafe

SHA1
8e569da1908643c1464e29b6af89c9b5f1d815aa

SHA256
64f27bdd43e8a728676f017ff428587113f3cf6ba3b8e87e9c4316906df6c799

SHA512
9aa842427aa48e7a1412b39e5412e5a804078d580bbc823d2f04ab9769aab58b6737440af0f76149b9c4c3422f66b4e1b84a016b73bcec49e6ea271f8b813e15

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
67KB

MD5
824abe5cc3de953f39123e9ae4492aee

SHA1
ee94db532a108db750074069bc676a539ab15f1a

SHA256
8ecc977c2b60cf5c4f19f70280b0a9a36f882b3165e96cfb832bf2eef94debe7

SHA512
ce0d7255b4d629ad88dc8d375ccdbaf34f6aaa6d00ea53a325cf4f92e23b041eab2c9b2e3d8150a46c90fe5ecc5ab1f690f5c6288e26cbf55f666d47fc6c4f1e

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
67KB

MD5
d30a6a24de66a760bddc3a72efaeb814

SHA1
40539541e8fd3d6aad3a491bbd3044d9ae34badc

SHA256
27884dc64d089ddaa05a1dd3b926d5e294bdbae62312d5eb44f4b011a694862d

SHA512
eae45150e6b6c797c244957b1744c9ae3a77e1313420d1c1a640d4aa7bfea43791e842dc09d37bf11de9f9abdab24d778578d005ca73fc97c285af7ae1e5870d

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
58KB

MD5
93b996c41df299e9a042fc0e044a23af

SHA1
6658ebc7d1cf17ba4a2362a092f41c3cb01678b0

SHA256
28ad7a693b712ed9fc4f275fdbff8e1f0520b383a05de26efc9336b169c8eac9

SHA512
bb92096864a11cb0afcebafcad8ac38d44c12278b54203604ab99253cdbf0638cbf8256cee95e57b799600ec09509589135348be69f7b75e2e1cc0394c3ef9bf

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

Filesize
69KB

MD5
32979574fd9b3c16721231304aeea9e6

SHA1
925f4e6a19f5aca55771ac07562f92ba8d2e3785

SHA256
9cf401439fe700e3094ab57e9befdb2858bf7ba93564dd4a705b697140f77c92

SHA512
e33bccb15d444765938ac2ca55722cf8184ca006a1e593ef8f490981bd09612f7dcf832bb68f31fec8c715af7545a5a252031c2a97d89f11cf1e2e5bcea663e9

Download Submit
C:\Program Files\7-Zip\Lang\sv.txt.tmp

Filesize
66KB

MD5
990db1eaa1fa11b3a12906165b5ab060

SHA1
7710a02cbad325c090f92f9916280d9532b8c77e

SHA256
916072dc1440d2835def29b4a477f08087bdcbcb84fe76a43f870a58aeed15e5

SHA512
3c91a606faea0489ee9ddd19a48325b8007b4780a0a4448c339a2d0fb25a4fc1cc9101d46e75440fe99213cc404711d971dafb7222c019b9571797dee14f0d9f

Download Submit
C:\Program Files\7-Zip\Lang\ta.txt.tmp

Filesize
64KB

MD5
095043bea2ab5d72abf981b0e53edec2

SHA1
ab4e4414cc6f2a13c212f00ee00ed02a90860bac

SHA256
18b09f6ec8776b3f61033bcbece6c1bcf77d196c11ce0cc3233f86d3020826ed

SHA512
86bae2df2a0cab8c4f4352a461456df680c0b78e356e74909048bb8250c2cdcfce0d892e0e9a2f294cabda4cd79b2bda6fa281c83c48adc423e64db4a789e216

Download Submit
C:\Program Files\7-Zip\Lang\tg.txt.tmp

Filesize
67KB

MD5
b5068cdf1093d46a8861892f870b82e7

SHA1
0ad6316c10cdc99c772c9b94bc8cd6aa259d364c

SHA256
6b6089f4f47014171f804b3fdc866e680d80208c063a60e5a2dc1e1bcc03e3fc

SHA512
88422a8ac87c5e2f973a32c7d38f64af6bb60671d306ca1a338e4d3869071b9e44923a75d82262ce35aac58031a2fc25f05ea5b90688027d11d7d31958d332e6

Download Submit
C:\Program Files\7-Zip\Lang\tk.txt.tmp

Filesize
66KB

MD5
3d9a474ea08caf06b4bdf9eab2b35c6a

SHA1
57e7f0edc73f7102872eeb4fe290b52a466b9e06

SHA256
a19ae691f683d24d018e74d93a41daf2272b9d7d35e376275f7bb53cab2dfe3f

SHA512
c901c9b22e07bc15510040bdf9f2378e8a262acf2f6553ca293ff1c44e7b59b4643918ac241e9b8ae65d29c0dc331b4ba958f31744064a3ab12d29b3933b0d58

Download Submit
C:\Program Files\7-Zip\Lang\tr.txt.tmp

Filesize
67KB

MD5
017061c47143cdb792a8cfcc2a2f97d9

SHA1
cba404b910bdbac98a9563a927f873639f3d4f23

SHA256
5414622f6d6a791a88468d79618c49e2e569aab1beb0547cbf6daa8524417383

SHA512
6a492e491d13b0e670271fc63a11389ed0e35a950c2cf75729fda479477e3e06aa77f466f8a3ac1942cc344391828c45aa8fb24905ac50b2b685238b7108d5d8

Download Submit
C:\Program Files\7-Zip\Lang\ug.txt.tmp

Filesize
63KB

MD5
9c35da5e8d089850266a9e64cede8d1b

SHA1
ab2f1dab5abfa9da4ae6df8136f05455c81561e1

SHA256
9ed7beecadb2cda2fdd565414cfd8412b5192bc5c6df08575d5f3991a330d2c6

SHA512
6f82c791dbd5f8b643559e9271d2ba3396b5fb28d965213f32db1e6410a68278cfd16a6185ae3aacf72adc2ea3f6848a935bca8cfc6f122619c1fcfa1c7da179

Download Submit
C:\Program Files\7-Zip\Lang\uk.txt.tmp

Filesize
68KB

MD5
fea17317717e03fde95fc779c8e6bcd1

SHA1
d18d93bbb7153edbc1a80beeb62bc8228090e43e

SHA256
00f4674b9f4b966c5744b6006ef139116891f6a3693f1e0aca05d08dfc942b1c

SHA512
67b65b61da7c4bd9c5dfea1839466c370e166cdbefb6afe9fd668fd32d787042a0a413f42ec021158c4f6abc1799cd2b197fc01f7cad290a544421c27681ec9e

Download Submit
C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp

Filesize
57KB

MD5
7e11c1d4ec285efea80af7c516fca620

SHA1
4ce8b3e4fc97e6fc578ccbcf22e016b6bff15f6c

SHA256
02f630faeee5953681a8c605d7823336a83c150a1f4bc6be86bc45d3c616083c

SHA512
993beaaead4856b3cbf1d8ce255b84f5729a54aedcfdfe130834b6c6dcaefd6dc367927d2c2fc0a03e7904bc56446b910fb1ec8ed96787ce49b4b4f9f487e4ea

Download Submit
C:\Program Files\7-Zip\Lang\uz.txt.tmp

Filesize
61KB

MD5
1181e14146fefc3b2fd95a6f195b50c8

SHA1
36324b6a5802e3dede372588cac614c591fe2f7e

SHA256
522836cc9d4110d2e4a5448f5e489ae30ddd1e8e8c0be3062696541f9cb09ab9

SHA512
18ef797b086fcc07cb28878ca3b3b58e74806d044b168ef5652199e567960cf439eee1a20b6ffea3276c1e38ad92e2d6546cd8f18d9620c21adfd6dcbf269375

Download Submit
C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp

Filesize
66KB

MD5
3ba8d702b21b90a3151d9b538569d822

SHA1
48b06a47ece2817dfd42ebc9e49ac2096be39349

SHA256
ac1010ea98274d7b847b48e5f9842622358b2bf9fb67c29b31bfe974872270fd

SHA512
5dec531c31bdbe9dfcce27af00728dd0de618867e43a7d1a833c47d4dba2bbf629a86f9dc783e4c7ab9c8d10beb042f0a54687c26a441ded516ca64989ae850c

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp

Filesize
68KB

MD5
dfed7238c8358a23eab37105c683dd97

SHA1
a0a8abef1d482d2afb00171c9ca28d5f36de8ff0

SHA256
a218486cbe9e4331d59d1c31a9f4edae06217afc6bb0ef497b72368c5ae89529

SHA512
dd3d499843fe82552333167fa84a7d1cd6b597f0858acf16b02450c211bfcc838428982bdb339f3dc26abec03605a6f700c0e55584a4a6a4d854c0780c6223ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Word 2016.lnk.exe

Filesize
57KB

MD5
aff87fd80469225cb9765df45f1c9945

SHA1
118b340e57248f769188d827204696d9d0f034c2

SHA256
fc4381e2bc978e2d0d18376be4ef9bc330cad9877c44a174ff6c3d7d970770af

SHA512
a523344b2d3c66df7ccf3cfe9d99ba84763635d78ef8b047f8079889a10edbf3f06507163aa264d24f2cebfac5aca29ec850a34d20fee242b61b79caa08d3e9f

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
52KB

MD5
1f1d7e21ca3757dce0deac6bf27a6a5e

SHA1
45d01fc9ff3d1626582fd56e78657bd49f83ac2c

SHA256
edbf9fa7f84ee4906f17ffc8c0283a8f0ac9bfba13abd1e47f0a92db46d23d23

SHA512
26b8970c4b3264fbdd5e55670e55825c5cb43ea9cd55d58f9bd23a577749dd71bfe80ff1582c64e768a018417618ac87123e0e64524a9a19e938f478dc3d6e80

Download Submit