b26ae06162ed0e06eeaa0f6ea8758fdac915f48e719d6d525da54a99efb0a2fb

Analysis

max time kernel
120s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

079151f4722685a207bbf0022f2a3270N.exe
Size

86KB
MD5

079151f4722685a207bbf0022f2a3270
SHA1

b62c14d4755a499570ec8e91a2a9132c306ab491
SHA256

b26ae06162ed0e06eeaa0f6ea8758fdac915f48e719d6d525da54a99efb0a2fb
SHA512

25aed81885036ac63c8c16a2c5f7ed61d76f49930ba96068ba12d68c2b9b29b72d9b7be54dfda83f98179b8e5648a0b5503466229c0276373d58955d336bc662
SSDEEP

1536:W7ZhA7pApM21LOA1LO/7ZhA7pApM21LOA1LOO:6e7WpMgLOiLO9e7WpMgLOiLOO

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4418) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4124	_MS.MSOUC.16.1033.hxn.exe
4944	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	079151f4722685a207bbf0022f2a3270N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	079151f4722685a207bbf0022f2a3270N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	_MS.MSOUC.16.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	_MS.MSOUC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	_MS.MSOUC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	_MS.MSOUC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp	_MS.MSOUC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp	_MS.MSOUC.16.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemData.dll.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.tmp	_MS.MSOUC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	_MS.MSOUC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\th.pak.tmp	_MS.MSOUC.16.1033.hxn.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	079151f4722685a207bbf0022f2a3270N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_MS.MSOUC.16.1033.hxn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 4124	5028	079151f4722685a207bbf0022f2a3270N.exe	91
PID 5028 wrote to memory of 4124	5028	079151f4722685a207bbf0022f2a3270N.exe	91
PID 5028 wrote to memory of 4124	5028	079151f4722685a207bbf0022f2a3270N.exe	91
PID 5028 wrote to memory of 4944	5028	079151f4722685a207bbf0022f2a3270N.exe	90
PID 5028 wrote to memory of 4944	5028	079151f4722685a207bbf0022f2a3270N.exe	90
PID 5028 wrote to memory of 4944	5028	079151f4722685a207bbf0022f2a3270N.exe	90

C:\Users\Admin\AppData\Local\Temp\079151f4722685a207bbf0022f2a3270N.exe
"C:\Users\Admin\AppData\Local\Temp\079151f4722685a207bbf0022f2a3270N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4944
- C:\Users\Admin\AppData\Local\Temp\_MS.MSOUC.16.1033.hxn.exe
  "_MS.MSOUC.16.1033.hxn.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3884,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.exe.tmp

Filesize
86KB

MD5
2e2cfe0b5133c93d2047b7daa3409885

SHA1
fcef1fc33b1b6d65b7364677985f471980d991f6

SHA256
84ea8156b5e5cd2fc37d7bfa3f78317861b48fea06a84ff9bfb5cfbcd4e89efe

SHA512
137ceca5dbb68a879bc4d99489a5541ff9ed73a491e622be02ef8f60e3873cd65449914f84096c07d5a8bc104677f5653c828e2388845123073f864001b5654a

Download Submit
C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.tmp

Filesize
43KB

MD5
95125b2119d42c69e67079ab5eec097d

SHA1
a39c413a69cd044b6a484a1ae808c8f257e1ff47

SHA256
f3cb32ee7534f1ca111d06eb6d0f7e84cd0de19fa345152a686bfa893d027d47

SHA512
91666a4ed9c0b73e8e67ad0270dbac8ba559b2a297ada04faf8ee176d92d86c4390d97716dce54cb95336dc236bfe77e82483bc32e496e94043292668d737da4

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
156KB

MD5
a4a452337e7cbf62f8527d97dc81a797

SHA1
a94416bfa720fc24a8626d6c456e3fcd06ca8d8f

SHA256
fa17f18cd7d5bf117e0c51914358b2a54b2e3d1b4cb387ca96ddadb321611ab2

SHA512
f0efeb3a5f961b2987fe494839b08167e98b012c04833213ed4b1555a3cb7d326375a116a21a33bcf1f31db36110aeb301e931bb1a6a0a3227032be35294708b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
142KB

MD5
352c9364cb1fef9173e4bf0175212747

SHA1
93181313365ccb24298a458a97032ee94342d25b

SHA256
46adc037f7fecf7471d0d9781ec010b829d51a61a51703207e6b73ee5965c49e

SHA512
40bf5f367a401a0f631cc1678dc71351af42e681f81d8c5c6cf3c0339ebeb22d4bb5bb87eda730ada03ded40a925ee902d8a9f4cf087b736e0c3cd63bc26b1d0

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
108KB

MD5
5cb972cb256bbbec8162aa27e715966e

SHA1
e2614c90e13ee2a1295aa2c2a1204b2ee5af8f48

SHA256
df666bdd2544a76e5848c131c06c020b89293b96ad90e55df9a657fa7dc3bb33

SHA512
16b855054dc36acad1ee185c42db65c8eed49c3cce7cd54e9821fd599fc3318424b9725a1f2480d0f6d6109529a158414b9b710878494090027d19af6005bbc5

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.5MB

MD5
789c7ea18ceb173b281aea72eb9dcac5

SHA1
b7589c5c542c97a41838b553f4aa19bd7297aac4

SHA256
9f2b2e9e75673e889a298650a09f3ca8424b757f68ef0c46f9c8fe6b3f3a4643

SHA512
2f18538bb5910b67c93efc37cffc8f05826fc1e446b64b74feb9fa8b3e0e093fbb980907f8b7cfbbb777461af477a4b870afaeafa50f726931d0c99711052531

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
587KB

MD5
bc408513aac556910b1d15e1fb3d0768

SHA1
1edc605eb1d9a11bb017018e38e6451c283504c3

SHA256
6d985a5749d89b16937d63687afc57cd672dcb075b68f17ef76be9209f362d3f

SHA512
8ddb6055d06abf2cb5432af6c21aa09109d5d8da408df27e4e8713eb1646a14bacd32a09c06ba6d87085beb8800f6d9f9faea2d20ab68dae5bf32b67f02f5373

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
974KB

MD5
ec93cb1d2c40a735ce1c2f1592aa1fc0

SHA1
be81d0bb6d3e7f425d22dc75eea1c01eba332b04

SHA256
b6fddc736192a5ef5674dee357020cd3252b54a6bc100a1b23c77ee866976eeb

SHA512
ec5ada4bf7f590b693dec91a7bd53099aa8c78eea5cc640a1f982643171fd10ffe6c1bb10c41e145af6e849e020443a94d9d8acbbc715e22f7b34695ca855489

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
726KB

MD5
68a6e037c2920098b5b239c18029e6af

SHA1
d3038512568b19de522473679d43adbd7b8d3ec2

SHA256
aefe2d6e45b3231b7135fe2ac016a79dd0924dd95fe69de6aadbbded2de8c6ac

SHA512
8e26568622f1f30a224ab243b221685f82993f1d5298fb6286d3ab95a91363ecf3dcdd564618e4159d3c7e0ea3fc2a4f789d6bcb2df361142da89b4123fba9fd

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
727KB

MD5
637ad6bcf5cf0ad784754ccc1fc353f7

SHA1
3a1d1991cc7d09150d9575d0a96b87d3bb5e0544

SHA256
88007a8f0ae8697f3f010c248a631c2421094a4f62a7d503c717972c79a1481f

SHA512
2bc7e847f2fccf76f6be3f379b06bc9aa456ecd9aafa7d5b64f6e24bd7e45a08b697b1364c21fa494b7834a78052558aa49d2eb24170a41e1c208e2ef298bae4

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
52KB

MD5
d9422d8148d4e60bf7b0c2fea654d779

SHA1
68569846bd2c179edf2d500585c8621aacd5b2d4

SHA256
317343873970cab5f9ae158f1474337a7e2d3f11757c72a5838fbcf0f91f90e8

SHA512
ab65cfec495967c633e29a01e576f9db65769b05ed4276ba5fd983de71fa2c1bfa013c58005c15a52a533e503b1a88c4bf3ebd3bc7c065e8642495ad52b392d0

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
55KB

MD5
73110170dbad64fea5cbbbd38f99dc17

SHA1
61c24a158649a979ec13930713776ce2f973895b

SHA256
0d206a7b915dadb87da7d40d51741b5dd44bb2c7b3e4a9c15355d38e8578de16

SHA512
e02e8001eed5450cd58776980405f61e2e4cfa8585707b84f56a5be481a4140e8ab90836c3802c82ad1e80aca6a3c80f5cbb1a91c2bf92795efda5f199a92dea

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
56KB

MD5
754c60ed4d8b301492c6d62600717cdb

SHA1
178bd37585c56c6a05c8b3e2cae7bda068393816

SHA256
1e61357f70fcdc3b19bdad1f19360287ab1c504a5a5cf29b42ee8c4d0306f503

SHA512
ea13599e079b6aa779f5f7241c5787074c78d7eb3100beb85371604965e92e51d8774a2ed4be2636d3cca0199694f9d37ca2c8c39b3b8126c95a0755ec546ae0

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
52KB

MD5
07a670b633b49d51599930e7935fa167

SHA1
fca76e347bfd6109b494cb7f27d41d55802773b8

SHA256
265c1c011ddce3ff5b18158c59d17a8fef3bdfef3afaee533a4b17f3fa1294c4

SHA512
daa7b0fba6b77e95c2cad1999e215f058b771102f98319c1fea10af4df5b2623b2f41f490a79d3aed91a87703a6c09641556494ad27cf3131f5d8c659cfb2cd2

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
52KB

MD5
2b39803db983a0978b62c56bb0259fa4

SHA1
930fc16d001864eba11151ef5fef5fe183cf906b

SHA256
d14df2f29334f24b25732d703d47d11cdf57df4a44f5d99b508e4926bcca6705

SHA512
6fd1368f929b5085857a4baeff93ef897919c8b8604ce81d2e45982d15cf116ac71fcd88c538d57c7df2056f3cc9518cc04da44be0e2ea07d289709deb57f259

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
48KB

MD5
bab797367db49462db384190870c712f

SHA1
1d4f8a72a07ccd43fa3a551d136954fe1d91dc63

SHA256
00d219c0da10748a0a24031888f726766c7f1f9e6f763c252d0b5e5e97b4512b

SHA512
f525b4fc09f56cd3cce625349fdc9f12f96cb6186eac8b56a10451ea1e6152cdb91bf4df9b634814b5b41a9a575ffe48da4ba43405980921a0e8e8dad64197f9

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
51KB

MD5
ca92a680c32884c485ccec257bc05030

SHA1
af03627cb817eae39f4f5f0ec654af04bcf019c2

SHA256
34c04f8296fdcaa9ca272b8d284d5a0682b13207982d9208079b8bf55841bc9e

SHA512
1490a3b3853647222649aa6170f09fa1288c6c185c53e82ab708dd2d2e89df1c4a1dc890a057ef2bcd75634e7ace6632ca5495a7d24d77bbcd643358cf724bbf

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
53KB

MD5
b2ea0cff227860179edf1b45d5937d74

SHA1
e9613d0a56b4129230f1621117594a17b23cd22e

SHA256
ccdd902a2136e6bc3478db0e24b470f0f489935a2e3f7c81576b1c6c1f612ee6

SHA512
517fe3b53f9ff246380e77bea40df9cdc12a54372003104559fa8d426b1b11031b6fe52e82e98d6d9d18f13b5ba24d45a3650f4bc3c0950ae887e44ce756f51d

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
42KB

MD5
57208726d3156caca5c96253bcdd0979

SHA1
0f69ddd6d8633a763f6bd3b893bd94195a2e0838

SHA256
c8a6dd435d6abb97f9caa4223a0438b478df9bb060e67916c72e86bd4b8a3ba6

SHA512
66ba5c5739cf35cac5f76b441425e7b6d699f26ba13ca6f66dadef1923c25b1c4acf5d3362c51494842e809b34037aca62aa2981f492ce576f0404fb96a88330

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
48KB

MD5
2dee0c2b643c96065d1cf8928bcf6ec2

SHA1
4ef3bf7ff0ff2e2a7ee3d9d7a4a58245beda605c

SHA256
dd1a155072487d3172df3dee7bd629176a7f7cf3a7ce5b53aaeabdff946f4026

SHA512
d9e0753ced2b12bff0cdd086cdb19b989a93bdd3969a6a917a9ef0b5233ad6a6ab91b1414794516ee873dd7495359d7c8df335ad370c9d0f6fc8abf06b319b54

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
52KB

MD5
ec070307e427018032e9b1ce408397e7

SHA1
fc41feba5444e6d4b4e056d9e4bea5004f2e17b3

SHA256
82d0532b811b68b31639d3057eecb1ab1fff90afa7b03ef882467ac362be4511

SHA512
48c1a8653c87c828157d18d3f338a6706c113aed1f3b0ed4e7266847ed922b8b53a99899eb87d02f92c5ffc93caf60838256b4083c56a600966e83c1c1bf18f7

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
43KB

MD5
a907007fc3b84f1dbabf9b13190d6fe1

SHA1
f52181f54c963e35e6a839a58b54280cda7393e3

SHA256
3726e1e87d51f64ba585fe427d161504974e2dd1caa9267125c044eb0a6247d4

SHA512
494a124e2ca92107426ad19fefea1fea5ba38536d4ac9edd3ddffe24eac448fff604f1cf95beebb95bf9359427bec24f58305def840aca7d7b106b822adce081

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
49KB

MD5
2cc2401a9d2efc8e452c002731cac455

SHA1
2658a1df8edd5e82c176934b0c3d36a4bdf5666f

SHA256
84e3bcdd0d214e0c608c879891c8818920c33d53de879a196ba8568dfedbbb61

SHA512
dba7918d2e2b3722cbcb8399b6eb79314f401247d0c77546191e3f55d85a4e672cd42fd94435b211d9eb5fbe9e06d05bd74a601cffb09455ecf8f12832335d60

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
53KB

MD5
76f1611b140f46264bcc2274b4f364c7

SHA1
963a09370abab5b912a1c2b4a9034d92fd608ebd

SHA256
7dd9920c877f3c27d85f8a5ea77a31d76f8129a19561f8361124b7097432e938

SHA512
307fc445b795745343c3c11c9deeda5e93d48c6b89b6480d5eaaf4c48372c004d57a780006999a98bbce20632430d5604e15f4f2edf47886e0eab828a7dc9d89

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
61KB

MD5
95690db7c8e0d7007eeabf51f816d579

SHA1
1c432121daea6a35666541f20be41fa14475ddfa

SHA256
794706c809d7ebeca672c1313f05a5b1a335b9bc1ad75b097dece1e636b6ed12

SHA512
8d68ddd9d86cf0bc8de02b05bfc156a5bc48fec50eacddd966e3154d6c9c8192a1f3aaead9a1307a6b485178fc36a75b43a3eec9130cc45a8ed7ba233e7e0083

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
54KB

MD5
ffcbdbb8bdc0685f0d178027452dc762

SHA1
1ba633e1676d46e40c31d4dd3b20e6397b5533a2

SHA256
c74259b1236474b1caf02070b763295a027a21b9e56bc8fd8bbd8db79a949ec6

SHA512
11d75a3cc0534412b368defdd6efac64475ef4a1c099e430fe495ab22b7bafbd3176c73a9ef418b1966c5fb5aec4ba30307178a35fe202569921af6520979b5a

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
61KB

MD5
cd60374a1c7028b8b43af2bc7ccaf2c9

SHA1
e441c2743359b8e37f5e8e7d2d1b9c98985667f7

SHA256
5246565f59a402aff15fbdb91b0e95e922821492f4668b533012f1501866c784

SHA512
51696db9548c16cc82f41e72a96021af711711fafd7bc1eb01bbaee566e68156979fca1307de6a5e315bfd7fbc4bd595a94a0fa9069ca7d3ef7ac02a29df9d6b

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
57KB

MD5
405bcc99513c56e7f9812c7a383e0ac4

SHA1
fb9aabed319db9f6017af415b7d6e9a1c9955671

SHA256
0debef794a72a8dd4cc7279805dff7e912e26c0698bf56ff492e479d805ff96d

SHA512
9697aecfa74d0d6ec374de7c230da4e7a4795eae982d8b61a852678aa1ce0cc2c7ae364c75c923699b586e75b077c6f549c6a1b883df7a3c69d22b69456c8eae

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
52KB

MD5
351ef5f35086466a5d46a2c553772d1f

SHA1
f0c7700a2515f190549f1d4652290a98347339e3

SHA256
a2242359b81b17f77d02e91c8fe14c0241dd46fe9ee599b1fd20006ac49c07a5

SHA512
dfbeca6aeed09fdf11e029ef7602344f8ac02c9b816449537fe3146a070c7ece3296496ef76ef487e53945cb6120bbcbe37273b8ee5d677b7477387be8896164

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
53KB

MD5
dd20d1bce1246e2c4ca9f6e63cd09984

SHA1
f2fbe798a7ee60ad73c8bd4fb1f3007f4a11afc1

SHA256
8cbf01c8288ebbd861cea9fe67244d26e42c6a1210c576d8cc8acd5686276125

SHA512
ec73c4a573e55d1efaacb3c4eaa377631b50fddf40a98fced6467a5441bee3b6e2d77b2b1a97f6f4106973f6f74108ebc1ea612f59cff42a1ee296f1d9dd76bc

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
53KB

MD5
80b5b8742c1c37af2736ebad3ef05147

SHA1
65b0aa4dc3821e7b8c776d1d2a62fea9d8e63240

SHA256
2afdc620e294ae1ad61c4e1fc3dd836beff01d9b60ab55bb6c89627a319b1197

SHA512
3c5f0fe837177d0b4d0f56dc4fb201c8dcf4ec5bb4e903d62b78b51f5f404fafe83bd3dcdbbda088c385e071b605bad21423186828ab9504b1944f63b56b8c2c

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
61KB

MD5
3ed55e74834437a30aa6035159089a5c

SHA1
f280b35ff68d66732c722dcc04a6f9da7d2e6225

SHA256
aa9b63001b27905a80af676eeac3f5e347c89b4886b3ca169719651486dc1407

SHA512
746d0101b03feba0401be658dab2fdbe58eac9531bfe63fb059cf4c161d2a4c82b19176a98e8d79571fc5a29078cf3aefb9e4911f283579ef23b660e52fe1fd2

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
51KB

MD5
36a18f6664f8ffcb97db7db3086486c6

SHA1
756f242772df403e5fbc554edb5283a057dab1ba

SHA256
b9fc771b527d35f9c35dd8ba36b355d5a488cb413dda089272b2a5aa43d543cc

SHA512
d8c26e415ac4df9822ba219d4e1856e2008659ab49e42ec178413011ded8b301d0371dc4a214e755790b2362dae044f31d904d6e8254ceb8a07678a39424e763

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
53KB

MD5
ca5c36d131f03c06da06eadb41b4fdd5

SHA1
2deb558be54f49d2934cf2feb1f44e42d219dbb6

SHA256
c20aaec8c8d5cba57987f1c05fd518737fee8a4e46b16ac932b789a15d8e844a

SHA512
428b78e12d58390737437af7b08e4de096108a133bd007d4a118476f8a11e9a12e8d9f9bceb449cc49b5251b10ab535a777fa64fd53bf24f1567662c2d9e96bd

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
55KB

MD5
6d92322e9e558b764b969776d4587f80

SHA1
45a3394de42d9925206b06e770f9b36ef5a7f44d

SHA256
cad95db5b94d282e0ce69d519b9025d2b9619aa4cd285e8f49a245593e4fc0fc

SHA512
391e754a1fdf3e143717e93d7380d3a151e575c28f00e913283ef4342fc4698a58bb65e5e4a0308455539782c8937b86bbd4392fc564953e50e9101e0ed82a6d

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
43KB

MD5
fa8dcf00beb0a1508d20335956011491

SHA1
b6f49517bdf41885e0c7650722073b8c902f8841

SHA256
d304e27738bb1dc21a2e500f2656af7d48991d4c1c88cd3cd15df0ab067b0d4a

SHA512
981829d2627afd1c42ac4ee67c098274c99ddbc745f4e94b652af5a2ece4f201c77ff931dafbcb462500fcf6f43873c5299154322fe12c07d91bcec18b846028

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
52KB

MD5
be053278eb24723edb2b719300f42c14

SHA1
3262a94b4520bf388a1dff7ee63b493959c2f50a

SHA256
c380718911c425c106e1648402b6cce57169100b6f13200bdcf893ef3dd28d0b

SHA512
d29876a80914ac1e24a4b4abe9428d1d75ee022969a92fdf5d6e5af0eb7083cd301dac8a123f6a9d64c2fffb48716357b72b5b66bae13dedab8e6f9bce8938e3

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
51KB

MD5
bc240eaea0404d57996b903ee065e6ac

SHA1
a60ea9e01db0b983c519d53ef912456b6cbc2485

SHA256
53d601f3962353d3a3105bb30d6c3809cc28eafd29954946aca64912c9dcb561

SHA512
862f57d7b32350e2edbdc90c8ff83e1d83dfb79a99cd5f9d5da849b086b953eddd44e4868e8c127b84558ceed32242c553d5a68f09e0c547b9bff5a368ae04ba

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
62KB

MD5
6f7b5d3d6520141064242f3f4a7c88e9

SHA1
f75a3af49963e6eb660096a1055ef5adb9fc7ae5

SHA256
7f4ede19a03e17117e469aa9371ad77440bf0fdcb965bd7d0597bdea7b1123ab

SHA512
68591e7b7e1c6674d78ce3d70ec4d0f7eb2de62f919fdb533c32cacbc8c42519ee162bb76ac98ebf2a8b7e1a204a37ce92665b3015246e30a36d9f8f8d835387

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
64KB

MD5
d6ad2d4928131d698fca55ba2b951d8f

SHA1
18e91fbadca1c95ca081d3e141985fc33766966a

SHA256
f53a1d3a6d29b8a3df63927438a80a9804688a888a6cd4eefd495f6729145549

SHA512
21bbd6977afc79d4e7372d7ec07e516568e15c2eb3044b733ddede3024673f79b1d63d0013b61ad889e6a38c60e18f4e65cdea1eeeafe45327043931f97eb10b

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
54KB

MD5
e7200a5be36ecd1ba0d4f64f86adf037

SHA1
46966928ff80844b4ccdafb54f7d536900549faf

SHA256
620e247d3f5afad4768c464201a1cfbcbb51f23e340e0ea3c71cb3a667fccae5

SHA512
17f260763c539e4e02f5b25d0ceed8be6dde01b99d885bd600bb6e62782027469e6eab11ffce4de9ca10359e830ad48c8c517023d7433c53f0ddc651402fcef7

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
48KB

MD5
8f7121e6a05447a9e8e0827983d0d8c7

SHA1
336f78f706ab3a2352c798e1400d1ff741f6f82c

SHA256
99494b7b2c2d04c2155f7979d70713a14abc3ccc48af993be10ceb10365d80db

SHA512
307cff280d3775fd1d55839b6625a92b8bbf91edd685ee4df8f841e60521ff2c2ff232e845f0470a5fe86b52aa8e0e59936b55d8926a4143f5408674a4ac9b3c

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
56KB

MD5
35a8e4576e9f63dc07d385310097fb3c

SHA1
faeba0bd09a7f3c668cd82f4e4228ee288feb914

SHA256
543c1da1ec0a99282a24b872dd72b20d6b2e6e6e186e8271432210e37271e38e

SHA512
d46058117c605566ab777f890708bbc23ac64b8091a522586d363f9486b04c4f396c66b6cfbc252de3e5c3114b1e77e04cf007d345e4d55d0e314d5a72540a3b

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
52KB

MD5
db2d7a03f978268a3d6d4df9954bee3b

SHA1
4a1babbe2fc8aa721eb0ccc2da4ed3304df1f6ca

SHA256
a03b5447ab7522797f9b44573013ec75598fc47adadae950f082e93fd704d349

SHA512
09baf2ca76f09a9b1184b3c17cb8dccba1a7983228ca1531ab2d982398ee5b1a7563f855a12ef81d105ddb8683fcc28222dd4997c4b2a3b17df995817d31fe8e

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
53KB

MD5
451b9d82114e1c05d0b7bd9373f49c40

SHA1
35f70fe35f5e6982237ff9cdd047e6f740741881

SHA256
1656dba27504215b8b9417a9b28a043e84abdc0c5aa98594210ab3e2177c440d

SHA512
051754973f0d8b0dee227336aac27e7a17da1c8f449f4b93479ddc6a22d5987c9ee8563b02fafe9e29ed009e2f7d66cbd7183163a38a0982a7ab0d4f31dc99e2

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
53KB

MD5
40f3169bc13a0e7b658d6dda5eeaecbb

SHA1
a3e1456776ec2f1f0376041177f3656f48860cef

SHA256
d66fba3b2d7c590a97dc7f6510c38cd60c4295fb06e186d6a51a8167f53a8a20

SHA512
9bc98165ece4af046d16e1322a34dfaa0077c74957c842006a7b5d9f746294f5df4c4307270e255408e9a840dcff6008a86b4c218a1e936573ab0b03adcb7f36

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
51KB

MD5
ca4423cb053193d3cbea20bc3cea7804

SHA1
7a6ec5b82df13e08f85d2184bcde34f8e760f377

SHA256
69ff4c1b52ce929198300e17cba9d3e396b6f35101270f938e8db566690ffcbc

SHA512
265f3e7f381aa3cfe1555592961dc9156372f1cf2f638418ae21840787e1ca4cb7b14a813df9f669acb3ea14091aa79cb88fae779d361dca1c99f83de51fcf38

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
58KB

MD5
dc9acf0724f4fb1f20914258e7b0f966

SHA1
d42c70f58a113bd8eb4fe895658dd08e004dc060

SHA256
d4edeb1634155512aa657304e87d59085cc7d4b591d97d64a43d7f055df7e32e

SHA512
4356a9eabcd2f5ed76eb6b0be25fa3b204f25469e7adcfa01145758e16491a38c215cf3381ad47d6e510451adcc5ab7afcd53347d8a7c4385c83c919397d1915

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
62KB

MD5
c0215b99bc4411f7c75d81900c56adac

SHA1
2ebbe77d727636b25e880278ae1d25078be53f2a

SHA256
0af986a5c618283c37bbbaac85d530576f23b2c78b8a3712ed460c6621fa688b

SHA512
b0304ada1750d5e7729297b98fe35cf66b3b9cfae6eda897ecfa0dccefc7a181cbedee657591ad897437df4777f5a57a5749bab1a60331411e794a7c573fb28b

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
52KB

MD5
1264889b520734ccdab919a1fee187a5

SHA1
ee0675ae09a6627aa0f8dfb6d8b1dd553426379f

SHA256
6796ffd1abff1a89ebf713bb5ce204d0ae46efec835db68e472ce8622d468252

SHA512
8e6774b58cd941b14c74734821d9576e8a6838716520cf0018f697990b3de1b6497541c329e81839ddc8a7d38ff17cb9618fb77402db7eef32976a9331a27f32

Download Submit
C:\Program Files\7-Zip\Lang\sv.txt.tmp

Filesize
52KB

MD5
322794b6ec7281413a061a3de15ed77e

SHA1
77f30014b350879af7304f599698c6d9a4968b99

SHA256
d560ce4372fc81612549ea02632754a435ec89a1db3bcda9765bd50badb800fe

SHA512
1c537da6646608826c6cd3a4d7b55a5f2a7b53666699f873dfdd479641e5ecbbc1153b8d2614559011ff4db45d72f2a3c9be742586e65bd0b6b2df2833d67a15

Download Submit
C:\Program Files\7-Zip\Lang\ta.txt.tmp

Filesize
55KB

MD5
6e41497c267f10830b242b1082cc1ccb

SHA1
a4a007b6f70badc143166f2450fa1d16f6ddb13f

SHA256
620a1dbd9db3f9233fb2d64b8355741763e683ce677da34d7001bc1074f6d625

SHA512
b50808e855748006ade15838749d4e7cae54ea3e21735ff50fcc79a87fb6d2c8b3d8018c3cf1b23c435b6513131622470d91b1b4167cebe6320205fad5ef686f

Download Submit
C:\Program Files\7-Zip\Lang\th.txt.tmp

Filesize
59KB

MD5
1969ab46b87a153cd1d948fd98621d04

SHA1
45032c84e2ef8e5a143f190deaaef10b8b7347ab

SHA256
6ce10de774560bfa5fe6efe1b9dbf4866c8e0e3e54071f049264f5d65af9dbe9

SHA512
2d541d9ab9e68b88863496b1ad2cbed0bc52280cafc8f9c621786f08ed321efb1df9e8544960ed7d1511a8e7d4ee75af2103084a245750b1b9ff4007bb1fafad

Download Submit
C:\Program Files\7-Zip\Lang\tk.txt.tmp

Filesize
52KB

MD5
1e3f06856203fbc35e1a84b57acab6a6

SHA1
e8330d5ab6a83e51449c4e16ea32b3b43c00e445

SHA256
748b623422018ab1f823ecd0795ea82c1c8be9f9ae32b67c9de86333601c0570

SHA512
e6d65ee01de40a0d5c6b058bcb1ea9a24909fcb11a008d4123ca93751ce3af7c1f983b29dd99e244725a86e5088fd92368d3e7ef89542240226a4b92947fdfcf

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp

Filesize
53KB

MD5
3890d66c79d463289864cfb14b5b37d5

SHA1
c3e2ba0ea9ff441b46ab8dcaa0316252e0787014

SHA256
78ae4ae82622f8be675d4845def2bb437a354ca17bba2f3dbdd7c4f38889e3f7

SHA512
3ab8840e8b42faddde8a9709985ebc8ba78e768c3d1d9936dedeec82fb2d17f3f31b2783fb7af71547acc1696107383cb7dc401228003fc34a4f605c0a0cd3b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MS.MSOUC.16.1033.hxn.exe

Filesize
43KB

MD5
607adbdcc3578bf7a38c5f1f22308ec7

SHA1
6b45f15af021aa63a1720044b0a528e06e4a461b

SHA256
605f31e86b3aaeb5e74cbdefb9d9174008a95135d52a37fe1e391f3418f4a965

SHA512
6a24cf8ee9a92e45b24b1b6d751c6cd814b2e34858b154f7fa65d9ff3ed132287612f56e7289df56472bbc829f44080d0652fbd28f882ace20627ac46b39a827

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
42KB

MD5
02a60b493dd4723517b2d995c00156a8

SHA1
729d504a8d346e2967d738debb583e4557ba3c29

SHA256
90d070374f1c22debe324d88d88f5936d819574de1b30d6bdfcd3a13337883e4

SHA512
f2bd4ad817680c9befab0659f4fd7ddfd12d3529e3907af4a7265de541459278ef8af5939c89460d42af24161715b8a554bb6d2a774cc9cc0053f4cf9ba2af20

Download Submit
C:\libsmartscreen.dll.exe

Filesize
43KB

MD5
cfa3ec66964863a353a2a8efe0426236

SHA1
707ab142d660a99a4bc10988e1fa49a7f07e536d

SHA256
182ed44c53d06ca1503a628515bbeec43a32271f98be65f9cabc791de2d89417

SHA512
29abd5f617a065912bdd5201d1922b3c17d37484697c9beffa9116363f6d8c4cf6f60c21000774196253278a477daf84318f2600c13d23d2ceadbb0d4a1ba98b

Download Submit