86468e912f3f8d87a65f1a09a2f4b62d3a73cb1e08bb35d08b84c3732c7a0610

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

86468e912f3f8d87a65f1a09a2f4b62d3a73cb1e08bb35d08b84c3732c7a0610N.exe
Size

126KB
MD5

ed4b6dc61f7a5bfcc2a4aae8f7bdc310
SHA1

4290d35757c8d8d39e43587c114e193b1a1ebf76
SHA256

86468e912f3f8d87a65f1a09a2f4b62d3a73cb1e08bb35d08b84c3732c7a0610
SHA512

5275a842a909f46915a2c6f2de83814af15ef82843bd5a2b7c42d75dad67545753c28855daa8583ff2a68d4267cca357d50aa1424922849e464a8182341a0620
SSDEEP

3072:6pWpBwchcwD9uduE2YapWpBwchcwD9uduE2Yr:PBuduE2mBuduE2U

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4669) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1652	Zombie.exe
2008	_customizations.xml.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	86468e912f3f8d87a65f1a09a2f4b62d3a73cb1e08bb35d08b84c3732c7a0610N.exe
File created	C:\Windows\SysWOW64\Zombie.exe	86468e912f3f8d87a65f1a09a2f4b62d3a73cb1e08bb35d08b84c3732c7a0610N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	_customizations.xml.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	_customizations.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\management-agent.jar.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	_customizations.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-debug-l1-1-0.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationCore.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp	_customizations.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\IEEE2006OfficeOnline.xsl.tmp	_customizations.xml.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	_customizations.xml.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86468e912f3f8d87a65f1a09a2f4b62d3a73cb1e08bb35d08b84c3732c7a0610N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_customizations.xml.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 1652	212	86468e912f3f8d87a65f1a09a2f4b62d3a73cb1e08bb35d08b84c3732c7a0610N.exe	83
PID 212 wrote to memory of 1652	212	86468e912f3f8d87a65f1a09a2f4b62d3a73cb1e08bb35d08b84c3732c7a0610N.exe	83
PID 212 wrote to memory of 1652	212	86468e912f3f8d87a65f1a09a2f4b62d3a73cb1e08bb35d08b84c3732c7a0610N.exe	83
PID 212 wrote to memory of 2008	212	86468e912f3f8d87a65f1a09a2f4b62d3a73cb1e08bb35d08b84c3732c7a0610N.exe	82
PID 212 wrote to memory of 2008	212	86468e912f3f8d87a65f1a09a2f4b62d3a73cb1e08bb35d08b84c3732c7a0610N.exe	82
PID 212 wrote to memory of 2008	212	86468e912f3f8d87a65f1a09a2f4b62d3a73cb1e08bb35d08b84c3732c7a0610N.exe	82

C:\Users\Admin\AppData\Local\Temp\86468e912f3f8d87a65f1a09a2f4b62d3a73cb1e08bb35d08b84c3732c7a0610N.exe
"C:\Users\Admin\AppData\Local\Temp\86468e912f3f8d87a65f1a09a2f4b62d3a73cb1e08bb35d08b84c3732c7a0610N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:212
- C:\Users\Admin\AppData\Local\Temp\_customizations.xml.exe
  "_customizations.xml.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2008
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.exe.tmp

Filesize
126KB

MD5
3972c03c6003d875ebc19b02934e1c2c

SHA1
d6dedfe6d0d592b599bf283da9521ddc70b87aea

SHA256
a7c9ac872abf12028bbba427d013ea0f3497b594dcd36cf0e05a8d64ebea7776

SHA512
bb8fb5504f00b03c9d2eac60ded81a7950dae779a3baa618f6e0d8433fc2a5bc74cade358ab42e8b319cb0364a9e47f06849a78dd700c11a9c111de8d7c57772

Download Submit
C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
60KB

MD5
6d19a03b1e04f96d4e6662495d1c6458

SHA1
955025343d7598b3df3c4961c64d9103d5de2014

SHA256
4eef2b28f41edebcd87d288b80f78148b8c9935028d26c15354184f5e7275e5d

SHA512
f8968b4ca8f6a4d0ae23c4fe93d168ed0cbccb8dcaa44c9adc33ac4866bacd18cde180d51adabafe7ab391c5bf253d26d74e38aa3176e34b643331156178669c

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
172KB

MD5
94e3cde3d2ce5f2a490a9a87623e711d

SHA1
2163be99db001b9893a0154ffa99837ab73a4d75

SHA256
a3be848643ef37c1250d9298e8ab856b7f8ed913c3d6da8a686b0ca91661c3d3

SHA512
0ae27b84aab64a3606f6dced2670157541535929ba5ef44b3f1232b2d07cca90512fac14ee6b93547671b19fbe949adfcae5d3f8f156c91ded39c9db6a2f9f4d

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.0MB

MD5
0b505276a5391f6487a071a23799d482

SHA1
77adfbd4812f9d00c6a252f2a8ffa9e43b2376a8

SHA256
6ffbc170987179971526cad961cc6e0492ef5e48b13ae04c4578394140f7cbfa

SHA512
d6f545a7c22fa7ad62513d07961bb2cf7985443ba98f0a20a8154de6ef90417e635623259a71e9ee2bede290a0941a3a7f081864bafe0ad973257d206fe4552a

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
7e02dae4569826bc49abde55264648fa

SHA1
e6466e6bcee55c0bbd0369f1dc5644a8125f3be6

SHA256
922c095c629fad2e71ed6af48a055e1a5921f6aa243e1781c71230bf9435489b

SHA512
98c4709d5d0f8b2af22e186fa3cdaacf34aea3456b0815ead46d984e2e098c49bea6468640cb4d061ac8064d92b470dc505d6558a89044387d09bfd8852394ca

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
604KB

MD5
ab78314e63314088486092442b18276b

SHA1
5d7a6933bfa0a012e2033e53db1ad8bbf3bceaae

SHA256
06b9927ccc58b4c046d69afdab62a81ec62657cc73db715185333de299ee430c

SHA512
d01d9f7ab8079632bb9bf7c8761e0a614494f60fae5c8f4fe54a47d6d7665eeb3792021961f5d590c18dda75f655e2ff643e5845752c078308e78053c7aebd92

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
254KB

MD5
f19399d5ec417888f7d9dc255981e76e

SHA1
3b6e917bf2217d1126391031e2e78460057386ab

SHA256
7b89ded1734b53922489ca280eae75960ff13371151aaf92af3401a10435cfc8

SHA512
cb1328eb0cd8be7674b06079ae6b701b0a2b6115e8f6fd30c2f50c7eb5796619ca37497478e23dcc057fec715be2fdd21154b46a0179da549709c1b459b86775

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
744KB

MD5
edf6e4a334d5882c5319344a0e6f87c2

SHA1
bab1d7dbb62d797535803a3c9cae4cd9b56a87fb

SHA256
6fa6e1262de45a33e90479c991cca9f7cb9d1e9ec7a763ee432a38a7d30bf0a5

SHA512
99b941b87ae68d4ca95bb2c2ba18e56f19ba88725536dcf45aab7ac1cef2a7befce47d6750bc268bf6f13550ce0472d0016a77b5d0133ec39f21b419b17083dd

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
76KB

MD5
13867c02fd05a01acdc0d83b9bc89def

SHA1
631b5a14fd86061b1637d39ef5b1ae0878bac5bf

SHA256
c7ba7b9a47cee8772f861fcd6d3616ab0c2827513d4f6c53f43bd4ec9e5d1e68

SHA512
598bbb972216832438cc4f3cc2c8fac7cceb10f4d7d41b662de0d6526817229bd2c16328f1a97808d8a543cd99b8f6a0a57b968d022d2816b4736cd63b0953f4

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
67KB

MD5
b349005d7c4916e039487a998d52ab91

SHA1
6a80e2fe4a7b7f80c3e3689f0d93ba0e8989f68b

SHA256
64bda4e72df08fe5fcefe26ed1b79a324f6f6ac53dc85cfa2e41e0f521b4fb74

SHA512
d3d8921e9a9f08dbf959591333cf1ab18e764837c33e665a7b791f799435939bcd0dbe709bd997c97e3f41d0a117cd25d09f640dcc00ce59597da0072c054b4a

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
78KB

MD5
d20b4f8f2145220a7fff5dfe96bb6fb6

SHA1
f0ee7dfe34a0ceabed9013ae71ad2657144ac0cb

SHA256
742e399c6cb6e5ede7607af59558546eb0bdc9c26273aa7aec2dd91753791821

SHA512
feb64a5c17a36ccb8561c06ccd50078c9da3a9204bd818d84d26399c9d235c3ebb36debf80766ed44941dc4b0241afa5ee7989c4d544aada7e1950b05156fe09

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
71KB

MD5
55bb17aaa0289808c35ee6cb036d95dc

SHA1
feb20f0c6848e84508c90d5dd81afac7e938a907

SHA256
fc8899da5b5a5bb8b9e74a69a4aee0ec521b4d1fddd143f5b8a552bb0b8d39aa

SHA512
bb15d7c15f76c1828c7ab10e0dacca220e23f70f547df995ee5bc3745be9ad92b862aa65778b42c82cff828fc4e46305190f4de1e90ad4258468465c649c1c6e

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
75KB

MD5
103a2a062a05db0810395832b3357ef2

SHA1
b58ecc512608507cd718b5aa20371f2e8630442b

SHA256
3d7276faf932c0d04a101bea991904c84f1bdbde3b93954e894cb12090b3187a

SHA512
4933abf02180578d6fcc50bcfdfbb944a7013e74dd18d793c6a1303ff4a469d1b8cfa6f164652f5bd2aa12093a6eede1a0d7ff70dce3241b64ce0783dc438c50

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
77KB

MD5
babc675ebdda258fbad790f2b1647ba3

SHA1
5fd641bbbc6ec6a4f36315c62a1872dceb4828ba

SHA256
46846f76a7fe5926f6ccfc7a34c7cc92d3c0eaaa6fbe6ae4379b48d7b5deff37

SHA512
b84fe22c6c3a2a1fe1dbe40876a6ad495ae51224db73e0054cfaf7a5ef8843705fe6dd75077fa81456e0716af449dc25ef70e78d97d9df6e8ee3e2d4188d9b80

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
60KB

MD5
746aa8bd337a70469296520703abcfd3

SHA1
3f797f346e4e20f4eb270d3c50bfd521df451c14

SHA256
b2976b51520a5261cddedf75bfa594eab325f25005a368c2ec9117b064549907

SHA512
3a424350d4f28def3ad24bc96d5e45849b4fb2f31e31aab708d2df6a1dd551af0822702f682ab56c5ab0e5e07b6ae00b93f841f099145b2527472a0a5283c3fe

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
79KB

MD5
5b179b919c49890de319dcf53f8e9fbd

SHA1
0a21dbab5f19339fabcba09e295ac58768e64087

SHA256
19fec8407368b922a0e0d27bc18f6aac898ba79efd2aed7564d2d99b45d189e4

SHA512
86346924a67a791c65745929fd8ef3374b72106d09dd6cdd9577d248e959a28b91c1b270d55b92cdce709a77d34992b875d4f3985ccdea223542bcb2034f7ae1

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
81KB

MD5
ecc709cb2bb2b34c6511280c655ee964

SHA1
cc715a23d679a51f02431acfc1b159a2944e8ff7

SHA256
2fec1e2cf8c5090b08d42eea01904e6c2feb8542ecca279020a9119fe1a39c69

SHA512
2b934dbf4f4d11477241d105f076fa86fbdf71f8ef2bd76bd3712c41be3b7137b9a49d11d72bf57fdf1d87da1073bb83a67eec517f5dc5d7beed94cb65482a68

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
71KB

MD5
ed3c64c2731684e43d46f5b382353055

SHA1
3f35e87e49920f647e1e39f44112efe7c8c017e5

SHA256
bf957eb059d982f4000c4863706679ae858551bfe62cb2f3ed76484308540a73

SHA512
08c2325e12b0c2d1f9e5ada517b567a4da85ace2f49427472d586bdff4918b264ca48f714d3d19d3b640002ec3ca4a243dbfdc11eb2b99578e977af810a050f3

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
69KB

MD5
f9635422d3735f1fd996e792553cac04

SHA1
2aeb0bc1c1abd4781b524b0699e63d6964000f69

SHA256
4734a303f7d10d75f98addfe93eb4ac0de7da1571a3fcaa4d99eeed2a7595acf

SHA512
a488b6a2f5911083a384763134c5c14f19f2100d08a610dd04bbd5705c749bf10456745af706e03f56767e6bc363ca48cfde7ccba722677140c39e9648f61b84

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
75KB

MD5
ed79d36b59ba4427d74bdddde654f0c8

SHA1
cd07f3f2738749858e25ec7f128e1092aea47fd2

SHA256
1ccb1ed44440021adc1f96ffdc44c6bfc679f3158e59afdf08e8c707a2b85b0f

SHA512
5d1e7487774cd79603a6772a691ddee2587793b6fe5a2d6bdd350db9005a1b37a682fb6d92a85d04d14bbffe064fb346464ba1e3f71328c2818d8f84500e514f

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
71KB

MD5
4bb9026deb430980165abe2d4effa5d8

SHA1
e60a57a0c2c008ddf3126522d90b54e62ebc3913

SHA256
d80830d6827f6a1dc84ba78ed725bfeaf22b4e0f49442367a9e148bf4b7450a3

SHA512
cea0b5ba7f8be9d895af21bba03d0c591137512cff570297bdbef70412f27e6593c5fb1375dca6de46139c1c9fc3a2fe337517724747a3d8626c308f2ca88698

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
76KB

MD5
bfb0c74d50070150f5f2a759b05883d5

SHA1
d98bbd09d13fb27d2122e151c413087064ca4a31

SHA256
b64e25a86b46afb823abc5152d65ac6967c3125955eb91e05225f1d8590e7329

SHA512
bf14c490f7b2216994993546bbb47eafa244da1307c52739c0f991439d8c13c9df4f803334444e0cc89fda74aed82918cfd779be8982ed7a7e5bf4d350a68e2b

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
66KB

MD5
695eb066c46553bac43313c1f0f39b9e

SHA1
9f4b510426a473cd197a372cc606a893d195b4f2

SHA256
2f8eed61bc6c8fbacab9a6d9128a112f311cdc46386e199c1a8f4665281fb629

SHA512
0338c6dc97758ca2afb7625c8504c85bf7689532a987a6a947ce6cdaa9e46bf52d098e96ea8d5adfc506519c3208bd1ee3f77aa35b6a99319beadc91f94a127f

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
69KB

MD5
c9326f955c69c73fbd1480b151287066

SHA1
8250e08e8f82f57fd040435e4c3de313bc863d1b

SHA256
da40ef5a7c802fb047f2831b5c674838b6d95d5f7a8d45a2c0fe81eba51722df

SHA512
d186b185390ced609ec032f93ea00fce6d6705f4bff93d7aad98e46cb21b5384164db43be6ac18d8eab5fd9cb8571853b4816401b553bab5af004df068152757

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
66KB

MD5
01b2a6a7d213b0c385b319a1323be161

SHA1
508afa849010a9f17c7613c6ef01dc51c6f28d4e

SHA256
6e4f50a09722d339311377f591a8013e4b132c107aab357adb48f4625350eca2

SHA512
6dac683c3d677603658d94a3582a2239070d37df7d327b1efb749ed6dcbd596743413fb5a953054fb1f0f90c7bf4c82491d10d19bf714259be6009f1a1afaace

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
67KB

MD5
975e025d73a6fbc52ec2ad51210c056e

SHA1
d4b34ad3d3a8c7aa344feb845b80db684e6aac03

SHA256
1558064b6fb7756135d352ab19c1e2aeb9ee79bda997b82e33c0401506764194

SHA512
5f5e1ca9cde149bc194ee1fa5db70b3465dc31989752965689ebf79772c365e3a22e0c55c5864ec8b4e5cd8555eb5db0c4b52f325f4b396af84ce3d229da8d66

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
79KB

MD5
041ab9de21a6dec9bf0ab7f4e9704c2a

SHA1
42f583741e9b94f2afde56d840da74ec4f70be16

SHA256
63aaaaed59b25fc7ae98b55c28826223b17304b2bb18766c74e7d565c454764e

SHA512
f87b76322bcf817e70b1fc923e1b3e832a857f3ba3158046897512f078b819616610956e2248a665664c69a129ce64f7ca09d91e11ad2dfe8bf11e6decf87e69

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
75KB

MD5
7facca82d3a8c11360a989b372ae431e

SHA1
0d0aa9769082b5b05799c87afbcac258aff46357

SHA256
e522c6ea2cc6532841e886358f06084268133c0ace30ff2b3e379b902b91d634

SHA512
dcf2eb9632bc1cc538f59a6dc2c54e9405659c4de10a96e71034045e85ad9f78c4bf0d9a20dc60d6f0132b6b33f8958f9aca38fd7955c1729b809fd5c91631e6

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
67KB

MD5
bd3d5b8ac27e2e3c6e541a8ad1ebbc95

SHA1
76fa4aab23030e6337224af938301ff3a79052b0

SHA256
0c12077c10e7a085852d6ce9d8d4ee3a671123967b497f9f1d0d560ee770ff95

SHA512
d3ae193f9d631301b44120425b242d0a0920d94162cceff890fb5992db04958dbf21aed2ffa7b0cce9d3f71b4bc69ea9793dc525261d06f397fa3768c986d3a7

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
66KB

MD5
8311d2833977d58e896bce12d2ac0871

SHA1
a869fd09ee69787e558d453ef74d877adc8d9d67

SHA256
babe7ecbde0e58c6cbbe5f93c61f4806aa92c58447d643ca1de59ac06efa47cd

SHA512
62046213ac4406fb3fb11a584e6af97e9c5a3e85a072336b9295f0ba09d6fe15339f09c7d1f31cdb6eea0aa734af17186423dc8757a3efcece8d07fa69bf480d

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
75KB

MD5
e44b0da1850754ed3925120c0daca084

SHA1
c86a9b71d19c4d5c3171c65078b761111cf9cd8e

SHA256
565c133b3c532cebca153b2f2f04086f4a48ed9589cd48503989fe79701bf56f

SHA512
074ea706aacc97c4f92e613b883bc64efd5575923b4d4bebadf0ea8ced98cfc22e7d2faff2de43120cca4484575f3b3acdb131cd8d558d852359e339f3cd71bf

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
83KB

MD5
adcb08e890ed8089b4b9fd7b9657fd66

SHA1
a0d77060a2ee7acf308b0ace79663c6100b89b5a

SHA256
9f36851397588801dcb24ad5c8f78c45c7bcf2c6a582d91f65764f7134fa0adc

SHA512
b8fc07cf3eb0b74d0c37caca7cc663263bf7d7bb8b1f7bc634bb2ecb74bcf7346d92d70fd877f3adbe407d6e83f8b9ffd0207a90ce05949c3ebf6d9c78def8ec

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
77KB

MD5
045a21233f4c06cc9750e34171164cd0

SHA1
a51abb20a954170be95e656871bbc9426e0980ad

SHA256
1545d6eb9bfdec3babfd47931005334992633bbf4173b8e54fdcf81d6d81a959

SHA512
306b0a9422cba0f98de5021557ac5915e7ed4ce6b562c0b03b24b35aa59a7cd62ea73f9e1b7612330ce67f50fafdf999404a8a5c2b9cc64aa8b4a6cb0e49e888

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
83KB

MD5
dc026327356981b49802de753bc5962e

SHA1
e259e934522dab2d9b73106413271ececfc27473

SHA256
fb26cf8eeb75664aa688afe01067065aa79be7ef43a0eba03e5ba9595af95c6d

SHA512
4279ffd16e38e5e2e96225f8febb4ce1646ed8e0cdcecfd3a2452c63a2c28b4f138e389444c55a6bb22da46128e2ff5c4de9805a850119b19ec49d796b78e8e1

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
70KB

MD5
022434d2412ccc4c800180a1a5cec7ad

SHA1
b7fb34339f1fe3a2ab635e6bcafb0f765501245f

SHA256
abc0b1ec2c8d30187f7bf152b791500fe363928572dd09837c32122c3688a1c5

SHA512
3a581b9fa441392ce1c3c20cec5c9a94d6942e239f6cc9a73db33284087c2a906b2427730c3ce9f9d06de18a60f5dca6cd5c68f707fc11d4031a25e90d3f79c9

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
73KB

MD5
9b8e0a7c0ae0ea52f763d9a4a926dff2

SHA1
f5507d23f5cbf51253c2b6a31af5e34fdf9fc045

SHA256
5c1edec4ba156e9650c2f648cc2d25d861c029cbe114f34a61c6c0bea76f6528

SHA512
e60331aefc9efe3d8843f4fbcd153f73fec644d7ae63689a83a610334684b37ed8c48241ce1f6d1f09f2abf81f411dd4b28797cc8a8238a9506b95632e2885ee

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
76KB

MD5
0c7cb6bffefb089b6dbe256bd3a1b89d

SHA1
26a0e71bb056e503187aaf540784ff3d97342d3b

SHA256
718722bb15c6027f8aa1cc09f23d7224f5a4b10a1fa1133dabd4b7ed1da00a31

SHA512
85736490f9a8d1aa79c766c0da1abfc261c15a685aee1fab08e0aa31cae93e626677baf5b1a5b9deead35bc938c4e1e3d0c10d85e7a543280d9c5312ff826142

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
76KB

MD5
735614a9ce56874aceda53f4c6ce3bac

SHA1
982131e8081fa44ccd95db1c3692d2f325a09404

SHA256
f52144c187661ef925c92474aaff18c702b1e82f071559405791e99c717f1567

SHA512
f5cf553680e5ddb24476dfc5be499317e30b69c4396e84f74e0ac3ed1db4e533f766f1a0fb60ce306b371d20e83c9ba7a124d39d810d426e21662c8c2bddee45

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
70KB

MD5
87663c2fed99b5d668516b0f6c080412

SHA1
56990b4c37fb902a8349c2d8589888072497f8d0

SHA256
f8b9127e6959ad95956e4ca321f1edd72b907d0813c5064c8a95566b9aee735f

SHA512
4a911ed70aac99d7ece21ac0680b3d1d06eccefb172d234b8e92e7ffd3240db8abcdc40d1d959cdab04dcd56c7118c819b9c89356af508cc9d3e91489ce6f8df

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
72KB

MD5
0201f56f7333ff70cce6761e101be842

SHA1
a910cb19fa3d23d3241c6ea4a27875698bec6d27

SHA256
0a31d3dfdb5f29b62a4b1ba554fdc05ce95a85f55c8548e31139e0a94c76f6d6

SHA512
d1798dfc99e6fb8da00f81011af679072f1e1347e1641dbbbe292a6412b7b94d864e646f17bbe94631ae304412b520269f7a65a31b28ee9034b1e98f904a0fb8

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
72KB

MD5
51d3b75e057eb933ed5bc0d84ebead3a

SHA1
22c9820b628dcfae0a9db15db913d827fd191459

SHA256
be10012aab2232b4d8eef321bb2d817af4544d2ef57c7963a24790bcf1502bde

SHA512
359281f4786dee0a5cea4a5207b311f0c1e96e08093e76e1e7e6c2fe8c270907752f3cf3fa2997e0b1bd0bcc3987c8af7fdc1c73e2a3749770368dc5ef2714bf

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
67KB

MD5
5450eb27eb038800d8843c80d25011a5

SHA1
51a3578e68fab3f9b21e570470bffe8586477c37

SHA256
a0365e9946a0da98b59269a21c3ed089a10e32ff2584eccb1ad3a56945098a58

SHA512
83b92248229b480a37e043afe694a3ca91f902e4ae9671de4edb6428bc12840cf2b606ffb0b2237f1e9ed968859c90c4d15228bab089924c103a1c91be802585

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
75KB

MD5
9c66793747799a6a57bc611939961c3a

SHA1
7816b4ccad2a6984d754583e6a978a61fde799c6

SHA256
ac80befc8553621a8b403fed80650e63a84df57159108df67d5e97ae76661cdf

SHA512
2691b54870bc3ee30198acac2cd1d81e2e4f7e6ad275ef745facbbba729266a100a9cba5c5e7c56ab4a71ae42dcf14e1cd5ec4131a97a516abd81f66f361ec68

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
66KB

MD5
f1586abf633338c81ace340b01b3b888

SHA1
e22a6ed31e9a627b37a6987aaeaa96fa85316a11

SHA256
f2ea7a36ab0acc021f57b3c97c60d6a31094a0a5cb897553d4524bb0e78b0dd9

SHA512
7891839d2ea2cba34590f4b3620a8f7e902525495916f38084597b065266678b9fd16c968918561459d0c1f75deb88910d0d5cfff1cb03c256a06d1357e0e2f2

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
68KB

MD5
b8439bbe428c194dc2fd1f0cdcdec775

SHA1
ac17c690a015711f61cd7e19ee3a94172a03802d

SHA256
ab9742f7488d4e7cdaed0daf8124f9cf7fd6d4cdc74feecb230d39a5c6fad6b7

SHA512
6c78a7eda884d73f0fece5ce958552c962f863d28e830e4838a089354aed0cdf057be6e8c070abff35bd43de204e5a91cdcca2234f1fd81c26f04cae6c012506

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
68KB

MD5
c53cea22806ddf22516a35579091a9e5

SHA1
bf292f1bf2a2dc9dea8bfa30464281257cb9ace6

SHA256
da2f73a50dd5f8dcfeb6c5900cd49e6fdb57a863be9c32828e6c0c4398ee66a6

SHA512
06fc9c2694471d4f68ae909f82b0c3be0cd4abd7c633bd42a5211c26253a4bbf49f1235f9c9f6ea29f39dec75ed8ac7019307e5163c602b48df9901229efc475

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
79KB

MD5
95b6903e7b9fbfc3a7e645372eabb278

SHA1
943f5d808fc48335aae409b93c5de016fd4a0705

SHA256
d8cc4ef12becd05d9b03ee0948210d6ff340c9780b0ceac2e00750d0b66a3941

SHA512
e9300b447b8d078614054bcec981dbbf987b95ff91f3e5844ad3a0ebfc1a03f0f785b354b323a280177e5bce9ac9aa2d41f6842c914ce6edf1de6c9950a93f10

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
87KB

MD5
51af1d8a0d24a9389f6ccffb4ea6159d

SHA1
72f1349b0b421a3b0530dd272f2e7f83f9e2c5e3

SHA256
21398c8ececdda74f6ed01fe3c73517bd7a1349465f1f8cf1853e7b3e4009106

SHA512
e1509ffbd11c33899f4ba9d4e14b0276825d433f51d31e1b3ff7e0a07897095f4a5b1be3403eaaad23f043dacff037724c73bab0d9986f99e60efea66e4d5bca

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
77KB

MD5
e2b5bca27a255ea5d6179fc42dfcbf3b

SHA1
ce5436fcd9f445e4e1b06763be36d250864716b6

SHA256
dfcf8f279fc546e3c30cb99816e6193269399f449d570b5919a4d112380b681c

SHA512
202443e8fdb26c37809852ff3ea6d8d0435bf802cc2a1fa8e5cce83b5cb4d686fabf1b2693f6337614c441c1b9520b674d93e102dd504add5c11193e8c3d28f4

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
71KB

MD5
d3ddb3bb597af5b27f75e76b4061c0af

SHA1
2cd0a2fcb662555dd4b7df28076757fcf7ce7209

SHA256
2f286087d2798063c9969efac82425cc3cd74009a21f6eb969bea8e5e9307daf

SHA512
37480659d0a30c49b7639ee6f6bd752eecd0893f9b5375cb8c06ffc39db484371adeb69ad6e654df1ac37534b366bf48cdc7a05f09494e64cbd41c660b01a9f0

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
72KB

MD5
a003b965c94bed731af8da7162ab60e4

SHA1
c2e14901344b6f459e854c9c9cd4419913af7d0f

SHA256
bbe738097aa470610dc928bb812f2e651bba4c902fc6ed983bd35dd6720f1f23

SHA512
debeaa9ee2edd74f683c1c6a26a010a195f1b40517f3e2da7bf6bbf1ed063d26029b074b55e76362109641339682417e6465d3b6d401cc021f2176a2aaf34084

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
73KB

MD5
d2c049774c941bfef753fb4399e09ab6

SHA1
b1ae37a29e81c2420635513074b49c9907e99432

SHA256
74b01841d7b72205a4506c81de7b85deab990f50e24fabe86836fb50ef1b719b

SHA512
97f60b8767ca57ab0daef1528e283d9b187293c8ccbd7fb974854c9b876b09b04c3034df80e6e9b0c31930b85e01b68b0e7ddbd0b014237b81611d42ca72264d

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
80KB

MD5
ab3e84cc107a67b2356823515cb274e2

SHA1
7ecefaa65480143d2c310ac1e45e1a24d69896ea

SHA256
7712540eb7e479fa0ac483f87401c55dad40f0149ad10f8f9301f476e963da94

SHA512
3586988efaec7a90aa0c85f2a952eff1d392891b7c1278cd526540ce427bfe96bb0d9189544564575b1f7772c1ca4b59f84f3705fcf04ea3b804d18526d3d907

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
76KB

MD5
926ad284b6d22e27eeb3ce9870ecf3d7

SHA1
b34983519820335fe3e5adb538b30317c349138b

SHA256
26d288b0ee13b4d6c04f521634215f816dc44a1a66a3963f33a9d4ac1313a6c8

SHA512
03e73f7811c0d034c6c37498ea48919c20533a6652add93aa0f78a9039affd1c042daffeaa1f1f3cef4dd158d398f0cb7ab6bb710ee5262ae281746eed00a560

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
76KB

MD5
02bc9d383d66f685e120e85a39902981

SHA1
da355198404aeffe306d51be697b511759486e14

SHA256
563463470e460a2f82d5d2f64ca2538b7e08786f3f0c6194d0eb4544b1e0bcfd

SHA512
1cc5187d3993e7cf5459d8290409517a4dec4269dcdbcb4b74e3d0b7e64507e528f9a4976bc08d0c28db51fb0450ab995f18cb6fd9f98cfa8e432c21450a369a

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
73KB

MD5
f5da860aee248577bca34cc6656ffd4f

SHA1
9304fc56d4f26a73b6e69a8fb74f661de4aacb94

SHA256
1c6a65c82d8ffb623f598057b59ce6e519da9d205fcec1e3ac2294e7e7612d5e

SHA512
f49fd53f28c0897dccf75c8e0341379b9300a77ebf77c917e2b5de7d1f38f7973510af6f9bb592c0858c32eff796af34bd0c9c90965c3c697bb56ed915c9e278

Download Submit
C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp

Filesize
79KB

MD5
c0d024cbb9eb440343aa997122528d4c

SHA1
47f3f55cb640e24d2fe57a4be5dc972fb3be50d1

SHA256
e01ff3704cc74e2ff37e2021c2a625af9bbf6cc5680450ad9d8ab1940db83094

SHA512
05b2108004dc9a4f0316b3724cf248ac126a407dde5347df09c71c2a797c476abbb8c7ef5199383477c4b8096426a1ca613282e662c1a8ff1c7d09aaa18693ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_customizations.xml.exe

Filesize
66KB

MD5
d1a08500062b14accc713cb512dae666

SHA1
8518d5dd6fb92747bd80b6d565f8b2d6f0a2e4ef

SHA256
8b8150acde4e3b4c7ac16f6d9b734e52f0e022343f01057a905a3e10c1e60425

SHA512
452a0dc136bcb9619f0ea065311e962db86cb1b60be16999ddfab7c158428b43be6376d0543b2f07828a6577fbbb0b133a9e3bb309d3da818558e2cffb26cf6a

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
60KB

MD5
214e315b6305b51edb332e7c415de4fa

SHA1
8aadb484a407f1045e346009f2571805ad559a32

SHA256
d78064e544e2b7cae1e6b1fdf3c7ab3e0b95472af31ec14f1af3928652b125d3

SHA512
0a6108bd879655b2a023b746aab63a7468342e24bdb0eef2d401e0b0e03ac79184c0f0de3d5eb9c9a94543acae18838b9495c2caedcd6da2b8896d178a457a8b

Download Submit