a75afc86fc77e12166dccac6d9837c69a4b7e045bff30dbabed1944d135b41c0

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a75afc86fc77e12166dccac6d9837c69a4b7e045bff30dbabed1944d135b41c0N.exe
Size

80KB
MD5

bd05576fe2c645585fdfd31a3061d000
SHA1

d82ab72cc2d52e47d7c0255929163085329fa8c1
SHA256

a75afc86fc77e12166dccac6d9837c69a4b7e045bff30dbabed1944d135b41c0
SHA512

f02ad07f4112fd4bebaf5a629f8b63dcc980fe3b8ae2bb01ce896f3ddf89d6139fc799f1e9b854f2a669c0fa506aea926f8d01d17a568c7a9122b2ae4b97ad1c
SSDEEP

1536:W7ZppApBMyKoIWbsHfySkT5GeCyi348oWGRPOzkjId6q8UdrSD+kCoIfL2YwqAFt:6pWpBMyKoIWbsHfySkT5GeCyi348oWGz

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5246) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4272	_update.status.exe
4372	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	a75afc86fc77e12166dccac6d9837c69a4b7e045bff30dbabed1944d135b41c0N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	a75afc86fc77e12166dccac6d9837c69a4b7e045bff30dbabed1944d135b41c0N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	_update.status.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp	_update.status.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html.tmp	_update.status.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	_update.status.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	_update.status.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.Client.dll.tmp	_update.status.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp	_update.status.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll.tmp	_update.status.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	_update.status.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Json.dll.tmp	_update.status.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\MeasureRevoke.potm.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp	_update.status.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp	_update.status.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\PGOMESSAGES.XML.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag-dark.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	_update.status.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp	_update.status.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	_update.status.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp	_update.status.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp	_update.status.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\minimalist.dotx.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	_update.status.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp	_update.status.exe
File created	C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.boot.tree.dat.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNBI.TTF.tmp	_update.status.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp	_update.status.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationProvider.resources.dll.tmp	_update.status.exe
File created	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue.xml.tmp	_update.status.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp	_update.status.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp	_update.status.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp	_update.status.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ppd.xrm-ms.tmp	_update.status.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp	_update.status.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp	_update.status.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Primitives.resources.dll.tmp	_update.status.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp	_update.status.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	_update.status.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp	_update.status.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll.tmp	_update.status.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	_update.status.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp	_update.status.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp	_update.status.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_update.status.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a75afc86fc77e12166dccac6d9837c69a4b7e045bff30dbabed1944d135b41c0N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 4272	3148	a75afc86fc77e12166dccac6d9837c69a4b7e045bff30dbabed1944d135b41c0N.exe	83
PID 3148 wrote to memory of 4272	3148	a75afc86fc77e12166dccac6d9837c69a4b7e045bff30dbabed1944d135b41c0N.exe	83
PID 3148 wrote to memory of 4272	3148	a75afc86fc77e12166dccac6d9837c69a4b7e045bff30dbabed1944d135b41c0N.exe	83
PID 3148 wrote to memory of 4372	3148	a75afc86fc77e12166dccac6d9837c69a4b7e045bff30dbabed1944d135b41c0N.exe	84
PID 3148 wrote to memory of 4372	3148	a75afc86fc77e12166dccac6d9837c69a4b7e045bff30dbabed1944d135b41c0N.exe	84
PID 3148 wrote to memory of 4372	3148	a75afc86fc77e12166dccac6d9837c69a4b7e045bff30dbabed1944d135b41c0N.exe	84

C:\Users\Admin\AppData\Local\Temp\a75afc86fc77e12166dccac6d9837c69a4b7e045bff30dbabed1944d135b41c0N.exe
"C:\Users\Admin\AppData\Local\Temp\a75afc86fc77e12166dccac6d9837c69a4b7e045bff30dbabed1944d135b41c0N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Users\Admin\AppData\Local\Temp\_update.status.exe
  "_update.status.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4272
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
41KB

MD5
958576b6ec8925f68887e7a7fcaa0f5f

SHA1
9dd3da29af8c2116e4580715c0fe8cd6c3aa6a71

SHA256
3d903915bca1e06e651368302224833285ca1422772627b2baa2660168f492ac

SHA512
b1c8880eaa5f9af5b2b81e5cf5e430705eb1e1dc3c531effd4fe5384515ddc178b10f78fc5f9dd09bfef00a909bf645cc93b84de696787cd6b63b1ce00ed174d

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
151KB

MD5
1ced24b7c81c4c313f71de0a4c927dbb

SHA1
245a01ed010abe2c1d64a3d407017affe48296ba

SHA256
046bafed58b917b89c1418302f2e235425cfc653ee284a85b07f69ee96e8e9c2

SHA512
170406a8f72b69bc7fd1d56df080571dc3b044dcaae1e1761e462d979836993a61c0cf32cbe9283724e4b9dc87853b1baa410b5462da5b24f89e4b8bee771a83

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
104KB

MD5
570582719c91821ef944095f78e1c0b6

SHA1
ed330eff11ebb57e0a6bf137167e3e8f01c504a6

SHA256
194c6ada038f72a23d430ccf2198633df5c65d09dda83ae667126e235f31ee24

SHA512
668e6c6b8c90d34478066e3800b83adf7ad78d392d5e36a5ccf91930ca9f9d721a26586e144bc658aca5a9673051bb4a2a357d75d8526c858b6b877c7b708502

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
4869b1df11466e1afefe35eb9495373f

SHA1
453096af13de83d9711d984cc0dbd1a827dad5f7

SHA256
ccef7b08b8fb2c0cfd59aa55691cea6d1faba4a892c5d544f795812fc5788f35

SHA512
a8816fa2d36dba24ed63853642fb0707256bc1f0ae785ce0eacfe39ea8fafe7280920f818ac5205bcbc5900eeef2d6141882024844070e19df593c5374811b61

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
2f8634459aec96109f58402952fd2810

SHA1
65a62b3c6e04bc72140ce9bac7946a8c2c3e7e94

SHA256
3e08bfe790e138357853c30d18731b89477edda0907a5a1bc2ed63179a205102

SHA512
c5c9293c1b716d72ece040f12bc6e84b782b9d128021df15b533401222625df7293f8f7a40dab63d222cd3aed0ba9d45b7dd3b38e09c2152b546a1e20494b056

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
972KB

MD5
5aac6f79ec4d3d26ddaa559f02d1b555

SHA1
8a2e4cb0496b32b001625bde176ae75506a6a82e

SHA256
3ba5f0b5c22ac479858822a0bfe720c9a26396060ae1c821e4ed38b85f65f773

SHA512
1e6840398fd3dc47d6e64e491bd901301bb120bbc8675e1474ba66908c74af5330497e4f8fb7bdf3a673c4e51d055f84ae1b893f4ea91668ee6fa6c7c56df9c5

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
725KB

MD5
39a99faa9b71be67f7c3c725506acc3d

SHA1
a09cb11bf2ef951d5a863848f616c7bb2e7f177e

SHA256
05e8c7382f94b1c5d88d69e4c74b4c7a34785a769d5c7e19c503cf7bbf6157b8

SHA512
739941ed529d43dea2d64597878b1e31e9dc43fcc4024fdb734ba3ad1ec539c6e5655ae148fa75f8af4974f9c1de3f11eae92b65db11550d04d7d3f6825c51c1

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
98KB

MD5
3c18bbad3440687cb6c84ad070f50599

SHA1
6ac591a66081ef3c480c35edd1d8a15139da00e0

SHA256
5d928e0d6ac562feba6968cd9bf7ee49fc00e301cbd77e1cd7a4c0f6c735b567

SHA512
796d2bda8e7c52db507347144a7343ce4de7a2e9382507411939705a428ac9a5033854f4c62a81d6f070648c8c35dc2293fca774eaaeab954d6b63cc0e7690f4

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
48KB

MD5
3a745a9987813fe7b8a3242345900152

SHA1
88d82f7a917b0eca935f10af6077a6e95042f714

SHA256
a288887c384789a9f0ee4c5a3a240507098861237840c7df45609c5c18cefe9c

SHA512
8a3694fc7ca26040e0885720c041611e43b2386a21d3deb7ba2afae7a02a3425945bec74782d813eec4822bfa9c49bf1b90b074408ac05e25dd1ae75dfb55fc9

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
46KB

MD5
8b63f4a42158672b1aa90bae9cbb5b4e

SHA1
6526cf7bf888ab55d6c7ca56ad9d8421e4f266dd

SHA256
1f48bd4b55dc8f7c04b71686fd284188f04e79cfd524cc41868c3be93272a5be

SHA512
5c47b11b4ffb9d57c43db9cd3a40ce105b7355c0c9f238f319a1d386febc7d06ed091e95d3761d0d7566e8819bedb74a98d403a669efb7d8625204dc8de305ff

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.exe

Filesize
51KB

MD5
e5138faac24cca87bf39bc58731ba6ba

SHA1
343733117ac84983c120668dd895d716baad6f8f

SHA256
254abc939ead6764d1ffc2b33e780a07adea34a6898ad2e64b7b451881f14de5

SHA512
664d549267af1d23c2ad3486fe87e681c96660207781b8e65a6253d53e7e0fac78f02bde274a498a0aa06b844166a37c37f5b0eac20114b0608779827e0b825c

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
46KB

MD5
84b23fd13a78306f59c415a18f4d71af

SHA1
ea16d144258295032bac0b09e1c755153ce6c372

SHA256
2f31f26a67bac9f6771a58019e2274e01558f95d172c3606f9c6ee85f7d71eb8

SHA512
a32dfb56f9c57f2705614310489e04ec13b7a90dd04b3b9625b34e63e307f2531d6407015358e83df616d7fc0ce09e6d7e74f3cc88f7f7f70438b523951f950c

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
51KB

MD5
c4ddf5bdfe41597d2f04ab24e52cf269

SHA1
8b7b8fd689b5e26586e41b1ae264d4fa555a0eca

SHA256
a43ac82344cdf637f44064ec2e2ff4731f38f812a314b55b09995ea471403dcb

SHA512
7d1ff0ec0265d86e8785282c40a1cf27923085bbb39a121e7d16fa313a144f9967f5cf067bd68a13186992fff0b7d0e238d97719c38c2efae18b125f050ed722

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
48KB

MD5
8a188dfd94617819f984fb8951009860

SHA1
a0c9abcf764085902521ddfbdf660a1a5ffb1a09

SHA256
e00f45f9bc3776f67e5416db2078e002dd2fc624934702719b2c2403144f7447

SHA512
60df34ba4e8a2f19e0a4396dcc1d9014d66b5f0db655b240d9587473ab2b8688993a94e810dbf77044318fa1547468c720418499b762f9793337fe73ae744dc5

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
50KB

MD5
9404609e00a204606e2fcf0274cc2100

SHA1
7533ef640f08a6c4939b1234256af01df01e064e

SHA256
4050812ec485ecb71cc0643bd3cfef525ad9cc21b6d78e3906e809c4dd946777

SHA512
01bf9cd2850f5156442105d8b956593affb46955b87edcff6f195549a0f697dace6ec2f4b961c96f4e2e0599298c08147accc92f3ef016cc8336377f599b3d87

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
55KB

MD5
d7a9ab21ab8ad10681ad4e643d76228b

SHA1
64192cc832037a337fba75554b86c5538f654717

SHA256
3679d3fb09a38b8d156901a71069fc05230fda95dd52e7e95d67de0787983abd

SHA512
cfb6f9fb842e47d3944403d27a9ed5349b4f1b30737349631d8133bceb803ed91ad3f84e9b228b2a8ab3e585467454b73ebd95a3d97dfe06c212c163844ae183

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
50KB

MD5
1c68d999041aa1e5210286dff9d0d965

SHA1
4cc85ecbe023fff82826457434166d6b6fa918bd

SHA256
a377c3a0feb5dc3982e5ae732cbeeb0d886c0fbccaaab0a55b29624cd05fdeff

SHA512
ad9e19a4e3f491d864d75d53a82e233c4d564fd5f59ca6569b234d3a60f46de5c7ed2d54a53c78cea05c403b33dcf7afe1eab8fc139bde6787f95fe0549ef3a7

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
51KB

MD5
f1a0e3ba1b5f3cf6ce02a97dba3d09b6

SHA1
5e8c629d6b9a465f86858f80fa467f1e65c7a2d5

SHA256
5cef85934c0cd4b2820b9a289f03c9cafcbfb85f16c1ca32cc8b7210a6b28aff

SHA512
aa5b59935e6845410c9acaa16c044f8d31043614e041071d180cbe3b5e405605ebb54818d8ff6ab86a24961fe9f1ae947130a162a8c59ac6d1bbaf74de0b91f6

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
45KB

MD5
1dd50751f61410e878b81455a67d271b

SHA1
ff848677891e0cf1ba3e74f50f173500ce462151

SHA256
e7bd29ce0902bc789235779584479346366940a6eedce642a6702563ccea4154

SHA512
d339766106e1c575bac348c3307ec6344c4767d768d0b1ed8454c890ed5595263cef082bca5ade481e87b15d0449e37915bdfa57d5a7e59b59cd4060aa1f14fd

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
49KB

MD5
47a50917fe0a0f5df03f9733e04a511e

SHA1
cc3939b6477dba4cfcf9dbf4fe5a3e3a66665f45

SHA256
27b541d4a14bb4c8ac358e7aac1a791bbd7e4176773b7eea8cae18ec1d547d7c

SHA512
332eebf0186b3d5d2b9c3228a2116b37c4171cd813a700d1888374a9aefad59eac9b58fd7364e1339cb3248c4dc21c06487f0e62db72f4e6d4bf047cd82d4755

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
51KB

MD5
30230709ce115e113f8641d664378c19

SHA1
001e540711f13b899026674a614a6a0bf8d2327c

SHA256
57f5206ab8e6b830730257096ed64dc8f2034853c125163242fee814b74181f5

SHA512
a4c8a18a7323d2089d12fa13fae75164e0b35ebb39cc7c12507d12d9a1384ab710a1c3898df5f60d1fd2249ccf171e35130ea3e6567ec2bef6738c96219b749a

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
56KB

MD5
2842bd11b66a023be3bc06304a4daadd

SHA1
5dd39d5796d2332f05cb9789f79ea30ae2ceb0d1

SHA256
f199597d05059984a91cbd51aa2cc8fc535f039980fe7d390d402c5b5498c2f4

SHA512
7726f631bd50fb37aeca384f72cff099cec7bd81c13b66d3bb8e728b2c75bd9f8310b2b0cd198f650aaf9f033f9ab13c8e3f260064259e241ce1db77c835881b

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
50KB

MD5
0640fae94e3dab0481b445d5caaab165

SHA1
8a2df8868ce82d185838e96e9eff829f506ef4d4

SHA256
c8170a96ccd69bc9ae7366015597e780891578e0f71801261ee81b974c077c47

SHA512
78f48d7f6953e15784873d9c79a4821012822e6c97a3274b4a834118321af393d9100d4baf085de8c349bdf2fd5a2fef55240a963a2dcb7897c1db0687fbfa04

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
59KB

MD5
d32714a09f981cb82c96af134e8651d6

SHA1
08d64cd04a9d5bda3ae5134e5ec9083a3d4085b6

SHA256
ff6fa3cacbbcfed49a5b7216c6c0fd1bee37db0c7b0ff679f0e01272e1c603bf

SHA512
9dbb57097da3259b3ed2d8dba4d31ab3726c8e985363743d85437cb4740688b0d472ef1ef99e60dc9539f4451d6ff2a34c28943b4552a18a30f4188f38e095d8

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
59KB

MD5
c0150ed09bbfdbe5296c3cc5fe4983a4

SHA1
261418a58091f47fe7ee4ed85b18e623acddad1e

SHA256
f8d01c04cbee50a8779453d38bf5b6db7485df7f056d1811c052fb485b730196

SHA512
7a6b2ec82a141c5521be14d21223f0f5237893ea12ee66c04386468da3f10c3935651c1ef591376aa29ea1125e75a656cc2fe5bb3a265f8e8ed59359d0b5a079

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
55KB

MD5
01727904fcbacac296542f8ee2a18800

SHA1
fe58b051002476575a9f8c6e4773c538e5da21f1

SHA256
487535169b6864485d4045bd39d37ea93f7cbdadaa144ebb12d1d3bf1537f28d

SHA512
c3423d1909f9c716eed3aa1f97fd4ecfde2972160e85c70e34a4716ba261d7433d8178dbf571ce03e66c94706bffb0c0b6c7ce30bfe53e09968522bb3bb83c66

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
47KB

MD5
29958afb22da6a6aa39fe6a1a27f8367

SHA1
2d9e0c980f2b966f07004b3d36b4d2bc0ae4e57a

SHA256
32e7e9a365f6aabbe0839717509892971ba507006a5b7b239c7f33d4c62fc00f

SHA512
d62f4f9d9bb0ca866333831f903c21dd65ed73793b70f3053bd47d438884bd23cf992839378a582b5b061cbc4c92613715793111ca0631c90a6d2cdb8f4a274e

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
50KB

MD5
aae8b201432f57b268eb39ebe63697f5

SHA1
38fd6d9fbf385e136c7494c7e22c80b2d3c1005f

SHA256
ed3a4cd824cf60fb6a6c68a55cba40ab9e0ee5798ee826896e18ce89e6cf9071

SHA512
ffd8675b256951ac0f5bb4c3b4bb34d2c68e9771bde3a285f9af5a43d9540747e3eb05264c62ec4d4821e02d4679053ceab383ba7c71f1dde68da49e7979b415

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
51KB

MD5
590c17b3a69052f1633d8e320a4224f6

SHA1
691e7252a4f46bbb7ce6feab8e7116a533ec1257

SHA256
ef8171e6be3afe779dbdac63ee1dbda1a3bef8148fa4ed4e2da883e0ec182bbc

SHA512
f9eb4610821c278b16de8c64a7c4679d2bc41385551134e791ef6bd9abc869b753e7cef0dd95a6fe9d920e9e6dae166b1bb43e2f066a5f160f53c0b8f6cc12fc

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
53KB

MD5
a4d2a055d2f99126c0a30eca92edc5e9

SHA1
bb694922972ac04a6c6303476a2930203b151ead

SHA256
2eed3ccba9e5a51960522ed3a35dde3500fe19b94e440eed69210bda7f031ea2

SHA512
c78b4d0ced2b910895a3ac605f60683c6901f8b6511a70e606e63d2abf6b97ac9dbb951a345494decc6daa22936206d2bb18f42114e960f642e3f0254fec33d8

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
59KB

MD5
7f364a0ccb071e4937f2b65386fdd82d

SHA1
b6591b2a506c077c0c21f04d74594413199a450a

SHA256
a8da198ac2d5c8ded4cf935f5eef48e67369bb5414b5f816f1311b3fe9ec2826

SHA512
7af7230d25088172767e3284c17830250de4ee6b3f854d0f7a717f1dd85831446d1f8fc5287be4648de1b1c23b4298d300654ef4562d41fe7d221566da115328

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
49KB

MD5
5f4f44a8ea98617a79f854eb5b500869

SHA1
0e73bf2926ffaafc377f738e4a1eb3680c805da4

SHA256
0867fdb03e6b35b1ed9250cb0b8a0d5ce3cb397886e7d042f685089dd0edae63

SHA512
8ba2fb1fc8bce6b8e09572fe1221f6c2d662e6f8768ba9e5c4e77aa21bdf32bb880cad11d2f37e1e2c03024eb8d3b7899113b693fee7511e158fc4c77532b27c

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
50KB

MD5
97c42986af11c4455f4e66dfd66ae1ca

SHA1
a1d65026e981df3743fc34121c6362b70d089a5a

SHA256
dfa6e6c7420ec198d2d89df49bbeb0fa422acec01948cf5bf5338b4f9c7ae607

SHA512
bd93e22c561713f0a82136e8d7a7263740de562250252e322666edfd0d06a5f402a33a733e0663d87768b70bb525b75a3aaa3e2bd9e023113bfb7399e2fcf760

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
51KB

MD5
9816bbfdda81fe5ad1cb2152df106d69

SHA1
d715b05067a81ebf057eae6931ad67be15a9852f

SHA256
f62f4ae3e70ca5331528a0639a83706a94dce196cf6626c9f6dd4c412114bb9d

SHA512
c66770f153c48d5e27df6cce6bda560ac8526b0c7b105ee7acd5c58cb8a468a20239746583e8de2d3d84a72a471d50d8389e5be4e01bc004656eb94d99ffe18c

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
51KB

MD5
f1323e01b70c2bfd9803ede6e915637e

SHA1
37476b0fd3667b4e3c43d57e64cfdeaf7fb72ba0

SHA256
327307df0a1d006c1c2bb1f55c00a22e88700f18eb2574b3954a9a3196292444

SHA512
b1003bba8bdf5548278a1080de44d8719d5c595823c6f6d0c97cc84268e6e3f7d9287505ac37ad1558a8f465d286ed932a8ff515ab8002d1cf0da13864a0b63d

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
53KB

MD5
c4fd23e3bb1e07889fa262dcd728dbe2

SHA1
a8c1a29902ea5635ff30addff1b1586adc28fd20

SHA256
db1cc8689bcc6360e25f605912390603e291d8fc4182394e64f93ed13c0c4a00

SHA512
bb2da9ff2e77a2e025f37a3bf61c8f015013f2209dab200fb0376efbf8dd2af1762dd96f0fc4e86af0608bd5bded647dd8bf4ca15dc1e23fcb0a3729e40fa605

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
49KB

MD5
a44c8cf2c1a652cc50056492fb6c67a6

SHA1
1fd72080e88f8b00adc379ff85d2b86166c1fdb1

SHA256
39e799d6eff06c050350dadd3137913bc32ad46d76011f5c1bff155560d4503f

SHA512
55627044db8c6acad3140a98902bfc133d7e1bb614138105d958d020327d979e9d0718350e7abec312244e80115a539283c15c9637ef295d6bfa69af1563643f

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
50KB

MD5
94b03351b3a2784fd28e6ddab70061f9

SHA1
2afaf254312f607042f4d51b3f43ff594bc9c68b

SHA256
d0f4e36224342e90109739006ff6b3c65d0d77d2e9a0e8c1575b013a203c6a37

SHA512
aa73acdabe4b3b006cd01f0386a16ec23d353557d1cd4fc7de8d1f63956de3b472fdadc449570895611932790c899e968f0bba507342af43a6844baf99feb11a

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
46KB

MD5
11f31c4291bb86b18c5ef41f4c0146c1

SHA1
4ac35c311bdbf5ac6d9607f96a2abd75dde8b9cb

SHA256
cbd9f2712aa578c5dfa2b1b67a23ca8ee5283a4d8155b8b984a393be9269af45

SHA512
637c59257dbc6c91bdb0ac83a350933e420f8eb411c9ea6f1fb64cb01d393ed1de795c51bb67df9bf3bdbcb36a2106a48a7a29df48187662bb9878a6fd39f1fb

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
47KB

MD5
d1bc208a5ff6b89844780b51ab37d5fa

SHA1
4b2edf2dbe6a5191adb3a20a494e7060adb4cd57

SHA256
09510f42c172360ac7c867829443e94072cd0f138af70d06e569bc0be93c5dd3

SHA512
c0eb3cb4b61e8120b999b5bc1af07b9d14569a580a1babb6bb7bc408babae52d1db7c5fec08cc0897a5dc2651b5c5572c3410a10595998ed42c6cc5bd814e4bc

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
58KB

MD5
3c4711c11fd9b46e53849cefa54a52ff

SHA1
4b6735d5dc28aa877ac35eef3ec79e7b19e5c637

SHA256
c9a2959dc33d6786ff75db736ab6323acc74ad559bfd0732f1c5a488fdff7db9

SHA512
917bc808acbf2218e0b42b026858ecdccb9c0660f61c2be17327ee893864d04ba46fd30ec09461531d7b223cd1484fc3b0455e2596651e0bf6b2e69be529d58a

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
60KB

MD5
7f363316f0d55ca7ad46deca67d1072d

SHA1
6bb49ccacde23a5deb2e463a122dc7419e5a37bd

SHA256
17aad9843ee4ba58eb4109881f93eed922cde1d8ed4d5e2757e21edd83f7bf11

SHA512
64bc4360c69fda74d603a0d07f1cbc624346b814ccd0fe5474dbe2bf58bf96e0b265f701854f7035d704bf21e3dd98bf8c15fcd287e26103221d14a9462579a3

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
49KB

MD5
070f8e05d0829ee92d8cf3dfde7b8d03

SHA1
f9d9020d106c8bf4c44d5a5a311b52b76c089fd7

SHA256
7bad03819e77f72c180b7f9ad50fb30ac9f8340e51ec54258758c33ab1097484

SHA512
7635df056b8c25e180f8802c8cbbe4b9fb7cbfe0c07d9634453b813199e5c4c51ac181f6f1a4e65f029e99a92003a969c3dbcabe37cae714f85e3d7c90191a5e

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
44KB

MD5
eb5fae108cb7b3ea7bd0544adc09bdc5

SHA1
7e04bae304f6dd8185cab26e5c5df1f2e420341c

SHA256
6e3fe4063687589543d47b0bac6c0f03cca24304397a20552cc5276c764fe0a6

SHA512
464bbd470b698b253418bc08dc2750e6453717e9afb337ff1713aa0da1e7988bad456582028fa821ddcaa132ffb6172e2ae6b14e3be637124d4b601ea75b3c07

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
44KB

MD5
09c26931fc9cf4489538b2989f22773d

SHA1
c3e2a47018e02e4033d2b8d8249a285cde26f183

SHA256
28db641471126c518808fc05411af3739694ea5d169cdeb34909e5cd27852da0

SHA512
7256d49314ff1668d1632ab4c56742ef275451e41a8dc7788af207e1d2765c1347429be894a302d5a107836c8525e7fbf63297ae0d881fc0b412cff359f01522

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
39KB

MD5
6bc2b13559ec3a3fcc17c7bd7b86c797

SHA1
eeb434054de80c29aa149a24c1ac966669d3a0d2

SHA256
765c9a1162fa649c62a0ffb6371f8a8767cdcdd6b3e7d4e05ae4ec9ca8d58764

SHA512
437f1e64ea73903613772183f626b04e6eaf9f951f6f65a4ecc28c2043d7a81a25a823617dfffdb26035c405dd16b0d70e2dc3400d3f5d653087c72854e9b680

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
50KB

MD5
f100d03b27d7fb5f53251419e70ffd8e

SHA1
e324e3f367aeae78a32f313a19ccd43f88b21bcf

SHA256
915f4007f74ef1b0ba707e8054997df1483b5ec98399bcf25f71f55d58cbbe39

SHA512
7b4566621e76d3a401b76c397024d5d7b4e9567b2354de9441219af9f6a3bff94bba3eae3264cd90781256098f4f52446bcec0a9f02923228365636e88d0e12a

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
47KB

MD5
4c192c40c0c95ef2953b18a9c2967d5d

SHA1
b6616fa38eda998e16fb16ce2c0c71114434fa4b

SHA256
4d15342ed93d51a0983a33adfa3504826da7883c9b85a973144275332b51a57a

SHA512
9020049327317e9d3a206c9072b2c01f47c7b025d5f754f8d9a5d94915eddc239aa5efc22b81cd22d638172f098d177f8eaa8d6b5d40f6bd65a91019835c6b75

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
56KB

MD5
a160790f6e1073c1769d99f1e52e35c3

SHA1
e358e4a26c93c51b3a132f81fc0e3e76fef1316b

SHA256
03275ed3bd1c74389cc356c38b1ef4960e5e95c2081fd7d1b3e10a13cf34c2f0

SHA512
069734bb69fe89eec997a1ad3bd6ba7d0b384f417e1cf2e2735c68f44ddadf715ce1e25eeafa67fd47c51696cd42db2cbf56a9fef27f48f7ee9c178880ec8129

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
47KB

MD5
1a9bbccdecedfc14b46a7231853a7608

SHA1
44cdffaa4c346d9e7ad1bbde167a20878c49282c

SHA256
647d94602ea84c71ed5098548a8cefb9d9bc8a5af9a04b0627650bec78d45207

SHA512
569e7cc1a7e36a1920ca275c24037a7d78349722ceed8c25326f329e1c03458ac6a17c5a5e4c9e73cb88ff4e98ee29b58d764d3f886bfa6884d396e75f9cd182

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
51KB

MD5
3536e4bd3822c7f573f728b13366c255

SHA1
7ac71e5b8b0ccd7648ab5d9ab5cb84396c3de48c

SHA256
686c4c0995e024d61bdfefef70fba489c919062f2ceed4ac0c54dca9ddb96f80

SHA512
618f4c7a5328f8dcd1d404f9308b8a7263039adc01520c8b06b3f1703e3fbe61f858116b5395404bceb22e8de11bf45449cfccfe412c2bc660e1ffa05491c074

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
48KB

MD5
bc066aa2e1790a2ee7a94029fda1483f

SHA1
273e41d01af3da4c8774bb55c335e58d8a0494ce

SHA256
444498597e4381d84529f8c8ab389b449e10d124c12757c87229184fb8880c69

SHA512
f44d2d6c68e52fac38278e5bd44cf4931bcc28d55904fded07d90430d5e14760c2975cd7f4090b983d6f554711312f6e4230dc8d3e3824d1a7b7f5442ed7b5ea

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
54KB

MD5
88b48f89d60c5be1045083e4c2c8b80c

SHA1
f73f37557075a3ae93f45c90297360e335d96bce

SHA256
23cb44a138e1761f2549e669da19af6a0bfc353b2a25078a7f2986ba5eaf5f54

SHA512
c01b0e6783b6f3b8fd2f911504d1c8377c198d8b33d0953e5a0d2dd0b8a955fdc21acf5ed49334a31f75cc6d4e706897f898f770c0a14ada1b3c05f628416a53

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
57KB

MD5
2096d93d376aaf3d03e9e9eed4c58a86

SHA1
84d758f423d5b43169c8ce3d0349ea4b7c76b54c

SHA256
4084aec5a03d730f11337a7396f20ea26b909d548279966a1198d92ea3aa6287

SHA512
248a37571f6679f724f27dc0373d26e9eb42ec7acfba3648ad415c071dee0bae0f9ea19f84b7ce8034a6da6fd14caf4e2b3eb2533a647afc0e356e651a0a1e7d

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
57KB

MD5
5937fefdcdd8bae65dc3da0b859f33de

SHA1
5690e2fec1ba406cb2d08c2093ceea655471165a

SHA256
628608da47a055d45d616ea2edfbc9eabcfe31a8386c93e3b1c5fcd6ea1cb541

SHA512
b6d20a917a1b4e55a8b1573be7c5d7c7255a5316fc5596c40700dd2f79d104b22b15a1992389bc3ad8d88231669e1372a391f791e89803dae9def4a01463392c

Download Submit
C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

Filesize
46KB

MD5
555de88f8bb61d58df329174ec77937d

SHA1
4d75679695a4f9dca4b9c39b1945da5714f9caaa

SHA256
2f94625f7b3c017b5af45b7ac16e736201b45a681396b44cbd687ed7cafc2dab

SHA512
3c0c49e1d33992676f237c3681f124596c1aeec42e77f2ded12b37dc3a83d33f62b1e1dcbab3e1a898a7d2749b54ff90ab20b9467c545dde0780ac7635b0e401

Download Submit
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Grayscale.xml.tmp

Filesize
40KB

MD5
0078ff73a4c7ad4b0908fa468539f405

SHA1
ee6171c373b629f7e5639a9f54e015e0b7b09459

SHA256
a262d5b4422c1c89505ea7a75a19678c57c8f05cb0e98fdfab2a4ab1568836da

SHA512
1336a37e2d8f4a6d0350763e447dc695aa9cf3b92ced37df54a3624069b6eccc9c9965c9804d81f81ed6596f20c5545cb09760d146a6b74daa465ebebd1c670b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_update.status.exe

Filesize
38KB

MD5
7f30419ae2273e16c60592e518508ad2

SHA1
fb0be30a54ab89ce604d7c2d8fe5cc61fbfcb503

SHA256
6ff4f4e8ee2e91356b09b8705bfaed49dfd14ca24e4b5354a61727db16011b30

SHA512
b999888dfa7844377148a2e1d17a990ee73b14273ce824af76ff19c13b4130e9ff21e205c07bf43ad6b7efd19288bdebaec8350846fb1e62486999f458601c42

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
41KB

MD5
78be7edbf955974fd1f785801a4f81f3

SHA1
6c79888dba7d45816995ad7347c6203150f44cc3

SHA256
9ee1b209f29249e28bc8e01a2734fa262e46c98fd8aaa709c2f6b98cf2681020

SHA512
0ebf58f6468e510264af4e4dbf1848f974bef8c0c7c8919fe53863859b6dad0ec5ddd1ee49ced608b943c15ba01d017eee04bb8c4cbaae24a9f6125e6f97908d

Download Submit