azov | 8b495a0b2b763c0712323cf7be9bab716e11778bf60dc0adf86d46cc33268c09

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
Size

3.7MB
MD5

8efc4562639f99dda4987cae12d59daa
SHA1

a8b97d1625f62ffd42c9090c384334417f3c6cee
SHA256

8b495a0b2b763c0712323cf7be9bab716e11778bf60dc0adf86d46cc33268c09
SHA512

515ff759ace1cdd3d53a7380aca8cde66de85251b42cd84c52c1b1755cd7093c56a2f267174334dae3b6f5c83ab0a7b1a2333c5407e361efd164af749309dcfa
SSDEEP

49152:BCtHaa7BCM8e7jI/MMTs2ibqKL9VlTFZ1bBzP7n1Y8/17MVfw1QSXm+RFvTCr9lc:BCPLHlTFFqRlw6a+kZ

Score

10^/10

azov credential_access discovery persistence ransomware spyware stealer wiper

Malware Config

Signatures

Azov
A wiper seeking only damage, first seen in 2022.
ransomware wiper azov
Azov family
azov
Renames multiple (8847) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RESTORE_FILES.txt	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe

Executes dropped EXE 2 IoCs

pid	Process
5872	identity_helper.exe
2504	identity_helper.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe"	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	identity_helper.exe
File opened (read-only)	\??\E:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\N:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\L:	identity_helper.exe
File opened (read-only)	\??\X:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\E:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\W:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\X:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\H:	identity_helper.exe
File opened (read-only)	\??\K:	identity_helper.exe
File opened (read-only)	\??\S:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\J:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\N:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\T:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\M:	identity_helper.exe
File opened (read-only)	\??\Q:	identity_helper.exe
File opened (read-only)	\??\T:	identity_helper.exe
File opened (read-only)	\??\G:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\G:	identity_helper.exe
File opened (read-only)	\??\G:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\R:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\R:	identity_helper.exe
File opened (read-only)	\??\S:	identity_helper.exe
File opened (read-only)	\??\X:	identity_helper.exe
File opened (read-only)	\??\A:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\J:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\Y:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\I:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\U:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\Z:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\I:	identity_helper.exe
File opened (read-only)	\??\L:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\M:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\V:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\A:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\M:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\P:	identity_helper.exe
File opened (read-only)	\??\T:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\B:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\K:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\W:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\B:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\K:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\L:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\Y:	identity_helper.exe
File opened (read-only)	\??\H:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\P:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\U:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\Z:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\H:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\A:	identity_helper.exe
File opened (read-only)	\??\Y:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\V:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\W:	identity_helper.exe
File opened (read-only)	\??\R:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\B:	identity_helper.exe
File opened (read-only)	\??\O:	identity_helper.exe
File opened (read-only)	\??\U:	identity_helper.exe
File opened (read-only)	\??\I:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\O:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\V:	identity_helper.exe
File opened (read-only)	\??\Q:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\P:	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened (read-only)	\??\J:	identity_helper.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-36_altform-unplated.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\RESTORE_FILES.txt	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-white_scale-200.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16_altform-unplated.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-32.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\MSFT_PackageManagement.strings.psd1	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\ui-strings.js	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\RESTORE_FILES.txt	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-unplated_contrast-white.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ui-strings.js	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\cs_get.svg	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\pt-br\ui-strings.js	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\RESTORE_FILES.txt	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\PackageManagementDscUtilities.psm1	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-200_contrast-black.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-96_altform-unplated_contrast-white.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-32_altform-unplated_contrast-black.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-64.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\LargeTile.scale-100.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailBadge.scale-200.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\en-US.PhoneNumber.ot	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\RESTORE_FILES.txt	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\MEIPreload\manifest.json	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	identity_helper.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\WideTile.scale-125.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailWideTile.scale-200.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarLargeTile.scale-150.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\de-de\RESTORE_FILES.txt	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceYi.txt	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-400.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nb-NO\View3d\3DViewerProductDescription-universal.xml	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-24_altform-unplated.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailBadge.scale-150.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxLargeTile.scale-150.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyCalendarSearch-Dark.scale-200.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailLargeTile.scale-200.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\skype-to-phone-tiny.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailMediumTile.scale-200.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\zh-tw\ui-strings.js	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ja-jp\ui-strings.js	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_opencarat_18.svg	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	identity_helper.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64_altform-unplated.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-30.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\MedTile.scale-200_contrast-black.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\RESTORE_FILES.txt	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\RESTORE_FILES.txt	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\RESTORE_FILES.txt	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\ja.pak	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nl-NL\View3d\RESTORE_FILES.txt	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupWideTile.scale-125.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_altform-unplated_contrast-black_devicefamily-colorfulunplated.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-80_altform-lightunplated.png	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\ui-strings.js	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\RESTORE_FILES.txt	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
4336	msedge.exe
4336	msedge.exe
2504	identity_helper.exe
2504	identity_helper.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 4732	1480	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe	90
PID 1480 wrote to memory of 4732	1480	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe	90
PID 1480 wrote to memory of 4336	1480	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe	93
PID 1480 wrote to memory of 4336	1480	2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe	93
PID 4336 wrote to memory of 4252	4336	msedge.exe	94
PID 4336 wrote to memory of 4252	4336	msedge.exe	94
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5452	4336	msedge.exe	95
PID 4336 wrote to memory of 5460	4336	msedge.exe	96
PID 4336 wrote to memory of 5460	4336	msedge.exe	96
PID 4336 wrote to memory of 5472	4336	msedge.exe	97
PID 4336 wrote to memory of 5472	4336	msedge.exe	97
PID 4336 wrote to memory of 5472	4336	msedge.exe	97
PID 4336 wrote to memory of 5472	4336	msedge.exe	97
PID 4336 wrote to memory of 5472	4336	msedge.exe	97
PID 4336 wrote to memory of 5472	4336	msedge.exe	97
PID 4336 wrote to memory of 5472	4336	msedge.exe	97
PID 4336 wrote to memory of 5472	4336	msedge.exe	97
PID 4336 wrote to memory of 5472	4336	msedge.exe	97
PID 4336 wrote to memory of 5472	4336	msedge.exe	97
PID 4336 wrote to memory of 5472	4336	msedge.exe	97
PID 4336 wrote to memory of 5472	4336	msedge.exe	97
PID 4336 wrote to memory of 5472	4336	msedge.exe	97
PID 4336 wrote to memory of 5472	4336	msedge.exe	97
PID 4336 wrote to memory of 5472	4336	msedge.exe	97
PID 4336 wrote to memory of 5472	4336	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Local\Temp\2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\2025-03-06_8efc4562639f99dda4987cae12d59daa_ryuk.exe --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.73 --initial-client-data=0x228,0x22c,0x230,0x1e4,0x234,0x7ff7afa45460,0x7ff7afa45470,0x7ff7afa45480
  2⤵
  - Drops startup file
  - Enumerates connected drives
  - Drops file in Program Files directory
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa3aa546f8,0x7ffa3aa54708,0x7ffa3aa54718
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8714143018159940034,17441324366725339563,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,8714143018159940034,17441324366725339563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,8714143018159940034,17441324366725339563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8714143018159940034,17441324366725339563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8714143018159940034,17441324366725339563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8714143018159940034,17441324366725339563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:1
    3⤵
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8714143018159940034,17441324366725339563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8714143018159940034,17441324366725339563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8714143018159940034,17441324366725339563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:112
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8714143018159940034,17441324366725339563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:5872
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8714143018159940034,17441324366725339563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8714143018159940034,17441324366725339563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8714143018159940034,17441324366725339563,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2984 /prefetch:2
    3⤵
    PID:3900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\ui-strings.js

Filesize
1KB

MD5
4681554147c2b41f5b1ce8a5aa09a6ea

SHA1
96ae2bd5c8eaa6fb96d001a3c2afb1045b47141e

SHA256
6df4e195a0e525c94351bd8f2554283f5d61d0ced5b27ac61bba1c28064b9e98

SHA512
e84183f6ed2f372d57880072aa332678b7b15cdd5acc88c5d6605b1cb4333dc3de525e55fb6ff1f7f999d06475cb99bc6a88ffd40a50b516bccd3db700d1c28c

Download Submit
C:\Program Files\7-Zip\7-zip.chm.azov

Filesize
117KB

MD5
185082bfbc50ff87ae30932cd84da536

SHA1
5feff36dea884b1068c97ba17758ebef1db1adeb

SHA256
7ead02b51b82f3812c8b7f0bfbcb9b93db2a6f5ef31954d4700845e7f93491aa

SHA512
ec7ab8a8cd38ef818ee3317656f0a47126d3fa0188e35fdd9d5935e05e9f206e08c7ffcc4a621a0a8b294f4be22b4789903e82ddaf87c19d8a95504e543022ea

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
672KB

MD5
d2b496b26f3c7e3cd7a4e350bbbea9f0

SHA1
5cf6805f06a8feff726079dad0e9c765eb162c86

SHA256
824e78b208d24c14c3d48c41938d1b1582112bbe8b70dcd129d8985704f221ed

SHA512
335deb832388c42f0cd09e45f987a40606fdef36266a136eb5003560a45ef4887ad096fa939af1891586034164cd7db54ccb61881c1a0dbbdd07df096a8433f5

Download Submit
C:\Program Files\7-Zip\7z.sfx.azov

Filesize
210KB

MD5
41a6a3e5e25979f0cb4f8184acd33dad

SHA1
4678deb92b7fa2cdc599407d213d19b612061a61

SHA256
ef0bb9be97a3212dc1ed4bec13711eb75b4ed42921d4ac4d7cd22cc01ded1684

SHA512
0bbdb768e4ca36da592df9c869760111dbd3040535f751a6fa959396e58660ab4fd2cc48b140df80187a2b2e4063f5e43b5314a497813199103d6795b58b779d

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.azov

Filesize
189KB

MD5
00a0286b9d1304115375e3f5a500f229

SHA1
519caa30d8422b20642cf405046da5d010826217

SHA256
f2be24be53de66268e0e862e347af38febe553eab07be6cb8e15819551fc6913

SHA512
13bed491a5c08ef4bb66885a7d4f785b2af155cc7b3ea62a22049990fc7de04acc91d069df1e5a6d1698139c301f79c084aca19152e3bd6319bcca890723c577

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.1MB

MD5
c37fbc1640b2bc4f48d1e237a26d67b1

SHA1
677345c435d5a3087a218f1ee450f30cd3ebc769

SHA256
8bb44164fdb4976d4b2d2a7ab44fc2bb388cf197c0cd8bab9cf2aa5124c34236

SHA512
a6d4598b92f08c4ae533049c49004cb83f54393b73ccdec63aaf6fbabe449fdc2d45ed36a6e3acc56380f0fb9dd2a983f790bb14d24bc7c7569cc4aa99923ebf

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
840KB

MD5
0d330d3d2309f114812c8c16f85b553d

SHA1
b912ba035257793a200d92c9aac60dcb236e8c6c

SHA256
9b54abc91dd774f53a80ec253622d24c42cc8850907d458fd7ccbc7ba066b25a

SHA512
b29accbd92763fadcda486d8d35fbe4be937d6c49b7ea09b7ec8cf18b69e510f5908d102467137121b6bcacdc7ccd8a41959b0c4cef34dd502319394d7c49479

Download Submit
C:\Program Files\7-Zip\History.txt.azov

Filesize
7KB

MD5
d4dd0dcad1eba51d5b4556fe5547c11c

SHA1
aebb45669e412f0831c9880962d898678cf322dd

SHA256
b2348e40ee2c102163f0a78bea8cb3ff01f0c99302a5d38a038b3225b459c96b

SHA512
f122e0fc33630b9149c3599de54a881944d382333f2cc5723bf19231a518e296d8bb1056911906571f983ec2c9151014c238f5c6423405753659dbd3bed624a0

Download Submit
C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

Filesize
2KB

MD5
78ede93114e65f9160fd03d3357c56e6

SHA1
88d531b101e57655f1d0d26c6b3257aa2468d460

SHA256
c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5

SHA512
074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.azov

Filesize
4KB

MD5
65900ca61d8f3af682fc44a0e215636c

SHA1
0fbb36c8bf0b46255df67eb33c4076bd87b6afd0

SHA256
bb7dec50e22b4deabae56d9b01d53c2c5dd93d32d73048cb464e4de2749d47bb

SHA512
29c0069c6a59d047fec02433000b6d918a6251c693615a0d4b893e2b85b894a4dbd717beb6c02e8634fcf61e331b8776a54df9ec6d9a619520d815077fff49de

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.azov

Filesize
7KB

MD5
f0991cca06ff607cbf3d04d1b8649e19

SHA1
8c0b641ca6f6dd641d81204c9ce076b1db548554

SHA256
bb08830061b33aeb774b379fd7d67d84f24022583657ae287626bd105decd01d

SHA512
6ba7121e6829dc3cc98ef4ba712265e9f10401c26d09996aef326cac72bb6e1658b4783ceb788197cb8acd3af1482702b166a10b1543587eebb72f567670b1ca

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.azov

Filesize
12KB

MD5
a7ff181cc9d1885ff841c59ff98788b9

SHA1
2921d4a79ad9c3f29442ec7d85ca59086f4f3d99

SHA256
c10a3d02e2d57c958e9d8bae4ac6fe30aa74bfb6e1585a30c70895129616bc5e

SHA512
f64b9c4bc6bc61bd3f00e84f4926c339bfe12eb61026fb81350ae07c5ab5b6de2abc8750a4cb613e678c2da2a9e630edd7ea914b778bf97ba43df2abc861ada6

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.azov

Filesize
4KB

MD5
a3f24a63edb1fb59109cb07c4c1b5983

SHA1
31cd20d97a08342cc29c1f585360b8b108dd7419

SHA256
32e9503595cfd72bb602e0f90065fa44489e2513c8d6185fc7c4d27d3c2d4271

SHA512
662514284b8a8057e38691061cacaeaf4cbe0b08769a4a78ac667374cfe7e1767d24a6ed1753a46ac2543783f91557f9614fbe0f80f4b02b27d8a0ff125dc19f

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.azov

Filesize
10KB

MD5
11c59eef20e52170db0aa522b3aedfb7

SHA1
fa0d72444b97d3b822888b201b7873a6f6fe3366

SHA256
98a4c4603e09976ccd9fdd2190a178ab9ddb357e47a8f1a54e75c7f0f4a66733

SHA512
7952fb11acb689402de7a6945cc5ec4168b2ca57397bc9fff85d17e4b34f1216867ea16032e2f53ab30cf8f978d92a5680bd722aa5dae5796901e178332e680d

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.azov

Filesize
11KB

MD5
bb2666b3543fe8be185b63031de2edea

SHA1
91ac3552a76b9885ca85c25df7c243ea2a9407dd

SHA256
87997d527b294593d1c0aae65afeed671eeef2e9a01ccbeb61303102eddb5d3d

SHA512
1673fae34ac531b47d5d69bd4101166d2aa322af3d7a0fd1d4662a796279c566814af63f50801716d26400d9bd33822c77191aeca81eb2335ba0b86d3a2cc621

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.azov

Filesize
11KB

MD5
0640f5b909970055888eac077a254894

SHA1
d8a73a3d0614cff3dfc02e4bbd97f52e7f6b2932

SHA256
747ce001b203b0634bc50412e97db1816d1eb6bb2aed1419040f46eb88e1be83

SHA512
df0d301324939a0b1bdbd1459116f6c648d506a423e34d2d72d1cb40bf7feb7df531075dbe09ba9b775b284e9b4fccfcbf99062793a115c5ffb61e007a76e4ca

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.azov

Filesize
17KB

MD5
c2c802e3875db8dc83a6b06e49068170

SHA1
a60b3dc3ddac1d401523480cc18b577050ec26ce

SHA256
fa1a61c4c10d74d8f0f265c9ca8e4baa5fbd4b0e61d4240a7537cf21a78de8d4

SHA512
b1bc8c36460471f4e62ca08a7118cec682beee79b8f3fcefa055559ef0340b0483b11e3f0ea2393829badcfbe67b76df01512044f3713d9b7c0537a23d892804

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.azov

Filesize
14KB

MD5
90d24e2b4a48f546a0cd57b3842dcb4f

SHA1
515860b509746fa6a1b93d65daa5d0cfc626b85e

SHA256
ea7a2bcab7d85695c6db7f260ca5361b1fc0dfb34e1a0e48e87aa95da6c87f6d

SHA512
be9d7a8a1f0d787ab9427fa1dade48b442696b807213d724c428d0c2dd6870eb814351397b9794f1b8ab307b9595f221a8e1c830eb966ed7591c2c2009df1273

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.azov

Filesize
4KB

MD5
813108120a26f0b392c96d2b3e7b802b

SHA1
585aadf7759cf542fba6562e9e9d1ccc198193cb

SHA256
fa271622d7689ad97c21089c285314f520b12bbaf9e8407559f7f3910a172dfd

SHA512
10950d6a809e265a6da3bc3c1bc58f1d8fe686824b3190ae562089708da1e553adc0c0ffef77abd33fa354680d99f6e1b9b701e7fb7054fc0fb17909b420d060

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.azov

Filesize
8KB

MD5
22b2d309cd23cfbacc071e7f9f137b31

SHA1
9bdf820cbae10ad49d0c280d75fcf04c155596a0

SHA256
fa97c2849f4aa12806d83958d0fcb30fb203001cfb11bca248194b6472422bb3

SHA512
6e623cc703361b4a2336a5d70754c428e6a0bd7183dc01d94bc64964dac5f7994976ff834c445accd233d5e877aec33506f90d40c9c5974e472ff11475092140

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.azov

Filesize
11KB

MD5
b848234a744add2ceb0d887c57384808

SHA1
49714f64af03077d22812dd3cc08f6c574860a9e

SHA256
cc3ddf6b945e3be261e48cbf1ae00f855eac1986b6854d8f1a2e50748539b7d5

SHA512
638498b0f240fc11a20d507b4ea04e8182747f825f16dfa0125d30fd2065451f1bb9cbe36632e30c962abed5c42721d07020fe9b6a6bf18bcf880be64bf6c74c

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.azov

Filesize
9KB

MD5
efaeddac5f4bc536a430468b60bcc8a1

SHA1
f9ae43f61b9114158d8c709965214c7818b5560b

SHA256
aa8642d78a6d6333f8024a541e045667d56f962ad29ba29da89bb62d1bcb1d52

SHA512
4dcb8591f7233d6a837588be4d3d72db610d1bb893ac9251567f9898d19fce8ee031a0c24601c209b36161f844bc400eb73f89dafa1797b44b2667fdeeae38b4

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.azov

Filesize
4KB

MD5
ad36f621c5c0311f6ebd76519d96fbd2

SHA1
c8334a10e20049cf9d7248a7a876ef328f708d3d

SHA256
7c6911d5aca490dfc218d6c4687477205ea7beae7b074520b9149a62efa3c381

SHA512
615d519457d23e6e0aea7e54473d5eca30e0419aa8aac302b12450d80447f6d0f7341d2fe99503572d04e9674a0f7c60cd19f340eb302088bd133473c2d7245a

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.azov

Filesize
7KB

MD5
b322500c5d5f40dfda113ba2986a9b2b

SHA1
f8e9c581ae2cc0a52f1d2e4d08184af2e2d38c3b

SHA256
0a6e5031d13dc9b6863330e689e93d5333a8d2a4103294b55ce7fe482c7a972b

SHA512
61d0492d01e7df6400488e4ed1ff31445bbc573e6a364e2c49734ba7e7fb2cdfa81cc8cc129222b6cff42a7c20da9f56de1d230a3514c26b28bdb226e6d078e4

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.azov

Filesize
9KB

MD5
892888e7a6185a86530406d005bbf2f3

SHA1
4aa35dd1c1b05e14625e7a74c9703d5142d12e12

SHA256
fbeb00aa80ec26ab9766432ee641b2f4ee859c7b87cb6910ad8668eb25c451b3

SHA512
04866dadc2feeec5dff796657df35e7daa212a64be030eee169fbfc580b697ca304d6f1ac462ad3f6a0a94e2e1866551428c5258a9f68d5f159f52591986b7f1

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.azov

Filesize
17KB

MD5
d8f3af6642a26b6e44724e05d143e4b5

SHA1
d9ba5f4ca78ae0acad6d7d440bcf8feee1dbdc52

SHA256
c182d6b87ad2fdc675751dde29a8931965a9e449441edfd4081482352d06fcd0

SHA512
dac1116e12f55de9153cc5ff0ab013ab7ee6ec9341e0352981db2d6a44b7552a1176ee301da430fda508d0a690ded46e7ddc9d90df5695f189602a4e08be3d97

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.azov

Filesize
7KB

MD5
4c981b4306ec7b58fbee818191f02b29

SHA1
03041c732c5d0d065d49bdf05b41169a7d1b8bee

SHA256
d6cf17b0d0c9dbc7f5ab323393b5726c98f0f96f9c6f3ef07d776abdf47afc2d

SHA512
214582f5d7c7faeef82b5dfd0e005ab75260e35a3a76698ccdbcba9cd48bbbcda32f328ce896e1a95c2c58b07b7a40224b82b61f17e86ea63d4886644479ead9

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.azov

Filesize
4KB

MD5
c89746d693d2e2b62d45b452730cb458

SHA1
d3d2b11985b611f5479f17ff5033a8a832417b47

SHA256
d18b4a46a806e1bca2b0427501adcff31926f11d7a2eb411d5c4e3859ef66a59

SHA512
c763d13e12e50b001f37021ada397137e2d683dbd49b428a3d16851bd74959b55b2f36488ec71632aa0f6091f7a61cbce786d5cc0a5ba1b27a429bf53158f82b

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.azov

Filesize
10KB

MD5
0f9fd378891a9d72dbc05fccb8d4df30

SHA1
3913a78984c244d7bc7f86b786065004ff05b24a

SHA256
ebb8efd52fa09699e076c596ebe08c98ac4db50004f90f185f23b11d4944ea3a

SHA512
75f780fbf9bd0afb244eca7fd834eb4bfefd59346183387a0c2874d9cd4c777603ba9e56d6079ac8789792c48a094b96b9c119493d7e4fc498cf4c4908b46e5c

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.azov

Filesize
7KB

MD5
065fba93ce262024c7690aacef31dac4

SHA1
fee399ebf46837812626d062fbc5835c11253bb4

SHA256
ab838fd7f35d0bca520f225e01fa0272331ce095aa38ba0fd12154e4f3e089a7

SHA512
201c3cfcf7d044bdd8c3ff6ace75e7ec09ec038b0d844f9b6943139665b8ddf0c3c9dad8e15aab33bbfca0f1fc3d6e239b669b4a1571a187c599be95cf96a9f2

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.azov

Filesize
8KB

MD5
d8b41bd8fc465ab711121d2c05c272f3

SHA1
d16e1f71beb51360faba5d7c12499e97329024d1

SHA256
003b744c2beb4043153f3dc4d71668e8a0db26e30620970646047d1db6aa2aee

SHA512
06c62b17895351aa0826fa52afa260b635ed450490772d6b2d19394728fa661f224c691687d776d8aa386e743cc5a34b803787cd4efb4d054fda585f81fcd477

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.azov

Filesize
7KB

MD5
458afe978b7c62e94fd76598faa22c6c

SHA1
75d3a3077f3e82e5c38ef5ccc81e4d5159d718d8

SHA256
c11fc5a67c977090521930c6f9d7a48d8cbdbfe27abcda278f88e9c3e2b4f05f

SHA512
8e30f3b6df3d12e7a9b6492119c3e765e7e06904241b897ad04da566e12926fae9d27506a707c10a74d2030a2b3197cae00dc5699e491af5020f90c10256d93f

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.azov

Filesize
12KB

MD5
3708b3563a5f948eb1f210a1b639ffd3

SHA1
52b4f07c0054caa90085d38c310d14f7408036c9

SHA256
3f29c25887bb9ebc7e768636667e7208119ecb7f6fdbee7f55c875fcd659a53c

SHA512
836b9f1ef58b42f813b6ec96967851531e389c3810967bae5e3a80238f70d25d38aa21fc91ef5c8694b85f144f0903c0440b1bd676f74802abecd62ada610e37

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.azov

Filesize
8KB

MD5
81e55786e07d88d2508eb5c09f2c1f1f

SHA1
af421e48312cadbb54c80496eba689741c5ae24f

SHA256
73190d2916326cb063042553b3b95d83ff8fcd532cc5ee018be54224fb0195f9

SHA512
0e9384502e35241ea423cee0c4da1c4bd7315499daf971761eea0270bdf393c47dd4c068d5f58c2fedc4fedde3a8742d0f2bcd8f34ec41adafba44f6de10286b

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.azov

Filesize
11KB

MD5
c70ef790d3ce137d4827f15209b3020e

SHA1
2b728e65c9f5682cc87dcec0ad32eeefd023c1ca

SHA256
4cd13e6679a6c21baec77562681afb9d54ec101fd9548af503822ddf4aaf3650

SHA512
4436953f57f305aca6c089099c673211223f6a914ddab67b5a371deb7461c427cdfbf9c95b19c2329e1eaf1eb8451d64d27474650150222623c6b0656135a9e1

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.azov

Filesize
7KB

MD5
e504b0d8f09d5a8a00c59c646769eac9

SHA1
ed3d36c5176f53b72d212cf20bc30b7a139ccf55

SHA256
a6cd092549671428b5fe2927f39070a050429864f9bfb38fcc1dfe565f42d1e3

SHA512
bda2299e3ff4c74b3ac91218495a9bc374d48bf21a2948b75812fa0722bce44f17cd2cab0118b740f0d8264c49fc2332c7ad4af5652ab1f69d0a01b98a8dae8b

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.azov

Filesize
5KB

MD5
6fe5f6f8838add5e29014bb8ffe97714

SHA1
a0da93fd3b026ac7cfc3600ed4418f6252c76261

SHA256
37d83c139f2b64188c4dce3cbbe004a890a1aa422b70df9a3872b3e8c3c9cdc4

SHA512
b48f2bd522c505d2e33b3e3fb2e101132530cc963ca00ddda22fa9f6d2524bafd3db510eb87d317426c77086616e675a2ca31f67d9131e5c15d55918dcc50fad

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.azov

Filesize
7KB

MD5
1b170246fef29fdf384c4512634972d1

SHA1
d15628f93feae1e4bb166bf33274b44b8bdae186

SHA256
77300393033583ae187f6c98ce8a3bed33968655f93e108ee858e3063875a640

SHA512
1204cae1a2f439d2e90e1e7db65cbe7d31027404a6836dec5bdac1df5c9288b1589eecd4c8ab625c28b111fb22695881fa361adf2a37182cf5d57b448f51212e

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.azov

Filesize
8KB

MD5
e79196c53a84edb256c52cc9ed2d0d36

SHA1
fd16e6345495e75045cab4c95402c78221fed1e6

SHA256
9f25fcfb63f5a45c078ec9d10f38624922f3ec5b9b0110025679955438fb9396

SHA512
e4a306c7d35df544bc023062f93c7d7607be3d39956fed8dafcccd158d0fcbf91cf2aa3f038b68361bf7db864b0f581c0b615f87fa0493cf0cf6da49c2e4b478

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.azov

Filesize
17KB

MD5
5ad7d40f857a071cf8143e6cf1f24efe

SHA1
84b5561783fe12aec78b3c3208b5734b526ef52a

SHA256
e3514b822f319474038ea4de90dfe00aae299d68efd0673a2f6c67512c56ee06

SHA512
6fa8f07caad5fa6d5012df656aa2faaadb9a08420981171ffc35e3b1cb3c936312dddc8ed67a1114a1c388f605fbe0dfd75b9d0259e6e193f02dfa3973358061

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.azov

Filesize
11KB

MD5
cb1f27e1475eb16f6ff8ae1050b827d4

SHA1
835299ae3da83ec0ae265cc0bdee3798a37e868b

SHA256
8d58189b205fb234be7d5f8ab0736a7658512e0ced8f13726458b454094d244b

SHA512
9a81b2478b51611564eb56a54beea21ddc1d515063dbfab5e998ff9054fa729114ee1f75691cb6dcffd7ae693c89da9031ac9b95a6c99e174d9a6eb4ec3e58ea

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.azov

Filesize
17KB

MD5
c1f0a842b5f8aefdf1e38d2b12e37d4a

SHA1
048dc6f79359118203d7ab2480bb34c6afe51904

SHA256
39967e86ef9380d01d1d24ef9ed13f9f7489698546006598de179b0e491ea808

SHA512
b00d93956c9e87777ee2e51053e9ed6348379ea5a4278bd3f1cce30972f9c61b9fef0f1b64300f668aedcf6dbe3fd0a3470f59afc257102ad33ac83e051f213b

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.azov

Filesize
8KB

MD5
14260e0e463ce4198fca8009da144fde

SHA1
7956234dfd2cbe23d8bf4fd561fce723a956803a

SHA256
b006ef9a99d2ac8b8628bdc3a799162679f5990ba869048dee267fa32718c545

SHA512
d03d5404548fe1526b7bddcc30b16da0bf50e4b0837ef41d0bcfd0ee0a42dec1cc88bccc1bc72f75ed77d78ac1f54ba32af2784030018261b2c8b59a531206db

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.azov

Filesize
10KB

MD5
59876529d033df7be0634742d7939f58

SHA1
bb0e37c9cfba8bfaad044b260970053b78fd1231

SHA256
a9a47de802552fa4a74b39d9d54bcfb53004eb4a11b9592f54fc84115069e6a7

SHA512
2aec0061ca3111c7daba7f2d16c255f6d0da071e45cf612d96abf5238731545c243a8a7259850a5bbf7ea1911af91a9afa6301279b05c9545953d561e5ad6777

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.azov

Filesize
13KB

MD5
abc8ed99e6857ac83d621e3ee804aa9e

SHA1
858fe408cf1eac7f55eadd1390ba3f58f4ba28b8

SHA256
b876478753b361d2fbd8fff5b4833bc23632961e8bf17a3601e657f04aebac1a

SHA512
a56632fb1221c34f2ec1d71dcd4975508fe2df00a89eb56b1efebf8a48fbebd33d7a33950470d8469a713c26bef8d8e10d09ca4e28d50da35ca2efadd029f2f5

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.azov

Filesize
8KB

MD5
c767232b33c20febf67efa024c280578

SHA1
ebfe42f4e6a927713ec286a4b07a3e4c2847e32d

SHA256
2c3b099466856fbd3c66a62fad0b107c11b485824c28d202418d99c27b5c37a0

SHA512
c04feb8747618c3a9320e04026f8dc21a4f7d0f3228bfd3ef63656352a2da9220d94158ac49fb5e7fb6787d0c78b94d05eceb885905ec0958b3f4cb2bf518bb0

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.azov

Filesize
4KB

MD5
05c83f52b6788408a26eb7ba32f7fb0b

SHA1
6e93c3e69cd8d388881e08b2d0134e916a5aefdc

SHA256
435ce5109c297cf6b4fad5ac4edd60d1acbbc56624d9ae25b717e3531d207947

SHA512
f25021d0ad0e92823ed78d07a6b33c2e57db475f7ff07de060b7691ccb2cfea8a183e9d8ae242120599924c787de4807990ae4c944610afd7f66530f59ac42ce

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.azov

Filesize
8KB

MD5
befefdf724c3b53d1069a7fc7c1aedc7

SHA1
552704ce7bb662af660fb858e3a770f8bb139894

SHA256
e788a201f3b772d43529baa5486f5d6f60169f8c2a8cc61d79d5e779613ea448

SHA512
b970f5155865a11763917051419f152482b903cee9ec6e492629e229e208d87ec9da5f6e2f96ca7b87123c5d74c5a2e99119a8a7d8e8683a868f782bc8386ad1

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.azov

Filesize
9KB

MD5
1cf51baa2e6366ec95654172158fdc2d

SHA1
6c7159d0e3098a8fc77e24024df7e52ec2418a37

SHA256
3d743a2cacf94594fef46b971e6a9cc1bb36abb1c85c6afc42f16b854d68a32e

SHA512
f0e93c63eb4c0e20673dd68e4d3dfbba8004e3c0cd3aa25e3786ee3e7f118651a5120c38cb3a0f4ed7f68f65bc4d2dcf7123b5eb8e1664988f571bfa16f0de3a

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.azov

Filesize
12KB

MD5
eb2d19637e68f8c85dcbff2f75e95a96

SHA1
dc0689cfde92871dee728b3a673246c7906a9de4

SHA256
df18402bbf5fb6791e6a2690e4c3ed418b92df661e58bd239c91748cbc8c5fb7

SHA512
78a719c7e8d736ac7de783e6d7fc1fa76025bf8fbac09e6db4edda24bc4aa4202cc58f773f8bb46c781d37e2967df7051b4dc5d51d521ad97be8bd1c7abd317b

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.azov

Filesize
17KB

MD5
d3ea79d711db9540a5476a66ae668a88

SHA1
99e900d0ad672cda116c7a1e6e91cceb8cdb8d61

SHA256
ba5777b0f21464f7c1234053ea98c4617df3079a004a25f3795625f12e33b929

SHA512
d50310c464253ea43da3f3d9b5169914087140231bd93623b76dc233ca644333673343b11d0ae137c811fa5aa6d0fd276288e7e255e5f675db785793949ef751

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.azov

Filesize
7KB

MD5
1b40ca434d8b59a77c6c2b915d26bb22

SHA1
7c07fbd9f9e9cd8372f60d1bca94e68617e0549a

SHA256
999c6b858fcf0cb186921aca42e7863070f76abcb5ae0d9a5524aee315778448

SHA512
67d6120b07370609b96825e597f12ecbab55de08eda5203200fcf661b3189312cccfca40f1a06dc18f28fc09e7bd93c6e053d75f71f0c5cc586b41c17ec53ba8

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.azov

Filesize
8KB

MD5
40c0e210453b71ea4b4112ed6a1a6e9b

SHA1
5d9003a0ab0a2a1cfc31bf811b6e141c2fe0b1d9

SHA256
a55546f527af5528033f5e698948bed96c5650422d04ae2e7eac032cbd291e14

SHA512
71e926a0c8c6fdd446c47e2907b66792647bae98265f33d22ba470cd0758988ac803a088244c3cd580f436f227c38f6e87fe7e88e9d481dabba811e59c1bb562

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.azov

Filesize
10KB

MD5
7f98a3111cc54dc42c46624793584bea

SHA1
6ff1855701bd44394c1356679499deaf8475719b

SHA256
fec2b7a443c9def72a96062d4b436e38ae826b5399d4f1dcb728210e3c80b349

SHA512
03b264bb44c5f092b5128dcd56f2dd69246ed3f0a3333caf6778d70bcdf92a179ec0f660bfd8fc89044640f46c720a5b916f63bd61dc555efa144429dd7e8c88

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.azov

Filesize
10KB

MD5
2c6dd134e9a359a8ed31e7cfd0265510

SHA1
99477b82bdce1b06d3afb53d88bee78a7ea26e2f

SHA256
c78fec2c2bb12d47cf9ac5cf423f1f681d01c4cd59b01725962813923d32dc4e

SHA512
7dac244d2bb858429c6c7c1c620e118e520b8e8768319446bb156cd3464af33c4e285bbd19f5f8202f658d8ca5beaa285690b52f25eb6fcd220db394d2eb8720

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.azov

Filesize
11KB

MD5
524c1c35caa8f5c4af972fba8c130b8d

SHA1
7c9ae9fe160270ab7d3935df3721114f15736de1

SHA256
8c0ae375d00ec4b2d8d372c7d921821aec47305a7ab09b7a0236439b119ce2ed

SHA512
cabb9dd51dc9eef9440fd63ac7d7e0e52f7d299d0da07edae9a54951728cd5d49274def61f0adde24513100851e4b20c605fdc89e62208a62c19652aac88519d

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.azov

Filesize
5KB

MD5
9690466ce2e306de89608de1675e5dc8

SHA1
0562c1d4c554dabd9282b14727960ba295cd4c7e

SHA256
6406165b07c62f65e1f4b425778a76e05c8ad04c0719880ea22f9f85861b3741

SHA512
756928474b1b51abce33862593e184b4f1ac3b20134123b35136e142ccbc0b821e0697d60ccf7916b10d847ae4e4365448bfff669f8ff5fb6617959ce5ea2e95

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.azov

Filesize
12KB

MD5
38004bc335bf63a6d14f07255a35ca99

SHA1
0e7ea7e8d0a13b7e1f7d748d1803a40d3cd5b384

SHA256
097a8cfd1705f7ceb3c1141c2797ac5f122e47e0c1d094f3574fa10433ba3813

SHA512
9c69f321f064f0f48cccde233e9b772332f2a51ad70680bcbc10f279224eebe1f4ca1c87ea55ac3d2ca576d8a6077956f496ae99dd4780b7b2309e836b5e00b5

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.azov

Filesize
7KB

MD5
2a507eef247592765ac9ed47ca132813

SHA1
308845d19928c31cdfc6ac2c1eb5ee6c49d82503

SHA256
ae12abd5df8243511e22b89c55ce223e05544996c9c6e1181ba896302bc2ef6e

SHA512
6c8612261d1ac8cb431ed78e6ec2c465793166ce27610f56aed08f5484a96cc432744811bf1272a253fd2b7632eaf9543694fc7344ccded5c2dfbd532965ea2f

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.azov

Filesize
8KB

MD5
f63eefc58dd3b84d82b49e06b363f218

SHA1
3c3c6f43a446de78d91689287a4f3cf6e8bcdb3f

SHA256
396a47942b3a81144d77d35d7e45d2ca120cf3ae566b3a4fa677300650e59191

SHA512
21cd327711e4ad01e1a13a3c1055cb2ea9f0dd4ef4d0d3eae57d37511130b1387de26fa4d361faeb94749e9cdd37e79c835c4c8fe8f5f1b3be97d691847b39be

Download Submit
C:\Program Files\7-Zip\descript.ion.azov

Filesize
666B

MD5
7ffd4a80d7c234e2ef2374cc5e3f76a4

SHA1
c00b9facd7ce1d6268b89de119a328a1a9951f08

SHA256
c61b05c27ccc92a53c5c7247bce71ee80e24a5dcd5cae318f8c9d519f840e5a0

SHA512
0e9c56cbc9cae78f6471f910243780fae6bd7755a4f0f7875e7a25cb7920fe59ffb31662c4ca0d410edcab04b6996817ae3641b32109726bf561b565e911cb66

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

Filesize
350KB

MD5
35e56b9bbc2c2d9fe7322e28782598f3

SHA1
6bde7b198f937c8969209a84fb0cf0661c0ea7ab

SHA256
b3790640642649a1f0ab05e8a661655a5e68ea969935cef4aeeb2c0b52717e15

SHA512
ed0ba3acf4b9f4d676595ba6d8cfa573f252aa801a8d91aeec58332aa1f380e99d52bb9e486d3c13986dc6ef377f3765cabfa7353f1cd9cf914d83e641103bc2

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Filesize
4.3MB

MD5
aceecb21171fa57efb33644265348543

SHA1
9e395bdf616d71d3f3f77bfbb396255ef507f492

SHA256
9fb6e7363bad8c6d3e33d7f3b40a226d780bc21e86b45b741fa87e9a0490aad1

SHA512
5af92ba3e1dd4c8d4396c9cf69775983983cee4e594b7e84fbd21b154ab649fc3e3857e67a7f729a9abd4d5bd7af20bcb80ea587f166b89547521cb48d9718ec

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

Filesize
2.3MB

MD5
ef51c66283d7d63d6ebb36a511afda2b

SHA1
4545d90f4d00020a8e2a67e6b9822e89763c0fb9

SHA256
2a8bde56569ce037df8e69dc4f3714447ed4e9d8e956d1a3abd63dc6c6eca4a8

SHA512
2c92c5c73a4c34d36e01fd81393620637e4db4d9d09a4dfcd62cd83c917c39b150790e8b63a1105eeac7f8d78130a60ae6da0139a6bba883e68993434116d0da

Download Submit
C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo

Filesize
772KB

MD5
a501340a77e335e845d16b6a6f0e1305

SHA1
45c521bef150c18ab169ba1e8247f0a085f4f27e

SHA256
e752cf75da58f7a41d3789b1470a35fee0ebcef95bac3c393a13e732cb629501

SHA512
b75fb51983ffab0d9935cf5a3cc7886e3b0a8272aac87bab3cb661926945098082f9c214f03d6c09670a578e15468e0ecb257f0e7cd8b6df859327da8cef984a

Download Submit
C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo

Filesize
613KB

MD5
54693b1a5f179b1346ea8c2ae22296f8

SHA1
65091828454bd2d9f05abfbfe7c0baad678e02c7

SHA256
688ae64c0e04e515490f307295bafabc65c8faf3a6f486b895408e66b90d9b56

SHA512
6402367e48338383b82d8d95385787b054d0232ddd7f128e2dc5a5963e9c51a7e7493da7eb9ccc6186748298a3987318e9ee3c893b2cd308ee0bed6414395e98

Download Submit
C:\Program Files\dotnet\dotnet.exe

Filesize
189KB

MD5
480dbf8439471081980f0b24427b2afc

SHA1
bca522859be31d5d0c511a674d2ad0933deb8232

SHA256
d7c24f9fe027ce7aa1df43e6d5daf3e0c3013df4fc39ae6f63abd3bbb460d619

SHA512
fa7b4f896ca76dc4646d6eca9bbace01d372251090c6a93173986102607296a6cd98b8ac700ca4ce7ff1c4d8f5b0f542057ed7dffb1892186f9628bc4e329d0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\id\messages.json

Filesize
666B

MD5
33afc1ea3c14dc91f65c355615b63040

SHA1
bd701a996c254a0e19ac600901d22b71039e0516

SHA256
d2f76ac872d9257b1b451c401210c8760b6aff0d886036e157b72a4ce240c45e

SHA512
41ad8cca0a8e42c62aa8ffdce67ee9b11445192065b779db209b4ad5f91dc2a2ffbe14bcfbf3925c196134f8a9cbab274d5c229cb6db965d11830ac5b777f6a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv\messages.json

Filesize
666B

MD5
324194442992dc7e2cd15ef42d4abf8b

SHA1
77fcbe0086b50ee7946e7719676c01c0ed845570

SHA256
0db504953b1e32fcf7a44d2bc2c34f4169e56b766983b9d5daccbd6b1d2aab9e

SHA512
1d820124dc0604465586a6f8927b93f3dc04e983822637b28d3095f5c000123f08b2b885d059c6909ac31305d36d0129d490f689e40db501a7d15f47f442b408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\d2687597-a907-4294-a544-7d9ba30bea04.dmp

Filesize
3.4MB

MD5
f9678e27ab864afbf8d4dd917fcc0c13

SHA1
ea198382a77ee47cd27f1442e8f99eb161bee92e

SHA256
859519b8b79a1fd479cdb4dbaafe4f69ff3c6d71d425d19188ea98b99758d2be

SHA512
3c49593f41bd5bdda95fb2fcfc833af49c9d885cfe704efab48f04d9db568f47cb769888da004fec8cc40af75b80b3502bb31b6b8f0301ef3dd9fce2d011ad1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0621e31d12b6e16ab28de3e74462a4ce

SHA1
0af6f056aff6edbbc961676656d8045cbe1be12b

SHA256
1fd3365fdb49f26471ce9e348ce54c9bc7b66230118302b32074029d88fb6030

SHA512
bf0aa5b97023e19013d01abd3387d074cdd5b57f98ec4b0241058b39f9255a7bbab296dce8617f3368601a3d751a6a66dc207d8dd3fc1cba9cac5f98e3127f6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56361f50f0ee63ef0ea7c91d0c8b847a

SHA1
35227c31259df7a652efb6486b2251c4ee4b43fc

SHA256
7660beecfee70d695225795558f521c3fb2b01571c224b373d202760b02055c0

SHA512
94582035220d2a78dfea9dd3377bec3f4a1a1c82255b3b74f4e313f56eb2f7b089e36af9fceea9aa83b7c81432622c3c7f900008a1bdb6b1cd12c4073ae4b8a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\78983b9f-ee3f-4806-a8fe-16807f79c046.tmp

Filesize
6KB

MD5
108ea8b230c825743384ffa90cea829b

SHA1
6e54491740104019cb05d50c74d7a397d8decc3a

SHA256
0978a075d55dee9b939a8530488e3b2e86bac5155bfaf0e6a89fa32fe323af57

SHA512
b965620c3e2c254d56404127aff52321f19a4f2c45e5cc3f95f7a6255b28e332baa2f2394b42d12cb4271d201a492a79c15bfd7d02d90b0ad517387e372363b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d1f8fa1f3500a667fa4b218f4771ab4b

SHA1
94ed003e8c5e41519578f9d5ab750e110293151a

SHA256
53f4452fa108e27f927b0a49a45fc674337419bbe00188a5d9dd44089986b166

SHA512
b2f25a2f990e540ef946d3a276750ce2d717541dd9b5cbae1f8a510b5550d71922d171165f6b7e1ab8b60ff7d18c4aee3f264aa46ef95e3114e41a2c9ce51f58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
9990344ee47d77bd6283421f8ff9903f

SHA1
b71ddbe6250ec51e84bf2c50e08e946be9203a19

SHA256
e07563fc8d7114a98c9c01f5b8e652de9d2093780c35b2342b79f24a66fc1b53

SHA512
4ac8e04385566f63ac449d58e3cd5f6842fb9ae4102ae90848c013ff18dc81229e19a7d445430f381bfd9df711086eb75b7f48493b1acf44703e455a36f7b089

Download Submit
memory/1480-14-0x000001E726DA0000-0x000001E726DA5000-memory.dmp

Filesize
20KB

Download
memory/1480-9-0x000001E726DE0000-0x000001E726DE4000-memory.dmp

Filesize
16KB

Download
memory/1480-1-0x000001E726DA0000-0x000001E726DA5000-memory.dmp

Filesize
20KB

Download
memory/1480-0-0x000001E726D80000-0x000001E726D87000-memory.dmp

Filesize
28KB

Download
memory/1480-2-0x000001E726DE0000-0x000001E726DE4000-memory.dmp

Filesize
16KB

Download
memory/1480-10-0x000001E726DA0000-0x000001E726DA5000-memory.dmp

Filesize
20KB

Download
memory/1480-5-0x000001E726DA0000-0x000001E726DA5000-memory.dmp

Filesize
20KB

Download
memory/2504-1966-0x0000026FCC1E0000-0x0000026FCC1E5000-memory.dmp

Filesize
20KB

Download
memory/2504-1955-0x0000026FCC1E0000-0x0000026FCC1E5000-memory.dmp

Filesize
20KB

Download
memory/2504-1953-0x00007FF782E70000-0x00007FF782F89000-memory.dmp

Filesize
1.1MB

Download
memory/2504-1954-0x0000026FCC1E0000-0x0000026FCC1E5000-memory.dmp

Filesize
20KB

Download
memory/4732-471-0x0000017DBA750000-0x0000017DBA755000-memory.dmp

Filesize
20KB

Download
memory/4732-482-0x0000017DBA750000-0x0000017DBA755000-memory.dmp

Filesize
20KB

Download
memory/4732-486-0x0000017DBA750000-0x0000017DBA755000-memory.dmp

Filesize
20KB

Download
memory/4732-485-0x0000017DBA790000-0x0000017DBA794000-memory.dmp

Filesize
16KB

Download