fbdf2a8b1dc716a8b123ade5f2817a3659fd3c833947b9e5dbba23c52c87f258

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbdf2a8b1dc716a8b123ade5f2817a3659fd3c833947b9e5dbba23c52c87f258.exe
Size

396KB
MD5

8f0a0561b4782ee9d3565e5ea757fe26
SHA1

90a02a26561ddd85721991843be110c30ed6e5ea
SHA256

fbdf2a8b1dc716a8b123ade5f2817a3659fd3c833947b9e5dbba23c52c87f258
SHA512

cc8fb90d5f0203afd5495832890f2dfca752b92866e2e78218d34084b445ee0a7f3a5de0653d2ae578bd9d3c5e2e7bbc7328a2981632810032f614c8b97b52fa
SSDEEP

1536:W7ZhA7pApaX0aX09rv7ZhA7pApaX0aX09rc:6e7WpGlCe7WpGlP

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4673) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4252	Zombie.exe
748	_desktop.ini.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	fbdf2a8b1dc716a8b123ade5f2817a3659fd3c833947b9e5dbba23c52c87f258.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	fbdf2a8b1dc716a8b123ade5f2817a3659fd3c833947b9e5dbba23c52c87f258.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationTypes.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\bin\npt.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\sw.pak.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\vulkan-1.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbdf2a8b1dc716a8b123ade5f2817a3659fd3c833947b9e5dbba23c52c87f258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_desktop.ini.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 4252	4328	fbdf2a8b1dc716a8b123ade5f2817a3659fd3c833947b9e5dbba23c52c87f258.exe	87
PID 4328 wrote to memory of 4252	4328	fbdf2a8b1dc716a8b123ade5f2817a3659fd3c833947b9e5dbba23c52c87f258.exe	87
PID 4328 wrote to memory of 4252	4328	fbdf2a8b1dc716a8b123ade5f2817a3659fd3c833947b9e5dbba23c52c87f258.exe	87
PID 4328 wrote to memory of 748	4328	fbdf2a8b1dc716a8b123ade5f2817a3659fd3c833947b9e5dbba23c52c87f258.exe	86
PID 4328 wrote to memory of 748	4328	fbdf2a8b1dc716a8b123ade5f2817a3659fd3c833947b9e5dbba23c52c87f258.exe	86
PID 4328 wrote to memory of 748	4328	fbdf2a8b1dc716a8b123ade5f2817a3659fd3c833947b9e5dbba23c52c87f258.exe	86

C:\Users\Admin\AppData\Local\Temp\fbdf2a8b1dc716a8b123ade5f2817a3659fd3c833947b9e5dbba23c52c87f258.exe
"C:\Users\Admin\AppData\Local\Temp\fbdf2a8b1dc716a8b123ade5f2817a3659fd3c833947b9e5dbba23c52c87f258.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:748
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini.exe.tmp

Filesize
397KB

MD5
c5ae2b2dccdaa7b87b86f9283f21a6fd

SHA1
541338daf2e92b6c92607f05009f4c684f4a6fea

SHA256
571e7b9955ffe9c3dafb38b079520b921b0230b1a642b3098ee3f467df508425

SHA512
215ea27dac43041873faaf4cbf2a57ae495a9ef95e7caaa4ed010f59940c0107f66445378a892e861edb1be74609387bd3c4ab5011955721bf15b7cd9ee63ea7

Download Submit
C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini.tmp

Filesize
198KB

MD5
e542662d4072763f5336298e6cd8d36e

SHA1
53107229c33391f1c40b6c36b7ca4f1268bc6ed4

SHA256
e382915b694e1cc3b5574fb94ab9dbe708bdce140809061803c157bab910cc10

SHA512
9865468f1556a3a7f64ccfe863ecaf6a56c4119c18e1b71df38bf4c86061dc98ab9e471efdf749edf8019502bf710fdb7ed80d2aeecc5e58a8b4d9a76f1cbec8

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
310KB

MD5
35579760148705e84c50a694aa164266

SHA1
906ab98a5281c608620000c00767614ee637e5cd

SHA256
a4102b73c528e89cbd1a8370b425a2f38b923f48f8ade5554aa7c713781f2625

SHA512
90e6063295223b5bc231ed89970e91f3c95ccfcd149795c4de420124d4ef1ad70297825741f1b457c4e0c40a6a5de01033a08eecb6359927ce0d5d838c0a7b52

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
297KB

MD5
588b6e02a5af2740ee5f4ce20c9b632d

SHA1
cb7e1b2b691d0099e047fc08933006191dac683d

SHA256
1bb4ae88826ba51fea93936b262f73d26579baad1f341ae30fd8c2a2a34aae76

SHA512
c3ff742aed4d73e682b5d4141428067dfa725b4db18cfa2c7424964a2259263eacd5031802f7cac5336789f76d56adc41fe17dfb8c11113e702ca239ff2146e3

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
263KB

MD5
f58798ecef1006b49fd4bc159b116283

SHA1
bcbdc5d9af6c8309b827afc40a6c907191a0c9b2

SHA256
b602f83a2b6b3c32e0e925fb3c192594b8d7a3ac34dffbf692042fdfc83454b4

SHA512
1d336d12bd89e1bfb463bf3205403b60060323edb12ae2c57545ed288ccbd234629ec38745549147809831f1efbbf97b43c93de6b6ace7e7f9ab712b4d73a8e4

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
2.0MB

MD5
c4291989627508186c64b34f0c46e317

SHA1
c0567b1f31485e2c0b439949e249ec5d76e49289

SHA256
71bf7be78af290b5e9553825a2b8812439152df2891ae84b56fd1eb358373743

SHA512
eb16116060532acc99f4f3de26a3cbc981d0b06485ebc64426e45d0aff15aa3f4cbcc33755fc7e74d1b1af02712500e00964b83eccf82018dbed8aa0869ae333

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
742KB

MD5
7f5e9273fc7808fab4ee6bc98ce023c0

SHA1
fd5dd17bf76c76297b335b7bbbd80b98e8eb5e8f

SHA256
4b446e0a303b1b23c584933ed7756a357e831703a77a0db8c5a8aa8446c299d1

SHA512
73bc897c9824c5153bf34985bc8f6ae4a5f5b926fe9ebfd608410d457fec80ce6e2fd41638d6a933c7c4c74aedd811868b780c3db4d9f3b1bcfdf16ee901d2d6

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
387KB

MD5
8c3030f5421c98356696f1e1f3db08a4

SHA1
7ff12388ca07e3965f04b6748fc8251fed547661

SHA256
01705c3aa6910d2cc72536a7eb2814e7d3da4f997a58d52678eb7e997faf286b

SHA512
f45372071bd4908d9114d3cf534b5151be305f7c68674a09e8f5b4ce9de2b2e1b5e3545a857bc3e8e534f33cc9abc1b05b0adce89fd19e0ced721b2c9b40f426

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.1MB

MD5
87cacfaacb8e77ae150cada94ae3aa0f

SHA1
e17d21242104e772c36bd8cadecc61d4c8861ef4

SHA256
e98a43aba0517bf5443baeb5492dcbc378f523a818b2351c1f6656e59103e4fd

SHA512
1b735dc1e877518f40b2743422dcdc9ca2d111414122e6a43ab929589483178a5b98bbc304aab3f93afea6537917f6cdbd3a02d23b420f6fb2141bf1d5c79cc6

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
882KB

MD5
e72f05ea854b2a732007b67d50698255

SHA1
046d5e377477b738bf0780827495c89dbda60df7

SHA256
bfb1a9a5cb263452b8b374cedd6b86a0c6e158260d5ea2c46180085085b94a8d

SHA512
f44a820a251ec3beeb29f7342e163cbe577508dda1dfe75c32bb96b5de2788f5e1ca71555944b373b63550b56ba2f220f451fe9a49ef94c17a1c2eaf0b88ea48

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
207KB

MD5
62d5f5f0997ceee8d97d9bf89fd536d1

SHA1
4964fd506046bbe252806a7f3d1d746cdfe80797

SHA256
c3fbe5613783da37e70480beff49ed2901a3c9efdd64a07b4094c843dfa6c8bf

SHA512
d89a44544bc6215ad974eb9dde0a7f7a9e928ba1ae2d5730f8ce57652604c424e933f60fc554918e98f824d737e1ae3f53f7f2172bf21185e1c5ee1ad0000348

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
211KB

MD5
7870627fe753081cf4e05c5d26a883a4

SHA1
9bf3aae536df5ea70905eec737e9594d618a95b8

SHA256
bd99a1075ed8417200d03ca2d67b5d473b17ea50d5e1be3d7c5cfa6e5eb70214

SHA512
24206d0e7192905b2da7ba6c4aad7a423ec4a49b53a9044bddc03ea5055f72389b9f2afd0bf07e4d0816fddcc18344d39f1c33e46e91d73979b38c959f0d18f3

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
203KB

MD5
7ef27ce59dc4d62ba7e942fd5d6a239c

SHA1
8aa78986a15628d77bcdc9c49f01c627074602ba

SHA256
2db59062a904d6800f8371ecc25cb47b6baac360f183c396de72375a84bfe315

SHA512
f01227f90d9ca04b18c379bfa82506250c948d3662161a1c85d097461df0620d33307ab10ab87dd74ec646515302ad784c298427ddffa6566431882236dc9706

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
209KB

MD5
a64b08ee2f6532bdd88dee899afc1fed

SHA1
48024507393eb0008f56a4856b2d683d6054ab64

SHA256
8136f2c3e24f74bdfa5b6767de8996f9c3d80767d588d4e09d5bf46a604e8926

SHA512
bc58d95cea8c2ccfbcb40ce4365d4c4cb8bab2a6a94df895a1a63604dd4b3dec07158d3dadbd1f5f96688c00eddffa3c1c0a2cf24cb7b615d9d375800f2d880f

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
210KB

MD5
e0f49314a3cc6ab99846ba1af8bb13d8

SHA1
698faa07c06ce43e5439498a25aa5ec702049337

SHA256
1e916501349847b7ae9a29941f5bb9eceb0ab4a759d379182f5dff6b449f00bf

SHA512
3ec5cf00bb3981da064ffa0ae1dc32e02298eed3fada31a54f2d8bf0bf77f73e3db00048ba9311cd5a7184f2e91ac5870eaec908108eac4869d848354b4485f0

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
213KB

MD5
aaa529ad7ffa1e813b96e08ee292c8b9

SHA1
266c2667c1b42112bf3c0be683117f698c837d4c

SHA256
03d70244a7e397054d7c18cfc7c420dc74c71efc8163f249ab09d54ef84b12b2

SHA512
c781da286b3a3902aeaab274ae2d30ffd283ff4aa5ad901029afe9d1cc881bf736a54376af00249145a338c7504921501d45e2290db2e6c4cd7f0b1409b3a575

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
207KB

MD5
d7132e1f3b64b8b3894f9b1e88c7fc7b

SHA1
4a68f7dd735f6eadc01feebd993868abed5bae11

SHA256
957b627ef10b83159349022c67357130f5ee98c2e2e3907024dff4288e4003a3

SHA512
9125f2bd4f66c3d5dd4812946fe03ac9b59a8442031189220c765a93b44b11b50c36e1180d8498c0e01eadf94d561cf5630b6d026a7881dfcfb53eef7d77e7cf

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
207KB

MD5
c3df784c55e707a164dd3172e130dd9c

SHA1
986219aa38d5fa102d32f6cff4b7db8c6c1a22b6

SHA256
22d3176eb42139009c29fe22b29c31f562ff47e5a535cecd8d9d5647c36697c0

SHA512
aa75a6c46c15372be22f5c2d2fb4518df03675e8118e3fce12ce0df71b2fb600be643b4254677f3403cff23c99fbf293c89761b55473459ab5233098ea3d2c5f

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
203KB

MD5
18ed113f2de7e0623388357c94cc677e

SHA1
43cebc5fbfea6f02757baf69525a7f8dd38bfd22

SHA256
9becfa2d99afdaa87b53e9d3886700d041858a7ad62bbbb822d888f0d2353f04

SHA512
ae1f7bca83aeaae6c298fd9d05f3bd3ca9010f59e2a8d1c4cb767c24329a7e562107f7dcab6d499d043da66890d14045c6c17b89d59c89ae3007d57629939556

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
215KB

MD5
d607f2c1560b4baf4c869c7a9fe26df9

SHA1
49e58c5ddaf33051e8f63fd9aea819b5c7869193

SHA256
43dd7113761dbf64fa6ee0e5041cbfcd5764f3b8e036dd707c45dbd119909bc2

SHA512
6c25ec8086847b6d13bf09e2f6229bb551e9bdf3b506b99edf2a972bd2894289ddecace1267d000db3e3744e1520974aade498adba66450024a1a874a9d75f3f

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
206KB

MD5
a4dc9c3b1f68d1735d1d4e00f6fa935e

SHA1
13431419e45413172f6da77e3d332c19db739139

SHA256
ba617e7d5669067bd6c6582290a32703c0abbaf24ba001a1aae4eb916db0ed9f

SHA512
320460ccdc62838bccb9df835de95441543729bb72ad5d05a3afa222aff1f50128934fa6831de220ff182359f33da4582a580f358030b1d5b7f48357c1f4dd3e

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
203KB

MD5
f2dd723a46c17f01f46edd5b9fd66a05

SHA1
6fd0a25cd87460d4aa387faca30faafc0c21fc8f

SHA256
cb65401b65c0d2db4775e45a9d2020c84eb3a21fb62297d6f37b670fd20a4cbf

SHA512
a69b8408d53ee2c939846295c751778a686085895cc08663bcc597409cee62d082f0aab9586f4cce3f36035d3820efe9444c0dd77601486c0fa51a3e4e87967c

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
205KB

MD5
2fdb3c8d1abcd95ede09c7aa90e65818

SHA1
71ec59a12b54acf83d4a7223744fbf61877c0245

SHA256
f955bddd1b1541970641995d31d993a5c4d14c91467d9b3229c1cac0f5718695

SHA512
d7e1007d756821ecaef0b6e0c338c5de430de8d78e30ea3c33fdb51b4632fb123130b4e51341a547f7e658157a732ac6374901c58b3c45b1cbc7959498b1272c

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
206KB

MD5
d5382a44e4c08e581b5cbfd7f5b7ced9

SHA1
fac977e7f4634f64eb7910636bf97ed2bd9f013c

SHA256
4cd0fd9dd7c96d7a1486f37f3ce0a660f89c47c57b5e186a30853f52242aacae

SHA512
a2c85f46246136d16a6bf65a7f047ed05e470b9d4a68bfc3c7a4d628e97481502c005e4d32b7778fef3554a726c2b01068a988a5b7138787ec270fde6c1cc427

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
208KB

MD5
201852aa28189074062a128408923274

SHA1
d63a4de37f81ab885f1bcaefcee3072aaec4773e

SHA256
7d051c8b1c5259b80c6b3dfb66f5f30344684841f2cee9f31dac87d0e3ccebb0

SHA512
f76f703606859208c9337fe1d683565a08942cd3fc33888b0a28bab2b21bb4e9d74453c4a14564a96219446d6ce13bebc4b47858505de3344fa8942edd97c6a3

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
198KB

MD5
a4cd28fb7f6daf0151537959f1842839

SHA1
a1e621920a66064ed5258d5b9544ef874f93cce0

SHA256
32d0e637926c63c956484d582fe06c87b9467056debeb1147ea590e538a13e79

SHA512
b1ff2752964aa548b8a3190439b1823df72fd5685294d480334744cf752e5986aa26990f3cb459f77f9de1afa2e4a1c10cf55d70c0b4a1c56a86c32f79b6aa2f

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
204KB

MD5
8f077a121d206f1347c94019d11319dc

SHA1
9dc7fa0460d11b5b9750ddafe5502d31dd05b48c

SHA256
769b376591bf1e0da66423bb87fbbd3cafc3f8799b8be185cfd7d1012f41011f

SHA512
eca6619c60de3409b530f905ca43fa0607ea2d44a98d51e46d1cc6578007fe99a9a432eaa59012281dd725476ada6f23546d98504c5967d6aee235d5e7f00773

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
206KB

MD5
69dd29257124487b75099d3cbfd4f907

SHA1
c21af6105543de1e5d2d0e0df58d8c0bf216d1a1

SHA256
689998b10b32fef43e81f4e7d2cc25445d3709d36de7a601797ee835430bb4fd

SHA512
e0d6edf0eab88457947189663ee71010a13c71943fdcd01ba945343c1a76292c4dc0a499b068e3e180e12581fc016a253a61c101d71b71591a82532cd40a7697

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
207KB

MD5
e83c24c4f1ddff95dd0b9e1aacfb2832

SHA1
75a4669fd61b95362c52b7c22e4349622dacdb47

SHA256
1a86f2144c819ed5e3be556a4196fb1e4784bdbd3e381cdd0790377efca72a06

SHA512
9d0fd6b381f8558f294fe43ba0afa5bea98576f07c8851f465c4007bc2fcb2984eca518c4a3b2f2f10fd66d3214f7086d53068d2a51a1bca082d7182dc8e4d08

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
215KB

MD5
be4e199b9afd7cac9f152dcd804e8662

SHA1
abc52e5ef73ce77f8ae54f5ea1c5b463c285d5ff

SHA256
9312731842fcce53a1608f5a27ceb5f923c6378c33eb2a36df75313cfead2abf

SHA512
33e66af512d6d16b40d0c27cb8000c8457668bb0b1df8134b4711485065173dbf8b9ea6a985d1daa589d2e70907895c07093f95ea1358b4cf1254ffe6b0ceeb8

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
209KB

MD5
e215000988ebb6e02b49a90b58edc8aa

SHA1
98963d692a6f949f30cedab80cdd5e95ab6b8dc9

SHA256
3fff090b65f5e7cedcbaccdeb4d842b4e42879e1696d6c8937190a6b19bf8a82

SHA512
a7de880eb2f2cee4d70288220f8733125b6af646963b331f87cc3afe7da76606c265d5ef64e9233375bcf5a8923425cc6952cc86e6c8239ac4c8f4ec3e481849

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
216KB

MD5
6bfb4353f50c7305a0e01f8bba18966a

SHA1
f713bf8721dc609d8d4d590ca1dc352cdea36a2d

SHA256
9703b9bfd1ada239f94be19a5aa2ddd18318236ab05f41a9ebf3fe33efe8e6f8

SHA512
6e13698bf36cc61d0180ee2c135ff25c90f10c67104c82f67db9fe41a72ed1987592020201217ad123b010a33f4af84c209763b8b7f24987d88d0d0d03ea9268

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
206KB

MD5
5b1e07a2903f014e6d15ed8d8cf392d8

SHA1
992f199042f1067894e4e50db0ed2738ec5f743c

SHA256
b1b8eb5a2036ab7d12b06eb4eab5455c065e84a83a1a21729677db57575fe866

SHA512
dbb7a97e9e3fc0d7bdf571ee86cb3f6b63728556b1a945a110497b3eb9833fd12ecab54878dd8cfa4efc01393f950fd57b6b0ac2561fd7e53d5fd6fbec31e99a

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
208KB

MD5
b0485a1ab1f92293c241bc4e97f298f5

SHA1
65a9c4dcc040c02f09eec7bc1f0614c0d9413308

SHA256
86f28f2f189e7dbda5ffd00076cb24e62e40ce5e6990ca1a25964b4c919389f1

SHA512
50abd79e2018055cf531c56b288f5d68751ba761ced96e40a434a1b86f45ce7777cafdd85c1a1b8b969e83a4a233003c058627c6d0459565eb662f2faab7cdb6

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
212KB

MD5
9cad8a3c4ff4f35322ba007da87a00d4

SHA1
d16d19600e84f98fc4b3bf8088987f0bb10983d2

SHA256
af6b8bd9db2a9443891eb7295fcb55c8c4b40aa137d4dcc0b9150303502b28a7

SHA512
d3a1b347c1e601548fe8cdf50c6fcd5fcccf2354afe575dc7d888b45c11ac176dd99867ca64e0113471a1166ede84c2442ce682d60c5ae1dced0cf3731e6d5a3

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
206KB

MD5
9a414e7da2194812f3481b23a64291a8

SHA1
57b4e9d2927149f78d6ba5bf9cfa4a898c29bdfd

SHA256
a6ce883c24129f44b020e1d5a245952285e4d2b9c07f870195df5c4e449057bd

SHA512
ebffacb7487ef5d31c0e6767e496423a19b8f4b7dbb0cda67e1cafe60da13d56c3794e9f95b7bd87a80bcad036ff7169ae422172d11f330e1d440976dad59510

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
206KB

MD5
68bc6aded24299a3fae09c39c08a2d88

SHA1
49c220e0e07c48b3708f933c59e909c7af4c2696

SHA256
8201c8663e6b8b25b490162d28740741fb4f49923670c79e43cfb8e0fa880606

SHA512
8288e26743b4f3544ad16c23a3abf081d921d988a872155ec77a9502f9628cc8c0f66ef98eecff94648c5be7af00ecc6c20e06ad3c1b1f25ddb91f6909224c76

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
210KB

MD5
003d69dbec05e300e3117cf2b5e92a4c

SHA1
55ef0fdbb5bfb7adb4cd925ea1addf27ab791d57

SHA256
33d9684acb61b16d398ffc2cc580a7f23223b56a13310eb2b4ae85135e644ffe

SHA512
2ed3619ed55c19739062644453d81e55d72626866e622afd9b68a407472787339d2f95034cb316cc762b00efa2c08a5b9b5430dcce6927bdc93a7cacafc0355e

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
216KB

MD5
9ac27d7141285c8ac46dcab6776509af

SHA1
14591aca50e230636a5b2b59882ceedf81f9c951

SHA256
ce373681eb45c55160001532a77d82e500e48093217e48af5a554fdca5469acd

SHA512
5d3c3bf053f4b7b1715f1c94a0c83166bd3c5405f71eb849e27f710cc67d01125bef0f84dcffbd9a8473adc40d5c9535a6aa381bbe11c0514bec87153455c873

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
209KB

MD5
75ded9fa52210325ff93a82be2eb2d45

SHA1
93145b58bfbead572c8b786ce288fe8addea961b

SHA256
4839f973e8923350bf665f39e13161c30e3f9417bbf925f6993a930d130b2b98

SHA512
0fa33c0ca18293c83e2e2388a27ecd13c6577bbe35ca24dec4f3127d111143ec9addd81c73ba30aa4631449c33efe1ba49263874f08492072a805531ce7cf3ea

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
208KB

MD5
c93d0def3e91e31fa1b01c85db2747f7

SHA1
8f6e3dd6d55a23c3e830a3f4497d8af9d4e9b37c

SHA256
00c4fe81327b4cbd28f22cb5efb29360308e0da30b00726a72a51170c7352a39

SHA512
2c5c5d852301ae83a7dd210715232ca0e1c2a272c7c8c527d06b0b899875daa45063819e280d07e5a2a5f881ff8c71e138a0eff6ee1960b96b23732a6fc22fd9

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
204KB

MD5
11612955d82b06ade457358d69215501

SHA1
fa9b92b8f9ed2b1a5f609bcc813297bd75b669f0

SHA256
5ebf5e5541bb044c90f755b82d9439da95c8adf8c27b5fe529cbaa8ec68d6eaa

SHA512
c8be7c3e96b3db2f13c046d60cc8a529bd56c230f98e4bfd6be47ea04ed2db83e39132d67ed225cc42664717e6a31bf68ddcdceab433bb6909ec49c20aa4c27d

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
210KB

MD5
5fd3eee92bb84605f387dbf74c7ef465

SHA1
da628c32db91ac7d4737504e1603400e3fbb4f30

SHA256
b515167928ed0c7d4117c48972297f624b424fcf680b672c9e44dff27eae334b

SHA512
75b073e2ad06477da26bbc47c7373a2b676e41c500676cf17c2987c22e065f42eca4cb93734516f83ff00fc890c08d12094e2cf841a31d54665397c3dcc81b63

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
203KB

MD5
b46405acc96bb1b616ccdce9ce7dc0f8

SHA1
bb9005bb621e853773cc03f20cf104b0ff6ba0fa

SHA256
4ffe970b5aec1b4b2cea4f1b38a230d7acf2276854e31415a0ac2d799040e41e

SHA512
5ea2e6206941b35e807c1fb84eff3a81a54d2b39de75e439da19f1d106aeeb8e03da33ab6577d742527f375ae798d0603ec01866a4b4d33d349dd099597ba91e

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
207KB

MD5
64a3cfaa1aa973ade6540d480e7a2a55

SHA1
3df13652ae77681435c567895e1e96126f5c3007

SHA256
0229f671eee57f6bfa60e64acf6012cd3f80dfc51525da576a588008908d20f8

SHA512
1ae6a0ab301dbbc7623d2fa40555bb6f4c5287d117d265f980204b623eb4112377c58132e8d943115d80ae548960ccabba261567483086db5ebba0e584785827

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
206KB

MD5
403b40329ab8c2aa363bab86b564fc23

SHA1
62fe0e95e373c27eb119d1e057a5b9ae68415c57

SHA256
f4955178a484baddb6643de42802e94f9ad65ea65e7c8c2eb847514e7b6c27e0

SHA512
a191762fba8ccf400eef7f9e856930935f770ff043cb84ad68e94249c2c5154c5058f44854c893d2c3e64d5d95d8aa21fb0d98a7f7c00aec3642ed140c9cdc71

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
209KB

MD5
8b5135ab2096b147ecf89f7c1c47b8e1

SHA1
156535b828bd1619dde4cff01a96463087c0de23

SHA256
f23ea7e2a76a2bfde4e89f12130a570a02e63396b05090b46243bd2313a5e397

SHA512
1d86c3b211016d0694d0aaefb9f7c87b1636d294f6e3198361482ae2783e249017168a576d9ad38b16072558dd2523574463eba89477838fa22b96012b14323c

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
204KB

MD5
a1b714d1bc4a215d149f3d899c170b50

SHA1
a0905c68005b6e49fabfcf9df546d46eef4e3371

SHA256
279f90c58a25584545d83569931a11bc8caf2b7d33a84d5e23e93016b51cab84

SHA512
a01b144e52c77fd2b656e1ecbf112bfac5a493a32e177cf3295015c16826b1e6a7efad857c6191c3028b87fa831e9b23dcb93b8edc495546450557e391fba067

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
198KB

MD5
1c18825129d2843e5a58cee44d302dde

SHA1
c1c4d19475ecb98d33e7983d680124a81e1ebbd1

SHA256
9dfa632821e8f1c2ff0cbe8c69bd8e48a9621fceb0ce7b5f568dd542e63da403

SHA512
3edea74876693be4907f7dc6d188fd5a06e9a19ac27a6e4ff1a0850c75274eeff53ed8912ade99c33470ea3694f65b6bd2f0c0cd3bda39d06bb5d31a745eda90

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
207KB

MD5
f89f70e37c4279bde70ef097bdb5665b

SHA1
db68762f38f66afe56c86d5b50af5c79d599c700

SHA256
850c7dda50af6e08b7a6f2880e0c39a6127f6a49438e2679a920b215f7a97f50

SHA512
5dcfa7cd340802d3c2ab6c1d8357592ee8b9c5523ebcd7036603b9136a1fb6fc44e8d954fe6e066ee9f16828a80cdb1f2b6158d7a4ed7afcbc3647ab4ca8fa0b

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
204KB

MD5
0bc368d3d52685f1cae0f07053ea1341

SHA1
389c8146bc70f5604f89eb4071554dcdc9442d2d

SHA256
bf5f38e010f99988020b927ff4779dfa175fc4497b744a53bd1b252cb9c00186

SHA512
01be2ceeb2efda47b4e19e1e272e0146f56ec29ff77a926546cfe912111b3ca2c487010832fe2a2d1a012b7daf4e11f2bb4c228c7cc69bfe27afdb912d2e7ee3

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
212KB

MD5
8c0cb638601cf4d32ee942fef459b4f8

SHA1
e4b5bb3a799dd557f6d2ede3caefc2913d5b9da4

SHA256
b85e81ddb0b6e245dbe35af75316ea18b25149b587cb2d5ea94473ed17592dd2

SHA512
0ec8018a578a3502a6b964b2539a7d2741446d6e36a467b83180d44b9d63b0631e9a121aba830d1e592372f6bfa347c4ad7f70b281a3f5e42ff9e5c54445c79d

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
208KB

MD5
d2c681a7c7cad8b45fc8e3ec841632db

SHA1
260e80289453638d429fb436b1c5feb784dc2999

SHA256
a85d6594913230a04baf6cfff1b3dd2eb27795dcaa69f329d3bda69189af047a

SHA512
df6d40f266c831655d2285ec0e8cc9eb7cfa3dc4060987cb0b2b3138a3e7e518e682099b8f237862ef8a7809e2a1e4ddc8f317f96b3b71c692383884347a0dcf

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
207KB

MD5
f0cb92cea665169965d325f49d1923ea

SHA1
dae47780702c3b524b8acb8c3ffefd095a868bc6

SHA256
b225f56a057bd1a7da5da056f9ac4037a8e9391bf69e43b2731bc20c4ec41d7b

SHA512
789eb85c26722904687e443bdf40bb404178c0cdadd272a0c2fec1f3d88a9be52e3574b89f586fa6adc75338ddf31f908fe2c093f8a0bcd799c80564d4a5532f

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
207KB

MD5
91229e74a917057de49ced7eaec17d01

SHA1
59e62d2ce2fa174801949e7cec4c5023c7fc351a

SHA256
f19b23ed13d54afe858373ec72b588d8962f6db2f0658196111b951577813153

SHA512
238911e579ae611f5215139e6a2b136b32669e4abebeb83cbaa020fe5be979c68b5774723ca53e3475b5cfcb20e58a0dba28540df6627f02f70c117ff8521e93

Download Submit
C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp

Filesize
488KB

MD5
6f60b9d5db21379ee0aa6b2874b688cd

SHA1
6dddb541e4359bea766b5ec340b3c3640081d3e1

SHA256
1adf57eadc0ab714e841727fb8eb6c41bdcb50589c0f3e875afc073de0585da3

SHA512
1cb709f298905047c3a39aa1333dbf2234211c7dc8fbd126cca2077b2f5c0d3d7f261de5b107768884e5f6f24c94779040b7740d1f57e0fcc220f0d173cdf9f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
198KB

MD5
7854c83f0e80d179bbc13b24e793624f

SHA1
17314f988814449f4522895955ef220dc4776106

SHA256
391e88897dd6cdbdf43299de5b55d9e41c6cc1d2ed304137b7840aa6bbbdb215

SHA512
6a95a8ca572835e900260df3f3aad7ec2ff438bbf30a3d7950b46430fb1111f287ccee8b4ad6317a9b9f6c3b3a63f624ff685fa2056f540b057e1f413dda81d2

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
198KB

MD5
9ece0924918569e873c8f27709c3081a

SHA1
3018b769061dcf70a3d50c3552d8d2c295abb7e2

SHA256
1ff0ccc7fa8dee0733811f1965b2394580eef2ca69e277739cecf35143459459

SHA512
ef9b0b885e871b2710e81736830dbe5d68e6722656f04d547fda21d92afe426cf3c90eb1ff4e56b3fca23fb5c2d656b8f65ffe022debc62fd5f546413b344fff

Download Submit