c3b2ab9852b05778e23259add2dfd6de196194ee2431636efe550c10d5ad84fc

Analysis

max time kernel
120s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5429afb78994860fa86813ca3fc1240N.exe
Size

112KB
MD5

e5429afb78994860fa86813ca3fc1240
SHA1

4c64babaa0c2911663c9258f4786e7db76d4b1fc
SHA256

c3b2ab9852b05778e23259add2dfd6de196194ee2431636efe550c10d5ad84fc
SHA512

9044e83be1180669e6f6bc95ff8004f74fb5ef090cf97891162eeaa66b25638d618518b45e3e8d1147e2b1ac56ed47bc22a19348deb7070154182c53625f3356
SSDEEP

1536:W7ZNLpApCZuvIYXJSpXeXUH7ZNLpApCZuvIYXJSpXeXUG:6NLWpCZLYZSpukFNLWpCZLYZSpukG

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4242) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
5084	_Desktop.ini.exe
1580	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	e5429afb78994860fa86813ca3fc1240N.exe
File created	C:\Windows\SysWOW64\Zombie.exe	e5429afb78994860fa86813ca3fc1240N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jni.h.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	_Desktop.ini.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\SmallLogoBeta.png.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms.tmp	_Desktop.ini.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	_Desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp	_Desktop.ini.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5429afb78994860fa86813ca3fc1240N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_Desktop.ini.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 5084	4136	e5429afb78994860fa86813ca3fc1240N.exe	84
PID 4136 wrote to memory of 5084	4136	e5429afb78994860fa86813ca3fc1240N.exe	84
PID 4136 wrote to memory of 5084	4136	e5429afb78994860fa86813ca3fc1240N.exe	84
PID 4136 wrote to memory of 1580	4136	e5429afb78994860fa86813ca3fc1240N.exe	85
PID 4136 wrote to memory of 1580	4136	e5429afb78994860fa86813ca3fc1240N.exe	85
PID 4136 wrote to memory of 1580	4136	e5429afb78994860fa86813ca3fc1240N.exe	85

C:\Users\Admin\AppData\Local\Temp\e5429afb78994860fa86813ca3fc1240N.exe
"C:\Users\Admin\AppData\Local\Temp\e5429afb78994860fa86813ca3fc1240N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe
  "_Desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5084
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
56KB

MD5
8a5b1f8da15c49c08772a354025be07f

SHA1
0782e7fddd0dff1feceaec9b86e32d681bb1f174

SHA256
72826632ef1ba6147d7e012a6a383d2c13bc373c0ec6558c2a8d918107680426

SHA512
cb07d159c9443e1b07228068718f4fdf2011bc9a251fbfc1da777ff415fee8de41a21153b36a282de7dd20195acbb3484675f59b884b373eded1db4e865c1408

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
169KB

MD5
fbae74b25586bbef7d3c97c0fd72582a

SHA1
3b7330ddf3503ea221d001441581cd1fdd0f1201

SHA256
72c4b1f0f3245c737b91f385c8193a18085546f6d64c0ff45119a049b7b543ac

SHA512
85512733b325a96b8e42a8b2401f9e57372a96d9d3885ccbb4d00f05aaeb2dd550f52f080ac901dfba3bf2e209b5fede32faafe4f5168f11b4b379a871131c9f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
155KB

MD5
472972e4fa65020cfdc490349dba893d

SHA1
5e176fd243bbb0e1eb3e3b8d52515ac1920c4fb9

SHA256
ea4b1b34744d43ef3f3984ceb95006ce5112ae29bf64ee4fda6ba80190d2487b

SHA512
1107e1e24361a6b61055234158cca0b0aac1613c624d171b69874ead435bab877775819e4fa80ab13333b58451e49c68390e3d167928a29ae3c7ce99669cf3dc

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
121KB

MD5
e276374eac60e80d47f99d19cd4bb9b3

SHA1
bc113fc3237a29ba55087743117cfaf083e3b0c0

SHA256
cc2d7e9e4d2e9d50da59b2be30da831b619e4d3717e671d9acc185d8f3af1501

SHA512
97ce0439cc308e54b1703e10ae78734ea05497827580c3c161760fe33bf2eb445be398715603dad6019b1040ba405c4a0579db083a89d63a3519274b9cfc4d6e

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
dfb8f071335de9b94ba17a0a75294252

SHA1
fcf8e64fda70f85aea057bcbaa78a62beb293fe1

SHA256
a0b3ca3d340362c7b6cb34a7ba2e432279611ec5e1501ad9567e7eea0b161e7a

SHA512
431891bab0456d222a81fc2d6963f2e0bcae162e725c08a5a19ae5d3ffc173a49065458ca89c6d533908341abb4ac0e21b326120fcb6c560d9990e55194b6e0a

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
600KB

MD5
b511f1679213d1ca811d99fcaa0561fd

SHA1
f06b73cd2ffa588d8360d268d531f1fd9bda7bf1

SHA256
0ddd9bb05d3038be465c24b6abe4f828c9436a475cdd737526264efe24031377

SHA512
d3bb679d1e5de9154716912cc07c6b258c54f967b12c325d2fb227ad3fb1e04d64eaff377780d7f33cf1c02727175b85ad5ca8737a5a51af334348ba1d6bd9c6

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
266KB

MD5
f2db7b58a15831ad9316297e2e1cfae7

SHA1
55f26e2664c47dcbe6c36f11a9a5f48f40a66d52

SHA256
333d1e3246841a802a0e6b56afd8d455e399f573130e89eab276699093c0f38b

SHA512
95baa9e349edadfee8236aa9d19c48a2bee505c837c111ff967fcbe9c79134ce5b885d5e1aa331b6ee48053e7d972c259bfaa8e2e76f9b8a2fe7a5786ee0631f

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
56KB

MD5
e86f3988ac6858a7b8dc7652f3f38316

SHA1
26f578aba94416a55a9d2dd436c3b8fba18dd59e

SHA256
764717b80c827afe8e1bfb95c94ae4a324cff7fb47f48183f6c4a93b2520a14e

SHA512
8a1b53332710bd753acf2d750ee0d63ce1d73e60333cb487764ced4006ad7b24aa7be31743663346f3546eeccb9aafc0652887e1bfaca663403e8cce3e391b21

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
740KB

MD5
399f83b95e0d58c219faec87a0bb75c2

SHA1
62beac0b13c34dcd65f8ff9c173b9b28d31c0f0d

SHA256
8ff7b0bc262576618badd5f0958e293fc568731f10ce64e6ffc366cb4abe574e

SHA512
ca9d77fb29eb95a2d18d656f2cff9ece394006c54c7b9cdce344b56f85a97feacfe7706b040129fae3d705d0ef5f5ce7803ae4ba69473ffc4394ec80c4833e52

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
65KB

MD5
17b40061a7027b787cc51f66424f0f4d

SHA1
bf109d9dcd1c6d87b9e9a3978b4e4d3eba22baf5

SHA256
0a4dc2a8455c3641921afe5f9d92d21bb5136066fcd9b20aa6cf0cd5f219855a

SHA512
4069614490b67c4a4b7713d2ba4f14be8745da51ac6575d048ea6768c91802fb4d32da091f1422af8f1d1750c995724ac4b45d5b32ac2ee9114b4c5e4bc4d862

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
62KB

MD5
d022151bd26eeebb1a624d94217b8aa7

SHA1
d4ff15fad705b04dfe4e9463d70245742173740d

SHA256
752a151ac995975f09b454bb8fd36dc0febceab7fc9dd8f31cf678e0ce116546

SHA512
314dd3d457b882b7613039c52663d9586b3a60466c207c85f85ae053ea6dd13c0a27efcf2e1df8554c3272a3d19241b14cf37da55a6cc9f0cf00744d7868fd18

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
66KB

MD5
dc5da40fb993862345a4842f4b524aa9

SHA1
16fb0b030ee98bdd30a59986fa4eb3f6c53a1774

SHA256
ba0929f1ea2bf6fef0e1c45bda68e8a851e5c8e904301eace3f7532501c4677a

SHA512
53a52f41339e198da1a8aefc5f938030b03d49e16170b5fbf770458eee1f5a3df3d40bc51b6faf902bb4d891f077fc7a23943cfadb35485443415c85c3616ceb

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
67KB

MD5
595319a21a76860aefdb12631017bf7f

SHA1
89f4dd291b410fa8aec1376e4c827f85bc046682

SHA256
c5b91b06d0ad14aac925bd6265933a3247f91be7a880c8b08c82ed7bac0b2c53

SHA512
56d058bee292d0bf4c3405ebce0e6063c2c77d0977fd9b4cea5232fcd5b630370fc634c6947cd60ae827068b62b4960a346433cdeeb208a67f1354d3d68674d6

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
69KB

MD5
b40b92d7cb7603594d918e3667922650

SHA1
5e5e11ae11a07bca29f66bdf18b0c4b4cf625975

SHA256
49af30a9d967a46b1ae0bea3f805e7661f1ccd966a0f243b53ab388a1e240461

SHA512
8dc2e983dfb76149df90c668b9808628686eb2eee69952116643610ac0d3c40dd19d07f16cf7d443337aabec4fa877f99a4ebc857982410bc4ec71e4770c6881

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
62KB

MD5
f74ca1477495be81c8546b2c60a4b0c7

SHA1
79c4ab6c0f7912ffbeb591a0ee3e192832a670f2

SHA256
fbbc12b9f793c8514e76e823135bba5d275e2773c8fa1ecf576982a45905edb6

SHA512
f020c0c9900de1b756c98b0c15cbe815efede087606403c620b794d4114c2c20d9b1a885af6c819ac30f6aeb9f8f02104c0097df2c1f095efbb76f792c376899

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
65KB

MD5
1cb7552bf9d266e65605da15afb8206c

SHA1
5265205d71e21e801c9f69308de043e41e03e601

SHA256
abb981907bf68c142cf904a3f2175f028f2da3845e18426458247a45a53f61f2

SHA512
5af1ce9f76c3c43ea84cd3541208587d123555df7a43f2e9792ab0d77c2a88cdf1ebc63b78b734b41128ab650cd1f3984e59f685b134866e2ef2711c4e3ee2e5

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
67KB

MD5
7007b8b4d189577879e8a6e4a342c3a4

SHA1
bc02d4d4e3360c15b9cedf2efdab96a9803968a2

SHA256
aa39793ebccd43f3821786c14ff6c881c1bcd1cffdfb91becc5846b2827c1d80

SHA512
48fcfdb8b777432578986092f4f9e53e3150cbad0d5b790ef680599301ff42448711abbbefd4238e4f62529ef30b54489d53ba3292e424537c66c30badce2acb

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
64KB

MD5
5319fbd4e4611ef54d9fee01a651db95

SHA1
19db890abfc45aba5f8b5b260ea1b353aa6e3417

SHA256
91a4d177d8f36f2d977f4f27af04088b97f9b42adb149e9c70051888b0a35e69

SHA512
819b5e51fe51f9a55a080ea8877c8463612d6f2cc41091ad6d4417bedb102289c9a57a0e138017917d2c5b8886a199cf4172affeaf0677a9ce629af45ecad22c

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
61KB

MD5
c65d2d320f2c56a95b7e269514f03021

SHA1
405c40a58439f04050e16550e54f7e87039d8564

SHA256
b7190f5aa87f7e2b77f531d55261deb900277e1f43d14fdb5c017a79361eab9d

SHA512
1952ce89e4314d9e85ba94139f7eacfe14049201843bb4874cc0210d7a68eaac9869afbaf4f34f2cf1a078307d61536a3371d3afac302546397d3f0af610d272

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
65KB

MD5
015961d000b63406452e8d180683918e

SHA1
32afc06f8f164975353d43b0ecbef47583d07889

SHA256
ff7575d267314eeb2aa84ddee9b598b544af10b8cfebbc0be1b2f799e602b415

SHA512
b19cb67b981caa8b41044e4c879c6ab77f516653ae8527bbfbfa1a7e0024c9c4a1027924f2abeab633a830a299b53e3629a5b4c1280773acb2ec8e22731f23c3

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
72KB

MD5
2683add13a962bb08cad38630331ef3b

SHA1
88c29e6bf498e4b7842e6175f1858e93588d0eda

SHA256
63cce7bc3d6c0046c2c449bb99c660b7f960a7435ef2d8a6ea6ec0cbfa871c0d

SHA512
4e6afe324a365ac3ac68f2fc804886d05bbb969bc6d9979b37033fc09cbacb7aba1763dcbb24204658eed3c1ababc509f3c8e36a2bd6ff13baada698757baa81

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
64KB

MD5
541ef87398c7eafa6f069c80b4dc0cbf

SHA1
1a4c01a98ec30a64e72b16826ab69b9136e69d7b

SHA256
d73470526f820d9e99ea9142a240c887795392f104ca7975ffc8fed1f76a61ac

SHA512
a34c5d40190680270b6f5613920db543c6e78e65e3f5ca9a63b1955e8d9f571f8fc9ac1119b38929a0180bb717167e3368533b01faca613a051324012bb3424d

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
61KB

MD5
58d50d5a050cbb7b94b937c7cc4f0c43

SHA1
ffbc6e8d4bfdf727bdbc3e7fbf66ec58dcff4fdc

SHA256
918a14b024a998a8436273f88d5aeb0570db86f1dea37fa439b8d54121a5ef9f

SHA512
c9bca43522e07c62dd18b98771cd229f6e308d03174dca0e187f35e60c261587fada4086e5f99cc7a63e98460f4dec71288cde0cd29d52b7c119fe9dde30ee9d

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
56KB

MD5
73d471c3c13d2073a7d663a43f686063

SHA1
b1c47190fd2196c68ca28a91c93e6900cd0c503a

SHA256
c04fe4316fd36a7c2199968faaebeed243ef6af682967731cfb8f277a3cf0f23

SHA512
5daca910e8b8527fb9f25dbcf565130bdf4ec9589afce132b55021e48c10de8d3407ab582e0bdfa53c55660fb54590c0462b0129e0f91390555ef8f35aad0c2d

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
65KB

MD5
9c2ed1bcdb4f106653b320ac7e5d19ba

SHA1
5c5a834f345f1ea396f2240888e4d5eda619a0c8

SHA256
a3811ad11761eee0ef41b453a03fb4e4d67647b0f0d28e2702a14bf92e5f0ce6

SHA512
414f320a007ae556bbf0744ccf547713ee67b3c8c16c9781b386b13ea79c5da4e6db73daccf71ade030d276ffbe02efac59cac5c848c63408da483194f34ac55

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
64KB

MD5
13906f6e8e96cff62ba24c8fdd89eea5

SHA1
f13542f37adb4568128d359d2b480f278dcdafc0

SHA256
aa8db3b090c088f88af8b8083b4d99982dc2c3eaf331c474bb120a187a689358

SHA512
00331b8b62ae8e9cba7b8a33db4e5a264c783ef7c33c76566a84e5087f280861d715891b072426bbf718c843204544c41b54dadb19651a7e7216a49ae5a96f61

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
65KB

MD5
f13945185ae646f2d8965f08785510e9

SHA1
66eb980b317ba8e03246d6fdb6bde2bf94e43e23

SHA256
c83115baa24224e6d47b0b290b6a4e082d87031d5f48aba0dff560b507e27ea3

SHA512
2ab9ba3f2608201fd59781f2c72350c8690e89ddc8fbfc1bff8548823e626d4e03d61853dc5efd80a17e634f1c624c8863bf5e20f938ad06658e2438a1f4ae10

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
63KB

MD5
0597d2018e94370e03e668ff04f699fb

SHA1
49e5035a84da2af68be838c55dd3947ea2ab612d

SHA256
db255875d3003d50c024012b8ca0a085e69600688686df8a657f5b6ab0c31194

SHA512
e484aad1edfc1291eb6b12974277851bf9389256cd57909a197e7989dfed9762a44d049cb539f1a3aa01b72b9c0df726460ec629e18186966904964bcd16d60e

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
64KB

MD5
55f3fc361a87632362991cf647638e11

SHA1
87ce8794539a7113799ce6d58610e90c72e83e61

SHA256
4f75b09919eb6a3da1ebc28081fbbc98786884e94c59a98973959c560a994440

SHA512
08ce50b2a48ecd7423aafdc1407bbd40b9abfdf48aa7555388c55d3041a2a678c2b7403e91f158db7f840c205ee7484f9347a02bf0c3afd275cc529e3bdedb29

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
74KB

MD5
5683254756eedd41f896279995303938

SHA1
407daab6177e388419a7f19500ac221a64a2c249

SHA256
8960e1eb189ae0652205c32efc7ddc9f1e3b98a4c6a57367aef33fb36ec27b9c

SHA512
cd0bdbef6dd0cebf0f08638bccaa770c3aea1e117b46c2ace6947abd3fe0bbf40a04f847706543788089e4742ce6f798f745a0579c83686d1b72ede0f36868de

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
67KB

MD5
c77961bea820161a99af5b16710e0b98

SHA1
ddbd0017e5cd8729051c5d7e6bc258f012d8007d

SHA256
287370b9bc04593126a0b385274b82926b120def5d3e224a97b25f5df39bd45b

SHA512
03f02740421a174747085e4148a4a5f6c7bdc75ae05d7aa675de21628bc70791a774b6fa35793a9d4b54bf1b0610af044c253cf84be20280394e9ca4d6254c5f

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
73KB

MD5
a8fb83811b90f3bf6e3c1eefb9b11104

SHA1
ab3ee2b663bd36e21654224b094c2b41b57d2778

SHA256
b641df280a1df59a99f938eff241bfca13cde245963e42976d9016ebf1ca194e

SHA512
a4bcf1b483dcb102e1fc5739641dd92f7a770ad5498b1a77bf917793a99d84c5956d6bb44c5a1ce0888be98c798a653617efb214f2881ac463b93ccf62ac6113

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
66KB

MD5
ed73cae2f7e4b9451e5e65fd923b5484

SHA1
4282c6b46b2a148489c5d56ba88aa78be3aa5118

SHA256
59dc358d2ba8496578f9e9b7af890fefdb8852de220c3b2923b9b05de5eee55a

SHA512
e01626459c500c812d649daced3410bae6df9ef931282145814837c2fd7087ab81dc99a29492fc9c5f0c3807b661a0b660d12727a287e4d442d9cfbaea1ab039

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
70KB

MD5
1173dbf9880ff430c080a1865e0dc7f2

SHA1
173de3cb96583f53789667857784fde3f2d5bc45

SHA256
320b0d263fbeb8cf6c12c49d4deaa9ec84aaf17c4ae45eedf61b46e3c4f77c1f

SHA512
fe1778c8dc93c225256d7b15f785939f7a857dc4d90d5780047b44f7fc41b9455fcdc414dbdf6f7e84263ea59eefd85d601166cc657da813a0319b2ed4181ce1

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
65KB

MD5
90dc90aea6014860fc8d81cc21493cc6

SHA1
8047d9a9fbf0228327f203531ce9299abff20433

SHA256
7720e75caef07762c8a384078e1223758f691da79bd9e3b63f2705bb294a03bb

SHA512
237d0399fda3208f161227f421cfebbb455dccf5dbcf61b8ee5e24fe00c02f412e1c7d814650b429d78310c635cd840c8e47613303ff4c08a22c088c66e8f37d

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
66KB

MD5
a016ddaec798e153601b39383107d409

SHA1
7a16196d9c1e5cfcfb855ceb42efaa270eb24028

SHA256
352843128fe59286e5cf9b1b566ad4f226e231c24528c9d25220a1edfd5576b4

SHA512
502cedd125373ed7d2aea8b80c2eb8bd682a9216b3e05bbf9371f20cb004b243154eb46bbc2a9a5259b1852e0f03d443c587e84d5be8fffd41744a86d1b35d07

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
74KB

MD5
edad4962e334bf4da859ab318bd4a872

SHA1
ff9fe306859042bd678362f107e24a809df751d7

SHA256
fd0e205af104dc3a5c442161047698d7e7844cc73b5cfc32836208b7ec96d1df

SHA512
2d5604da9031c29748a3cb495aafb532e07e16368a7acc582203bf9aff4a59e41fe031fcaf9b1da780531c7433058762ae629e48b1952914a69209fa652e5c0b

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
63KB

MD5
07b1ccde57ad8d30963904fae11c49ce

SHA1
5c8fba3f59bfba2381fa78c83b8ddbc0225676f0

SHA256
fae9821dc9341a6f19bb3884e0d8909145b92f5cd247743b2b3e4f20f86e705b

SHA512
c4ead7377d7bc5cfa2db87cdef89d257157132f41b0d69c414b496e42d66697a7f2ed5da1c4cbd266d63837861706f53af0cef185ee1269177360187b8913970

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
64KB

MD5
3fff7d9463dcaad21a9aef3eec71cfed

SHA1
e0f8b764c25b4acd327036d11e89f91c57eea176

SHA256
b0d9ccae1d61c9e1208eb63c1d04d6596fd4f151aee62468f2ec54b0263dbdbd

SHA512
c384e20733c1e840371bfc302b487bc30de83306ae2b3cbd12b0cc5e32772ee12e47cd828193cb1b810a9520621c90205190fde0ee5f802f37374a615ef15cc7

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
68KB

MD5
809e08c2f46c22c8d8fac18108acf70b

SHA1
0ea7261bbab7470b86cb0c7c0b6f9d4260608f37

SHA256
91848b213e9f9d965c25d8793816fdd007431b40e37d4277f8cd7da5ad0b5221

SHA512
4e640410d103c8d5e1f9897c968bb5358bae0188f6f08ffa9dc1fea03aba373f306d57052bfdb7b424c2cd1da3111ac74f6addfa5fe83a76b79b30dbf0175dfe

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
62KB

MD5
2bc39a06a4d0e6a92a7b952de96cf524

SHA1
26547a20b245d6833097dfd77a9742617b8cc375

SHA256
91e6399ad309d7a274eee5bb2593235f1281d39f6cd43d3bf8ad61359aff7e6a

SHA512
07b50f110cc87d9c84e2a6c1ef75fbb9ef827172be7daf62128cdad7530497eb1f4379263768fd347a7397294a24a9bc90559189abdcf3c035a472a1a1f3ad6a

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
68KB

MD5
143d6d7979b91b7a69dcd7332114e43d

SHA1
a0836496f2f9b7acd63a984e2d6d1513823a26bd

SHA256
2510eb2b5c3e50c526d0a4946a13a2600b103afcd65f5f4b7bbe09239fe3e355

SHA512
4a1e98efa03353ddf6c049f873f99bd4250722b429391b0f52ac33ab8b1626c8dc8a7237d27fdb16339979eb14801183299aefc54522b9efa6ee87e6060ac506

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
63KB

MD5
3d1e06fe6259e59dbf15f7fd2e569e57

SHA1
f42a8adad9a5715b16c47a2fe4b64fbd4c6559bf

SHA256
b736358fd763333e5968983b2aa6bdaba9fe5d8cb646cc639d3d1888e1cf06e2

SHA512
b99d6edff9af2590327ee7bf9b9375278230cdb5d8c78c89695060683216aa6578e11f107982896c278a6b202e633bfaaa4800ab3a80ff10cc88b90e147c71e2

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
62KB

MD5
c31b594f81254b571ad3137558450376

SHA1
58a6d353121d57edda11054924a90b615732c025

SHA256
7fac5d0af414c37e0e90223b0eb9c4e57b1802a075b48e56a9e58cbb0b8aef98

SHA512
31fbc7292e598457ab492d8e3a1fc7050dea4899352cc62b8ce59acf0937b1bde157155baaf282d420dfcb174c9ba79fda0f633a4e736a7f3a41c5d0ca6bd11c

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
64KB

MD5
a71109274f1cb65177407e7f417381b3

SHA1
469b2fc00727e772a8765c545f4b7543e4910b54

SHA256
a07432ee5068f613384daf60d2defc48b8b2e688199b3e2ad393eddef4ca2914

SHA512
398f79a84c7ca70fed7499b0a589b9760c01e5897b2831224ccf2ff54c9d3c5a6b236c5618b7db02ed2d27c0b1f25a84a7ee3516e9ae51750174e7a4c91629b9

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
64KB

MD5
1fa245f960c81f2c2b8863da463dd2f2

SHA1
927a92a5a357ce374ccc06ef71bfbf60d2e7fdd8

SHA256
706fa1c42f1ed39ebfa9a6abf1dedb7a073d1bb3d1b6e4a6a2aabe14431aa29c

SHA512
f8045cd7078aa8a3c90b35eb98cfcbd9822b6018ec90d1d6811dc4673a7afba5069390e20353acb17e7d8d618688149d89e249a9f4acf4f61822f2cdf7cedde7

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
77KB

MD5
c3d7b7b39ad6b6de4b124aac112b8243

SHA1
bc7d7511d0e4868dabdabdc21b6680256f2bc572

SHA256
736a41cb8719fb2f2625e4e2cddaa9a03b0916172299f29d989a3945cbeea807

SHA512
d34ebe5378e1276ba20980ad51998d96a126cd0faff4e31ce5fa405dfaf00790d561ceff38621963e297699f0ca547980821c9ae44bb24e5d5c0d849de3495b8

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
67KB

MD5
23c39625003e52202adfe6e2ea465493

SHA1
44118b78794296a67c9166a8b3205ed6fad9a623

SHA256
6d029b7be4a13de1cca6d94e0c7b16e23414e8a7b05c0eb6bd680aff2899e1b8

SHA512
7f8638a705a3bfa13d7654c53354e5da02a6d3e458a342abc32932b2a3e31a4a858b12b495685fabb5398679cf6dec258cd4a1e1e01e3daeef937c9f7e8a4d7c

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
61KB

MD5
c8cda5bcb90ca15f1446be5d1c67f21d

SHA1
c69a55355e4de93f5bdc112f1e006ac9cea3dfef

SHA256
2c2905e7662550b2082127700d4878f7ada5a1a3ee6738cde603148d631edf6c

SHA512
bcfb98394840bd8dcd1e4ce65e6350726f6082055b9815934a117bcbd3bccb9f33734cfaa24c811b86c1130977ef515248ecff383e5c18d71fd339e0ec46cb25

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
62KB

MD5
edc3425533b425240131652a7b9c8afd

SHA1
b05632b0069216a6812acc717076613cdbf90ebe

SHA256
f3c64c4e3d4d9256e1f46cf0c408ded5d0119b8f241cc2d98b8f30a917e41830

SHA512
cb50665d21e50505b2a4cc08e52f89cc5f8ac3bce317e439c27e5860875ad57a288622de24a0365e3a8804e886f0f45f606990a26739aa9fc58c8adb5cd16fdb

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
62KB

MD5
f6a60dd07d8d74ad4740763451442670

SHA1
9fe6dcb46a2db11b8006d1962ba33708c0c55679

SHA256
03a98dacd438134d37b9a543ff1cdbe4d40e5121b580e287e9272d6c2e4e6aff

SHA512
60ba80154da852a59d4741782353d2885bf9437f475124406be5ecceb933e1f17b9fbb6fa5b5c72b240eb036b36b2742a9219afc54be03f3b5d38f55f4943ff4

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
12KB

MD5
5b7a3cd76ce32e54144493c75053f6cc

SHA1
40c5b2047c0e6fef1c71792862cefa38d86064b2

SHA256
c6e9ccbf0cd27a0778f3bc9ee234c54b167cdcd49c0660492f773c20a891bee3

SHA512
f28871bb6125c6d6a46fa0f0779cdf7b6d57295ee6ca7093af7c0849d8d42ee75974c3dfe826f731dd290303124cdd46d6f8b7b98ef2bca5355ff441bed91416

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
57KB

MD5
86c1ec0678f5410d35dbc80dc378fb3d

SHA1
e3e15b2c45ded4c3e011a3db6da5cbe67a5459c0

SHA256
c1a799c9d4a3b8aa88014a24bd35609d4a63e31954e71a6e216796a34f606557

SHA512
34a9508c1416f001102a1f2c38d11d5c3096a890f446727eb8e913383601824d916ed6bedd97b81f0ee0098588ef816b6737acfa473d16e7b8a914ec02fdbd4d

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp

Filesize
75KB

MD5
ffd62ceedf0a7b55385391e181efeedd

SHA1
cc64c8c6a8bba67801e634a61d43fbb1e02600ac

SHA256
d82ddb00b7f03ce443ea33b31ddce010d506a9c0b8e1e9afd98fc4784d732d9a

SHA512
3677432f547ba32d5cf52aefbbb4092e9d66423e91c6a4480a5091e2a624d75c966ca84b2c77b8ddb496f1b5506c5255a81cd1b93172a8229bbc44bcc6c03028

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe

Filesize
56KB

MD5
0a0a4cdad2707951ea313bdc9168aac9

SHA1
1b3f600d5b2cdf0e5ee6c3f11f27f488d4ab2856

SHA256
f1846497ba25aa87420303007466aaa8c36b305ced7785a93a1f3ce2fc8670d7

SHA512
c3a9f2a8c555190edfb76c15cd28193089657d42fb7e9dc0a1d31dbdb6d89834641587f1bfb313505df8ad1e2a0b220eac8d705616dc4bdb6c1b19f3948a643d

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
56KB

MD5
74d698869c228546cac81af10587aaa8

SHA1
3d1cc73d89d96a457a1035e346a45d156aee2b08

SHA256
f56d156fad3ae4bc63b2b29d0273462d55a41f3e963af629468a2d9942e63734

SHA512
2f975de30432420e366dc6581a309b32aef7a2cbc53c1ec303bcb457b6bea28463f78dc9318dcc3842371d0f050b7f4b27bafc6dafaefb8c42ac50bbeb72f6d1

Download Submit