ac91bd7e37580edf5f5145cc67db5982dc2b4dbf5319cbec4da30537b13f5397

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33402e79296f208694a4e07609330620N.exe
Size

87KB
MD5

33402e79296f208694a4e07609330620
SHA1

a1fea405f723a9e95e0b4ab6ad2635b1ce27afa8
SHA256

ac91bd7e37580edf5f5145cc67db5982dc2b4dbf5319cbec4da30537b13f5397
SHA512

df8b3560a6b31235ff0b1639f5c61f401b6677a97d6e9b8939eabb41b95241003b958198a73eeecea69f345e5cd6734b62891006f81182962c88ad6f00872ab5
SSDEEP

768:/7BlpQpARFbhNI/VoVy0149ADJ59ADJR7BlpQpARFbhNI/VoVy0149ADJ59ADJJ9:/7ZQpApMye7ZQpApMyqn9

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4718) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2660	_jre8.nuspec.exe
3108	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	33402e79296f208694a4e07609330620N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	33402e79296f208694a4e07609330620N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsBase.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	_jre8.nuspec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	_jre8.nuspec.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	_jre8.nuspec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp	_jre8.nuspec.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp	_jre8.nuspec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp	_jre8.nuspec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp	_jre8.nuspec.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.resources.dll.tmp	_jre8.nuspec.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp	_jre8.nuspec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXml.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	_jre8.nuspec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp	_jre8.nuspec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp	_jre8.nuspec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV.tmp	_jre8.nuspec.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp	_jre8.nuspec.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	_jre8.nuspec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp	_jre8.nuspec.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	Zombie.exe
File opened for modification	C:\Program Files\DisconnectOut.iso.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp	_jre8.nuspec.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp	_jre8.nuspec.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	_jre8.nuspec.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIACAPI.DLL.tmp	_jre8.nuspec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Input.Manipulations.resources.dll.tmp	_jre8.nuspec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	_jre8.nuspec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33402e79296f208694a4e07609330620N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_jre8.nuspec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 2660	4020	33402e79296f208694a4e07609330620N.exe	84
PID 4020 wrote to memory of 2660	4020	33402e79296f208694a4e07609330620N.exe	84
PID 4020 wrote to memory of 2660	4020	33402e79296f208694a4e07609330620N.exe	84
PID 4020 wrote to memory of 3108	4020	33402e79296f208694a4e07609330620N.exe	85
PID 4020 wrote to memory of 3108	4020	33402e79296f208694a4e07609330620N.exe	85
PID 4020 wrote to memory of 3108	4020	33402e79296f208694a4e07609330620N.exe	85

C:\Users\Admin\AppData\Local\Temp\33402e79296f208694a4e07609330620N.exe
"C:\Users\Admin\AppData\Local\Temp\33402e79296f208694a4e07609330620N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Users\Admin\AppData\Local\Temp\_jre8.nuspec.exe
  "_jre8.nuspec.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2660
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2927035347-1736702767-189270196-1000\desktop.ini.exe.tmp

Filesize
88KB

MD5
5988bfc40a2dcb8cf65d476e2f66e919

SHA1
36749c86a10c117cb123c622f6108f47fd6ac142

SHA256
292db7faf441a72e24d28aa9d31f71fcd5ea0d25e17d15a4d50f924bc5524b6b

SHA512
5a5ed178666f1cddccc90c62f328ed243cdf80ccd897e3ce72472229f3f88936d706e23d55bd12584ad149260831c9d03d5b6f5f9484072c27279ccaaa2ab7a1

Download Submit
C:\$Recycle.Bin\S-1-5-21-2927035347-1736702767-189270196-1000\desktop.ini.tmp

Filesize
46KB

MD5
7bb546b8feb97daa2b96bdec4958d833

SHA1
1a63911bfd49c84b3464713b097ba7f2c881fc0a

SHA256
4ae3d8313cea2c6cba9c0d9422d7517675d092cd0eb3df92265a79f8d96f6374

SHA512
76dfe46e1f59a8b2a9856088f465d39e4f1b6c1b8ab32e73ce3ef379909791d75018bb5bc105564abf8056b9c00cccdfbe620cbea37c1e118c312490b164d18c

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
158KB

MD5
f3c303e4d81b487acc179a85e2b2b566

SHA1
0a8ee6c0baba5e39615840f3fbf2ea7b4e6e9f20

SHA256
3ce24781ca6302b3f2c4ef5973e9da1701224aea21c4b8ba3cd376dc4d281ffc

SHA512
1ee41c36847c6f045bcf4022029b17a2b039a9cea2df00aa88955882e094c00e3daf2a6efa494fd11e45ac61d60ed1ee20d1599e38869b1462c6fd6240143571

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
5c4e173db7084f487daff4f5010ad677

SHA1
084df25df2211310d4942314aa15ff396722ae41

SHA256
5cf2b68f02d774ae87a20c828b5647f06d4f6bdbbd0f619a00870498c1f74f63

SHA512
035281a8447d531ff5e6cdfa994a35246f440e47a83fabce21aefa0dcf45ae4b947d20b9cdfe63dc8bbefa03e53056b2501f7a508a1ce19f2a1320614c2fbbf1

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
95ba5dc12f0744c79d1576643eec721a

SHA1
08b6ba9607840f7f8f6dfef5b8ddbe1fcef242c5

SHA256
f954b618355fc8fe01dc05baa32dcace6a117a6e894fdc50946ea1983337683b

SHA512
438d54a1691c7b2ff104514eeeaaf799dbfec2ed575e13478eaf4634e6d96b68246b608859a528527fc8e59ea6e9ea071425e9971cf447f90b13416507176bf3

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
590KB

MD5
a10a2610709287cc2b43809fecd308d2

SHA1
e004e9f0b84f871797ce130b664b963a00102050

SHA256
b88629d63ed0c84f8ec92c60556afeb2e2932352751a0bd6e8fb54cb3171d43f

SHA512
a37fed927306468df44b4217bc0b444f628b1149b34fa2cb41b4b917b4a7f5c8e6c145df273ca19c1833f218b68f105609708438d863ea1327b9a7f07716f576

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
234KB

MD5
4dc4197bfb3f5bdeaf68da484af0a294

SHA1
ec46df8c0a86ad8101b35eafd3be907ff6ca3e2d

SHA256
0acf5217bf6f8f18e5272affc6d34cf8f10ec49b1b7c738020f52d2af7a773b9

SHA512
3ab55365761d93ca9fb850a15108c49a84c512a93c210a78553b8c2692aa87c7d32f28263a542b2b90104687d2ef27819b46f725ef7bdbd65520a612db974211

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
976KB

MD5
89c7e47704e22c58a3edbbf053f1012e

SHA1
78a6baa74a9c4ca6601d33094e1c96e7c8c4a871

SHA256
ba7b00328b01e7b887292c07d9ab1bcec5aa2479c775e88a442056a4e76125a6

SHA512
4b06efc9e43dd049a569fcb5cd88da13dde1be0e44088117a3906b1a4ec3944568743d99b41a857cc2cf7fae3a5d1e511c421da105ce7ce1be8c57c53ab724b7

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
730KB

MD5
e6648be2b992aef943febbef96fd6e14

SHA1
643e832e462f0af6ba353dc92169bc574e190732

SHA256
d18cca078bd9f34ced8fd14a686ff2a6e3fce900775257641ddd444217ae275c

SHA512
fea3821f4c5302a3552114aa5336fb6ebf65361d79eb1aa4cf70e1d42211c60bdf9452d6f57dc950ee9ade45d70bf141d7f071e8c69e13ca2b6302aa45c75435

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
44KB

MD5
4aaf4d049ea9454e1eadaaf73afba50a

SHA1
68c190a44b4347d3b7aec1492056be28f340fde9

SHA256
16a401641db755f9d826edc91cf8c84415fbd9b47100a5680cbf80b995276a7b

SHA512
7f170fa207d171c10d713c3612c70e0c9c7e417290b4b60294879e2d6650fa6f3fc8abd49370e97479289dcfdcc3d56f6b37a761241d1f1fa6096ecb4d9adda5

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
56KB

MD5
2b17c658182b2b0354d9516b0b8e31a2

SHA1
f47ed7e9fdc5c8a7f074f8a9258c2e21bc0c2dbc

SHA256
120ab30733ade36ca3c8b0409d3a8c9f52119437356a2b574e1b25173e125b63

SHA512
1472be6dcb9ef5660f3e7974c0aba97c845516c429ac981c21fcfc1e325d0b1f4ab4dd47bbb090d66ada4d8ff14b672c36d212b7d72aa325a68ef1b903dd8393

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
53KB

MD5
a955dccc7d0682c543ee29c4496295cd

SHA1
8bd636e57c8744c431b28306b1ecae6b43e8d9b2

SHA256
0f5d8ed0d111323810c553095bb6b3eebd6d838a1ae2e2afd15dc366ce727536

SHA512
c67bff1af5535b89cc0e458a099277c338f894cc425a3eb37c6a430ff047eb6b9792389d5bf42a78ddc936a993397afbc283cef3337b03235cd33392cec49181

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
47KB

MD5
3b359d065ab5e5c7f63b68bfd7a71492

SHA1
dc7bb299d85e942ce8994325ae214127ee2ebc88

SHA256
88df7f20b37a8e0a1e46c013fab8f34259dc83f3c7280287a8f16bb2349f486e

SHA512
d6b5c1207c2066f8f7d14263855c35520215494f256d752c60e48b8660106baca2a8fec188aa93f71a8927837948d08b22b7d66a0f4d80b0268a641d0df59f2c

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
55KB

MD5
153a7c302209c936bcd26d8f0662755b

SHA1
b16bb1240b9ab8dbf77c1a84bc25a1883a580b93

SHA256
d31c402ce20f1c39f49a237d4b50e2c9e91122497717e74e137532da229a8b4b

SHA512
a9f71f6a547fd72daa6f3264bb0b7a51badb4d907dc5221c61c1f98d24d51b392336699c9c1f51c5ffa51647a64a726075b317c49c47f00975041e7bec1e4201

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
57KB

MD5
8b267effbc03a3d35612d2e88f99e161

SHA1
c3701243723aa78f12f71ab9715e7c59602ec098

SHA256
4b5ed2fbb5deb804c49f4c7c3066d9d6528938acc570ec6764c3fd09465363a7

SHA512
d89c13e0d9a61b17a7a610bef78b1dbf0fc0a491353919783c8389cdc74fbf60321d706f5ecf3ed9e3b1bd1ac015cb8a44bd0655bfc1c32ca19e6a22dc86a971

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
60KB

MD5
4504d5488df816b8aefaf08e8bf4a970

SHA1
5f123ce562f855a88742dcd1d79c1390d528bd7f

SHA256
c46637f1b80965215ce7fbd2382f93821eb9123c6c21ee339a11a35b46943778

SHA512
7fb82f15ee7c9cedf716d5c93762d7d4be191c02d9a48be19c9875e7cae87fe8d1d6bcc6e300c48a15b73f682522dbf1a70a7d810d8f1bc8bbded00ed0afc5f9

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
55KB

MD5
b285a5e765e40d924adf8192dd8b5eda

SHA1
b541a4728c7eeab1c28c2888ec2ef9f7a2c87b2b

SHA256
9d3eb73fdb5ce407c84efcdd0c1390b633d70f47c35001940d65cf8868a11cd3

SHA512
b411dd4e762fb1efa5248385c0893ddf831fdf9e17d959c433e2a15801321ee8ebf70dd40a07e00e8b45b53fbba0100762c285f68e6215b1bca6260935cfb282

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
41KB

MD5
c3f0359c23304350a414e406df61186d

SHA1
5b783a28bcf5106746325d059e8d0b746e0a1744

SHA256
22164f7c7062b449a1bbcb63747910cd163208d05666f754d57e61c7a94c38b6

SHA512
99cfd841a410c51ad37f4fb1cf111ed20c24747148e4b96bacc717685a718419d0062506029387db7d902fabe7e41fcfcd09e3e051d766354b1b695bff3991fb

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
46KB

MD5
b810fc751fe1fb50b5bf9dc9e0f518d5

SHA1
04fe541fbbb778f5bed86473338f63fdb2d72fec

SHA256
69f8efb8923138f11930d751703cc1d6d9df8047661f8ea9649d974039c3dcf3

SHA512
ad45f3d3d3c7944cb468595b1328892168214434cfcc9b6bb3f3b0f1afe6350532a4824d19de1a5dc4ccd20d9855bd29282ac259db8fcf9a1bd1608a36cde49a

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
51KB

MD5
6d81a8526aea5dee376114eb408ac901

SHA1
3ccdde9173ec7c00fa00d4bba76d057c24e004e5

SHA256
cfc0894ad0bcd511b5502c4778ca10f230537ed5a452de630a78d30bea26d250

SHA512
73885c587ea8bc9a206ecd152ab1e629a8a153b9ee21c5ace88e80594ac51264bc17604cf90c48b17e0a3f4b029df73bb40563a8f0e0ee5c0f38517ccd8bfca6

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
51KB

MD5
0789237ad4e9a04e3ec0177b9b54eb8a

SHA1
a8cbfe091c00a6edbfc87d1f6e50aabc9e355922

SHA256
754f4717391469206d7f785ccee452b08e03f72100476c72740e46ccb1f8ef9d

SHA512
849724247013554fdd8a733d867c0dab56b5ea48f774555bfdeb72eb5d932035b715bebe508f6fb688c4208c4ccb0bd6a223e96c27b43173570d76277abc658e

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
46KB

MD5
3ccd7b71d0a2781f4dcd9ca893e7f136

SHA1
c0c4abde0d1aa2bb3d2b700cb65492fa98572bec

SHA256
064a5b466e45255362d7ebd7530d299c1b9d4d330ffbe554a246db9ba3735283

SHA512
8ff1581a5aa5cdc563864dcc3a94d05a316746e2b3be16b4e723ee781a0855e0b16de89208d0b7c45667f6237aa266ef7729eb5464c98c3194f623e4e661fa30

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
55KB

MD5
30998ba14bdfec33cba3d329deaaa7b8

SHA1
0af876bf16e4687f58a75ef92cd2193fa626d0c2

SHA256
3ca0f0a34df7b7873daf2314d5c368b590bffc5b9046165a79a2a1b627f6d5da

SHA512
d5d1324f3804c749b39bfc4e255cec54869c8057b38a15886aaa455c833d56b78cab71de3c6701c2a1f4a32d3150541f0d4d2101211f6e5ac39acae7554f38a7

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
55KB

MD5
3e67fba16c0eebf273df515fd4f263af

SHA1
d524ee9dc05883a404c889f7ee7028d94a922cd7

SHA256
4a826f85ef625ca6f74a4df0e997a2f9fe05afac1f22fbbc76b22caa1b7993b7

SHA512
53d662253288acb7c016d1b4f3469ddf9880322c69e350ec435d9f2412698b14f639075e8f64a22ef6e8beccdc2d2bed7100bb6d1f2d4089a6b9793a90636b58

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
55KB

MD5
0f6e122e5a2c8d4579be16a1f8f44594

SHA1
407a46e64460d16c42100a6652ac50110111c2e5

SHA256
aba0258f1832519c42dbbc75215cad7babfd52b9d1c8a396e17a09084d85f506

SHA512
4e7ab8f631c3438d7a1de32de967b868e183e7bbabd3d7b5859e8b5e06adb95f6c93c3df8291569821a14846263efa518e3ffa21dcedc6d85ae35e14c934b2e4

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
49KB

MD5
328125f728205e32165c8fc1569c9230

SHA1
33d114468c8c7961e58756d1c37506b0392a9c56

SHA256
6ef1632bf27806d8f84e9551d8fffac6436a0864b30ed12bfbc4a316eea32775

SHA512
865bb50b4cc3f325ff5d781ae3c368ca7c7337fccefdfd73ce7fac0448c250e5b9070d357c8f2abc7e467b478227b9c87ea554223fe314e07372c2d11deea950

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
52KB

MD5
ae0db23db3f9d1855998f920ba9c0f6d

SHA1
a373456d94f410483db3992a070c17be6f6d8b5e

SHA256
da00a5111d9d848d32b57a1d89d9ecb8f3e4a0570ea23fcdfd379b18d595b878

SHA512
1baa77cdd804befa2152fa1a0d9d81bb8e5b772e61f0d76e3157a6a7a6a3ddd9ee8b4cc9125770315d4802e423c760b943ad54afd3624c676e751780ddbfdc2b

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
49KB

MD5
212a529fc77ba138ddc4b137a62faa72

SHA1
8eaf78c1c3d1b09a3889f26f5a23ce10076e3ee4

SHA256
145fc6e949b3e0b0225185a19a6dc066ba27aee64422b43c29f4d3f5b42cbde5

SHA512
9a122bc9981b8591e5b316b36895631def973c9209f30c95b6c43d6cc03cbb441c797241ddadb25aa2f8a6e6568596a8ccca3bc38b67bf34a3c55c73c19ef150

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
46KB

MD5
086afa8b5d5a01c772965db07452cef2

SHA1
4d92b0dc4f834ebdd99cffeeae3adf1b968208a7

SHA256
90d4ab5da4c21baf236c9b83090290670605c1b1610e1b45b6a7bc9936a5fd17

SHA512
01ff64b10bd89ae97f4a3ef0126b5c03fa045229297206b838d5249912d270628da3c0d1942dd66ea8e2a6063aa3df90a07193cfe4bbd7fab3ce8cb52cdcb931

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
51KB

MD5
28cfcddfdd4ce181458ea3c83156bf72

SHA1
a45d9f427116171515825b2dd708229a59230da0

SHA256
028a856f653c13afdb78db6e24777c8da057cdaae75db782f1ac840c11ac23c7

SHA512
6ad0381107f7f14b50c5b236d3812271d2220b2a0d8ab1449550456c6510f68ee6d13a869c1b7da2a3073877705fcbddd05db3f9676ab26f0f14a4030ce0304a

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
55KB

MD5
f463c7e17e67b74b468a77b086471f26

SHA1
3877006b1e4ed9e3d9e00d5ffecde404b6ff9161

SHA256
85883e41cd3a3443d360007589ffe2657dc1b7ca8391edefdb79ac7e2ca77b9f

SHA512
7d751f8934514416635d691be4bb8f6b46c9c2b36d5d32c3f48a52bd11c2534f3e24ef478823ba8b2c8a3d8883a3a5c0883f1c2acec90cae1987fdcd26ec6513

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
50KB

MD5
c75a2b5a387db4c92f2fbb8872660922

SHA1
99eb2739854f827bb710210fcabacd62e9b2e149

SHA256
7a330f47d9edec0cb48312712c0b5a31e9c597611a4826b9f4f73f508cda8d3b

SHA512
b572a777497ae844d6f62c4a947b07907fd16ee7a4c5f516d6588876adbd00187c141a94829fbc60d2378485648c89d502a33ed4ab6a796ff04e4cc81a3db4e8

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
54KB

MD5
e3d6ecff7a14edebc690a90b1662a0ee

SHA1
753c10982258c6ee3139ea87887dcf55a207a3af

SHA256
beb21bf5f2cf5732495244734c71aeed013dabfc44e124d8180291f16268bf8d

SHA512
420248b03ac881b8a753055e3ca9b3ec32ed22b611d7e454cc6637f83a36ed6206aef926873e062da1f65de836868f80f9312cea5172dd15df97b701a8047f86

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
55KB

MD5
45c675ad1413087762f460f8c63adaa3

SHA1
16cf7c0f8bad19594f9045633b34cb5becdc88cc

SHA256
83d69fd09e076c1954ae1b1a4b436812a577465920638e32c83a3be9fdeccbcd

SHA512
b58a28c9cbf4eed1b14b1f45d84b7d60715b49ebc9991f44a86df4f3ab9c377d45f3edbb4793e0e2d07d1a5080387f56345917bb7e749bab42bd952b45d5e329

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
54KB

MD5
cb452b0c119379f16271f4c19774faa2

SHA1
a4fa36166ac1584ac85df1293be098948cd6c1fa

SHA256
955d9f589a2b65821f5357e0113000edf905b8eb9e9678390ea8442574fbfcf5

SHA512
7c77c92c0e6a476663a4ca00b01317cf72c704592a09cc8d7a141f8eb1e71ed045c20dc3d9ffcf863cacdcef88b3cd7cdeb6e08cd4dc9a4c4ba0b904bb19c584

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
51KB

MD5
672ef5a5e32af4bdb245f8a1ecb4937a

SHA1
33b8f4156441a54c94ad5ceb792fbd6507e65fcc

SHA256
ed493634a23a708d435639d0777a014f1695b3cd626661f5a71e9172e3eef845

SHA512
63061263d9c0135358ab22939e461d0e1c7597e3a50f6d617ef1e604c99dd31effb43ef0e821d9dded5e7da5a210fc578d2a8c17e023825cc7a503f7ac10ddd1

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
53KB

MD5
237192e699bfee0dfe4a66d1edebbc9b

SHA1
514ede275a25fcbba77afa41b8e98907f23647ad

SHA256
cab50447ed48f77210f01d665033b3ab7e786f4bcb95c883116119b779ea15e6

SHA512
4af5c5259c72c7f7e7301f72d7a34d8718cbd9999e86fc7ecb047c6edeaf647edbd45c6eb09373b474584e27075a4f8b0f3122727a8638297568dcd850b8cb9c

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
41KB

MD5
46a78b3e3e7500c291fccc73434eadce

SHA1
8e6dffc8cf4587e81613e8eff4c758b11d2be584

SHA256
f9444c5144de97be2a079d75c1ef22c49ce8dca227ad76cfdb263ed411d9f117

SHA512
7ae1b4294a2167a3e36c71d3b74780f49b9dfffbec3be75bb5feaee0a8b0fd180f78f6911643d3bf09abf7df4c210386d2b4cf1fe334022d1c613f9e829c6672

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
54KB

MD5
ce41097c8b1da53b560ae1e13af75023

SHA1
56a4a03a201bb84829e6e186ef5b02cc9ee3b7d1

SHA256
2b234ad4de3e0017ceed3e20cdcbe03222f38368b4a05a05b1a5731e7dae566d

SHA512
c42794f5902e2ee6857235584d1ab16892827012da5c0f957bc85364a389a4d0fb48c6a5bb6888bbfa6051a619892f6f65aafa93358ec1ebecd5ed4f0248a21e

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
54KB

MD5
b04a7e0b948dca68fe6e4c27ecdd5117

SHA1
3ec5c2aef5128a96e9c40456dad025e2bec5a425

SHA256
a23c224b1ffc8d53d31bb45740d4d28bd902add6d74bd4ea6278f2600cdb3631

SHA512
7d0511cac87615e3b44ea686b3ce67a814cb5334ba634242413930baf5c23f45c3dab5704a9a11a5db8cffaf1093072c72844a7cca05c854665b839ce5fd7937

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
41KB

MD5
fd2303f8984fa430dd586542b469c734

SHA1
2850bf75456c1372f9015a39dbcc8bc582bb1110

SHA256
c21910b4c32a513d4e8b52fa5bffceeeb28a42dfbe26dd0468a0a38490ae2478

SHA512
aea01bcbde31dd598ffca60850931b388f556d85fb945bbe69147c48674e77f586b12c7aa9a8a52e6857e8cc1133ff1c852bff5daf6166546899bc38d4a1f1ec

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
67KB

MD5
f5a0d6c3db9688f68378f0eb88744fb6

SHA1
f01cc3a45c77127e7d5f2653c1e42f87840e3cb2

SHA256
b716079a8d229773c1e1480ae1997d4257072d53c7ab75c5fd20051a806828f5

SHA512
30227e2fc384132471c5c0ed29776a44623e3d007d09c1dccc7c53bbddc3d2720df70548551a9f58fbebc9c009f307ff1179a57f27311bb6f52b1e99b5d028d7

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
56KB

MD5
43a3628a13081d3fb83e1a2ab0db0a3d

SHA1
644f9cb7d35319f0097a984b850caedfc2f3a4d5

SHA256
75f5da2843778076f9e3485aa828aaa9b9151daec3ddeb0289bd78afcfcf75f5

SHA512
5a5ce314d19f5e5f47b0b20747a83ec9d0c5aca8355c8c6d1d117240add7df2bcb3e212f0cdff2b2ce285ea80276762f2d75d9ca06ba9859daf41b686258b107

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
44KB

MD5
15dda2213e40330a2979c4eb799f2000

SHA1
b81364278265cbfe5ebe58f5eb0f6601fb51f68c

SHA256
c0ee361b7df899fcf285d37515fde8999343f4115ca55aa9b7ecfbe918d55c20

SHA512
529ca510d3c4bb63c9dc2715f5c8eaeeb2b7a694c053f6f9a7987b6fb14e39744931eb5709c16179cbb3f405673853da8978b47ac0b4c68f089c5f7588f1b5fd

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
51KB

MD5
8851d98bb0d12319a52a44d124276753

SHA1
dc34cbf1174d55e4d98d91952e82739f7dd1ef85

SHA256
288b3e356b137b771f3a5ce9dad72428e3eea73f53f13055db129282748ec87f

SHA512
e17bf7aa66dd7105511e52e5b574b32e494973ff3cd0e93a6d324d5eaa050d756702bbf827391f683cc37dd19197cf93b7617958f2a0151917de3a841617a972

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
56KB

MD5
404adfde6b522c85a40ab2a565f0ca9f

SHA1
4e4b05c4d3c95e07364c0b755f15bcb5bff9dca6

SHA256
9c4de0099a0a5ae02a617d1bc5316126ed29050cfe17e9bbbef11ddd78f37dd6

SHA512
2bda0402d5c9562567222d26d64d0a9c70c3079501aec38e5f4636e5520eb21811f83eaae80dcb558025a835ad54784067b9542687bce758460742a46ed289bc

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
50KB

MD5
b77749452b759340284e1aa18dbec77a

SHA1
a08a1e8e8e40770baa531cade6f8d9a205032047

SHA256
75c1c5b2be4a752ea046c96825b6c18d8e878668659017e42bdc10f361624d3b

SHA512
845c319f3b2bd17a6f7d325a5e934bc7857f03fe4c5fcf3ebed6d30e5d46806bc959f9366fc8dedddf90a3e441d3309ff7fa0d26adaeabd1100a39946e946149

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
51KB

MD5
6ab8823a812c4b9fcc54eef9e0e7aaa5

SHA1
72b012935583b203177d335af60c223a08147fed

SHA256
e4c2dc0d3c890d75975bd20941b4156904bbcfaf73ae932f7eb27bcf64810e8d

SHA512
58fde89fb1fde82c0eef365881145ac561be7e0b7ee8312a3cc54f0801c14755d6958a73232e48dccd5f6c5c09746b8798c8b686096de5257cee77f438333928

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
53KB

MD5
983f6375064cec9a16a602391756195b

SHA1
2b3e0a93904f9d6cf9c576d29bba87931c2d204b

SHA256
42cafd5d116393eca4d353c3548d94a9a1b2d0cb9b6b4d12341a545548061ab6

SHA512
11647330a4c098669b277086c42acb07d60ec8c8bfc40358d644e350789dc8e2b41f6e07b48224a1b739fed089bac89f75cb9d74faee594fb2c2a9cad14ddf6b

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
61KB

MD5
3cc28315b23f1f4cc05619cfd6e0d2cc

SHA1
63aed3cd480bbc05cb796cc7e42e7b55812b40e5

SHA256
8c4198200c43032e060c3b6294df69d96967f6c8318974764ba2b1b2886506bb

SHA512
80ed8abc4ff697682d6ed2dadffd64fcd723475f4c8dc223697c1a5e65a92c4ef67d65396ccc2672d7920ea4d6aac7ccb6dfe6cc2ff1754c6d8ba615c971b584

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
64KB

MD5
b74196d1bd78a6da46f64e4328b11596

SHA1
50334ef6071ec7fee072eea79ce3f34519636aac

SHA256
acbe4df624cef8c5bf48ec47014d0419daf329f21249bd6919ab905ff388ce8a

SHA512
369f8d4c9f1d7b8588164998d84d496128e931a8c0d2eb2e37960cf17f55b31e3f469ee751e0e4beb233bc6dc087de2f159c58078f02033f9798cfe9f3f446fa

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
55KB

MD5
df6b52e9cbc975cd95e9fa9f563158ee

SHA1
b635169f4e910719ce8adbf335f63ff716285d57

SHA256
dce9c285c71a23b0e5624c2820dc1196172443cdffe9c43ba6f55d8ecb683e51

SHA512
a075b40448e704c59801e5925f35ccbf4823e1ff90ece4be39b0a9c3832cd8036f0c607666ad83514911abf04e73363e8714ee1773b6a8fbaa568672c1645758

Download Submit
C:\Program Files\7-Zip\Lang\sv.txt.tmp

Filesize
46KB

MD5
fe2cb79abadb4298072b6990ef0a5dab

SHA1
0373d41956364c095cba8fe230e39e490ab99474

SHA256
db425afecbfa46df01e4da31405929557a4f03573cecbd1fa49394bd9c6eadb3

SHA512
c33c6bd25de9271f9d7e13a48f2c79f69b336ab253788f53bca0d79bdd5fa2137320a97cfd2460fcf16afaa3f86d1f5173ebf301ceb67721335c9d8544cda5f6

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll.tmp

Filesize
57KB

MD5
c21d85ee03b81ec86a3e38d6b851a5cd

SHA1
4541117be8fcf12848b68e3d23bd4981578a1208

SHA256
f8ec13e5f8b6281eddb874f958b8d4eae2fdee8a62b8ed937da5556de0251c69

SHA512
5ad2cf6068892f80ee46c7331c4c5eff748973ca51339bee482aee7fef54aaf452440df18fd62259aae18132f505401e3e1f956fbc53d3e5cc9866707109d4e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_jre8.nuspec.exe

Filesize
46KB

MD5
6e0c93e0c065944aed28417f3c980bf2

SHA1
c7c58ec35010e82699c38123d8bf71429f7834ec

SHA256
7675d5bd56562b79d93274717eaed67678e8c3cb994a4434d853706adbf87049

SHA512
eb50beba0dd1a87d8890728e35fc64b769455f176b0e5a269b1ef65a841b62153d751edf792cf8a1bd09900143041ca1197c24ea06402cc6cd45e154ae9a1266

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
41KB

MD5
723d66df240850d97cb95b6e32a6ac00

SHA1
700ae10f99afc047ec1c61ff73f60bc871c34c49

SHA256
ba1978670b6e6f43cc35672c8a410d98c3a9a6f7a26a1cc686a57ae73cf5927e

SHA512
067e074bf85f99071136f9f493b3ee42a33e0d65ba1facf9682261aad33e36bc75b18cd559430413eb3aeca77401757775cf8c59d14c57ea3bfbfabe2abbe390

Download Submit
memory/2660-12-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4020-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download