38c72ebde26a44e45e15ce77b1f5f069b31190d069923212e88df653c09e5690

Analysis

max time kernel
134s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2024 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38c72ebde26a44e45e15ce77b1f5f069b31190d069923212e88df653c09e5690.exe
Size

168KB
MD5

087504cded1644c245e958341e10a92f
SHA1

a5137ff3feec5b3e0651649d5f17605d8b0f2987
SHA256

38c72ebde26a44e45e15ce77b1f5f069b31190d069923212e88df653c09e5690
SHA512

3c9722050eca59df58673f2a65053666e8c9536356f9fabda2d49946e79c8e700aaa2e45f0734d0e871ea0771cdf04896a4a417c527ecf2fc625e0832bda619d
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eBSWMe7WpMaxeb0CYJ97lEYNR73e+eBSWT:RqKvb0CYJ973e+eBS4qKvb0CYJ973e+S

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4744) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1416	Zombie.exe
4860	_.arguments.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	38c72ebde26a44e45e15ce77b1f5f069b31190d069923212e88df653c09e5690.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	38c72ebde26a44e45e15ce77b1f5f069b31190d069923212e88df653c09e5690.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\de.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe.tmp	_.arguments.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	_.arguments.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_wer.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	_.arguments.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\README.html.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp	_.arguments.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	_.arguments.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\Logo.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF.tmp	_.arguments.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp	_.arguments.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp	_.arguments.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	_.arguments.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp	_.arguments.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp	_.arguments.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38c72ebde26a44e45e15ce77b1f5f069b31190d069923212e88df653c09e5690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_.arguments.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 1416	3564	38c72ebde26a44e45e15ce77b1f5f069b31190d069923212e88df653c09e5690.exe	82
PID 3564 wrote to memory of 1416	3564	38c72ebde26a44e45e15ce77b1f5f069b31190d069923212e88df653c09e5690.exe	82
PID 3564 wrote to memory of 1416	3564	38c72ebde26a44e45e15ce77b1f5f069b31190d069923212e88df653c09e5690.exe	82
PID 3564 wrote to memory of 4860	3564	38c72ebde26a44e45e15ce77b1f5f069b31190d069923212e88df653c09e5690.exe	83
PID 3564 wrote to memory of 4860	3564	38c72ebde26a44e45e15ce77b1f5f069b31190d069923212e88df653c09e5690.exe	83
PID 3564 wrote to memory of 4860	3564	38c72ebde26a44e45e15ce77b1f5f069b31190d069923212e88df653c09e5690.exe	83

C:\Users\Admin\AppData\Local\Temp\38c72ebde26a44e45e15ce77b1f5f069b31190d069923212e88df653c09e5690.exe
"C:\Users\Admin\AppData\Local\Temp\38c72ebde26a44e45e15ce77b1f5f069b31190d069923212e88df653c09e5690.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1416
- C:\Users\Admin\AppData\Local\Temp\_.arguments.exe
  "_.arguments.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-945322488-2060912225-3527527000-1000\desktop.ini.tmp

Filesize
84KB

MD5
acfb276c74cc90a0025ca656c3d3be98

SHA1
fbd89da4f9bd81580399738d8c53faa863c84763

SHA256
5af878934a6022e8c460084501063e6da3dee03e95007707a3fd49e7ea212b7f

SHA512
b0b56c76f81d227311fa0151366784ef81180a008a01392dbf91f5bee3f7696c99cffc9ec610b614909922de8dd70ee7b43cec3642eedb73939152ed9bc97b50

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
197KB

MD5
4e44e9f75b31550ee996198a48a282c4

SHA1
e73b873554d12cd4646157cba06c6d729a553b4e

SHA256
5dd542d2d573d1407353238a52b84916daaf15433dbbd9a164eb46da04e4008b

SHA512
6a94972027d7943064ecee4b8bc3ad7bc7bfac0a202c405c9230765b0a6f139f40cf415d0b9f41fe7220f50d40127a2943d99aceaae4f444c5da62d02a4fa8aa

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
183KB

MD5
524dd68ec458c1ce6f3a01dca1a00a69

SHA1
24af49971e196cc92af48f51b012b56d081c0d30

SHA256
c9693c35042158e345f62f39b11c5cdfc8c6f4ea78f4fa88b3ec9d9eeada50fa

SHA512
3a1ee9553eace398841b922f22ee63e256de36f7ef51eb0ac5f88ef9a1c8b67e26e9871bcc36d7ea8dc19427d3654efb03b335f66dee5ae23a97b28546004713

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.3MB

MD5
1a72f58039d61c1b0d97b294d3917088

SHA1
e00562093f0c3ebf9f278d8a3f3053547e560bc7

SHA256
bc48dc49a58f0d8e280353ab08b6a92547afe151a0d2f523ad9d6a4bc77182d7

SHA512
60deafa8d0a95725c968a0f93d0970f3fd82d542805987844524afb53598c8488fce179132d7cd79bb8505bd25d503a9b30033b0a6d1c48508ae9e6075d4aeea

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
38f403634495dfbbb6546ef63b6771e5

SHA1
4a7170e85d414a68090d19f2353665aaf0a23766

SHA256
ea6e79431d72ac75caeae0c860b3c673b4f1f6a32f2ffe12481d05b9a1c0bf3c

SHA512
5396068c6e2a98b4aaf089d5658011a93ed883852cfa0db2a966e354c3affed5b8c2021506c802a2afc1f2582541d61b3c3199ad2052936bc84faf624155bc7c

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
628KB

MD5
22845f8e2615037e6186b22a13c36208

SHA1
4ba82600f624c442c3724462e79479d66af79795

SHA256
90fecbf9a13b5ce29d1885073667811363314b4e716995e287273f12de376c7c

SHA512
ab91ef32650502fafa73744d974a36b38d5b928b3053534e3a33131cb90da290389241547818a37376cadac9222b7f13650dbd4955351d74141d1f8738a77664

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
273KB

MD5
25c8a048dcc3ffe8ec185e8e9ebdfa79

SHA1
243bfe98a510ccf3d33ce97ee9110f9cc4fff19f

SHA256
fcbddda48dab2513beba07eb4cac0ca356ea965a88cd9a07d17a01fc2f5568a8

SHA512
896675dff061d37bebce3903c9a81c60fc9dd3d424887169e7e5c8dc10bc150bde0c8a5614dea4986b4451fee24389306097be48416e3ce30f1f1bbac585db8d

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
93KB

MD5
2ae8f7c04c2c8391fc366a40e65d8391

SHA1
480644f5abca5281605602e11a43d4813660745c

SHA256
c23514589017855663a287647c6124ff9393e4915a7e0256b685d2434d5cd517

SHA512
3553e0bcd67a5a2fdb6b1d5e63437e7755ded42fb5786f75e4977d6ebac66dbed8907560872546e28905b38f4f3b9d0707024215e1b5677de41994fbd6ec6be4

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
97KB

MD5
d13f19e56aa16538c1bf413b358ae99f

SHA1
46ab7f79f3fe3508e6e1dab978741569d55463de

SHA256
38204789f2f0cfc130400f23083a0e40ab3addcf51ce308b72af922da4e2f689

SHA512
ef525a8480a43ebc74d2c01506ac99e4b798a5724129f04f8d356abb38e983d9743e3251cb4c1619b8836be26700fc0f87a3b31ce3a956e191c7b779ea77842a

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
90KB

MD5
97ad04f714520883a680f46a0e31d453

SHA1
6b988a0209bfcdabd9bec14ae353d265239ac933

SHA256
91f49df3fbb343b6b3c6e8a6c34ee222e676ed380603c1b0836b6f991c16d608

SHA512
9e5fd7b26f4d840538573e0f2ddb11da0edd39d924011b61d929bb5d7b7feb6fda18d306dd1b1b6372a05d26198af4f4dbbf6af6edd73797c02b634d707a7c52

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
94KB

MD5
bd6dcbf1346dc2ea5950c2a99b6903aa

SHA1
a070c340cd7cab15cfaa6081c6ba17d17947e5e9

SHA256
4f58f55ea416e618af1a3434f8c7d4ef610265569eafac8a3e4d1f7917c70f8a

SHA512
d1a15d8bb6791138a91645d4850f34250ef4e6faa714ad8d4fd32b55f151e45f2cb58d79bd019813e7778c7469d19554d1f7067ae484b05e8147d5834faf4d0b

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
95KB

MD5
ea0a9932b419e8c0fda9ba35c476b317

SHA1
3c97ac37deee6c0dbd0949fc26b8076f91254392

SHA256
ae9f5e8bfcd303b1ce0eeb236a275cc74f22229bed3a3a63556f15055393e344

SHA512
4198bf8e259391a010bcfe885d4906b14b2591a228be452097c128b1e53abd0d11d760594ef62d5c1c5e8e91e37bca5ab2d3576fe7fc56b4f91ca122ea97d2d2

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
84KB

MD5
3bed425a6c8f1f843e7cbc8cdbb16e19

SHA1
ed2d770fc364026ac42d0a3c801d08a0030490c0

SHA256
9fa4191104c9a1165c1043eb0b70a1ad38ff828384454f1a45bd039e4087758d

SHA512
dff72d6e7abeca052b83340179f66849f7d4317e87ab873e9b879b7004b2e90c9397b6f84cb9af09cdcabdf538efdf207f7e31053500de644aeade6693e20426

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
90KB

MD5
4a2716cc75a7a60f882f726f619dd10b

SHA1
f1ebd66e6f9fc5a3094dc2ec60dc93bd16675569

SHA256
a5a74ded35845c2f83bbb6a43752da0ca9d7e1ef898f1db0e6609e4f0830f89a

SHA512
cc024e6f1070906c5c09c6d66a523e76c441f6ebf14fbbbc228067624959b8055d7cf9b8eb62bc5697ce654b8bf6afa363350b30ff832be55d74ed1c56864fc1

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
93KB

MD5
eb73b5701b462f4648c9ed65ed29750b

SHA1
19f1cc885820d9db2330f973f215099a669bedaf

SHA256
bbe6cf12922f94c5512579282b067a510d86c0e2400ac7bd26be03dad337d102

SHA512
d0a46c0a6b760b20fbaf4deb41e5209a567c21b6567e8f73a37233dac535fa8386b4e024a14e1d4ba5d214985a793211319b7563e5296c737540f543576b718d

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
94KB

MD5
697889fc0fedb349ec2ebed13cf3e0c3

SHA1
4d09e6759de972b0aaf4e7195e1b0f650bfc86cf

SHA256
8021c22b52f93089f41c6101c9278d9962515ff1d343e3df9d5b18477686e09b

SHA512
87937c9221bcf1cf42b63d2ff787d34ca75fe4877680e9d2bd0cfdd94bc678a5ba2f216d508f32dd65db77f1d04eb13f468ccabe070a4a06ac2fb5e64012bb0d

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
92KB

MD5
b7e3769885b601db0ceb98ebfc1f57d3

SHA1
38ab49896f037a4cf0041b454b266a7f85df0def

SHA256
e90eea713c102150d494e473d68abc5876fc9919707b8eb0c9cf7948481eeb07

SHA512
32e25fb343752f5e73b1953295af8ef5c1a0bde02f2f12268724642eb10bdd037c3b4db63c4d8f5a3ed3f6844fc5a9b1c6e08b5b08fd0b27d101219412d4b1c6

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
100KB

MD5
56629aad9c877a279883267d4659dd88

SHA1
f4b7f16b26c306387b27f51680f4fc25b2b9ec50

SHA256
5d894119f0c267ab20a8f3dd37614955277fd2f8f5c3421d1f1fc8807eb0fae3

SHA512
63ecdf057b7e6168860ad27968cf1ce5b6dd99b460c2c75e271dc7f3c5d15a5c0d2d516bfd7179e8365d0d36809016f52fdc0de3d31590083993ded22762fa93

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
91KB

MD5
760ec2b8cee08f981ab1812cd237b28f

SHA1
9734ec48bec3a884319199c8eb864891c9efa192

SHA256
af6b61b646060a85d1b7f8b6470b9ebb0560a49035ea302f4c4fe2d21afaa811

SHA512
e60ba5669dc4ed456d47d06ebb917d0b5782933045b4719450cce05bfdf8764cecf22bb506933d0be61a20863dad96c05e780de5799ede7a52db350e546db8fa

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
89KB

MD5
c1323c77e37c0f5e9d42ad53de3c9a75

SHA1
25148743d8a562dfbf7e0439b969be4ff7d8d72d

SHA256
1783529f96d49ca34643dfa44698c6bd94234ec200b0fff6a15e5ac39e2630a1

SHA512
f5a36122bdca553d71536836840e5db0e873d6ce88e9de9a1c869f84c99bdb942de00043c9468ba082ee2ffe9a3da3a55f5bd999b101c9479a493cf7c28e6a2c

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
90KB

MD5
f491e8f347f00da30c00e20379b1f7ac

SHA1
a23f50998ad5c7879f5ae3ed478e18debe681f1a

SHA256
2ac4fdaf18371f37bd3105667d4d720d667c0a42d2606213a82a2d0398dc26e0

SHA512
d0320a02f74048db08211d24bee0085bc72526f1982e3cfca8a18ad76de02a0e344df4830b800e472d65864e8fe9ca7557b0a31c20e814f253c76699c24ec90c

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
92KB

MD5
b1bafee9206eb241627349bbae1983af

SHA1
ed67b23cb7cf17c022c607c2ce5a6518a00a8e6c

SHA256
6bb7f1db9e286ea16feccd25f67b9323090f07d4f3c51bc1757459c46b2590a9

SHA512
88aa0532650c23b23db1dbcfb7c9687c7dc224fe20f6a4a876f570edc9d5db09a490a1454e0ad6172f7d41f55fb7114671e77a1a397106b34e9e893c9c8e15de

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
92KB

MD5
4de968e93fe45fd80cc329f449a51096

SHA1
1f586044ba2477f7622591445d4b7b8f638f6d2d

SHA256
1424f08e5b8cab1a8e590451d98f0d4ebdb1f018e62049aa7300c8027826e8e1

SHA512
1374aad16cf0005d7f70283e493b496ed7c9fb28419ed9d83c9335798fa3b109e8ca38b98e61431657cab85cf2487e28b73c2e6df45b2ba2d221d8cfe4766427

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
97KB

MD5
a238e935825534e5e4867b65d20391b6

SHA1
835b98f1a823f8b90472c9c5ffc18cca437dd4a0

SHA256
7d6a50892112c4f26bc53fddd41dfc9699faa18a48fe6aaeb4ec0c0a3aae0dc3

SHA512
08335da9b5ad8814f2c58f57eb09727cd92284f8f267ab5762ae8200d6774f726adef475457e77f11c28849b04132f672a3b21866a6ac9261bf6a1ecc5b83bf2

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
94KB

MD5
7796a32a60079ad72d96b8e1072bf132

SHA1
460db7d54a33570b5ff1f330ab8a86fef9e5d8ca

SHA256
0c7945fc081ea19c3abc87d3038b45124cd3ffb3858aabef8d6ec3f3d36aaccf

SHA512
d2e12db66f13cc525b71cdbd680d8673d4b2744a96ee89e1de07c6a2a0006328c340030c9f525a6e966bbc5bed225d18652e02eb40ad072f85472e057c1ed175

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
92KB

MD5
2aebc3f4601406921fc8564b1700643f

SHA1
1d9fd7bc65b893f6a939cd151b929dc1804d3a67

SHA256
424376f04434eef20a2bd5dc5f60b12ca4c18c372626c429d0df0127b45af3c1

SHA512
bf6a30bcdff5955e03b4b07b335701ab35ce09d15fa78b15cf58deebc5819b1c1137c6acfefa28eacc15b6df2519fd282d3f82d01314464c8f36e960c5cf9bb4

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
90KB

MD5
5fe1cac9eee9920e4244a736f73efde3

SHA1
e521cd13d6f5aa9a7e178f366abb37ff1481f313

SHA256
b236405e1dc7804751a0c92033ba16f13b22677159f4c9b1c9436aee68aa8677

SHA512
941fa4ef4a2b2501a57e56fb7d46e0769d2257da24d2baeacb92aee05275489b87b451f99e64e73088828cc085a5e3d44928484607a595bc49dc76deb96be8a8

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
94KB

MD5
b53d7a27d8be6026a2162db3f1c8655b

SHA1
880f713668669fd40a4be5dad08fea56f9beea87

SHA256
1c91c4fe9f18b9d9dc938cb775d0c2bb4516e48e872cbce391902a4ddaff4ec8

SHA512
d7a4dd2d48e7f3d0f0d4d2c820640b4343fe8e4cd6b472a7aaf75885f6a7cada60e3b43c0127302886f95ec5de5abdbf09bd93cce98fb1a0e02319f463d8a22d

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
102KB

MD5
1dc82264609e7957b416765a232ce971

SHA1
6172ca7fb4137a1127a4bdb720b9fbc54271b49e

SHA256
984436f739dc0b1599ed790da8b1da0ac69d9ea41a0424d2b3d6ca33086d9a90

SHA512
18a7b8771770b0eeb0a689c113a27d483c047b9d04dfd7d4d058dd5fdb03cfb68b940c62149303284f11b18b46b077f0c6fa1fcd888d5f17498902876456df0b

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
96KB

MD5
adc965c4042498d088a269b6a4ad95e6

SHA1
5f1a246361a15c214c9f2730f64ae7fa0b268295

SHA256
2fba4fde32bbccdde67fe7a8ff28c5bed9e31f9d53670a53c6f1c209106b5384

SHA512
56167bf51cd68d45a5579bfc66420a4b2a2c4cc5679400ed2d2abfe8cd71878759a54ab609ff679e717432ac672bf0b0b6f94eeea8189695101add55b05a621b

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
84KB

MD5
8b711993cd4323d72987f523d4706e3f

SHA1
a45a08e2205a8bdb2dfe3d6ced8020d0936b23cc

SHA256
18e6b5447db7d72eee36a901ca2bdd2017c1eca45170dc6a8f1025d56ddf230b

SHA512
de507f3b0a2ae44689333a0f5ef44a0da004b09f8850837ed597f43181775bd8bf24b2489eca46b368f1e92710aceadcb14c61323c887b3d5f65cbd2439f8a6c

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
94KB

MD5
243aed06aa96fbc38a57199f172bacac

SHA1
c1dd22a91756633eaaecdde2b0347b48af8f925d

SHA256
971923a4fae58daef909004376dc50a087b55b2f8c080ef0ef51314033022192

SHA512
f2810af3961e4ac479eb8c5a06bab22f403bdf1fdba8e89722b9661f3e8fcf39fe5698fade1dcdead58f2f4072b7f740ad16536d5890e36a6dfb30470b9b036d

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
98KB

MD5
8056f0b8375126a34ab012f84f0c6590

SHA1
b486339439a13e0686a4d4280d2cddf5c1c772b2

SHA256
cb2069945b60facd3fb9229700227e2679939d0ce085dd090a177a123f93eac8

SHA512
efeab58867d05701cc5fa7cfee87940e873d9b4745d3d107ba7648de1f89997ef4ca5406ebbe677d88a60b77755fdca3eb04b52f143cec0363350c668ec3629d

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
84KB

MD5
8330755f0a158b4b572fcb0b511eb780

SHA1
febd9757b7de2dff1f3a3c68b8eb043df87a1ba8

SHA256
279304f796d79fdb98d4f5d1c9bcc29d1365ebd249955a79349ad23abb2c19bc

SHA512
debd4f0584618d453e58e53a4b9efaf33427ec1af7f4ba026f53a52bec64be8cdc78692cfd2a9de5b934c9421461510132ffcb9aa736cbf5078fe38ffaa7c08b

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
93KB

MD5
d9a62dccb23508846d5273124d120c4c

SHA1
cc1e687122d9626befafe054f6a86bb97a1c4ad5

SHA256
231708426c2ef297a95e4992db032d94912169e29b301b8261b199a11b363ac4

SHA512
74bc4048acef9430b3d97e733407f36401215165aaa98015473e522ee4d5eef5a6a0b925ed8d3a92a7dc7aef75315c8560b96e6eb54dac96934aa9c0335c5ed3

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
96KB

MD5
3a0b78a697394015a4828f517a14de58

SHA1
f0e41bf7767ad45bd28a47c27d65bf38b4f50e05

SHA256
843d429287cff88e835051fa89e2a39c991ddf5e19379557c048caf7ecfa2c7f

SHA512
f6d216b6fb8bbe9e8782f195677e43f07febe514de4ce24cb9c7e397073d14300ffaa125b69e70b57dd3fc49563f202fd61f2fc43334d4bad9368dbb6358ee66

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
102KB

MD5
29b19922921a7dbb34f0c133138f85fd

SHA1
c7dd4235f0affe674e773b7793674cbfb568661c

SHA256
612e09d19c7d51fc7043cd2426f438cdf2840929f011404c1b74586d9f321f8c

SHA512
22288caa19da69d5727a38ac10077c1f75576c296992aca64583355d80fe20f8abc3d1f18727789a26b74bd3eee297c46569180bc6f7c9ae6c635ba7ff796b7f

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
92KB

MD5
3a2a5009d5d0561eafe5b0aedc8ecc6d

SHA1
73283dd3b9d37e5df7795b835eda0cb183b39f1c

SHA256
d9b75613d4a4d1bcbb3a03e8e0132ce48f12aea33e4808afc2d15edaf58d919a

SHA512
25b530683c3d1132cf76a10ae6d8b7d8b1126f66cdf77faaff38ccffffb9fcceabcb9db31fbe7c7a884b2beef53105fcb7c9fabb9ddf62e81d94a95e2b550828

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
93KB

MD5
0d65d58f9771b8c88ba737d927e885c5

SHA1
53449e76fe01a061d35f5e6a206920dfe0233c6c

SHA256
754b96a1b77194f2638c09db723650508732e4c349f59ba1fa8177b359c482e6

SHA512
375d5c5cc0bb58b910056ce89e9b8c1fcc2ec635ced6e2b2b07cdbefacf741f47f619d3ea4bc38a2fe086f5f72e6861b143c519851886a5c407373704286f29e

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
94KB

MD5
1de98e6c25b26f26272273f08f6a3b3e

SHA1
0c24ae345de30e886a0243f7bfcde1a6f55aaa9c

SHA256
6c295205931445f562cdb5f041318f5892f7e34e5f4a68e52a047ee8156df8fe

SHA512
1da4fb2e53f9bc18f418f3286a2235b629420ea5b13bcfadf048d496bbff6b8896f2a991c2de9d32d4e34d94745ba0fd0a3b0d0f0c99c3fff671294f03ae363c

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
96KB

MD5
a8dc5361bc850adf8b30b447ae1f78af

SHA1
25de94fd979868af23b016a2b09746098328c832

SHA256
6507678904fd64f319369600acae714b6e8e0f02708cf7c6ab40191138ddae5c

SHA512
6d42c4bbfbfe7a4de37bf8dcb570185ca43351e9021e6c9fca15f6b789b5db59c47c9e062a08cbb0d55abb5a53c52d7371427bd10df895b19e731582879cfe93

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
90KB

MD5
5fc9e1d177611a6b8263972af5ab6f7e

SHA1
c6f4ff52596ed48491fc0816313f701e83b081b5

SHA256
a06d0d21ecbbfeae83feaf2e48cd63255fd7c70798bdadacca0dcb77cdf4b36a

SHA512
f3e845e0b1fbb0137a7de6ee110863d6311b60ffcc88cdf2e36d473ec96308e0f05530efae15f502dbf05a8e462ed2cb3fb0073450acd64847574af034fdb549

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
97KB

MD5
05e65513cb08e7d323427fff5685eba4

SHA1
20c42857d7a13555af165d23289fc3534219dc9f

SHA256
d957b305854f2dcf1accc4395d2fec20fa9d055bb2c77e5578ba70d7aabd7683

SHA512
44ae8831117be2a4c2d00abb2b4712e3bb5343c7372ffc461a60cc85aabbc14a54fadfb99da4087a76ab493ee30141f0c7d9df4557b272e6b03bb20aa5068a97

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
91KB

MD5
992b0e6a323463a275d6b42c2b685ea5

SHA1
11c6332d65146f7aed3f6cc1ba5c35140b3feec7

SHA256
b0a56e58894e2cd22d3764e1184ed6f0ab4feaba8ba4b07913e028081b6aef79

SHA512
d857118541fe9310ee1c91d7b024b9b77f173f6f5c461648b16386c51b90da84a07debb870c0e420003465c3a22192df39246b318759a0358e981bba4645c6fe

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
93KB

MD5
85841c9b77d1858e559748af81ec6633

SHA1
522774a451a63171469fa7899f8456a4fb3c99b0

SHA256
ff591eb2f4ba5eba7014911131750e69e44c134a1f736775c81caec0575cf0be

SHA512
a050e572466285d5b4d9b5a509c1848c254e6ec089f9fc3172984ae4b84e4af8d7fdcca6eb6587fa25a1654d0d426e65f84b0d219e35c2b3d614ce2e72456909

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
89KB

MD5
50f9feacbced51ed3420634fa9777b43

SHA1
473defa4c82eb44e9cb59b56a6f42ba1256440d3

SHA256
14ba34cddebd8d3bca9e5790bdb8bb1d902399a3b940c5fc78b056fbea326a37

SHA512
8a7cbf3c356f1f7daa2c101fec321f6e49c0323f81da0b97e03afc5525e5a9c239781a9e3963854d8fdc1c0941284ccc953a557f16ea54c23576b5fbd2956a50

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
104KB

MD5
5f45f20da06fcb42eebda1f39ac6f999

SHA1
76aa82a3ac724f7f60ba206f9c6695e15c60b082

SHA256
7b14fbbbf8a6adcaea6b06c37a31273348b95558ad751182433f81541d18ccb7

SHA512
e1c4025b04361f78668aca5e9006e86fe85e832d4e68fa355f7931578112db4f21e9a142b64603d8a2b9ed2cb013a75a39c250bc97cbe0a10cd2d5a8a1eabe27

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
105KB

MD5
2b3d3a22c971fd14f70afb7bf74a5d84

SHA1
f23bc904299af17c3dd6c92c132ac25fd90b2b0f

SHA256
06f76350b87463e2b7a8664f1a18816d6da7c661b3707bf2a65ccc9dc6642e28

SHA512
85656c98b767299b52162b500418c58e1f4a3eccd34274e474e35ce8fa0d794beec2f7a88d85b096604e2802844766f22b59d3841519095c321ce42eb7cda937

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
95KB

MD5
13465e7dbde1c6b509e0198949451f54

SHA1
f553f24a7230070429547350e2b048f044e54997

SHA256
9ecebecc89d12274692e5a42cc53f45cbe00c479ec1e2b4b1382fb2f2abfc6ee

SHA512
27e5cd27c9d69c5c259d0cbd54ad36de1cdd6e954d2b5f49ea9f78cbb1116dca7b6d984d6f2058c088b78fb07312c228398fc7802fab7d1839dbadff5a177906

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
89KB

MD5
d2b8c3809803b489d14aaa4c6dbfc7d8

SHA1
adb3acb873d71f47420dd6f6c520dd153e877cc0

SHA256
90159957b5f260cc7d3dc4875a8abd3b88da98ba05d98e9de2fd9f7d89a40699

SHA512
ef5a047a561e65233392265832c25a8fa253d4f5a31a34ada9ad73cc79166f614533e99916697d9de325b4008fdd9024e5e956bc4187e8949b704497f3b4c9ce

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
90KB

MD5
83d9bc3d080ddb21aa780847acbbbb2f

SHA1
359efcb96e8ec6349a9351f8956bd3bad75129c5

SHA256
96f9afce10cece97b56e3e7c0aea37816759cada9ac83f97c967b49ac69f7aee

SHA512
fe089baef2fd5310eac3ff1023b01e6d86baa2990604ee9d52bc6099b8e304dab3d96fedb036396800979b7fdb2a320567c3e656104c2a2587f2fb1c7e951028

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
94KB

MD5
9bc46325ac4e84217cf11f2d3dd54cbc

SHA1
64e2b4161cd6634642814c6d3a11e6ea31c4809e

SHA256
aa8439fb092f7a886d8e66e8cb10eac2527b922190ae4d336abce7ee4957377e

SHA512
e82e06c0aa1e0803e73fba4874b3c1c9c2a6b60e4c79864c4093a6ede670ab7f7a7c86ee9e87a7c8085643f9588f267c6d8ecdd23ee91844fbe0a6a4c8472a6c

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
89KB

MD5
d3d730da6e3e07b4388851824a31e1c9

SHA1
41b7ab09395c4aabfc67e46eed14cf544b5cbd21

SHA256
43bfe22726f685fa4a944c1ff8efb8cbd57744042fb4da7e12f50ce180f42327

SHA512
0eee26cf32b20adddc55ea5eb0e28c17d5fed20fa8c3f2fb7b5f6e00884f8c0bc6b9669ffddf2d8b97cb72b42ef6f0c47039067e00d8cc4ef03b5d86d07ec6ae

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
98KB

MD5
eb3045de550d865cebba6c10dabcb4e7

SHA1
f2403f5575d30474a52befed63cc50ddde8954cc

SHA256
8acb077e59deab6313af727bf0e6b8b6a669ea623b8e1bb0a2125e9709d37613

SHA512
84bb761e38c34ae1ee9ae733610c3bc836e904cff86971c08f4ad7e2875fc3b66e16a1015845d17f0a9b58bf94827c54ec5c568f27045f795e6c9596a2973b67

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
93KB

MD5
9f39d7fd7be06ba60629124ba65d9a20

SHA1
03c328af178d0e9181b4406443683c0881ef4b1c

SHA256
2e7540bb6b81bd1a28b688e56ec16784759058f675b7321b7552c27fd103e910

SHA512
c2e170ea5ab27f8e13919cfebc8c269fbb609510b4331905abd72e4ab80cae9821fa314af34fe905ba75d42e9504a2df15bd40584b124bd4fc804ff75c71dcf0

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
94KB

MD5
12a5f95afcdf3ca4dfa898db2260cba3

SHA1
eb1102b8ea65452f9b4f1cc4b1d26f8fa99cc429

SHA256
8e66b6981568a902b10a190b86fbfe67e1215aacf5469eaa873f6f91f62c060d

SHA512
0ab66b64bb46729f0cc0307dcbeb0a84225cfbfe430f8b7ac87bbe509ecd3497406384f7c49f4455b77eafb23b847068a69042086eaab0daa4cfef6f3ccb8e84

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
94KB

MD5
b590583fca626feff70176a62c9e1067

SHA1
5d7435267ce70ca015cc60b6054f566979726eff

SHA256
1ddaec4cc8ec37e9cb1fe010a09f3abbd9e989ac505d56f9af0a78cdcb64759a

SHA512
dadab342abed20d37cb846f2f6ffe54293c841e97ecc22c7c0d6130501f9169141cb59f129a78792cde60f20eec25d1ee2b55f96eff0fd90e50851084094e84e

Download Submit
C:\Program Files\7-Zip\Lang\th.txt.tmp

Filesize
100KB

MD5
5b3d28faebd36787d1c6477a58e6a645

SHA1
d8ebb6b23425e7a33caa6fa1bb814c36c2fd5653

SHA256
36fcd9d3bc99f532f13d4dc43df7b701c0eb772bca7b2f028ccfb274e18a70e0

SHA512
fee063145e3b20269f60090953f524b665a071afeb9c784fb8bdde0597a896565a34c6a67ae2e5fec5b062c19b61bbdccb5c49d9e5e0d03866635abe09671170

Download Submit
C:\Users\Admin\AppData\Local\Temp\_.arguments.exe

Filesize
84KB

MD5
bef1f54a512a62d0f91006dff684fde8

SHA1
2cfa7e2b2168028e238986d3f369bd7b7cd4a487

SHA256
77961abfe0497927867ef0e9bbbab39f2d69b7e2855d6ea0d4f656c8186f4e71

SHA512
8d6ad8b4e3e76ccddc6677444dc4c34abe2ba65a5fa1868b0f2bd0930667521fa7b9ec6008c2510a69b1772b318d77c4c2114f9571835fb77997d2eb7c290479

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
84KB

MD5
728e10f02094debfab0a6d542752411c

SHA1
ce062a51eeebcc76c3377224016b185ece3a7738

SHA256
040c9d5fb66034566f0e0b2e5a4243e225e38b5ec9a5db65f5d64c52cf33e993

SHA512
1b1419fecd615bc08821ac25dbbdce3fc3a585eb7c9fc5e5db6659522f883e88d27213124b973e7c9db666c9190c6bfedf734a3bf439319ba6ca09b109966b8c

Download Submit