b82b62fd240b17a2dd1001816f3994a54589529a4884b5f7b1a22bb44a9b7b34

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d92d4a94159e9ec8483b9406ec311c0N.exe
Size

168KB
MD5

4d92d4a94159e9ec8483b9406ec311c0
SHA1

2130be418fc157ea2d1eb3a725b5656eeccb2401
SHA256

b82b62fd240b17a2dd1001816f3994a54589529a4884b5f7b1a22bb44a9b7b34
SHA512

e556af14bd328622e72b63fb405b552ab4febefdb58d255e164817434cfd1680aee07eeb90226c083a3faf9f840150bf1443dbec940f019574f9ac90002d9108
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eBSWSe7WpMaxeb0CYJ97lEYNR73e+eBSWp:RqKvb0CYJ973e+eBSeqKvb0CYJ973e+I

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4373) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4596	_MS.OIS.12.1033.hxn.exe
2236	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	4d92d4a94159e9ec8483b9406ec311c0N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	4d92d4a94159e9ec8483b9406ec311c0N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp	_MS.OIS.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationCore.resources.dll.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	_MS.OIS.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp	_MS.OIS.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp	_MS.OIS.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\sr.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ul-oob.xrm-ms.tmp	_MS.OIS.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp	_MS.OIS.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcr120.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp	_MS.OIS.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp	_MS.OIS.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp	_MS.OIS.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms.tmp	_MS.OIS.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp	_MS.OIS.12.1033.hxn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	_MS.OIS.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp	_MS.OIS.12.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp	_MS.OIS.12.1033.hxn.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d92d4a94159e9ec8483b9406ec311c0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_MS.OIS.12.1033.hxn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 4596	2832	4d92d4a94159e9ec8483b9406ec311c0N.exe	81
PID 2832 wrote to memory of 4596	2832	4d92d4a94159e9ec8483b9406ec311c0N.exe	81
PID 2832 wrote to memory of 4596	2832	4d92d4a94159e9ec8483b9406ec311c0N.exe	81
PID 2832 wrote to memory of 2236	2832	4d92d4a94159e9ec8483b9406ec311c0N.exe	82
PID 2832 wrote to memory of 2236	2832	4d92d4a94159e9ec8483b9406ec311c0N.exe	82
PID 2832 wrote to memory of 2236	2832	4d92d4a94159e9ec8483b9406ec311c0N.exe	82

C:\Users\Admin\AppData\Local\Temp\4d92d4a94159e9ec8483b9406ec311c0N.exe
"C:\Users\Admin\AppData\Local\Temp\4d92d4a94159e9ec8483b9406ec311c0N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Users\Admin\AppData\Local\Temp\_MS.OIS.12.1033.hxn.exe
  "_MS.OIS.12.1033.hxn.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4596
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

Filesize
85KB

MD5
84d0c2cce7415598952b1f7991038c58

SHA1
7636bb860f37f06556c1c0bb9ac5052fbc1b5d57

SHA256
dc90b2aa41ce237e30f2847beca82337427d4e3bfdc404e7902e2a34fdc2872d

SHA512
01d8c903c82fa0056d42dbf9edd73e613fe82842320958641cec7471387f3d64728f1b723234663c4a4c57adf16d08d286e903570e3d85c01391803cc4e4ee1d

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
197KB

MD5
11914cab41b877b0e7affed286a14d9e

SHA1
143c7ac20b445862bdd5db9254edb287688849fa

SHA256
627a58adfddb7b08bc56ff330e0b3fc23578fd99e0da0b9bde50eac3f337106b

SHA512
0c5a951af8b59dbdfb466db046a5cbec4cab892c75727c455868a01cdfc8acda7a5f23551b895e4c6385c0fde9076fc4294d4b0c6e4b1447b66e8da8c32d7b50

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
183KB

MD5
8af8bbf0d2a41a7b5c7d513fae081e7a

SHA1
507b11714ee745f7eac8cb860c7d1727e71e1481

SHA256
5d30e466d19beb957a1a3350657eae8b15a10d23f9dfacc404c749047b4284fd

SHA512
f90f8627e2340914159df3d4ca5c3cead894d537c7d8d96e5906606fd8393e50ce47f5c53401b296aaf2e2e82275f8aea6515e0ff2c997ae5816cc01968fa457

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
149KB

MD5
8eccb81e91c765caaccb09a95f74e622

SHA1
82bb03d005da950577d77a8694000adc187419b0

SHA256
473aa39db59a20fcae7bfdc0ac553cd1c65c2149ada952a7dc8f7efe17dc8117

SHA512
203669d0184f424db1edb3d2fea66ed5927be00520c31109acdf8dbff6832ad4cb1df5cddcd980b9c85c51e6b25d7a64b24db8e87a9db020545248f548ccc802

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
e7a445f40b5a0f93aa01ac698031de55

SHA1
71601e8c6cf9dfeb944aa31edf733fe535412cd3

SHA256
e61e002e48c986785ed41dedd1127ec07260e4537499d1365911d1c2f0b523dc

SHA512
3f881a2275f823b369317b8dd1822958fc3f37cfdad8b1d5a9c8e73bada328ce8adac1517f7af96833c59e8422ad759590462d48dd8f99314f278fd9637addcd

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
08968f6a98387a7876828cf9fefa1922

SHA1
a1f3b044575775b0771cff29dd721486bc305496

SHA256
c506341de2dcb749f94669e4af3c672bcdaec08cce4c49c0b32d440dcfec85da

SHA512
f76bebf37a68bc5f892f7836b7664d02b2a4f01cbe11b03320cd6890e05348520fd2fd36d22b4835f2c5a406d9e5520db365fd291e300a227a4c276f0b8ad933

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
628KB

MD5
904500d563dce8ef2bbc570d65b87fce

SHA1
66c6837c0de1115ac6ad91e5fe6bf5b7752ad66d

SHA256
5526af3d0d8ce14be6484684e39f9b391554e8370a0dee54becee782fafdb5f4

SHA512
03eb6ecc16c35eadc273cc17866c4b47fa1c48535bb73294f220fd67a666ff09e4b9194fd0795efb971b2d69728013975bb6662cf766caad37d174420b16f036

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
294KB

MD5
cb2b4bcd35b3d86f3ce15f8e5232d56a

SHA1
3f439ffda4bd7345e6027e45af9d89e8d46fcd11

SHA256
b2b0264a01c74c7ad3c341557b0866fc92cef1c989698fcc15c4ca5d91a92655

SHA512
cfac8ab7d86e3fedd1909b0c438d9bcb5b7a23f23d274ae26e940dd84f06b573e30bf2ef0bbd7553fdc6e13274a393696548f35493fbd282f402db24f9090961

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
273KB

MD5
65b044f2c50a11948794fc0b14a2ece8

SHA1
a5e361ba709faec84e2316c2124a153c969de2ef

SHA256
0a6374b97eb34f921cc915fd1c9000415691ca5967cfe85ad1a6304ef1571e14

SHA512
0d52eaffa3e26b828e695c9932fabfc27f2f5752767a1bb6df96dd2a82503dbca1d3ba298370bdd133b5c0e8d4125fe172282a5b4e6a7febf6ebdbd4b30bef73

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1015KB

MD5
a9473aaccee8680f6d260dd086dd9f4c

SHA1
7c4995e497f4b1b881b72f7c9913dce3d897bb1b

SHA256
57cc9f1e23d645231e788ec3a10f9a5fa5c745556aed29721fabf83bba47b2a1

SHA512
2d6e79c68dda533f05a4a7b82c52b895644a184e7405f91c37a28daef0966acfb02fb8dad935edb65c123ebfdd24ed2e3d4a73bf1cf65c1919b19c1a180715d8

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
768KB

MD5
4aa26ee9ab14f05683aa0212391f9afd

SHA1
c736b478be62f555b11662b3d81ef16fe33ca709

SHA256
2ddf6c842945d9105676b9b7620e03b9f27f4bca3ddd4f0e8490141330a7e294

SHA512
6bc78caed8a1610d8f8577320ce8eeee17a4e91bea1e536b46bd4dfc41495adc514f9a0724afa12140bac0066370ea99a005719bf7a42d7be130d556d7203729

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
93KB

MD5
57d36143e903f4c96f804e7a79db6467

SHA1
d646211536599f562cc9a70ea13d547a978022bc

SHA256
60a34e1ff1d6023c9a9cb5abb23c9f572373969b7d929591eb00a82c1641eb8f

SHA512
c2282a2679142d536ebe7bfcf062c76c45185332fc084f7443f6a7311a67734e624c623895822b155d6f11d6e2d28724d15fde60c479d687618b20b8dceb9b21

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
94KB

MD5
06f8f7b960bfc898de2fd0fa8fde9de4

SHA1
41b956875f08822a7b1fe0dba5e71b41cfbefb7b

SHA256
eea6c72bc3d522d6c8f6daf8fe45a7c3f7f83e66020f5ccbf39616d8fa98445e

SHA512
1017c384b5198598dad3d08c07902cddc02bd973657186373eee1fed0f1e8a34d3ba9b2a36a8d7e3d02c370e3c712c5c45f8b4a6e15cf37515c636466d317b98

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
95KB

MD5
b0d379eaa10a66d5f3323b99b6d3dbad

SHA1
a3291fee444c7bd2402dac89500fd64d0a7e5ddd

SHA256
f70ad53d7e8e8d8eb8d6af477e4fb760d66697935139bf3f512282eae3d92bbc

SHA512
db02a45bf2e3ad9463f965c858feaa7cc70a9f5512ffdb4754fd356e718fc46029d8ba78ca63afd84d2be16f625bb6551cc71692ad79bd3fb43bc9246a71b40c

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
98KB

MD5
299befddb1acfa50af7d6b8eea58b3cb

SHA1
7a679c147bb5f52c976995ff910481a67f4fca01

SHA256
f8ce16d0d3049cc0a7323014b8670707acd4c132065a1676fa691407f8025be8

SHA512
c24a1da339caf1c633f9d475ab370adaeaaa94eee5afe218f2011bd36cf8af02f512557b3d7a515958df6302063cbe28dca251beac5fe4ed77a8ad746ca6486c

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
93KB

MD5
b392aecaf75a5b8b7d8369d624aaf6ca

SHA1
81862af7a3bd6167f3f7ab6ea93ea1d7224b9f30

SHA256
b77b8438a4b3b5b2251fe36b129851487ef6be914bf4c6c614b8317cc070569f

SHA512
04be14336a4beaebe0cfa7a0f35a2a882bf4988efa405e1788e3b2061ffb29b28dfbe728b3cd41d49aff7b587c5624e8eb1219681a1ff5bd282e5d5c5e0e4e06

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
93KB

MD5
afea1715897abe3fdcf28aab0f54e198

SHA1
d01cdfab55aeecdb5624e97bfe7087f7d1dcc489

SHA256
ab3790108c70bfd82b1b18028eeb7ac843254314cbe121996f004c31a746fc46

SHA512
4c4b7b8903e0d8f7d575d11b518169171aafb529e2683273c54ba03a3d85867b761f2d0bf316d91bab3ee379af3709bbec1e6a84018506ebe81a32d49a9df603

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
94KB

MD5
1f79c79e3d323dc583809649922e7ec8

SHA1
6646fc068fca44b3f5c629686e2c9a6db90a85ae

SHA256
48fe850f0506506f9b397eac422e19ad6269c0e38c0a2b9101bbf3dbf4d97db9

SHA512
4e5f78832228eb87cb625e2b849055dd34d15fb3d38bef1ab69fcca96deb61e0ba2a62e145b9b1ffe055b5fc1b1125e9f43a5c369152d875d8c54a76fdc83961

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
92KB

MD5
191836faf1d91c197c77b28b8b22b9ce

SHA1
1ee9b716da54e630fe7a1cacfb76bdcecac5d4b2

SHA256
2e727d2b2edd1fb1a16d3b2c038b3bbf0eb8f1e879597d1e0471fb72e1e93ecd

SHA512
6cfcc2dcd065f8a3e7ca72c843f6efe23220393020201fa07e06a3aea8d4264c4013891fa5fe4ee2a209621e67515b699794ba39f9b6c886496dd97733612d21

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
89KB

MD5
abf1da9ae7ab420eb2cd428d868fd0c6

SHA1
0da97aa71b0e4d91606303b17f1be550b67e8e97

SHA256
7589cfdcd2e77f78e5448a5c13d8b2616ccf934c351d56387b71694850072074

SHA512
e4c16a7231b18df7b7172e1e5aacf1ceeedf83f344278b42a6ea8332adf34c8a40bd2b46f2adfef845209913ae1e2b9c098ae77102f05559cc71a529d321b091

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
84KB

MD5
10b3f0fc56a507b3ad18b56fbccc2ca2

SHA1
de4b5eef07170dcf72b1a0262c482594830fa8b7

SHA256
a0f945f404494d6b9f5d402cf94f733e7672b7bb0150ba788d261270d3bea3cf

SHA512
9f78166f1f3ade972762c4d8b8dea61f22614edeb4dd2f6dccdc0f02d04224f51c1956f4ea23e2fd6ad4702678db0b5b0e6bdadfdf9699a6dce2dac25e84064c

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
90KB

MD5
e0ea2da7b8a204efb2aeb233729d5aed

SHA1
a3bd4cb2de13bdb4e59b51d7a4f946954a8ceadd

SHA256
7525b12d15279b2e6e7b2858b47bec5cbff66079926e04706b6343800e921899

SHA512
67138fd605ae8bc70aff9f478360cc75fa45617b3d6fc4d1305b1003c2be554f70be7cd5322567dcb2e556f3a021ae7431d5f462fa0d36fe086962358d336e9a

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
97KB

MD5
fd5ee95330df9d66af5ca84ed0e30d42

SHA1
cbed15652e41e9d5ec068906fd7eb6d0568be32f

SHA256
49f7668b8b670a1cc8d624353882bda207b4f2e97e28a5d2ead9132379ea7b4f

SHA512
3bb7fc4a9c3cfee61fd1501096ff055680e804408eb1ad332a135c2f25004a114c1fdef908ea30325e26a1ba02e69046bcbc18d613cb48f77a8bfe6047e44d7e

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
91KB

MD5
e21a9efd4361b1fc4cc083cfb1ae19f9

SHA1
7eb8cd864db0497a3ef773a631dbb480a4db0c18

SHA256
17e0de0016d5a38554d217ea7f4f0d7ebe7e3e029a0785057f966d377c46e2e3

SHA512
2f9cef831bddb6f1dadf0ba1ebc7849835aa1ee0cf303daf9e7f2f63d12b989f0a43638634e06c872361df8ca3c424bf5c2c48d677e6ed51e1cd5e769f5ac83f

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
84KB

MD5
c23fdd17daec1f00d33751d100baec10

SHA1
61bc481f34416bcc2af22e29da34d9f0744d022b

SHA256
52f64cbc5165f95f38a41def952872bad1580de96f4c1f6813f55df7602eb01f

SHA512
13d9b8f72fec315e5ed9791486e6bd3b3af44f5824bc09c0345b8f0c2c394265f471e1eacff2df5554dd59cef1a4d09a1685a1993de82ad7e55856ec9bd7068c

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
92KB

MD5
c2a2c88d6059c445a880110c78f0ece7

SHA1
26ab7a003a600c545ec5449b30ef4ddaefeef32e

SHA256
c7953442bc90735afbd6c8c09464a0db349793e6a6269d74059b62f1c2ecc62a

SHA512
4a7efb83b3d21113d2006c5dad1b29ba69d0953089ca81120b471a527860e6d9c4aa7402423df638bf3d968d0f0ef0db50f28c90738d1d7ae09922e3c61fb676

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
101KB

MD5
6b833a15d49509d0bae830b782f65374

SHA1
d09364f41da4b9736b55abd4462c0e00950d55b2

SHA256
6ca7f71fd0aab3fdeb9e425886db1e83311b15b79730c7e28df752a54abe9d3c

SHA512
633d154dd2399d70bebde6fb07bc80f02cdb1b5cf82ac0cf2c9256ad3bc472a3ab796a1431c508f5c9c8512360aea5126e49e2206a181f6bfadc1bb3b0e8eb30

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
101KB

MD5
d2ae5086a32b71209e2b7df229f1eff6

SHA1
bb6080229c9a18a8f76b7f81b6fe454a2ac3a679

SHA256
db3d5df4ad5d9638a72609ad600c74f2d6c043ed49a60386dedc153f5a465c6a

SHA512
b1f068b5dec932378555554bd23cb0106c145b247d0c0d0b10e4687fe2866109e4a428268c3617069d21219fbb4e795168145950289b4004cbad5c9415c59618

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
93KB

MD5
74a9247cf93a184a752970fb8e57433e

SHA1
0ff6f54b407733de21c1acef432de6b54e15f66e

SHA256
4362d97da9d42d3310e54dc84ab7d047db1d5b9dcd6efde45e48aa5548ff3555

SHA512
39dfb18df8e6476726a80051637c1376354451c541334318e21ecefcfdedac6c815b733a1c3536c99ffe86147a3a92d3ccde426374afa594d9f1256bc80493cd

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
94KB

MD5
b70aebcc9ba5cbceee09d82231f94c00

SHA1
860886b31c7b04b8ac6881af9029ed3688463942

SHA256
4c7c1135ba598b3a66f921a91cdc68493e847778f65abea396a043b39875c30c

SHA512
301fd1ef5e480a64923887dfcf46a9c87d3104484e889bf6f3f9c22c61635652c071148e126607b21050c14f8d2e751f5ba01962372123b1227c4eef7ce12f47

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
98KB

MD5
fb05b64b22f2f274aac1bb6d6578aed2

SHA1
3b62203506efdb5b6b74817658346ce947163b7a

SHA256
bf0af9be6c81c74f14784c22d6839b317be6ab2ae4ed9e4f095925835cd9f562

SHA512
62632eba1ac8f450880a34dd5709134ab88862a6047043c70dc8c38e8872f82bec03dac26c9fdcd29d1e1ade13303ec9fc8c3751a5f12e2986bb909afc0ec6c1

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
93KB

MD5
80600bf2b0bbd1707810a879a47cbf3a

SHA1
3435b01a0d3d3d8fc844b935b905b908b1111d06

SHA256
868e8b848fd9a4f979547350802df63b11508fe3e7442fff9eb8f77d6e0903b7

SHA512
2bc1b2c990338209f2a6b1178ad2a4c4e8adaf2b3ece1937790bef2c47f9010b0e7991b1a4f5d926eac36c33f374a076c14bd94676d031f6e8a8886208583541

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
94KB

MD5
9cebbe1c1c20a2b42defa1f01869f5e9

SHA1
4db46d834e7ffdfe43aa9f55fbb9a7c422702a37

SHA256
1191aa31023445fe832e1e67ce04b2b0b625773c2c5226ba7a875ad2b22d92d0

SHA512
9a176192829bb8527827e74ff9fccd29b7b0167817fbae73cf8ef7f8d35db24372d62275cb6219d27104f4b4757f0a020e4b659ba8d96d67755a8da2a66fdf67

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
95KB

MD5
1956ed274907eaa001f560c112359071

SHA1
68ca18c19fdf82d082ce8cac07a5666c7f1a2bf7

SHA256
60cdd6f480e9d485f381210a8ce8aa688e0f6ae61bdd9ae2b5ec66cdfcbbb16b

SHA512
9702a2ec5173e524b153c72938820cf0c04d845f0f9a31a60e14f589ac2a6656fc6e85ef20d7d5ae9c133c936bf1c9682784fa6d213b4a4017827284eceb4258

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
92KB

MD5
17ef060230e7b91d8bb9f140110ba563

SHA1
c2616a0030cb138238dc6f314d0057df8b283d6c

SHA256
759700d12ac0e1163208faf3d1eab02c206731549abf545688158eaa8ec93098

SHA512
c70f8fd42a254e978c7f5082a0fb9f3f09bb6f63f387482fbd5aeabcd5deaa5152e9c6eb657f0d499484d193a32ef661973151ce8aaf0879bfb5b6349550d996

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
93KB

MD5
c9757533dfff7a1426c4a21c398b8c36

SHA1
167c53199c448614d821efb8ac3fa10836346330

SHA256
ad55897d2b3bca9962e53fa7e3440799f5a385ac7b7fb8f6ba7d2868cdea45c8

SHA512
230332d18e5758ba80727f625943802b245ee8e0040375947451cce999502b690a015b978b3d3c798e658bedcfd81dec3acba1529351d83e8b5a89cb11eb8f75

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
94KB

MD5
aa4fe1bd6ef6836b49bc35a437338949

SHA1
3f76eb7706e872f4211c6a10acfeba0ff2fd3c4b

SHA256
f41329c9de5e04ed04d4db28fae10182a41f376649f9d557feffef67e878a282

SHA512
612be5cace6a33b220198341f64150c90a026468b09a7a52dcf731be38152b024a4da5831fc645f0067ccdc6682644c12ad836643c6721b66052adfcdccdf962

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
94KB

MD5
cf9039a541cfc9ad16b1bcaae954e2ad

SHA1
03b61b0bd5a85226d69fab29fc073ca20564d660

SHA256
bf2a6c270887580610998460ec7998fe19d5944bda18946f8377f3c52d1cbb8d

SHA512
0e9a388e32237f3e5ec310d54944c40a56317ae9bdeda2e9868361abf9c14830c806fc788653c43822980fd02bf559cca5d6c0f676b936c210aeae2f3de7dee1

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
96KB

MD5
a549ae65048e55dfad04b938f2ffce7c

SHA1
6b74a3f2e1c49e30ae4a0539ba9afc17e0462cfb

SHA256
7216eb3ebe9bf5ad780a2bdec254f36273c65268fc1d8a2f3e7d9c8c369f1b94

SHA512
70ea7c9849c9abab698b82bf6dc6deef9f7d346c3de4f7b8a35140784513f9b88672ee4b08db0219825de102e87dec17d565aae71fb77fdc9f5828a6f4755908

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
89KB

MD5
4f4a928adeb08a582629edbc05990caf

SHA1
da494623530fc20d758e9a0ad281f2de166ef6ef

SHA256
e414649f0d03de63fa26e7b84c59086266199d8da30e6dc05b386e1393c735eb

SHA512
7b86771611692640e9ee92bc38cde0966ca764802f8c7f30031c4ad98836818fe810e6104337c131b51d26773cc85082137408cddf2b41588d7b15815cef35a0

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
91KB

MD5
1cdd0283b7a9212a911226c8f00142a9

SHA1
1c65f754ab1666f723c9b1fafe0fe720a20dd616

SHA256
a50c5750019f0a00f92e9e7ac161ad11d10dca02acd40b80f2b79144a1cefbd6

SHA512
29e44cc73e264653cb9f6c06cd5d97e1d840cd0db56eae3ff2fb0303f2dd5bea3762a46d92119caaadcc1c73d871b8d45b221bae985c3511dc5253df09569e64

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
94KB

MD5
f07048ff9808afb2013f4d40a9f1fa2b

SHA1
ce2edb07536f53c77ac51e9cce7139e4f3c431ba

SHA256
214e930d9f593608800546c92d5585455c00c17ad0a8ddc38a656b812ea257fc

SHA512
2474fed4b5b864892600d66a47004591a9df672b15f3649df44184b2075adca0722a89aa5af80d6898861bcae220f3ecda263cde39e7f2c7af14f86dfcf815af

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
93KB

MD5
155194a32895acfb7412ded783f86d04

SHA1
15d7b381467f9af047e531fb7cec55190542f8d6

SHA256
6c1474539dbf223dda2c707b042973d9c1a8e3bba008d095e29895fb820dbfe4

SHA512
0d519f98e583aa9e0fe3330b40ca44aca5b36abea9f8a70bc456abe907f47af7fdacea6478ccc5667dbf1042681904511b8963da253fb67a4a1311acb7f6ae44

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
93KB

MD5
e2dacc9ba1010caf9ec05551810c61cf

SHA1
97a29a02522579c8a5b0c3f756ddc633e4807e11

SHA256
6c227d645ef4c318ee12e47bf0e50fe1b5d6686ab54327c55785c7783efca21e

SHA512
85b5334c90925af98c3ebf1767135d0f5ea70f7081c5bf9bfaa5ceffd552f15748699e0c189cc90b9a518c43a7b9694948a09fde0785f66550a387fb08c1e298

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
104KB

MD5
a1476a74bc02339420ad025f7ad4b2ea

SHA1
7b4bde86cef322e103a414f8b54443e461d57bca

SHA256
14483bdecaa03f6683320e0a89c45af30ec1268da6595af423af78d14fef2641

SHA512
8bd16aca661ec6f1162aa845a73fd420cb6a9ac39d8aafa15dcffa646815096cbd7680967e04a241bc0736363d0470f12480cf04ae848db41bb328d985b31310

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
105KB

MD5
fc4597fe9ed96061158b0f2339a085f6

SHA1
7725e474edf012024ec4a3b56a394902962a1d6b

SHA256
e4c3aa6be3554493cc41478a0b00455f34ae7ae22d78a0e715273c84cbca2f31

SHA512
94f6004c2989fb7784afb0eeab76e40deeb78102576a94929b6071847078516a8a883e220db6f8603590e865ebd140ac49bb2e97d69e54e7edb75ad50b32f251

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
95KB

MD5
c36465f8e313825b6c8fc3aaba7dbb2e

SHA1
cd6d0e459bb2f5d7178e97e88f988e9aa4087a2f

SHA256
5ec9496d305412b36e63dc0bd20fb43fd2737963e4bb4512c250ea5eba1f39b7

SHA512
ce624ce9d99f8052a3d26e6e178ac08c84c3261832abd204bea00fd7631fee8dfb9998cffd8a91a36ec4e51e265a744352b036a1bb125b4de4ffdb6736904ee2

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
97KB

MD5
cfbf8d6478f21ebcc0153c746d2f62b2

SHA1
f9985324f37b6678e660080d64d65fe5ecfbb4e2

SHA256
c653acad848ff86b06743a86283a909d0015c625d7903c58769579064b441c23

SHA512
ef6d811a53980dff5d3e4e81b4045086de2e25ad0947438b8885ec618ce1777fba462dd6e872434bd89e7543d7bcde7ae4bc1035d17f6d17a108a0a9ee41f81b

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
93KB

MD5
a4a0b5c4e638737f4afe630724334ae5

SHA1
99b586e98967004beb279cba3ad2f9f341f86300

SHA256
2da922f2d682e695524ed5b97d2f09d1418e989372b6593f50f377aba687d749

SHA512
28796d685fc592e8b1b84b42714259bddaf58178de01ff19af0208dbbd80ce7b51afd92d253eb0a650a695b61ebea18b3a924109ae81debf616adf5c10defd01

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp

Filesize
96KB

MD5
4ce2d4e56ce9a7a4e1aec521f72c69ed

SHA1
912852ee2f05857c3e01f0759c68f1cb30e9bc09

SHA256
9efb4e983ee61d8bd7d919ac88acdce547de49512878abe3fdf637fcb824fd07

SHA512
4faece8b791d035a1ac7344e7220e9b627bd77d2dcb440ae092c9200660c60c6cc7d626d4607012c1ef23df9e72387ea84751b52bd552ca274a26956dc3ded92

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MS.OIS.12.1033.hxn.exe

Filesize
84KB

MD5
d2026d60b54c6529c0c08d3fb2415878

SHA1
e1eb10b1db201dbc87c814efe79f3a944b0a255a

SHA256
0f14e4cf368fbb31a3c47190a9e488d19d75d445fc1ccd17d9ee2ca011034c4f

SHA512
6f61c5d8b44b7b93aa6dd15e8f7b4ee99dc52825fb060727c9a9c309f1d5dd7f1ac85a5619e3c52be5b4dc7d41ade07b03ee07a773474670911fbd634d25dd6b

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
84KB

MD5
728e10f02094debfab0a6d542752411c

SHA1
ce062a51eeebcc76c3377224016b185ece3a7738

SHA256
040c9d5fb66034566f0e0b2e5a4243e225e38b5ec9a5db65f5d64c52cf33e993

SHA512
1b1419fecd615bc08821ac25dbbdce3fc3a585eb7c9fc5e5db6659522f883e88d27213124b973e7c9db666c9190c6bfedf734a3bf439319ba6ca09b109966b8c

Download Submit