66dcad8b8cd3af824dc4f7c90be046ae3eaeb1552b7d6296a18f57a9385f49a9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 22:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66dcad8b8cd3af824dc4f7c90be046ae3eaeb1552b7d6296a18f57a9385f49a9.exe
Size

360KB
MD5

b85883e27752e0114f1a97251eb7f28d
SHA1

f6efa6428f0eb14dc536103ce495018c9042f328
SHA256

66dcad8b8cd3af824dc4f7c90be046ae3eaeb1552b7d6296a18f57a9385f49a9
SHA512

a5d13c7d523f1811e6aff06b1e7581f29c8c5b5ac5152e009e82bace56ed612fa0627911a048bb530a474640e32f7e1a471bdc72e28676ad76149f42925c6720
SSDEEP

6144:RqKB+tOkWKR0iJ0MnW5AqKB+tOkWKR0iJ0MnW5J:v4Hn34Hni

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4837) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4368	Zombie.exe
4260	_Examples.lnk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	66dcad8b8cd3af824dc4f7c90be046ae3eaeb1552b7d6296a18f57a9385f49a9.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	66dcad8b8cd3af824dc4f7c90be046ae3eaeb1552b7d6296a18f57a9385f49a9.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp	_Examples.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	_Examples.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\LICENSE.tmp	_Examples.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	_Examples.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	_Examples.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp	_Examples.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp	_Examples.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	_Examples.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp	_Examples.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp	_Examples.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	_Examples.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp	_Examples.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp	_Examples.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp	_Examples.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	_Examples.lnk.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp	_Examples.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	_Examples.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	_Examples.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp	_Examples.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\id.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	_Examples.lnk.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	_Examples.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	_Examples.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\vulkan-1.dll.tmp	_Examples.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp	_Examples.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp	_Examples.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsFormsIntegration.resources.dll.tmp	_Examples.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	_Examples.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp	_Examples.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png.tmp	_Examples.lnk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt.tmp	_Examples.lnk.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp	_Examples.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66dcad8b8cd3af824dc4f7c90be046ae3eaeb1552b7d6296a18f57a9385f49a9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_Examples.lnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4368	2472	66dcad8b8cd3af824dc4f7c90be046ae3eaeb1552b7d6296a18f57a9385f49a9.exe	83
PID 2472 wrote to memory of 4368	2472	66dcad8b8cd3af824dc4f7c90be046ae3eaeb1552b7d6296a18f57a9385f49a9.exe	83
PID 2472 wrote to memory of 4368	2472	66dcad8b8cd3af824dc4f7c90be046ae3eaeb1552b7d6296a18f57a9385f49a9.exe	83
PID 2472 wrote to memory of 4260	2472	66dcad8b8cd3af824dc4f7c90be046ae3eaeb1552b7d6296a18f57a9385f49a9.exe	84
PID 2472 wrote to memory of 4260	2472	66dcad8b8cd3af824dc4f7c90be046ae3eaeb1552b7d6296a18f57a9385f49a9.exe	84
PID 2472 wrote to memory of 4260	2472	66dcad8b8cd3af824dc4f7c90be046ae3eaeb1552b7d6296a18f57a9385f49a9.exe	84

C:\Users\Admin\AppData\Local\Temp\66dcad8b8cd3af824dc4f7c90be046ae3eaeb1552b7d6296a18f57a9385f49a9.exe
"C:\Users\Admin\AppData\Local\Temp\66dcad8b8cd3af824dc4f7c90be046ae3eaeb1552b7d6296a18f57a9385f49a9.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4368
- C:\Users\Admin\AppData\Local\Temp\_Examples.lnk.exe
  "_Examples.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
179KB

MD5
5ece3ec4f09e28cef8122a85d46174d9

SHA1
0bd7eebbeb3907a75a28f43fbded1b5d413addc0

SHA256
aaa5053404ebe27bea329556d712e3097016d0e0e454cbaede5352f9cab05c32

SHA512
c23682e5497956f913cdc11af29c391904868d1ad073d7817bc64d8e8256fe0252651ae9c1356b01d165d3e23f86c8b2297bf3bfd819b8d870668689b972b39c

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
291KB

MD5
769571608e2721b6ad310e97af042b11

SHA1
63099b8254cd25de038d7d9d6bf24cff761343b9

SHA256
1712464a5f065651265b96b0dd4d0378d8a0191ffd4dd41a4cd7846b79e022bb

SHA512
c08cc008c9fe7420b4c56a857af01cb7e97768f03543602927cba03efd9fa7e38a7e166acaebdce1b601d9dc34e8cf96a223ac21f8eb4d8e9f6b39627d1851e7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
280KB

MD5
ad44973f0541bff7d9c6cbea21e4a0c3

SHA1
60ce9754e5263a90da5eb32ff37b9e660dd7679f

SHA256
56f1c5ccccd33e6901e7985ab5b42b4a1221223ca5c57e3ce920759c4c5666aa

SHA512
c3f0a29da69b815ff199e552563e29c376909b07740fd67fcb83d887dfd638e85d26c1a10de8c2dbba727555e17bd373aac00c570a1d90eee9cbb9b7da8515f5

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
243KB

MD5
e053dd076395222cd9658e64e09adcce

SHA1
0df99c0a29f442366ced4f03a87a20001f7f15db

SHA256
e000f32728e37dc830ef1dcf8d16b0c4c16c60c7421efd68f184ea2ae907380d

SHA512
b07396e93bacc827d19e3a1667e41047ffd5d2fdc320797f0a10a052301164d53ac82d1190711cb38f8b171fe502fec6f764bea540ada8cd11a5ce91a1244545

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
aae3c98f4c0b9870698040ed4c002efc

SHA1
65dab255f4fc0fd87902c85e1fa9b951707fa2fb

SHA256
5dd4d9229204d0897b75080c040f897f03ce70635c92927aff33f28d776a2581

SHA512
ab4a1d4185c852f4012add5f89f0a4098cb65e9f49c277d27fb12c6fbb4ccb32d8a972be3d0a27b98cf00fa5bfd1fae16e50d7a89cc0e391d5db6ae143960d9d

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
725KB

MD5
ce7c81e1af59c3d1fabf66df4d053fe6

SHA1
50928da96e64c545a29f99f3251758c932b872ed

SHA256
7003dda0c79ea7aaf64f5b34bc06b404131464fc866373da601dd7c8a7342a3f

SHA512
fec4463917b091063a15dde066513498143c2367c64b56246067c137dd5d44ef2230cb9ab0121ef335a91bd64eb1d989429f3145dbcbe514fb45c810068fbd9d

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.1MB

MD5
e4abd4364f8793e8ba7679bc90714e81

SHA1
67cfc6ba07c1981958ab1b60319bef5b0e0e55f7

SHA256
6f8ca6f1b41fc5b97dfc3035c388fb2b2315e21c104fa6cf892a3c4ca27cb0f4

SHA512
24793ed4f53603bc9e0a671ac33dfdf09e0878709ea0ffc1ee733935442c98655fe95f9a44fc1819b9269ff36c53b099047981db66d6fda0142a459c85e31d9e

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
865KB

MD5
f91a40a9f18e3d2e814760497ec143c7

SHA1
e04f74d032e26e268becae902a10b5f86360afb0

SHA256
27542cbe5baa8a8c9734eb5aee7917ed3865eff01c94f9c014c3d96fea5a66ce

SHA512
d575379fe4ba15d514e4a996789eccbf841e9b6e02075002fab72738d2ce561640f916f64b5b4f69a391693e6a71fc061b5d7a4e67ae34b55c993add15cf822e

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
188KB

MD5
40dc36cd3b399818d624fcf2e05679fa

SHA1
6076c50d396312abea76f502828802d25b6168a5

SHA256
a2abeb57817b5ef0626f891bf5d0b8a4a2a857e208f4bfec94d2d7b5f2ba5d5d

SHA512
f45d2483fa0a298cdca0a3d0fad09f810d647d47156e930b48d516ee345f5adf4a315c0750c206d2b3b2ca9749ebd922f552a9a11aa686b4f43c964dde2088d3

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
181KB

MD5
0eddfbf4e73615f6d23b78653f247dad

SHA1
b14743ca41c216b850f7d980510c8d3f9ce5c9db

SHA256
53bdeeb7c54d8933ea2bc20de0f3ef4205441b4b995e22f465b3a181a9ebf85e

SHA512
1f912007f18c38e3c286cff019363242a68942293918ec14ca4e68476e78772f7d5bd9b782d72f327b2e674f82f6eadcc43ef702db156d754ad38dd8a0b68248

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
190KB

MD5
875f9b1eb119f06c0fe0408bcece5f24

SHA1
fe0e5beb8bf545a9455b7c6c0b42e71290b04cf6

SHA256
29f4a2cbd1ffe53612161842ad39a575f8b178ac4bf43c2d7e7229e9a946bed7

SHA512
5b0eacfeb7ca562223640bd8734c7c210126f9e43f38e95aa5b545b3fde92165df6dc2d3362e2117da01c54ff5c7266d53cc60cc87d2da4e29b4bb74a439f508

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
191KB

MD5
915f9d29c6b3a096ae6babd618cd77b1

SHA1
fa005b75bbbf5efda64c100f814b4be6cae9d294

SHA256
fa31397f01a66255cf12036cde21d2f6d81b8b847e8196440c7875b3c0bf82c6

SHA512
ca1b6290fde0b8146c8b71109457a8cf4ff3a9779f9ebc5136b017724d5acee1f581b31cb22699a16954c2fd3363b57c509a2f836ee9fe0b8f5f41da77377edb

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
193KB

MD5
7690c39fa76a83e6f1c17f9f8508e1e9

SHA1
c7074ecfe4a6ac4bed5437d2f98c2406c23b0713

SHA256
64014daaed4d258550d923de362ceb17e43fbfb679e34a2c7eaf477cd17f6495

SHA512
2dce828514a1231eb9fafaf4ed134c515aa97ae18b00f14b246050e916533d7e66ea6572fb884cde7cb4226e952988a2225d04eaf705a7af4cc4e9646ea3e3c6

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
189KB

MD5
5456b099144b06de0a8ddf983428f24e

SHA1
e104f5fd16126ea1ee1cfabfd1aaf14c0d082911

SHA256
e37719d26a364c62eaca7d094e95260ac4b7cc64929d34221ecb4a6da4914690

SHA512
56c7e55cd59c5c7167f7f0904a259f1c52230ee54e613299428ee872d4d15c64552b1fc648bece8afa3af2471385dc642dbd265a76f1466d10246cf0d089da4f

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
76KB

MD5
149290de2e3e29c9c0213a33153c1de4

SHA1
4a7483cee7129d97135950346a5097c27b2b1369

SHA256
a79f35ce75769e2845a053b8289f5667b4a0b737f0156835f7d22f0d070c1bf1

SHA512
033cc9bfcfcfdd347912dbb36de496f88ed321deb1ccc9cd8478afc4dfa0e9eb3512b65f9137559c835f285d3cedeee1ffa64975e8b57feffe6c1e97382a26f5

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
187KB

MD5
613bb80d97af49abe2ed501abfe5ecfa

SHA1
4200313c1e65bf27dec4bbe4aad0802e73e78c5f

SHA256
89515315dae1f71b089e5fdaddc11261fefbc36c3e6740e750372e13b26551c6

SHA512
714ddce4b3e01c4901c660daa6c8dd2f0873d996780a4799147a30750525132cd0c68b445a65c56276ace227345e6ba2ff85e437bfda763f4480caf5682753a1

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
195KB

MD5
efb0f265dd6f20f3c46b68fd04ad3a75

SHA1
61903f58503ab9d20032a648231be9fcb6a7a995

SHA256
df91a74b306a8321336edcfe125bea7a9427b62ca64100055ec2b23dcc1a10e9

SHA512
7942c212fde374374a5363a143b223d57bef8ed7edf74fe0a2f7c2da15e7a9858c1119e2d8364902193b861d37730a87b01888edcd893ff6fd6d5943288f9675

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
186KB

MD5
55c9e0dedb53aebca9f150a90b878528

SHA1
25543c417a0a883444494decbdff02549d852179

SHA256
0b457e3589e333a6bb600ff17c1a22ef877cd8aa55a71f0e41f09e236c09a20e

SHA512
d7b3d25f4287c00729458c4cd25f8211763d76bb0c388ceeecaa1e30703bd27276af35688b3fd43599c3a89196d045477cec0f4ec38ce10ff5e316fda7888f51

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
188KB

MD5
6d9510c40a1ba42d10bd5bc9fdae5fa4

SHA1
8c8e862181778b51aa5da7c18a4f5e6389a29841

SHA256
f6100eb7bb876ac53ef6a9cdc6e9c8d7ccbb1ec6c0589265938c171e059df0c6

SHA512
6c72fbd554936d7d7db9d2290fac99016b1676d38748a43207d9865403e2f5bf2a40cbd34f2a5c21f992b085080ad47430a0db278afb957bdbf575832c57e4d8

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
194KB

MD5
710100bf4a6eb5da4406451247848221

SHA1
e4c774d546afc25172ae5f67490abbdfb871bf34

SHA256
17a4d7efaea2494d1e6c47072ffd66b366cbc3a8b38bcbd4db1e9a43c911ab45

SHA512
b1ba54affb2084d0a94411277e19035c6f46d00f6d7829145389dede1ef9ca6c5307b0b148c17dde6f5ffa0895c2037d25bfdb585815f3e0a279af175665fb50

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
190KB

MD5
a94dfe5485628343739888bda29ba618

SHA1
07ab70cf98efcbe9b8b6eb368110eed71217bf86

SHA256
126fe521d13759bea5d569619be3d6c335b9ce21199b32a4d513ec5b5164e0b7

SHA512
3e6a791faf225c445bb349e8a8a3b363a814be1feec050964a52bba97a75b9d6e79660bab9356210f791f837e952ef94428143b9b75df3c37ccfdaddeeb7f1b4

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
181KB

MD5
ffc44739cf5a51de101021745d1781cd

SHA1
f10310f955252d2bab3d6c50b7dc7a58521b98a0

SHA256
95bc8bc6604619c88960398406a670dd39037b067b8e1ce9299b98d676729431

SHA512
e497641c9badefe77f3aa674a48030e51ea09bec16be43a20fc2df26926c59c3db2a191368f12be523989a85fac57d08d9b3107503dc204c12fea6a4d5fdd7b9

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
188KB

MD5
a1cdb25e66a0a291812a0cde8b177bef

SHA1
6d19528c8039e1bf3b0977488adbd5395f4ca474

SHA256
3b6364c4b96014851887a07d90e4adcf44672bdfa68266aebee429a7c1cb276d

SHA512
4a6ba90da804cf68d606e7899029bef4f2ae8902f59cc1d71a2982b3836b22c5e0635bdc930f5c18aa03b22d85ea047fc2f64a5725fe737018d5b57fa5e1dceb

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
196KB

MD5
36ce73f9f03f834dbbf6b2c1a3551ad5

SHA1
a5be8e5c62a3f448057a2cd6e919e6f44975fc82

SHA256
a88e2ec8d90f2853c89a7106c05c9f87d94e5549c56692cd22a612187e9f8cc3

SHA512
4006fb06ab8fc2777e96f16bd813f56ffb486c61ec1629224e2f3496c7209119699c19173ff0e7420cd6081771176ce95094eea93bebaf6aed1696f3e362795d

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
198KB

MD5
26f9eec52af60fa14e0fd910843939b9

SHA1
298c2af94d4acd0f867356d7bcde6d921232ab2d

SHA256
4ca8501f4ea8e183198d9f7c9943c304109b06f061ea1b1e59a2c887ba2436f7

SHA512
9365124e66157b942088e06dce7c6c3d58bf2082953c1d82564fb9be652ca859773ec6d40638b07f2397b6e44392bc5b933af9b62994b7fae6c93b0fa7d12667

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
189KB

MD5
c5f924cdc7f3c95e13e696f005eacef2

SHA1
941f91ba704316c8239420af315064ea3651c4d8

SHA256
963c3f45c87764462ce8bb41c98f20d8f64981582cdd754a9346badfd12a8756

SHA512
1ef20fd2015e5faf4b9b37ec2b876e33646ebe9570fe5f77ac6b3e285bb1f3ba47552e7a07efdfb4ea643a0303981031c238d2b5e94c6f8f95e2ae3d651e9038

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
192KB

MD5
cf8711a3fba25715f4c92be4a2ea3bc4

SHA1
37a679a8221529844e1e24b1ad3ee10f17537775

SHA256
f2e8a5980a5982338c6e7e9186a066ff1524228c1610e2df2598a223ecaa61ce

SHA512
39568352e9495ca8feb2ebac6a9982a933786193f68e4b1ceb6571aedcce70b9edbefbf74fbbeb809021da8e9a0c9c7a8c303e01db6c89200bae24d95f32739a

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
189KB

MD5
ca093bedac268867c9efcf709eeb2292

SHA1
ef549f27b8aaa40dcfbb6d49e50ec15cde47fd8d

SHA256
a23fcdfd4c935b3e2e3419960d7712605bc3ba20debc5a24b71810002bc315a2

SHA512
8c4ef49c22b358ad980f7be741a8010ac1f76f36d7e0f7533ccef0a37bfad64cac481216f075d66d330b2dff54facf23f7956af3a279cd68fde2549171015d52

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
189KB

MD5
de257fd6daf2e697f55277677698d256

SHA1
9f0f86b994b71c6c91db2f5d7a1bb4aab819529b

SHA256
e8f7154d5ee0f5897160e755f85a8160b49a67804b78d7df0d9cb0cffd3956f7

SHA512
90b117ee6ecfae3e3e144e30f69e2e19567a8051a6eb9d15e3f8edf17fc2ee162e7aeb7e345cc447376dccdb15611989c4ce3bd3944f7750e479166219118dc9

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
193KB

MD5
a554170d9951baa85fead4388e949fbc

SHA1
61565c19ec2111797eaa922e1f8d61872dc5b340

SHA256
7e2f288d065bd807f787577b8ee650f0ec3d1aae2beb362f33b0c6fa7e3a9bfe

SHA512
01b9a2846a5a93c1b10cc3e822d1374a0d1dd7d389564cb2e9feb08797767c55fb1b792aedc81de7aeef871dd5ef680d0f58b8fad48dba58719ed07bb35b9bb7

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
198KB

MD5
7cb696ddc67409417adb1aaea32cf71e

SHA1
188dd47252f5bbe2cb75f085bec4dee18bdb334d

SHA256
92dc30f62741ef40bfc9b78cd98eb19a4395c32847fb4e11aa49093c6c532483

SHA512
d19941d4a4ad6f22ba7ec91aa3a4f126adfe7163d272336efb7cf6b0b86feb69eb19daf9d3e72caf390c31aa22519e7564e1df6691be1669e939817dac5e1bc6

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
189KB

MD5
c9e0f6d394f9c2561b201eb23aa59dae

SHA1
7d9e6f4775c47a2e01b65c82990d4e0829a82c1a

SHA256
e3642889f8243ad7408ce85833ef4cd154b63867a1ccf13c93cca99218704239

SHA512
f900b6c579ccd25529701bb8b8b0a16fc580ed6ec70bb227092a35d05f2b7f1429d4ba2d07891fa4962d4119021e3d9a9c13974cba29cad466c16b760a2ed407

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
189KB

MD5
d9aa0a7ce6c3fd9941b42f31b5ab54c1

SHA1
6c8150c358c47b3f700aadc0cacfb58873810203

SHA256
eb110b50df2768a22532d4fc01b1b0eddd5b1f76fd0e875492fa729b4deb0176

SHA512
a8e2f75e971c899f72ac4a51bfd8c951397842a5fc26008836e12ed123d3e2a32d4b7f56dd67d5a37828be02dc6c6322df1cfd03fad5850fc4e97af4207aa3ce

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
191KB

MD5
136b75d813abadf6042791fb6ceb1d1f

SHA1
c292afd8d08b551785b4ce4b429a6f18836fd79a

SHA256
6a88664ff89de5750d31b2b256b8afda818fbaeb3f2bd8b9a5f72bc31aa7c3d8

SHA512
8404ca40a729dc79203e97d120024349c12347f96dddf58740b9bc595313a5fee858e58f62d4aaf494240b158eaab58aaf0fd82ad5de017bf3ff9cc259e87397

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
193KB

MD5
86b5394991e471e40e779af7f748c120

SHA1
de87d85b8d3db7240fc6939c662af8f075e94d23

SHA256
9ab513da960aa7f5acd364ac59c91792cab9509c2f81b276351775beb895b1c5

SHA512
c3e42ed9b7ce7d9802df595fe3ffd7385578e14135830613413f43fd2e9a61f0f53f7b6887bb9e16712ffb26333597c12f0c2ce88b0614cbbdd20c2ced59a5fb

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
193KB

MD5
ae8cb5b6c6f7a818a09f551dc869f717

SHA1
1367465c573d67631ea007293a97e09b7c04c047

SHA256
6497cf0e5a87729c73beeb4dfa224c5f2d542eb620c6ccc095c7135b654f1ad7

SHA512
30bafb18fa0215ece11a388367a451822a9d5667d79045dc41351fc72dddf2f6485502bc3c4c089a892a10f284e897b63b67c972469a9be4990a0ec351a4f393

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
60KB

MD5
1bdc8f0b0ab6626a60901cfa0933da11

SHA1
fd6539c480ef9d13a3cd8ed65f4af0f0aed36ad2

SHA256
60dbdb63af13ed8ca0b001769685a8e7e1168048e09e6b763ef85df9db45b612

SHA512
bb6db269bf5a9a2b937ba765c1835a52e373f7fdd5acf3949c11f2ce43528873d333d2a7fd252ba814f072ae71c3cdb5eb098457b19a813fd00d9dd150a1955a

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
188KB

MD5
29f3b0267954435e2cd74038fa205bd3

SHA1
6d79c57ea95832dc017f2590e4bb1afd809407ce

SHA256
9164c20ab6bfeb21b02c5afde158a0b2ce29b605cd400233c4ffb038adab1f1a

SHA512
5425b557489589da526fa0c45b6f727dfe1125d3d9891ffc4d5c34c46dd8c993d7bbfa4b876bd522655cf2a8760ffaddf0d0e97efbcd40325a9363f8381aaa94

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
187KB

MD5
a5826b351a2e991251d91e950eaf04b5

SHA1
9b9d10cb150417ee57a28f48057548baf95e98ea

SHA256
5fd5ac4345bc689bc4a9411ff2fb69b296befd185f20e16a34d0c76cf9de6f6a

SHA512
5c9bb88413f811a734b69818c62698a87fddcf1d729caf4bc72a3ee2b9eed570f41c8dad1e5ef2ac76f16aa8c5eeb3af4b59a45bb174fc71b34734a359f8adc6

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
189KB

MD5
6e68ab622dc6e7874d1aa5aff5dc2286

SHA1
1d28fa5d2b52e092f9d3f1f6e0d1d7b20855f09a

SHA256
faf91c2e0446f5243198b57385d7a8a9263357715e6763fd5b5cf16532ffc8ce

SHA512
bcfd545b11b8dbef7b8bed97cc8cb2c6766577f63897ad4977e01f208e845baa7a10b56aa1bd0abe40c6a64ea558b792279233e5d0f4c9432f07e3d75e094e9a

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
198KB

MD5
b5f438c31927d03e9e36217e1ea978c2

SHA1
57196ed6aee7c72769dab3cf404a393268c81aa0

SHA256
b6b78bd24da4720a5bd07140c93402453711155a13724ef425cace47ed8b3e3d

SHA512
b0e0dffb4e282f0337492dfeef94d9193d8e62a8ab5b419c981fd6ebab098c0da85629181c3bdadd9abb55463e7bc41220f190345a0214659b65008d94ec6868

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
181KB

MD5
bb49e080934b37e5eab0dbd78557e770

SHA1
bda8ef414b5a6e5b1080495b452062903432dc7f

SHA256
59374a7fd46df298426d2a81a151de46b58b3afeb7a1ab4957b4d8f2856ed53d

SHA512
2a8b977219f1128e1149ea67733797112cfa0752a0ef99fde7fe16ac91f1e20d0a6dd399b8c028c802a7372aa4c00acc009b0ad74ed85ef1ce94893dcb0cb95b

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
192KB

MD5
1d431f866f9feda1b1b6b2b841732cc3

SHA1
aaff68f1fbb5198699959610cdeafa499a35860f

SHA256
ccc9a9a73072e20a0ce8187d027d3c2908266c76ad0a5efdc431c2620324f4de

SHA512
b5221f78027b2f406a5a009ac684a4960f7f338a4d9d37917398cc2761ce182579e2e48221238706e0f6c62266f7fdb9ce8a7187bb53843917d6183c895df50c

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
188KB

MD5
eb9a13b33728dd51075559256c396801

SHA1
f0744accd517cda1af81e20106a71fed23b6cbce

SHA256
36e67d6dc40fb0d63d86660158cb40d85e89a6a7430ef0af08d4e53696e54fb4

SHA512
c4597d52b8f166d1d6ebfa2f311ca7088c3cba39e28f4b6508c9ac6310f0ae1fd0704aadbafc6b9e7a7929b592443b238301109d38bc8e1eed6641d0359db76c

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
184KB

MD5
fb794e298294bee06a1fbefe2090d28c

SHA1
ba747ecfb152c40029b984e6cfc015679bc65c23

SHA256
9ed13f3e9949f6e34aef5f3c90c6c78e741d69f7b3556be71b1ee22ab22380a0

SHA512
a0bf6fdfa378ac8ac771581b703070916332e46c8430761ce892ca2429055068c4abe5869cbdfd6731a8e1e5c3110d0dacd7f45eb113bfedeec97c95325e2e3f

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
190KB

MD5
ac70faee8ec13ef85a5a84ba4432b93b

SHA1
6a674ac32557dce44bdaebfde101a4d20c50f508

SHA256
9ffbeeded176d3e9b62f3f29e493e2b5b84402d5d80c3da5f0b80a7dba422b65

SHA512
b887bbf15f63bd9c25b5f0473579787cf3bfe70f55be40dde0154b915a15040bc3b1f8f48a61fba84004c3175bee6b2822f5d571c71eb09cb7d282791374873f

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
187KB

MD5
2af22fbd6f929ae3b088dc3e751b612e

SHA1
047824f66f3f920d1a4f321c3baac7cdfa15fa6f

SHA256
22d4cf12b8f462efa77315dc63283d12cf57c40135e05587867ddbd92525fb61

SHA512
73f468642d2f5616f518ef78adb1a7a471c3cb8dfe8c056317240f4900281b284d76ded47a701d308466d32e129c64bdb5ed20eeaf3fdaf6c626510ac355d49c

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
188KB

MD5
71e8d1ee41ca5ff938bc4082fabe7daa

SHA1
3e23585bfde4917dff3620a4c9671cb751817bf1

SHA256
86b510689bc35687356aa91cbacb17afd9d5a3a2b714ef65f951127d1fd73ebd

SHA512
cefa3d7032b50fa8d841fd1f4e771cb725827c3a7d4e0e0316d0884213b46224c2a790aef383325c8f4ba40935f36cdc559a9187b4c27822cde1659d16979689

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
190KB

MD5
95150d592c1e816c1ead17259f50ee8d

SHA1
d3099494f83ea8e2d1aa278289cb456f025c92a7

SHA256
f45d8f97a07e7d29ee92cdac159aa84f0e4c9e51f3c057e6a5dd1945289d7bdd

SHA512
8a3fac264ec5e01573ca5ee63bd4585d6fbe4c86d1b22b5a8c839eb3d05fa2c0f1a27621153e3c9e1b5a92919cdb43d1f9f83565460716ec13783e8fcb3ac2c0

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
188KB

MD5
6551c1f3ab748874ac0ad2680946de3e

SHA1
23b7fed6abe8fd3d8784e9dab7e3fc3ddeca3364

SHA256
796fa4e3678d468d6ae4ed89f0feaf3721a6c445dd79541a4cddab3bd6e055bb

SHA512
50625427cf308f9d20ede3721b1a2b67caa619b4a1188676db7748e97b5d25a26f9dd5d7d1cead1dd6cc545ccc6c50751175f2f031cdccd30e2c73060eb88420

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
196KB

MD5
9f8fd63f5aa4359b45e5c3c358d0afae

SHA1
c24c32957dc4659750528fe067c5b48d23e346db

SHA256
2a57619538b68757f7a89699f54f87f05a9882531ff8e4d9c34075d350f42f11

SHA512
a48f8213ee66c3c5ea23b59f640b36a0f0e7419b29cc7ed5beaee6b4e27c1d702eff83b619ce16d1a39c1d45d2e08b17ccb6613f28d0da61618b644a8853ad38

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
199KB

MD5
685d57dd30cf951b5d2a7459bb117ac1

SHA1
54f262437b9bb9b07d7f0ee1d623ef540c775f68

SHA256
f1d1b44411f9ceb3641310643546daafb91bb5f36afff630db600cd80b8eea60

SHA512
76ef12ce7bfa0e7724d3d9546fea132a4b1582ef35c5c400bd5eb0a2f9a942ef37864501fea707b8e568c60faf1fa86ad965c488964a7d97e88941cb1470ec79

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
197KB

MD5
fb20e39056585fbf1f78f98b0742c07c

SHA1
30d99e4cf105a3ca2a0b25457ffef6f70d5c4b54

SHA256
dd2b5c3a765f13a4c9a09e8ae10c12317a20d4ddbaadb9de4b87eb1f55e8509a

SHA512
308b6a1e4abfda656825cdfad7a12f6a91e43f180c0ae968b844ae45c376c440f554ff833c099cbe0b82ad09418c4f9e0322be42b6326d2a03967461b746adfb

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
189KB

MD5
746568a84f92ee758e8956c2859af2d3

SHA1
5303cb43ec49effb1b95027cd003deb271ee617b

SHA256
cae9c18c4d4f03c3030b2a8795c45edba03196ca71e756ee75cccda2b565d027

SHA512
3a35c16637fe4551f413871d22e5f669be34f6828b088052ab54225a873e6041d887ec6eddcde490a9e9b1e231e80797fb0622e05e443bd00967b435b38a39ab

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
181KB

MD5
a6e8599f8f40188509fa3ba284786754

SHA1
c54c0fb2e1edd3ae97dd9198ddeea59fe1d137e4

SHA256
fe156584cd576a37c7bac2fc896834503d41c8245bf238ab4b4f647925f5932c

SHA512
3bc4d8cd80418d71300dc96eb8b936ac84af5f8b361765603eee90d089310d93755d5e64a0f4ac43213127bda6f533c11613dcdec86eddd8741639e8d4e7b108

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp

Filesize
191KB

MD5
d70e56ae4105a983e3d94e8cfbfa8420

SHA1
37fe231df12c4fffffe05574a8813d100e4a36f6

SHA256
b7562844190a2df4a5f9e9f827df91717a1af9b53aea71bfbd039fc1747a5cad

SHA512
c34c5dd63d58527ff9f7c66be90baec646e8a1fe58d6c64b3265a4d7237fa02a0cf7a313264ef53af8a4b0f4514123e6ab02891b2fd8f7991604bc6d12aac9de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Examples.lnk.exe

Filesize
181KB

MD5
2a35ab7c9f1172d5dc2fe209fb385be5

SHA1
60557e15bbb7e0d912c7d894442c91e08f5fa73e

SHA256
5098201aa3e0937a35bd01a883a317293bb32eab2874e9d3b2315f811fa3ecdf

SHA512
6d460e5d279c8add1b1c949df10332d7de84ef335eb16aee3d15bcbc33f78bc39da7f4b2112718bea2cc04ca714d0998334d8bd79500b2a30e244805a54f40fb

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
178KB

MD5
801c6e682c54fd56cd0f23e034cc614c

SHA1
bb0b49c94a0f6cf614ac9c8635b1cec87fb23c15

SHA256
aeeb93790c584695d9063c812e66da2560ec277f68f4e9c2b7812443fac3c47d

SHA512
4adee5cb74455b63413bcd8c5449e4afb51297d3f7e2fd3e32d305d4e93a31993e0c9ac67c9d816275b14dd7c6bad07d41342a58318e84ba482d856463bbd1f8

Download Submit