8e2ae71441c368323abcd44f14c04a3f48f368c44a0c129de2ac15431b980c24

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e2ae71441c368323abcd44f14c04a3f48f368c44a0c129de2ac15431b980c24.exe
Size

78KB
MD5

eecc3480c2c8940191c0ac9aa1748975
SHA1

462e4bc6abda23a88bcc4bcce9c4b560cbfacaac
SHA256

8e2ae71441c368323abcd44f14c04a3f48f368c44a0c129de2ac15431b980c24
SHA512

261a0e570590ba194551742f28233755d7088edec0bcbf6a9fb2b72596a6946f261f5cf8185c60f58bf758318964cad7ee9e34516d139c9709ed700884fba3b9
SSDEEP

1536:W7ZppApBULcfpHLcfpn7ZppApBULcfpHLcfpi:6pWpBwchcjpWpBwchc8

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5247) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3692	Zombie.exe
2992	_desktop.ini.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	8e2ae71441c368323abcd44f14c04a3f48f368c44a0c129de2ac15431b980c24.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	8e2ae71441c368323abcd44f14c04a3f48f368c44a0c129de2ac15431b980c24.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ja.pak.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_EN.LEX.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\sspi_bridge.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsFormsIntegration.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\javaws.jar.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\redshift.ini.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\af.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8e2ae71441c368323abcd44f14c04a3f48f368c44a0c129de2ac15431b980c24.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_desktop.ini.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3692	4984	8e2ae71441c368323abcd44f14c04a3f48f368c44a0c129de2ac15431b980c24.exe	85
PID 4984 wrote to memory of 3692	4984	8e2ae71441c368323abcd44f14c04a3f48f368c44a0c129de2ac15431b980c24.exe	85
PID 4984 wrote to memory of 3692	4984	8e2ae71441c368323abcd44f14c04a3f48f368c44a0c129de2ac15431b980c24.exe	85
PID 4984 wrote to memory of 2992	4984	8e2ae71441c368323abcd44f14c04a3f48f368c44a0c129de2ac15431b980c24.exe	84
PID 4984 wrote to memory of 2992	4984	8e2ae71441c368323abcd44f14c04a3f48f368c44a0c129de2ac15431b980c24.exe	84
PID 4984 wrote to memory of 2992	4984	8e2ae71441c368323abcd44f14c04a3f48f368c44a0c129de2ac15431b980c24.exe	84

C:\Users\Admin\AppData\Local\Temp\8e2ae71441c368323abcd44f14c04a3f48f368c44a0c129de2ac15431b980c24.exe
"C:\Users\Admin\AppData\Local\Temp\8e2ae71441c368323abcd44f14c04a3f48f368c44a0c129de2ac15431b980c24.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2992
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
39KB

MD5
57d030fa6bf56d72c8ead7b4c8ed631e

SHA1
bb129b83c9443fa11c3d4d3ef7e5c4ac998dfa29

SHA256
6d0d90d3ad227385527ff17ef8f28e852dedc52e14da10a9648dadf39e1652c4

SHA512
01dda560552b9018b9c5c77ec6ef5c437518c3cbae9b9f573e02a681e4ff4627b7f2ba934bbcd659d30fcc24babd2556d519e5a83d465e9eacc23101872f5fb0

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
152KB

MD5
5887d71b1575eb0553470ecb9c55a2ff

SHA1
41ca02b539786410e62a645c71b6403842dfb23b

SHA256
05da9fcfcfd9741a8194eeb3e27eb5047a40a5c45299b5347b325bb67fbfdb9c

SHA512
6cfe162f24d147013c01018c701937656d53036e1505363973ea6571749bbdf36e9be8f455692cb13ddd6584d65fdf0e742eda659619aa8be59cd431305543d6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
138KB

MD5
d6120351238a3c2539eeb66919d6569b

SHA1
c31a3f851a2834eeeb7f14b54b4dc59862dc85d0

SHA256
6e031237d4bfe1034dc269ab47934c6cc7eb64e4c5bcc573020e95b32c64e62e

SHA512
7136ce39e4b3f5c8122dcd2b1417129abb254cbe12243e5222623902e8b8086f5955f70fa12c66b41e7fc2bc3e3a62e0ade9dda77f7fba581e0a6e509aeab49a

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
104KB

MD5
c93dd3bad16b44e132635b75fe4295cf

SHA1
a7022bb5b33aa5c693c4bf1633edee1ae3a4b831

SHA256
25371b69567c8466b027ad89b8d24ab52423c187e96bff6568e199b471b0ab73

SHA512
d12ea9a8a9749603dd0fd85d51c941d9e171eb0bf4a0ad78f6f760a2839312b597db35c754832f8c18edb20a439029cb35f33e4c578aef83d24fe3d9ac989cbe

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
4d21bc84c1af6c6bab7fb5c3ff87ea3d

SHA1
b30d3cce228bd32b3f671e9a16b5af051aabb37b

SHA256
fd62ef05e18ef33ef036e9d236de0960ebf23308279dc0b51e8c8de2566ecd99

SHA512
11e49cbca7bb89a1805d5b1bdcca6bbb5d3ab48ad3dc6a3c88f34c4cb9cfe7e64d7904b6473d119fc2e4a95e34df02f05e3397d3954a366d793cdaeb9b675b0f

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
583KB

MD5
52c69119527583ac8ca831f653d874b4

SHA1
d3880d14003292900360e95d2cbee81f52e6d022

SHA256
e3dd1cdd409b5a306114cdd1eaa086a790285f7fd336dab54f750e9286c714c7

SHA512
1fdf832655dda9115806fc061e1141670d50ee9a31eaba8794b545ad577793441c42e644202fdf5e82560b15caa4a342233663a7c61e56305d2cbf2cb9f282a7

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
249KB

MD5
db2afaeee4c0b5b01a9c98aef3f48b9c

SHA1
fad076cc5a242ccbea74e804ad0d49a80c235182

SHA256
072bcca34f93ee4ab138e363282b84eb59a34afdebf3de897c87b818ed65f73e

SHA512
2cd65fed43caca3c6ae53d9f952017dabff338fc8927aa159bd014ec6831a800470c4669eda907ed6ef9735b154e26d92f0f9a3cc071fb17bc9b0589833e9c84

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
227KB

MD5
66e2ab0530a54bcc39b3f27c5b80d6b3

SHA1
c7e1fa4c86fe38de1ef7efb57b3de19dffda7bb9

SHA256
bf8209287c1e819a522e68f06eaa4471e94e5e781cd9c9d69f5a9ec7c92d788e

SHA512
22ee7dc665be3d495bb697a91c80c658f0711aac47d519f1092a6a1337eab5cd5d8feb674d023d4ccc8ba7a408863b735c730eb12c95a790311ef5eb995fa42c

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
970KB

MD5
57b34b8cb81f22f339ee6703604c167b

SHA1
253fe8898be1f8457b11e6053d3c5f0bb0c6a67d

SHA256
31369cc894bd25f2a6f84c2dbe5945d91cbf1c01140378752ac6e39288f3d22c

SHA512
0caacf61d2e31813e8402f4ceb6aec186d3ecb0e3fba83847bd2d57af6d74acf00c32e2cc72459895f5a8357b5ef1993d8b615ffb447c0575ad05b5c749f0014

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
723KB

MD5
0ca9406345d6f65c1f74520bc84419a5

SHA1
9257237cfd2b353518aa0f16c136e279e46a5c1f

SHA256
c430d53779f38f2a63e0cc24a92def41f45cef5be3805c2cf3ad882326689366

SHA512
19ef5abf0a0f8fb5664371faf389d61800a3c5854fc5cbaca1e604586b3e1be0cbe3fc9a4054aecdf0c2d7b990a503c46e14a6c4b3a919b55624f46cc5ca965b

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
96KB

MD5
8a440824e85a4a734f64f06bce2a6fb4

SHA1
71b0645dd4c5bba1350c72dfdb0ab57a817a85c6

SHA256
c92b361f2eb440f7d38ca8ff86b539f03c8d2cf1921103e3f959c25f38191758

SHA512
36f8f1eae65bb066b3ce977feeb891658c14e52f2af7d6cbc374571ec9be4a6b0722b8def396f5eae13e7d69893eed7fa18efba5b1b99406b820b41bd4a43d34

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
49KB

MD5
32eee599013c0fbdb0d4f2ee6690850c

SHA1
2a0ca42201483edb27407ec48231858cc76e323c

SHA256
1ea5c7dfe49ee8eba4bb6e39099277bfa95eb441867061db981e9c99a22f893e

SHA512
f50c35fdd2523c7d6a60e3b5de4269249ecf97d5d1b8d4cd14e5356b0556a4c51648ebc3a321a28ad9f6bf9c31b3487bb8c2f8b7b79e4d5841ede785e1d4c6a5

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
46KB

MD5
0a1de7e0b675837a70d94198e7ef0073

SHA1
2139eea3999462e3ff3be935df7e6dc9251e2996

SHA256
7b2530c84d62714641fd3f0e68c3ab01cae8defb4e01ac501d4d30de45c5be0a

SHA512
951b7e04f23e31b30027dbaaf90a4d7c19aa03ee0c4e754f4db125c7c0787b399735066ff5eba436bba391aadf083d05757c35d515aa1fbcee0c5cbb2ac580ae

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
51KB

MD5
008ec40f890abde378a4bff658061e7e

SHA1
d76efa3d5d70557c1ad9eece647730ed47e88c05

SHA256
6478df7021f85ca549974c93d633127cff5ee5232ec06f5d6018378eef3d1048

SHA512
ae950a7cb9031e4e7b9e25287da08ab2b4f0d5eda8a981721bfec209042499540f8d5da709d3272b3a7026a5ff90f2c3abf515e10169399c3aac2e8c6f03487a

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
51KB

MD5
477e01162ff73f8e1526cb06f6f7f6ac

SHA1
a1440877d460b32eeb83f014a75c67ffb70e6adc

SHA256
1aff9498a64ad8cc0df6a7044db63b6de34ebbb26cb3234ade269a12d8436316

SHA512
d5cb5b85b966f5d95023c34ec7628f0182331de575e5c5e3a3997eda6fa6d5fd9df8f8a1dc564378fdacbdf3cab84ac5ca7d31ca12f02057f68a708534fc6788

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
44KB

MD5
7530218a94bddc555933e4ac33c50169

SHA1
ede29442a8c771a1ee9febf163c0b61323de430e

SHA256
8b9a068ed249299362f98b3554e20d9bffae57b6c24799e0a8c6939c16539ef0

SHA512
688fa0e10d2064eee9b4dea98e35e5e90565c437d7e5f2f83e40f95ff4cb8f5fcf6ac10d2a5c72a90fc8138196a9a051c767aa8c31caf76a8dd0ed859329fe82

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
52KB

MD5
6c8e9941cacc337be828d74dc6bf14c9

SHA1
c0de0119ca051762d680c14b2945bb3239d18a80

SHA256
1ddb80d6dd12c959c6b98779c07d302d0c2a285cfbb663e600b468c19526cbd8

SHA512
49073b1d3ab9382616366ac567dfd9093550cbc1bba9419a8b3626cb54faa77f6b81e65f5a7ff6a6608d527548e4b8ec43c7f854420b53056ac72f7049662775

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
54KB

MD5
ba3592eb9070e010cdf068f4219e9daf

SHA1
b60843220e526e927320f8cf565404a71a88ff69

SHA256
7efcd833e8a6f433b5584e6a58b9e27a247cb4dd8739d14ce9c251c57b8a3274

SHA512
096fdcf43deb9de0c6ce844431949f3de9c61fb42cd6f5e79d9a2dc1a2fc4711f66594286c6b739103ca04b5e86e7f444db083b2513acce217798d01b07c8815

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
44KB

MD5
8403a6abcc2e823f9fc1ecb83b75d4b8

SHA1
220154fb8681db731c6d028b1fb1c23520b90f1a

SHA256
9520bc955a8f1ffbfe298c21a84c1f4e545bdc2b29610dec34392909f65c1145

SHA512
4d9dc9255f4ae995778eeb56510c2af7a88670cc2722ba74888c18766bb0f583f1992c1d5675a0f9c6de482c656797faf873eb47d4afdca76ef1dfd38ccc47e1

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
48KB

MD5
a27874200cf8fa043084e6de944ed101

SHA1
f24ec6a60ebd121a7a23780c5b95e3503b1195de

SHA256
72ae6f14eb78676636cc14c7ef6a110d6dff554e355661d030aef208e4fda4c6

SHA512
d51396be5e0c8eeee9789979eb005ab71edf1300524325ca86eac45a8c4bea95c492c6feb12ad4bbe17a7084a1edf2050505f5f98176dd56f485554d1e6dc469

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
50KB

MD5
50a1beaedf635df4ba0ece8a2e19a7fc

SHA1
631d46dd35fb915cbdc1dbf9705588b2795b079e

SHA256
61735e4f8e91f9e1354d74174dda153bc712815750b1224dd0f87033eec63d54

SHA512
9d1d3913449e846eaccae6585797f893ade8f67aca2fce3adfae11e83938bbfaf9dbf9eac0c44ce02360fba4bcf81f198f014913e7d0c5215af35945a63e51ea

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
48KB

MD5
3f625d6383cd812e40b79b3df82c1d1a

SHA1
a6ede8dbb65b8ad03aec472ad326a220ff884472

SHA256
a8355d12c2ea5f405159b23a2f69c006ce53c476623dbd1f3aeb2d8fbea4e554

SHA512
2cb2bfd450e9994ef53178486188ffb07320d7d4fb510e5ab9e1c01935366922d11d85df277a3b39c89b773e8983962e301f0f086ffdc39a22ef70ae79124e49

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
39KB

MD5
a2aa87e981b6180bfc57cadfc5888ee6

SHA1
4f0d87e8af70a68f8ff64cc9c2de43c452f103ef

SHA256
7c9ab5ae0530613fec5005d1f4a66d1f4146ecb52d1f12ca7d5c0b270bdacbcd

SHA512
868fde00374642da2b181bf7cd4d0c04cf72bd4080163dd501f02c6fd8e13e23ab166c43b1b656e8a9302bbac7ca5cf753bc8ffad5d5c2b7d846b7a008bdfb3e

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
47KB

MD5
108f4bcf02a59fd8c0f14acbe72baec3

SHA1
e86b86e2bdb3ba830030abad2d9a5f8053a2dce7

SHA256
e9492c6fca839e7cda147a0ebde8292898c5b5d830c7be166bf232e342b5eefb

SHA512
4364b36602fbc122f2535bacbb045f2301e9401ad00529fecc74dbefe55affbe239a5425e5838e170cd4f4e3805786ee1a37ac31bd141020c73ae56465bc79d6

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
49KB

MD5
ba0300b6be03b8f7a609ad61ae580dbe

SHA1
3e1196ca497d94f1a259063ed11c344d54f4f009

SHA256
a8716f0f600d2f1c85cd955811e8b7ab1cf694a5ddf091694081ae306ef154d8

SHA512
59090aa303105f15b2392efedebfa301a7a9e99d773ef8f284fe396e452467a6f0cd3cbb418ba7ecc893115c3474c15eb4c77b9b8e605f843c694922529a0305

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
56KB

MD5
e2d694f3d6c4c1b839c04b49efee6e0c

SHA1
a7946ff159f69824f95fb7f025dd7d750dbd70c1

SHA256
5be54758fc59cdd0283765348a6b8b39bd108e25f643ee96d196f000f76f28f9

SHA512
7501de5f8000c8513f8784ee64820e361308c1d5c7f534fe4bcebea9f507105b9df1a8ce933b5753efc96e4a6465adefd354b3896c0a213ca01ec22e30d62b81

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
47KB

MD5
0d7f061278f38af32aa4057758c53cfe

SHA1
5a10783c1b1fc56b09e0b8b901de606569e730dd

SHA256
b7b40688f22f00b5a913822e10c863e68b6a6acddd656bdcdf2fe60ea55bb03d

SHA512
7a6f89ee8831c0142acb3f34ad63d7838fd11a15243e756f6bae6fdd6b11f38fc77e2c70f462a438bc5c558bb8e42f23c3d3c74f33b2811f2f3734b3e464319b

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
44KB

MD5
e974275c1962b023297f700d70a2709c

SHA1
f95193c49964885ab093e30a57caf35738c06c94

SHA256
a121bdb64b387ac62c85a09b2145d9dc9854c9a48bf203f553e592767dbc2a93

SHA512
96a58ddb77a7d1adf9699acc51f536e870d9621207f65a75730f7143b5a5bcdf4b1a7aa2da25099b9494905ea20df8310acc0529b02bb867104f680fa4939c80

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
49KB

MD5
0f43b7ac792125784f70019812d12c16

SHA1
3469b3bb01349c0eaa08d882c6cb56f5df04af25

SHA256
f7dd06686a7a9e6579289421e742634076d5ca8f4b74f9f79b164269f9cfcb79

SHA512
1e75bc56bc98be1e0be9b604c6f461ccaf1f2bf1927bd6630fb3431aea53eb7596f0e64944832751312548f4c374c222459df8a70bac412bdec0d4ba3f8a5bde

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
47KB

MD5
5919f3fec666f8e31a791707512f399c

SHA1
d11c88d759e4c6ad7f974d3e3991d97a50c9d8e3

SHA256
f6a3012a3b2c9dccd171fd067e684faa6b3eb76336b3c06f4d7a08e89da136d7

SHA512
8528d99238babe05c28d607f9fc6de5000a2b75697befd467f69e58c89560a206c0cc443d64536c9dfac6b5723e93335a929c6f59ead881cac45ce603641456d

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
47KB

MD5
9295ff816a216d3875c44271f0486701

SHA1
36f1d5ac1855f8f31e5ba2f2128278f8a49129ae

SHA256
19e94f945c85fe95f9bb0e696d34cd7b626b9fef22523352d6ba617fff470776

SHA512
3ac2d0ba158ee6eadc37a029993d396431bbaecb622fb6f829e7c4e2324900317690c7674ab96a7724b8c05f5295e3f02a83adff5655dfc7a405a919209bd1f6

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
52KB

MD5
32e1e168bab7eaad78a07bfb5c6d8c19

SHA1
bb8dff15012ccd33aa4a107880f9491be3b406b2

SHA256
457506e1062d97c5f4dd381d16840ec179601a442827de36d40cf7c258336d53

SHA512
91b179e12ce34ef5547b71e5c8bed9a5dd315b44fe6bf6c8d68ae908d3223fa3c54a6c30a41b6f8a9635cb133682bb1dba90e41e5147fbd2f83609b6bb369e29

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
48KB

MD5
cf1e41ba6bbfd0f1cfc926ba60d5c551

SHA1
a32149dd7cb24e0618e2902d553ccc93011e80ee

SHA256
a2edee4ea5b9de9e3bc3acf154ac6fa2498644c8321b50632d297852acb7ccd0

SHA512
f22ffdf31888f996875384229879f089a54e9027924dc11cb377c79e6561c04be268f8dd8143ced4fcecae9a4b8b06c505db8322c215ab4fbea894f1405d0bc1

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
48KB

MD5
422ac27790746a05427a02f09dd22810

SHA1
f056530d99468839471ed1d9a3d8cf196ad14954

SHA256
8a06ad9f871b591ef3a98b86ea3382527a7397eb8d893652d5dc76f7e98f6541

SHA512
1aaf5e87b3d463b6c41f0b95edb1ea4723c1c8f0520276f5f067aa12fc39977aa1717a2155a796f0e70970e7b6a658e524260e330fc380f70350dc148719af6d

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
45KB

MD5
e9b2907e760718449163e7d199459fc1

SHA1
b9f94b7272164ffd5ff6acfb33016ba144cd6c8b

SHA256
b15d3f7816456244a32f9b4d7690741cadeae044deb1eb1907b355944a608b46

SHA512
9befdc336b136e074703393292598db3877ced7c31ed5930a1099885591d0aed05098a8864912cffb29527b818c72d7f91495b2787b2495b0420c745f4bf9bcd

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
47KB

MD5
74b28785cd8edd6bd6dfbc9419617345

SHA1
c5b7c409f73e5c6f4cbba69479f3242ad4d05506

SHA256
84f64f5459ff480253875a13e33212635b3d69aa93960b0f8665d3a0ed704ceb

SHA512
ef52e4d5eeb6ed87a371cd33f15bda8a5f56cdcc7420bcb48292917e5438259d12dd0beb28a0af0647a3abc01c603760ff16f6c7ed93e613fb6858364dd28395

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
49KB

MD5
5bfe51f116257d9f075ad42e229161d5

SHA1
ce0b8a7f4fc0cd8959b67136527cef01521f1e6b

SHA256
1943170ad874dbeab2f596ad78df52981bc440e7a66aa2bfefbf700a6909f030

SHA512
3ed46c56ab0f307b8ca52189d40e1aa0b2cee3ee59742fad46e7cf88731db11c54f7bd9985e7f93aca299b173446cb2ae7cab6b8ab0789fb77ab41ce82fa0eb1

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
56KB

MD5
8898d5005c1eab862ff825b74ac84a78

SHA1
1adb2232f8f52f431e4cf98261f4925b0c2ecf88

SHA256
023bfb1758eca9f0f4b14d22f34b8974ed1238d54fa954fafb9e12ecc394519b

SHA512
f079f6f7d5ae40ce61e3bc1bd99908d2125b5b31c47f47e01519f75573706d59a701dd4fc2344ab1c6cda8628b8c92617d7c363f63f3d3cb55130cc2fdab6a94

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
57KB

MD5
f6f68db3bcb60c63ae4f1c93dee7ac1b

SHA1
c5843a107005c60881f2cea0ee80949f7de89dbc

SHA256
604ba2bf6fe5afb375befb4e7bcb8f97578276a85b62833b1625867a6110115d

SHA512
e41937b65d64755f67d434dcbc73f0c776b5c974912166a420221ce73d33cde2debbf461aa414b1c2a31f7817eebefd945f8e4282eb40dfbcd70b8bd18d25a04

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
48KB

MD5
f7595880c90a9f8f88825247857910ac

SHA1
ab6595afe52a6958772b18700e407bf2dde69de1

SHA256
6fd22ff5550b7a5c3d8116833b34086303acb32ff3e8db2db84bee7eab153fea

SHA512
789892c0ca0d58cab2b95d84312011212f6aa7ca8dbc43e5d30dd64bbe8fd103e4e01671099c6fa2a31539143cde5594b84ebc91a90387ed61194f2e699a5aa8

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
49KB

MD5
0d0ca5cc7cdc840bf75ff43162176f93

SHA1
516596ec851569e0adb6d6c55200250c51332ed7

SHA256
807653efd8d7f27b3b8b4e74b62d942684a746e1f255a34666edfc734384b1db

SHA512
5751be68604a08c3888aeacc0efa52847678fe38f642680c4f52354301d1116848f911bf51d7fb4a45b69a270fc1183411d55d4d53cc08d417e336ae2b825ee3

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
53KB

MD5
3d436455b9a7ae6841bc8a735eeff086

SHA1
07511a8ae958e239e20ecc6709003c92c70ac6a4

SHA256
f54e3659ae156e10078b25b455efdb11d7e8fb8fc334fc4a3080343bd1932e71

SHA512
9e9f5c6aedbdfaee1b39e0435f0abc7a554733500751419b2f54f2d5c8c90693eb54528781e7e087b79ba1b349eaee519a7ad2a9999a84fe65c5f3e9d1c197c1

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
49KB

MD5
cb97a732fc455c8f132660f36e88596d

SHA1
203e31b34f74c0ab19696677e7186560ad8a2aaf

SHA256
e1938a7df9e5aba6ee87b5559649d4010ce1dca92dddf697496b263acb082003

SHA512
318fb2608558e54fa94858a844e563c1bdffdc4099a65443647b0b32d1710f0ee18f0c17c86bb31749edbe745911673584bcd4ff44bdfeb5ff91f3fb1b49cc79

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
51KB

MD5
126f1d2748f456b761b8be7c1f13ca72

SHA1
6abe77f71970539445ed6b4ec0fb956928bea1e1

SHA256
14fb74a3583c7dc26d4cc5bee4afdc924839e00b10821bfbbfbb012a3ab20221

SHA512
b7ca79632a201d24bbf2f2eb1cbcc821ff42056ce34b0d9e3504821d2b41a62ca91300875a745687a10de5615e8bb8a14fa01aa694664546486c2c29c17de936

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
57KB

MD5
f1dd47f12a50c1fbf24d8986c2d16be9

SHA1
93c184ffd243733e5f10abf185dca6fb506f6c95

SHA256
7fb61b53d05314940af1ba4292b9c53fd7c9ca4c0250f3307554fb56ce65f9f3

SHA512
f136644a6f8978dca2292529fb51b768414a0ebae0fb9afc2f941f40aa85b87e53e2803921f631539df5d41d24eb6f5ba3dcafc034424ab481f1b989035a8d37

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
49KB

MD5
1e55ab05ba3ac60826cc94b1b6a32907

SHA1
f1b2047751189aadbac5fc0a9861506cf77263a6

SHA256
538c7a5a1564e6719960bedfc3e4eb7b1728bca94d24730750cdf48a95ccf41d

SHA512
4ef5dd6c327cd684d600ad63b12b7048a1f3590f80dfcb749575752bd5afea096c5207cc01eb96a5099f8ee0a86076b25a9806fc0a60159583be094fa6a9a1a8

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
44KB

MD5
64169088e17f21844990b764d790b81c

SHA1
39eb204087c349310c082df521f237586d39e0d9

SHA256
3ea03378e5c4841042afcd8414cd8e50da5fe7d86ef1a36295a80db0c4addfbf

SHA512
ac1f141f787b7387a91045a37a3d417cf6bef0f7c37e563d31a60fd9e4fdbf3e7b4dd56b1e0e307169f45260092ec2473372357d82b210416d9b1765bfbc2ae0

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
51KB

MD5
3bb5224d237b030ea85ed9c1809bf127

SHA1
c2c9b7b5f211b942b2d8f60d8f5d19f29b0984c4

SHA256
efba8f0c71b6283dc215f6b6795c3ff954c3235040f1b64ee73dfe2cb9cfcdf9

SHA512
df3c9f5fe7e3c339da351e2b6d0a1d14323d262cc88aa268dd1bca16676e10004eb89a4d2eb4feb1c6ea1b5396a18437d0f51a23576ea05d060d87d774622328

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
48KB

MD5
c547559a6c85debd8fbbb486b0f69404

SHA1
4d5b6b2973e9ad4130848582c56bdf201a0da435

SHA256
45243e3946f90391f1af9dc5475ad9a7a889cf681a33ce2a3acf4f78034bd636

SHA512
219cfde27d230809e936bb2c05658ffb031f6ce8d2ac2058435d8339aae61bb55655ab669a7876f754b3f7c1f9bc7f98b9920977a9da6677ec7e26872249cb5b

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
48KB

MD5
89acf566ba8ae6ea42f3d29a4e2ca01a

SHA1
cbc37ead2e0e7b910a94b22acc78f7c62aa04e59

SHA256
d758fd828bb6c12ee9731f12f430191d8aa0995812b0bbd56d758816795376f1

SHA512
0a3cec7055ff4b85f9acb4f030144002750cbf1a4b145806b86a34ccd97ce54dff118daf30b73633464a1fae1ba1978624038e1b4f5545f0d5d322ac13fb04ec

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
47KB

MD5
155d026910c6dcf613355d9f8ca802bb

SHA1
70051fd3a7a95fc7f9e098ccf237b850dc14255b

SHA256
36ade4c26d0ad32fe2865e466671d5bb18a71badd8771e56a8b430b1429a367f

SHA512
8783b249580a71f32e48e120125832cd26753cb94534c0dbb3342920cbafabb4c4a49d933fdc4b0fc0fc38736d623360824f91505f239e8ef38c44e793583575

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
59KB

MD5
fbb0562fa7d28b8d9b090a67fec8d0a3

SHA1
b3a3f303723ac5fb4dc9fbeb8949979d855abb85

SHA256
d13d0d05bd7405e482d21a432d27b99551ff353a2daee0547f30534dbd8f80e2

SHA512
ac7296de1878c155ceef6470df281346a0b91715d481aafb0ef5e325ced35ee0b05bc34a7d79137f4caf2ccfb9783fdde5923b9dceb6ad09456d18b6b6ad22ac

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp

Filesize
54KB

MD5
0544710ab80881405075dfe8724e6a29

SHA1
657e94204d3beb6783f5dce43d616b1c3bd52a64

SHA256
d9a8ca2f3cd9567d5d75114aca4ade6bad00ff78222be4f0e4acfec49fb077e2

SHA512
beeff25ddc79a9b478fb93eb95b1ccd2f9ce038504aacc47fba754807ddb626b4c22539e5f2f2e35f2f605d3ab7453342e70880d769893ff1d78069766325ab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
39KB

MD5
47596dc3e2532c9cd2d46f48833e7e9d

SHA1
f9599bbe587265bb832f00483f2454c54e9eafb0

SHA256
40fc0287a3ed8ab0bb1453ca70f8627804559bea0484e35e32522a070ae2fcf3

SHA512
8075b50d154107ca6539dbf8d3a56e2bf0cfd7766b943d20e7769a9cdf3a99fad9bf06776a8f494cb8db6995843afad6e35dd74ac02bae284d2c8b01469e4441

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
39KB

MD5
313ace609398b2853a08dc73e07c75a9

SHA1
ae8684dd4ba4cb2ec3fb32245976a8ae21c51207

SHA256
5ed9139f62868a7581ce6adb585ce3261fd1185c554fb1726aa49aaf2aadfb38

SHA512
bd6065df94359b756907eaf642452d7b9db237a45ab6fb718d8759924d13556f7419e233b93bf25172f76815331979f769c6a63fe28c6d32f2d19013ebd9778a

Download Submit