226c82f680a0d47bd6113bf7282ce69addd83ac7619e6d20d7bbc1a8180bdb45

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

226c82f680a0d47bd6113bf7282ce69addd83ac7619e6d20d7bbc1a8180bdb45.exe
Size

171KB
MD5

2527ab738178bd8395d74b256c0922de
SHA1

946426c736faf51e478323f9d028370e9946a301
SHA256

226c82f680a0d47bd6113bf7282ce69addd83ac7619e6d20d7bbc1a8180bdb45
SHA512

3c649e9be8875db980c55f6fcecda9f5e6a1053fbd70ca022776c65371a2f87ad76a1fcb3ae095416fef8c00f01d7e4595726a6367605a0b3a3bebe000258a68
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eBSWbe7WpMaxeb0CYJ97lEYNR73e+eBSWu:RqKvb0CYJ973e+eBSJqKvb0CYJ973e+D

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4913) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1312	_desktop.ini.exe
932	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	226c82f680a0d47bd6113bf7282ce69addd83ac7619e6d20d7bbc1a8180bdb45.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	226c82f680a0d47bd6113bf7282ce69addd83ac7619e6d20d7bbc1a8180bdb45.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.Core.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\cs.pak.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFSHARED.DLL.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\IEEE2006OfficeOnline.xsl.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.TypeConverter.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	_desktop.ini.exe
File created	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMICAUT.DLL.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Internet Explorer\hmmapi.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	226c82f680a0d47bd6113bf7282ce69addd83ac7619e6d20d7bbc1a8180bdb45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_desktop.ini.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1312	2888	226c82f680a0d47bd6113bf7282ce69addd83ac7619e6d20d7bbc1a8180bdb45.exe	92
PID 2888 wrote to memory of 1312	2888	226c82f680a0d47bd6113bf7282ce69addd83ac7619e6d20d7bbc1a8180bdb45.exe	92
PID 2888 wrote to memory of 1312	2888	226c82f680a0d47bd6113bf7282ce69addd83ac7619e6d20d7bbc1a8180bdb45.exe	92
PID 2888 wrote to memory of 932	2888	226c82f680a0d47bd6113bf7282ce69addd83ac7619e6d20d7bbc1a8180bdb45.exe	91
PID 2888 wrote to memory of 932	2888	226c82f680a0d47bd6113bf7282ce69addd83ac7619e6d20d7bbc1a8180bdb45.exe	91
PID 2888 wrote to memory of 932	2888	226c82f680a0d47bd6113bf7282ce69addd83ac7619e6d20d7bbc1a8180bdb45.exe	91

C:\Users\Admin\AppData\Local\Temp\226c82f680a0d47bd6113bf7282ce69addd83ac7619e6d20d7bbc1a8180bdb45.exe
"C:\Users\Admin\AppData\Local\Temp\226c82f680a0d47bd6113bf7282ce69addd83ac7619e6d20d7bbc1a8180bdb45.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:932
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4216,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=1760 /prefetch:8
1⤵
PID:3808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.exe

Filesize
86KB

MD5
a620167ab699fdc3439907402f16f4cd

SHA1
a50e21efc2d42a82698ba9dd21e692e0260ae679

SHA256
8e6302a7829d4680b266ae95b04c2335acc990315cd7cdf86bd792b44b05dac2

SHA512
5b626f3d8df1db5fc3ec323ed221a1699e4263c27763260d86ccf1634503d8e83aae61f3c0b3286f9eb65d7bede86fba67e4e6b0d30612805ce7b8cdd6d6cdf1

Download Submit
C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.exe.tmp

Filesize
171KB

MD5
7ad351eca29c7f7b04784c8446a97a32

SHA1
f0d184efbc3afa4ac9e94acc9d180b115620275f

SHA256
074231bafcd8717cdd1fe50383911c1a3499d05b30dd4a87fe0f9302df278d05

SHA512
fd26d3468f7e8c21e10e10a3859b4a6f7f24767317cb02b0221b75d80d5066478846c54d1b958746fa57fe1e0afa200044014e23c508048253d87316908d97ef

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
198KB

MD5
741f97df8ce4ebba5c808a38a4b80924

SHA1
d5e3fa140690c5998c6358509441171fdda257f7

SHA256
5b8263734ec4c67f374ad0ced523f01e3ac8c33a0f0e872dad693a7706901e27

SHA512
a1212324abfa44a3b7e793604399ace9a29d4c02821c4dadb35c78aa5e0b3dff926453d89756bd1d88cfb9fae8eb115db32a45f7332383a63fe2cd3844a837e1

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
198KB

MD5
4cc82342e2ca0de3f78c48fe5c26b028

SHA1
794f91721d55b0428dbbe11bb864f6ec8c70f261

SHA256
48c5f0d437d8426dcd2ca10f8ea5f3a67d8effb3b488b545a7fe22a75351ebe3

SHA512
4fd5fa41e34ad14a693b21e518892472f31725fd80870454863a7ae4fe559cdf286d4b2a5e1ca4b9d92e5378686d62ceb0672cd4235968544db3f783d6a11131

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
530e7b143cf900d6d00d21da59516855

SHA1
842cdd8f09b95aedaaae61f0eb5c27dcdc2175f6

SHA256
322f8d95cd1b405507702a7c5b0df560c36fc55aa63c28ed9581535578281a5f

SHA512
4e06dc4288a08be657f7d87420c0b9f22d7b717b9c22a9440f45e4a813aa00b4aff497b5da6ecdbf99fdee877692e0ddd9345f9f0df69edfacbfaf923b574d1a

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
629KB

MD5
92f9bd09250c90bbdc2ca33691d3d0c1

SHA1
ed3803a46649c4131baf557a3cce24dea9eefe87

SHA256
d0fd074f04cdc3db84fbc8c85385a6f406879cd200630282ae0cc4987efa9215

SHA512
a4bf026ec3d9661fff79c40f22cc7d31caf585c9ead3c249c188b1153098a897ead029281d49fd0c3b34fc37c362d8d07f3e2237e6bd7297b0cc2e0032e702c3

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
294KB

MD5
61fdc56c328fca69e7e98b2726d41a0f

SHA1
18557eb38f0d6f255fead5f241c8b55c0afd8417

SHA256
f32086616ec3513f52751e8a70fe0432878cbbf808d470232eee559e133b49c4

SHA512
d686f741d156c28d16e61cbbd5183fd9cea25c53e696e0498add0190fee2b4824c4f13ca9c07675b3aa821efad66c86045f1231b3f8e9a5d93c8b597da34a51c

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
274KB

MD5
bb6abd40fd42c02e564a2fb2a016cb4c

SHA1
154b6de01e682076d038d56bd7c7851a5b0c77db

SHA256
84dd010ca65a1040a0a78680fcd23eeb8fceddc8cae71c3ba59d08f27dad5e16

SHA512
632abeac0599896d9cbd03d8a18c6adb311968449f3f350b30c757a19fcefded5b370066fd91ac7f7ddb5d3845bb44cfa514a81ec9822aee34dbdcc844433488

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1016KB

MD5
867a1597b64ccfb13b2884a19a2bc9fa

SHA1
c6ce8bc7dd6af326e4957b0f6885dabb658f608a

SHA256
7fb2c150978c26a5435e6a72a77df96980dc4187641b04a0c14b4d1725071343

SHA512
a69b23a5ad50aabef6a0b289793ea2f66ef5832a91b37aff70ce2c304a7cff133d99e81ff3f2be068c40e1289eb5e0a5cf287cc2f3f06ce7ff44d655bdc8ea4b

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
769KB

MD5
2a2ca0f31fd62ae81703979a2a26ac65

SHA1
2dfda541afb64f16b7954c1eee4fad17096f6082

SHA256
d6728697ef64f2bb6c2b10649e9565b5b88a65e911a9a5a7837e271a841e4f60

SHA512
d86cf13d1cf9786e04679af72350b9f2516e28660130ff600183bdbbdd72a7471257082523695a32c474362bd6664634cc34003d85b71813101916a78cc1c564

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
142KB

MD5
06eedb25e32423419fa680694d149ad9

SHA1
34b3f1659140ef727856956648760a3a7fc6b335

SHA256
32ab58e952603690e9f633fe90086705941b8f592588062ca580331f5d77d619

SHA512
6847da44e387058f06ea66ac44564dff09826ff94be3fccc313b9f0dd1905f2c3133f1734249f396ab7f8d2513f6624b81f7f7bc562bd2aa74cbe1768861a103

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
95KB

MD5
30d0e49e56c51c421bdd6916040f4d1e

SHA1
921a2d97a87b523fd9b1e57bab40f70860bf0b38

SHA256
a60ecc246334f138342da2e34036853fdd71df71e2072e535ee0764d7d89d905

SHA512
1284a35881fa2c2705b54a49d2907ae43e6e4b54a137a477facf074376a012aad9f10eed4270659cd9a157fe2439100daffda36c3002d33a40bd160b7f3ae887

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
93KB

MD5
3267a24f8d3fa1fdcf5c06a59ca83de8

SHA1
fe250e9398cdc78b20198fa63678027cd990cac9

SHA256
96c64477cb4dc1a690abf115da20b437596dc05e24aeb5f223ea925b747d77a1

SHA512
bc4b46220039562870e3ff3619e655b253182966627a4d7e00ec05d890fa4cdaf81772eaa41d67d5c4081b26e1f0d29b119ca967e751394940d7500b6a6e0b61

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
97KB

MD5
4f182d9ae844491b52267fe3d2fb670a

SHA1
0fd7103e0a7680255b62f1dc4f1679fec4543558

SHA256
f510e8122f53ae3e6ef7ba6befc84d0cd1cf6aacc1fa7a1b91be94acfcc3e425

SHA512
59a79851727911e67984a6fed09acb673e720fe8ffe0745e2494cebb42faafc93d84b60878310185b3d13a9824edbd5f63f64d28ec3b049935edd619025c9ab7

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
85KB

MD5
cf7e703d7689d9f5e7cd926a9291b015

SHA1
ae48723df3ab33fd3888746252ef3c7ea9dc5e1a

SHA256
49bb2576bb4174fa39c5540b96c2b7e52429c7556db3e02a51a1bd343b6f69ea

SHA512
c1accbe59aa463dfa35a7b47c80199a4c7f767c6ece43cd851e073ed2a426f8f3f3df7db9b2bb701e1c4e84460b91fcd368ce5da722e23560ae6f35a0e33789d

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
91KB

MD5
753df11d5903ed75c3b0ed11e97bf86f

SHA1
4dbe5ad5f0a17d21345f9651786de4fe200d06c1

SHA256
409528e9e542d639d9ca70c0a00d86a499304a9475f36c19ccb2cbe4b71a836e

SHA512
4ced37dbc98f934e326611da1d4c3e372e41a9e2dfd04a2bab7d41cf8dffa9ff9de41236f89fa814558e4828fded2676584dc7891abff2abb8b3ce7adf16eb04

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
94KB

MD5
9992c22ad5f65b326fc578f0e473e17b

SHA1
c793cd63f5f6ae3235eb9d4fd97680ee8f3f9205

SHA256
954ce29356416abb802e5b0ec15bd429918adc8f528c5448ca1ae50caa6007e2

SHA512
2b614d0e6e1043b74aea0e007241a4cb5d763915fbb15809abbcbf365a80cd72c4e01e795d6524100e4315d9222e4fbb72bd4610be8469b681412a8ae16fb20b

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
95KB

MD5
d88c6b8a1feeccdaeae0521fb2e7c32f

SHA1
cca0c972a9cb7c0f8b9056aea6bde5673519fbbd

SHA256
60f93dfa42b14c5c7298ab2a74702f50271cf853e8425648c21ea09f4e7fbf22

SHA512
fc9085a05f6ce16c91f01fdfcb79e293efc369019f9431ebb12301ea07d00800965689e5fc40f122dc0031a6f5919efcca8efb744c7de3df476253c02097f785

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
84KB

MD5
e966d833c414f6df7aeca01699093f5c

SHA1
f02714a55127f5091496c3c87b98ad63e60d1a5c

SHA256
a8c2d144f2ee7b52248cade70ab0753ffb6d08124af465d58aa35eaa42a3b578

SHA512
4571350a134839c84689eaf1836c41123b8b8afe861c36099de03f5680033e4ce9291fa78c52bb3aea3bd158dde0d60dc488b7f7c1f8321194fbf8f66b6bc87d

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
93KB

MD5
f2f8064cf3221bb4cd994f003d56f103

SHA1
cafc18b855edc7bc7cd78d60fb77cc47a2aeecc8

SHA256
f22ea67f859f39dbead0265f89893cc3e8dceac5ee1809c7026ca3db2815a9cc

SHA512
f69f7d1c007d2f05c8d7695f1a407640bb6baaaa4160c2fefdbefcd423eff7754103a307f5fdaab5666455b8a11418851e9db8fcca49ee16a5a716f77acb0a33

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
90KB

MD5
d0f72cc2e381c34ca73e448080c9e6de

SHA1
ad402c6703084ce8c5af54019934baa0f6f4e8b1

SHA256
4b6a680edb49d40b1fdc4f6f9dae5a520ca1273f768a86fa7486a1b21d1e514c

SHA512
e0d05ead71d4087628ee659d0f4ddf1bf4d21c09ff751140f3e4a1e8b3e386a22250fb64ba690e8e73ee1a773a29949f441ee55649de18a660aa243bb2c7b541

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
99KB

MD5
9d7abb175f59bac1c9a50c78d028a443

SHA1
abff721ba7f2480987bcc3207db6d39d836a9626

SHA256
aaa2b324ff63217892ea5eae0726231293cbb14f18d576caab9c3d707137f3a8

SHA512
17f652a894889d195e05ada85c3a898a3ee90cd2e97e97969250be484e88460f5de888ca09c4f2fd958ed893a4db2ee5458cccdb53a0edf34c8f88009a7f8b7a

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
94KB

MD5
4839295fc73d26c107ea263212d734f3

SHA1
844d218985fb3a98ce5e0757638e164cc066a105

SHA256
2407cdc600ed31b9d528a5efc4b6b0c3e9773dacdb3c5dba059ec416e0ce5e77

SHA512
462cdca6e73b3376a901be950fe168b7f4246974b8db0582dfca7817fad614dac44ea4fc3669273e9573160f970a32bd92d2078c6d6151810d68d43569639e31

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
95KB

MD5
6abb2b40121445c70e9bc79c7fbec8ff

SHA1
16ecbe4bfabf7d065a9633afb704b1209d15a6cb

SHA256
f7b3032279dac41e20e965f1936dae5c52c7f91709c259c326bdc01edc270bce

SHA512
06743b62b156f4a0e6150c8388f309184775d5d7b4d14525a773f2db1f52537d2054fab7494707398067c0776f802ff40ef29851aed68208c89e5b372d00ebf5

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
92KB

MD5
aa47d78b6658b117bb6cb15ee4ad9e4f

SHA1
f5d2e7931b61897f69626d08517a10379fe04a3f

SHA256
190dafdbe22113634a5921e75396f8f526aa7709aa27a7e9f1977a58b1417300

SHA512
d1638bb88e0b53f39e6612b444146188cac6d94d4a03508a5395fb833ed2c8f5d7f9843b90a78a6112812733fa0edb8bc29a0979e73fcd75b34927b8aa07567e

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
91KB

MD5
9958f1c7cdb46940eee88921778a146d

SHA1
d887b404ec5d83e64ffcdd12dc867a807b2469ad

SHA256
57ccd88472841c809315c83b2d941411fdec079294722d1d92955aecc00fc6ed

SHA512
9cfcdb054820866d491dc5b088a664e0566df676aa73f9c078fdea14368b51264976b12661ed61a27a7bc722bc4cbef7f8ca8ad920f3968c00dba7d4e7c4941c

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
93KB

MD5
f4867876f41d255673267b8dc0057ff7

SHA1
ef5db2606f90629f5b99e4c387407b9df1ebb6cf

SHA256
f19aa10d72fa0556cf8cabd6d8f399f9f5e25704f2eedbaf58619ef0e09c3487

SHA512
e749930048d088d5037de278bb57bc85e9acf23ea249f4c453c6d05a7a46fd0985099ec5a90b463e2ca1772f80a120f5603efdbb300be2a25d0a7a4898bd61c5

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
95KB

MD5
87547aa8ea9bc68eadeed789b3e81926

SHA1
6040cebf3034beda6690f1ee3019371297bd9bab

SHA256
2d20c6bcc2edf6a2187f79069c1ec7d6ae9eb21890444689534c6b95805b9100

SHA512
e11330da60a049ea16d14013d34bfc096246daba51c1237b2faaac1c370dd3d31599112e2ebbdbe26cf67332fb69b486d26c8c0cdaa4cb388e5952a12547a0d4

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
94KB

MD5
f7ca834c6db9ddbf723875e4019c928e

SHA1
a607bf379d6df8faf3993290030bf4a5a8e062c3

SHA256
223825bb20bf827553e670e772719036639aae6361c7b6add1066286df192b50

SHA512
4bebb827f3051b07c5a6d643d6a44544aa12f906c3c870ab7adc876294bf582fffb0ee0cf598f8215bd90676ea648a67dcc390e69a675e41bc0a052b2a552ed2

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
95KB

MD5
6f1a4447229443bd93e537ebc6eacb29

SHA1
4f042390a175c6ced670ee534440b45d76ebffe0

SHA256
773bcfd3387f1223a44f1b22542c5921581c184373e0740dac97de5ac89635e7

SHA512
ec7ee1cf3aee05e9b2881f39f651d2b39f039ee1a9933a2d44bbb229a53d243085930f1053de45f09170c0218f6e975e3cc3b04ca9cd7d8eeabc73f224d613ee

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
99KB

MD5
77c6cd5c1da04624276bd10b76dc5c5f

SHA1
d24db934f8918812b80ead1163b9d952eee2a384

SHA256
b4e1eaf05a9ae00896cc872ac1733f2f3c30c7fae55c67d0a4efc9e18ba1180d

SHA512
b07847acf98692f718c5b3af1614be313b9a985a871d80f962a08c4a2ec5b47947fa4f260331d5265434dfc8625e6ceb7db1790b08a23250bd1e94be61a9748c

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
85KB

MD5
fe1559cb25420afc2ff61e2fb14ee4ea

SHA1
6ad360d0c9e4d73c19a054050d1c35359c0efe25

SHA256
a1f6eeb4a2b5ee603549f901b1d50ede826d54c044af577fb0ab21f9fdf0b897

SHA512
036d04bfcd9a66f453d84ac656522a9c09f48b8731af0c94a25a206e699ca631457cb117ac577f78388f0fd4c6048ae6dc9f27098ab4a5c585581efd801d6d6b

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
94KB

MD5
d53aca90b7577399c4f9b922b5b0dfdc

SHA1
d4ad9f01e9b36f4c4d7eecdae9a5cffc45c6b92f

SHA256
d2c37298ac806d58ca73f8afa31055090e0999fbc92b76a49a149a39742553d5

SHA512
1b5bfe6cc251ff26951a0f7dcedca56b1a9a60d63672a63e4ce3163afd583d9243becc5fc4c0cc9e9f027faf71d32078b784d0b069ca080671d707867a24149e

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
93KB

MD5
32f78d22dacbc788349cbe446a0396f2

SHA1
b4e058baee0bbdf88782bae5c12445bec0accfe9

SHA256
ead686c04ce219fa2ec4c95a70d5c87033daee32102639e3ba02a6bd3e5e2fa7

SHA512
d8ea0d823faa5b24d634bd8bb9bd346a43d203122e6e37e8316448157ed1b8162729ae46f1b7b6c63c11b1b05c78e85024d8b403026804eeaf7a2a166e2bbda0

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
94KB

MD5
4ca8ea5c3a895faa1eae82bf412d0ed0

SHA1
9802841c9bed13e5a105c8999c9e8f761e4674d8

SHA256
a4f12ddf3846f18fed7fb539cefe4ac05599d34622c4e84ebecf9128ae658478

SHA512
de3cc4447440874b16091a5d63b085a0b0e89ca3d09d58314605b45a9bbf9304b12a364badd50f427ec080b92b1ed7b291e89eab01ae780bb39fb6247630a441

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
96KB

MD5
6ec8fdc3f5c8f1d981949aaf341ab067

SHA1
51b7ba098a3ccac07d2cf6da346897c68c0c8ba5

SHA256
abdc73c9f0d1f5508ed080b319291aa5ff6d616d8076f1b20d1cf474f07cbf06

SHA512
526572e05169d9cd775d64691c29a28549001dae689ec690edabcd1632c705a83c2e8a881403e7afd15362bd64aa7f83603ce1d33c58d1686a4a29f5a5eb6435

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
97KB

MD5
ec991ba95034ec875a1de4549dfad8fc

SHA1
b32e73a850c1a349715c6aa7fbf0aa21aeedc774

SHA256
52e7b1480b9259ff4be80f9d52fb6be524e2969648b3da9a40dae5279b588d29

SHA512
1b944ead1354c9cb132f1fe9eaf73458428835cad111313bb846d1e8a681c0d220fe6c203726252cd934c1d6efe76630e164c7f668359fbd62bb982f0727d820

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
91KB

MD5
17a397c957fb4b380fd4bc8374a5652b

SHA1
ca1807410b3d19169837079819edac2e62276c96

SHA256
891210dd83049523ae60ea16c0caeae9c56dab79d479fa59f04bb716aae9942a

SHA512
74ed01bb6111c61b3345ca827107c8258ab247dfc49c8bdc0f2e08cb473fd7e166485d76063e0cf3fa7992b3a84517b921740b88b45e36d464b2ec263d53ef30

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
97KB

MD5
5da1fb1a737e039e136ddeb76570622e

SHA1
e9c211000c05570012b70c135c32809aaf58772c

SHA256
b82241541926ee3ea900c3a02b091741994fa19288308a2a0d01d4bb29f1c0dd

SHA512
629cbe48ae797b9d3bea1ef821c3b3ccaf71d050bf7c1e1f529cff5bdde5b4f92827c8bfee537bd19cae15ada73b64f4cda7ac7f9bcf8a3acb9927cffd289eaf

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
94KB

MD5
70a5995b533ea21f1c202e1135f7d3c3

SHA1
0bd168c0359c4382ecec96ec94e1ebd9d0c79b28

SHA256
58a644e2436f5c61e97e3a6c6794aa1e08bb992278be5bebc96bcac162b427d1

SHA512
bc0d434c507ba5ed66ddd4e9d1b75bc0155ccc7b9c3bcfd588304e33fc65cfa751ac20b9149c1addfce6bec370f945b54b5de6b4dace7a32ed761f513113b5f0

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
90KB

MD5
bf03ecc46134bacdb595d40c5296fc60

SHA1
648e494489efb6b26d31332ebb21438cd01b7fac

SHA256
64ee42e6d3091c32f5da5f2de21bd5c64ac0987461f9700ab63a2c5d3f227df0

SHA512
ac94f3975529daddfa665282dee2e9dbb4632637c60695c5d916bfe04ba2ac25f17b8e46076b932596b4d52e3142f6b735a8125b5c2c94afdc4b3fde400a7608

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
94KB

MD5
55aec008126a7ec973384db01ab2eae9

SHA1
33c0ea790dc3a8b816501a8206a1fa35c3963496

SHA256
36ba66dcc1654a8f5b726dd64191f32dc8c6c044143f6c6f0d6ba20eeb5c2c04

SHA512
5c925c9a8d9610dfb4d5f5be72f1d28a64af9966563f75a948c65dc533c8c62b7eed7fdbc53cfe07226d973769a5b4a4d19dcbb27a3ed5192a81dc224dba3a3d

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
96KB

MD5
49382064eccefd4e3ac4d2d389fd20c0

SHA1
0ba3bc7c5b713fa653352ea630c95af5f3e0720c

SHA256
83de4f00f7dbe67da0ddbf239f344bd1480a2935da81b3fbbbfd5caa4d87bfa3

SHA512
0e414a8978a0666424588148dad7fe9d8e4fa47aa71b68704c0bfc6863264ce64a99020755b823101015dee53fd3ce1403043b9b37833aef410d255730ec18ed

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
91KB

MD5
28563e6f4c0c10fd3c232d638705a89c

SHA1
6764f65aea665f59e51c9a51e64d0747ec3658d9

SHA256
c5bfd7f3b91116bbdd0fa5e0e37911f68dea3691930973b18304a746ef9f4ea6

SHA512
c79ec989ea8a3161459295bacd5dd877daa6ea77823a472ef3e347d6a11f62f29a60ff6e317b376738fc3494df5e6142615ead97ca10135eb1d95f82f43a62c0

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
98KB

MD5
f51027a1a391fadc06c6eceecab088a4

SHA1
9fde43f70e8f005277e8b2b9a8cbb903ee5a5b5a

SHA256
30658a9052832f32a76ffe9cc738e1229ec26a67baafd91c711dceabc81ef807

SHA512
1fca42997d854fde2ed901e48eae839b533fb41a569cba1305b4ea1f29e500c44c18c3e2afb0fe70881326e64d0fcddf4b8f0ac5dbff268249e7a3998a0d5477

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
94KB

MD5
bd03af4f81ca90b1a947a7bf9c525a98

SHA1
75c8128ddd495d280a7ae53b283734c952912811

SHA256
df2a89cb72e26deafebef924d2cc3df4de636228e7ceeebab8f1401e3f0bcaee

SHA512
f2c250130abdb136644f6da6517b3ea310d0cf748fe7bb2bd63e02e6bce9dd9c2ec9136d0968484cecff7e4fdd6db6f2548dc021ab9b150f898d72727795f187

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
99KB

MD5
1b856797d405c5540117ea172fcbcb88

SHA1
3c1de2a59091ac627e2e8f3ee91bfba88cb51af0

SHA256
a03f51397f10834b88509c3569cb9fdf77f0b83df6ec3ad74e581ccaca9b42b5

SHA512
4f9f01ba3fe992ed3cbf5130105714ce6a65b98326e489d29b056c4ab125060e0b1573e2c33e504e8202aa04f9fe052bc17e41ad1473106e9c7305b8715e1574

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
94KB

MD5
cff75da7628d69dc7769dacb3ffb64ea

SHA1
2fa095f971e6fc7ed8d14a0ebd90c529291be021

SHA256
b1fddacdbaa43224a21221cb54e8d9abc1002a24a215f2cd0af8463a07908929

SHA512
2dfec4e97b6e02b4d11d938c873645d8cb963cf55315b394941a6989b8bbf80b5b4b6cfbd243f5789b1613b545f7bb1aebb490a800ff4cfb70fb12b5c0fa9199

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
94KB

MD5
02738a252023b5081ac51e1c91939953

SHA1
35a1fc596bb5e6dba68119fd968e64f956adcb20

SHA256
6412b05559e23bc1b1f1963793567b8027485a8d89f93c40eeb7952447947dbb

SHA512
db557efd77ee2e38075d833fff83767a6214d0f65e19a4142444b38f061d530eb3084758aa6bb84e9ceb9a6c7ac937ce0102d37e857682a29aaf1b67c5300136

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
100KB

MD5
6d31954e85cf70165ee05e352e8b151e

SHA1
feac3e7121bbf16a5e9ac56e1ed29bf57f4dc3e0

SHA256
dd1313ad9fe8004966dbd8f38a464174e2f58424a3eb18ad017593443c94e602

SHA512
d1f93bfd749bbe7f885d7ffb55f9003d67565f79420bf1b4178457a728c1b016a56f356b3fabaa74e9f31c4cdecde12ef2c8657425efa22dc6b4b51d3fc705db

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
104KB

MD5
5a88d31bfece855f3ae61809956f0de5

SHA1
eebda5e2ebc5472ded2daa5c9ef0e2fe59fc7d24

SHA256
80a7efe9a9b819786f13f7092196bb000ce8cfbdff60f13f8de2754b6443d52e

SHA512
4f8f34b203b7c24e3dcb0cf66f4262fa20bccc7e5352070f5ce557a22a9dbe52ca97278e42c015af7fdfd80e3bfc0665fbf9730c628a81e78f6dbd6bfb4289f3

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
85KB

MD5
8019469e70acd9e53ee3fc95ebadfcbe

SHA1
a477a2016ec2d64b58f70df6639aef068a47da9b

SHA256
f94c657376c5cfe976a43d142edb229e0213db34848631b7b6ccd5fe9b45716a

SHA512
a6632bfce9c2bf80b12dbbccb18b7a5302f88f839cf1f45e3d794c1544e8da62a321ed3e3a80ef65eb4cd2d4af8cee52830b60411d7f8a196afc9e54afbb35d1

Download Submit
C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp

Filesize
92KB

MD5
ae8bbe64570a02719e6a3c155fcbaaa7

SHA1
81bd2e4e296631451420134d7f96f822b646f68b

SHA256
d839c582ca497ea908d6e3328a56b9caf4ef3e11141887a9019325b489124508

SHA512
b2b47e0a258240e2e7bd80687d06e90a28aa9e2105352a937b3426bebee17c5b7168ba1ddb949551ffdbaeefea71b5659a6bfebda41f7259df8f097ad0a5d143

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
85KB

MD5
722e55c27c0380635e7fd05d39be375f

SHA1
9add2e721b9607086ac991d24e1486b06b407862

SHA256
8fbd09b3f6029f88590e9ac1afe44aab6e309d937202c99ba8b14c6498790f3a

SHA512
788cdcd1c7eb3f349233c2e13fc7df39e8825f265c402cbd664f7a936468ac899efb7d9f4dc126943b83189623f38d4c7cc075afcf21f489233d759c615fd7cc

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
85KB

MD5
cd1e1b95ddcb4a577ea74d274bbeb79f

SHA1
84a2f5035b40909c3b1d6ef54057d4051f916c22

SHA256
f8a27b40d61269584b73750ef0c2148d2123c4ce967982f5196a293b3fe5f032

SHA512
40971d1ec4398c50f32401d3853a873e05a79fd8d6e855dab549041995d2e934cd369aee83fce4a79898a0ff98f171eefa37d52e77d85164ae99a04b26e1ef27

Download Submit