94670930d4a6ff58257ed8f9f53db7cf535de0aa84334489d2fae607d50dd94c

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2024 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94670930d4a6ff58257ed8f9f53db7cf535de0aa84334489d2fae607d50dd94c.exe
Size

90KB
MD5

aaa856c8019c2ddafbe5a58aa02bbb90
SHA1

daeccfa6c75cd16f627bf22565bbdd787e4109db
SHA256

94670930d4a6ff58257ed8f9f53db7cf535de0aa84334489d2fae607d50dd94c
SHA512

911a37097fa4260cdc8dbc843565019281f9ba8899ea7b6d108c13f59235611b1332bb3c42c272c33551cc839ce8fdfb6c09eed14b91cc0053ed7fe3f28032a1
SSDEEP

768:/7BlpQpARFbhfyiyooa0OMiJfoa0OMiJ2kAHA27BlpQpARFbhfyiyooa0OMiJfo5:/7ZQpApHz8kAHA27ZQpApHz8kAHAo

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5270) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
868	_Math Input Panel.lnk.exe
3396	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	94670930d4a6ff58257ed8f9f53db7cf535de0aa84334489d2fae607d50dd94c.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	94670930d4a6ff58257ed8f9f53db7cf535de0aa84334489d2fae607d50dd94c.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	_Math Input Panel.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp	_Math Input Panel.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp	_Math Input Panel.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp	_Math Input Panel.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.boot.tree.dat.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp	_Math Input Panel.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	_Math Input Panel.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	_Math Input Panel.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN096.XML.exe.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	_Math Input Panel.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fr.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp	_Math Input Panel.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	_Math Input Panel.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp	_Math Input Panel.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	_Math Input Panel.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OFFSYML.TTF.tmp	_Math Input Panel.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp	_Math Input Panel.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WordCombinedFloatieModel.bin.tmp	_Math Input Panel.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Templates\Presentation Designs\Maple.gif.tmp	_Math Input Panel.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoDev.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp	_Math Input Panel.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-80.png.tmp	_Math Input Panel.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.tmp	_Math Input Panel.lnk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	_Math Input Panel.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OSFROAMINGPROXY.DLL.tmp	_Math Input Panel.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL104.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp	_Math Input Panel.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	_Math Input Panel.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	_Math Input Panel.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp	_Math Input Panel.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp	_Math Input Panel.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	_Math Input Panel.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_Math Input Panel.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.tree.dat.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\LINEAR_RGB.pf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicudt53_64.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp	_Math Input Panel.lnk.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94670930d4a6ff58257ed8f9f53db7cf535de0aa84334489d2fae607d50dd94c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_Math Input Panel.lnk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 868	4224	94670930d4a6ff58257ed8f9f53db7cf535de0aa84334489d2fae607d50dd94c.exe	85
PID 4224 wrote to memory of 868	4224	94670930d4a6ff58257ed8f9f53db7cf535de0aa84334489d2fae607d50dd94c.exe	85
PID 4224 wrote to memory of 868	4224	94670930d4a6ff58257ed8f9f53db7cf535de0aa84334489d2fae607d50dd94c.exe	85
PID 4224 wrote to memory of 3396	4224	94670930d4a6ff58257ed8f9f53db7cf535de0aa84334489d2fae607d50dd94c.exe	84
PID 4224 wrote to memory of 3396	4224	94670930d4a6ff58257ed8f9f53db7cf535de0aa84334489d2fae607d50dd94c.exe	84
PID 4224 wrote to memory of 3396	4224	94670930d4a6ff58257ed8f9f53db7cf535de0aa84334489d2fae607d50dd94c.exe	84

C:\Users\Admin\AppData\Local\Temp\94670930d4a6ff58257ed8f9f53db7cf535de0aa84334489d2fae607d50dd94c.exe
"C:\Users\Admin\AppData\Local\Temp\94670930d4a6ff58257ed8f9f53db7cf535de0aa84334489d2fae607d50dd94c.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3396
- C:\Users\Admin\AppData\Local\Temp\_Math Input Panel.lnk.exe
  "_Math Input Panel.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.exe

Filesize
43KB

MD5
3d51798bb3e30f25224adff23c8f681b

SHA1
81c68911dfe6aebbf8e988e75b4cfedb7d572d0c

SHA256
058202ab6da4946ab7c0dbff52a0a5d1a586fdc9c33ec0e805112c6ef8d7cb57

SHA512
ceb9be553be0ea8af13325f2b71f36787e17c4a0664a33f0dd22144f38a53c14b0cf690b8c49276bc7b5824408606ddcf130ed113e7f98fb70fbee5ed8732eee

Download Submit
C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.exe.tmp

Filesize
91KB

MD5
23a5a82a919852da1fca652436250fb9

SHA1
7e25cb51c5da0b9d9531e2338dcdd516e3abb760

SHA256
5c987a67bb614f2ee108122ff6fc426a0055fef967a2ac25adce25f67d271e4b

SHA512
3b87f73f20fc5c64c6aa97d6f58e7e90e654198edcdc977ae1ed8fdce80cbfd04f8525f832ee95474ad815ab18b7c5b3f2ad597b38c1735c149c87f9c22eb897

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
155KB

MD5
4be25770c0eb86144bffc0f0d6b20291

SHA1
a2779141591a75deb2a8f7ac2d764e941c71ff35

SHA256
ed08faf0f4b29916d0651d223abce34df7422173cbc31eb038d38b27c0f0e117

SHA512
e5d5671c075a73951f7aeb727b4895c39a07d2eae8cfb0c97d453813ba8f8b14d95f1361e3513a37adfee3c12a9cabfc3a5b2cf340f4054381177ee637341db2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
142KB

MD5
7dbacbf69546b28b486b00d604198ac7

SHA1
b8bfbddf5c13af7c4d72fe8fa9d3be0891c68226

SHA256
71cc3583d8fade5638f25a2d10d9b773db822473911acdbe8c20e9e2daeafdfb

SHA512
983120b8f7ba3cd52dfb818bbce3928d3069b3c8afede3aa697a69ec250c22c9c50eef0785b912b6bd1b508a7fb8418c127f3cd5cbfab2740f3427ae34ec524a

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
112KB

MD5
d5982d4692fa9f770d7f6f88d4cd9baa

SHA1
15eff057d3f4de9d3c00e5d1babd08397d435168

SHA256
4d67744f0f9d33a95f7329e6ecb29abb584af3c21c5477d21875bc8c8ffc3888

SHA512
1482b9843f6cc15d160eaa491c179f0413d2d1082240a60f4bac873e6a3ce324e6c3a0300d2f86d18bf4ee79d3d19d4e2726d7e873f1afabe621fa476ff8ce9a

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.4MB

MD5
0a643e124803b485f65d1b1b89b1c22c

SHA1
25942df9ce299a16c17cac253e373d290dceedf4

SHA256
71b39a3ac6491ce7adef980e88459fb5f5fe373f57255e2c3ccd4e9debc7d44c

SHA512
70e9a1b776ef510a977314978105315b7d5ae7980788d993da2ea9f085d2d0e425f4c67bc54edaeb14a335a47be0e091729df4994be65dc2ce1655ef3b506a2f

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
591KB

MD5
4fa53256d7bc7136c8890b82e252ceae

SHA1
62618fcfa9d2a9cf7d7dfe5afd87f63662c1d908

SHA256
58a0b8ee4bf2d0c43f681da12f5918910e56d1943d8ec195b8eccde865bf5434

SHA512
836928d3a490bd58f498ef145a5aa956db28e2ac2badd020edbb7070636e31c0a066efbe1923497aa4afec60dea687b2631d4c7a3c9c8a3272fa28649b53f0a8

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
257KB

MD5
461a4e9d963909eb133f3196f599480f

SHA1
524d8d38aa53ed0af58653aec5dfea3287444d12

SHA256
5132d02db52564e201b1ab5beea7df95aeca3110fdf26e3542b349011dc70fa7

SHA512
ec0758974b902d6dfe3c850e23e2473d3648259dd297069a32929ab919264cb2eae4e313c51f6132a043991aeb3f6f48994903b6c6724f38f0d6a0c7d1aa6f1d

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
236KB

MD5
7d5438ddf680349809132a2863106636

SHA1
3803443e7de7863026aa613e5b81877507f3a0db

SHA256
a46e18a4e09ed9ef8d3d6446f5221fb6436e88b824764749c847b0f3157f6d09

SHA512
3cccb506a396a808a155ba2a43719ecf62fa78d97a82c91626f6ef53bdf7609252f7516582e934be6f04d5d7e579bd8932db54d8b39e17af97d437dc79370631

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
528KB

MD5
65ded5094ecad2d82a02cada8a6606bd

SHA1
47f954d9cf3ab5878813e3bece8eff75efc7c7c5

SHA256
75c156f238d7e2c97c300ca2688321b45e7ea7640509e15f4fad6aaa1abcd6de

SHA512
07dd06cce6fe53eabb3a103d5a8baed592d1da665f0452f0a967f9c859f202c382d4761f047ee444b26cbe1c089f7df05c52b24603e97c8b1aab63d8e90abddf

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
276KB

MD5
56b327f4033cce5f005e489d80feba1a

SHA1
c9c9c84b00670683957b7893149e5e41f958efea

SHA256
82a64b8039f8dca009ba383078d15cc93ced0c194ee65c6a97e1691f0c74aed0

SHA512
ddc13b562704d47e8ce0b08241bd2110d4209de707310c510ada94e1228c1148e950bd1d2780afe82a5da96b605afea265792557dac125201cc45eb32c5aac8a

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
104KB

MD5
ac8c320f0c1efd45bf34f9d8b194b2e6

SHA1
88cf71ee1c2db55212822119301322e7a6632d75

SHA256
033b7c875183359ed72ca1cd7108e1316bc602e779f49ad2c6e0aaa6069860de

SHA512
ddecba404aa57806708ba2e2a17ac2469b94d2f0ada494e7788dbf8644dea8a35f594a951a9304063fd491810caec66073353304d40e85f7aab158d0866593f0

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
55KB

MD5
9a04db8431a1b2cd748009a2bdae6a51

SHA1
f5471c330f1bb8cd3663bb63e252574ac3e19371

SHA256
d92cb60251719a4df5183180fa5c2c82f2a59354fa39ee384d592697ed9f16ed

SHA512
9530ae28df5781fd69ddfaf8ba20bb6cbc88d5363c03e5e54c48297aa53c068a52763674ef10ef85d8177896c33128068f1ccc0d94917ee41fc6da64d7f64850

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
60KB

MD5
a770519e0672baaa611d1e1c4a2e079e

SHA1
a9658e50b590e978a1ce4d3e0949e9f06d46ab8a

SHA256
825678c5eaa5e9c4bb07b59390dfaf566d41fc812e99c79d19877cce25bce3b0

SHA512
088fffdd60172a606650a74a5fa1904dc1874cf47abe9de3af01e5dcd3d2a78158a47c24692f3a53458ca2f6a41829fdaa6b41988fee2984a023fefc2ba1aae6

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
53KB

MD5
380c322d1c5b1e02a8f78be68e2fa1be

SHA1
2bf4931dfa4aa490ef18df1263de5b91a65cd3fd

SHA256
5cde7c60a9e28ecc3d717c5f1ee54dd3f105198295973f3237a4b4bc2905e626

SHA512
916816daa0c7e5a60c329083ad705354a296c0bee14ec3628da79593f91d9ad939ea5c4e82eb9bc8c544f12bf8846a8a98141f3af206134b16b813a84d3953ac

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
57KB

MD5
6de96fc942e13ef0b172ddad1ab89fca

SHA1
c14a879e6c684f9fac201674fec27a3f1c57a9a4

SHA256
f379cd27b54809f6fa62a94ca004d45c6881ec223b82fdcf2b7ca50c92e8e298

SHA512
a6ecc223abd26365dbe369922fc1a42c8be4242f864dadb369f09240b5ce59eef159de48d366a399994bfd042a627f73583ff16f4d7ff66f61cdcd7a5ce190e0

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
58KB

MD5
85809ae13c7a5fa3b29935d3f69c0ead

SHA1
25823b4ed9edf748070c87119c12428677295921

SHA256
f08245a59a8f835c3391a659c525b96dfc008077bfcdf2a465f9a9067f6eb5cf

SHA512
1d3ebac5c26666ae145355e8e427b2fda4377908cbde88496ad144a9608bd208f96c1e25953cc2432a59567b6df995b4ab53b0e9746ca9f4b93cb00ae91723f4

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
59KB

MD5
49ad53e9812d2a44f08754236bc53ff5

SHA1
2a7effd39425dce51faad1a9764de9d6fbb45666

SHA256
bd79c34e342f8bfcad529eda125a14f6278260cd8a6b68b31c4a2cf4e39a2fcd

SHA512
f3ef9e4c0bbd48c0006c176ac40f81ff6e27f372841ee9c01d21516ab858a8f2f77866216cc60e12a90fced1fc7f21f4fe7d0c7b42a08bc1853243ca4c3532aa

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
55KB

MD5
ae137c9f8073e391ca5bc550a1266873

SHA1
412884be42a248d0ad2da569ad16eca3d2cf63d8

SHA256
e788f6631b67b206069055e64969c6148a289f5afed629cfc25c79654f17c127

SHA512
eb61078124d4c52a474a8d1b3d8dcd3f3391491a6cc43135898dbde0d9690aa05f9624d37960f87dde51d13e7c4ef342af3c535cbfd79f7ce91c7a84ae08b2a9

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
62KB

MD5
a4feb70421384e20373b1525c88b71b4

SHA1
34a11ac522eb282b1f8f9e8557ba11b87931f373

SHA256
f43955dfb9b2be27f7379c2bd2d901893a0b80ce7fdf74c056fe43d30bcad6d6

SHA512
9435cb3e29ed934250a9d2eb943b3fa7dd1dc8e0a34f2bdac497f5856d333c11057dd039df24a0f5e6e113d5f4f04fd7a87761cbc3f8340deded1e8462cb8859

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
48KB

MD5
e608ea5d4dc0c34b244b571f42e3f6ca

SHA1
4fd3a3c29d1c64629a8208864e5b631e51cd5005

SHA256
e6b69644e20935e6ea2c77c9d6574c821e7690e144b3833a9aa0ecfae8247ec3

SHA512
3122b36fa4fde1e73e42a4c858276e05f5247c9f9a7312a3f6fca16161d015554b982f16d402400485fb0596adec8d9d56ea496bfcef096060c0cda1a36c0b8c

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
53KB

MD5
bb933ea4df426717feae63feb5b05bcd

SHA1
94158ac28f74d1a66d19bcbe54fb7cc88fef6715

SHA256
c7b2f8ebea6081aa287c9df23b697dd9014ce031f191a763b86266720e0f5172

SHA512
89b1c3d2cf1d80aa24d74f38ba99fe316d84bf658a0837649f201f77351f81ff9e308717dfdc74ea35ef06f4f9d5d3569c60e04e9602a074db3ddc1be664dcf0

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
52KB

MD5
78bbb4ab9fdf64f400d6723af7161581

SHA1
f9bc0ef4289f5e78b8538d2dacc5c3938108c31f

SHA256
701aca70647d79c394d950fbb3bffe07a99440d0c077e70b04b2bc8b69829a6a

SHA512
4cf39da0212bbe566f8cace6acb077e7b91efd1d33bb7e8120321fba3fbd5bf9931b39a7bdf165e9c35f50e46efe20bfc4fffe121714afd8ddc798f8e9bd636b

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
51KB

MD5
231b6a8ecb3f89d7d1c36ed35c405e69

SHA1
a603df3580dd6f6678d19ce7013ccb6b5f2feabb

SHA256
71cf4bf7bd304780ac4692630dd826dec3bfe75fbcb31e9a3cf4196fc539bb05

SHA512
5d80e3aa1d2c3344c6bc8c01c38963987ef0e9d3523982e2093ad7971b88faa0b7313829c33b27b9fce8b9d06d730034d818dea506c144d5e96a27fc5500d595

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
59KB

MD5
3cd75af3f9760be007c557d7e2342dc4

SHA1
70363ec33f9f5e0e0d30cfbf16e64594fee3191a

SHA256
b1575d0969a1928e74eb7ef14e1d11fc8ae08178a72013bc557fdf1ed91a6541

SHA512
57fc832fb09403e82aef3e1cef7283f2f529bcf99891a1a938f2e66ee8f6ce8355e55818d346b5459ad6c658ff96f08842e05a4cc894cfe036ef89af2a67a3fd

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
50KB

MD5
6e72902d9049ed2563d4713ef71c1cec

SHA1
00af5d2bd39cf1fc954dc21d20a6f0ec40cd1822

SHA256
a28fe68840a63d295a52352e0753579701fa93adbcd371f5b4930d07819cebbe

SHA512
156327e7902d8ed38d265b601dee764e46f6756bdec8ff381ccaec7abb1c8dab51d1897314aa57612ae5573ff3de7bea062a4d2e709e5a52aeb454968056a434

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
47KB

MD5
7b1e1813b79ff5c6db7b20080ab6d569

SHA1
ae94f2af768f30632f391d1436f59a346ce33384

SHA256
01789f1e2af445d6ce52771e6d20e40b92bed72d7d6c9949ab00b330b7180699

SHA512
60200e5058c93367fd874590de9e2637929d19f5897381460c2c904c331ec15a933e1755760c6b41b33e44027eed09031ce0c522fe9d50f3373e3200e43a0464

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
52KB

MD5
d916d73b47e4d5db20a259b6061b94a2

SHA1
072fc44ee832a47b92140fb7f653117e816cd1d0

SHA256
122847bf00c3882cef021e8eaa76413e90534e17aa017b4d2bafd0c3309908e8

SHA512
e577ceb3355c7d58e0e6d645936f6a7566fc08be3ad4a786871268f68209026a5a6eb3e5027742c1c3c8f5c592e32abab379c7c1cd71de9cc796f800134bdab2

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
54KB

MD5
82184b0cc30079d052765f869cce0d78

SHA1
1baf965047eb3799d3c550e9135d9cc1546d44f7

SHA256
0074c6c69b56ab9633c54d724a1325d9d053ff2df218875b13cf7a2b24901c28

SHA512
1a3213ae9fa47582b940180d56a29457a41e81edb4ba4783cd7ee060885284337f4e325f64f59550b769b06cf42d2602f28a4b7ad3df62c11cbd4d2694bb25c4

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
61KB

MD5
a53d44dde7c4091f78d2c88513b52463

SHA1
da5f0cc5b23471b306fafc1426ff433e4cd7cc06

SHA256
e1ea03d7494617247f7f2a931b1cb15853d6dc0023ff411e6b6dddac7654ae50

SHA512
1dfdd1e4644ca36b05a1316f396fa531cd8fdda5b8dff201ce3504fac8d9d1c309698e98deb9038fe7bfed7ceb4baebf6cf3c50a540bb0b726f4b84e60a92c18

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
52KB

MD5
a3a67087b044b85640f79f4b255e374a

SHA1
e11db66e85a150c96d46b31eb344aa571e1ea3e3

SHA256
1ba9b8365c0d8c34fbb6d7d9a202e775152a61e90c0ecdea9e8ae3642f062c2c

SHA512
95950d3b1167dff1382be4ee363b271e57721413bdd7b7473a291bec3c9ecff803ecda2980c5320c852ab8816e49a1b289b3bc93f43790097a59fe47a7751b81

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
57KB

MD5
24a65c6db5d4a380fd4cc87589bbc9cc

SHA1
054af2aaa3811ff02ec596f5d12e6356daac371b

SHA256
f58bc256a4c49044f7403d3255adaee894c45271371625b15bf21385a26d1d0e

SHA512
eac2ec9997a3cc2d34f2b32539fc4e50c53a624bc89b0f7e1eba6f81e4ed481d71a356293b588e206ae09a687e83fdbb7599cdb8864c031f76e61ca697127efd

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
54KB

MD5
426a0815ad2cd51023c59d323075253f

SHA1
5834f5e9f0b7a10e508acb0f4c4d6dd9b485aabf

SHA256
2692e1c5147e3663eb496a766af0a9bc5ddd81c02697b3d7acde2767104d1c0f

SHA512
fbdbfd5b5d531b45ab72d2ec6c18f1e17da47b1a1929cc7632804316fc4497af3a1608cb677cef55ca5830e0390d7ce488c7b84b00285df20136dc82a60cfc28

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
55KB

MD5
1a5cf2e7332919f4c2e6d28d320727ea

SHA1
9ce4e66c34ba38680fbdecebd21b3c98a56c8ce3

SHA256
72210203321749b43cbe39d752b63378ca7e3c8c662ae7525cec9f142bb7704b

SHA512
f16e981d89c1ac6ad1e93d60a6f76ea47803e92ceebd2858105edb4dd55017497f1d7e3cd9e8daf646dc5ebbe646751b9b54205e5345dc8b841b7bf7f0e87434

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
52KB

MD5
2f7132e0a837ba4d0ca371f5ec7fd5c2

SHA1
7a42f4a2940363828614e53da5265fa6e71b62e1

SHA256
e3cf6c8505e5f9d6d90666f659249a12d9b9628cb19871f485bc1b2410202266

SHA512
e6311c3ca1f896fa261036d67a307bad4b30c88a95e0bea441f181bb51746a467f84d450817799da74a4d47f2a0ab9cffa2df8025d6f0356000952ef3206477c

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
52KB

MD5
46bdca145b53a15fc4916079b4529786

SHA1
65fa5f173820aacd64d0b5845007ee9b120ce6fe

SHA256
836be44517fa89752253c821a8c43c0eafe80b214dd37e7ac49e18dcf1f67c34

SHA512
bf365ef610b60bcd78d09222aeebc90fde5740e9818759cd452083b5c1b51718e3c8e900ff1cbf90dd14c442051695d4898a105174c8e10b28ae8549efda1145

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
58KB

MD5
ed4e1d80f0f020d29006d630224c1c0c

SHA1
b1d648c9ffc63ee2c2aa5ec705dc8bef20667468

SHA256
f72543c92cc9955c919855c7916f04577c27d4807649d5247626a322ed42f552

SHA512
4f22a1ba4fb4411eedc2ff956283424c544dbbc7aaa73b657c4c0a61e9d269360cb1164e6ad75e06250e466631a3379f41da7eb0c0562ff0639eee866dc16e74

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
56KB

MD5
bb26e6d117afdd5fafd76019ae9fbe5e

SHA1
b964b68c188c3e7f29d45ad4e3c36c4f1e8e631d

SHA256
9c8e201627c6d4629612eac4d3f10b611e2a97b09849b550ecc9316013257ddb

SHA512
8246918c25ec2bc0bc7e3abd00c2b8074e0ef8d9c6ad861fb47c8186b1386e425487ac102200736de118f7035f9d90f0e26e45e613446d788bc13bc32ba8df1a

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
61KB

MD5
56f0dbd5000f1ef5c8a22fab67c92772

SHA1
c03982bc222b449ba3f64f9cbf90811e33dedc53

SHA256
6813af6379f933a0944ebad4e222fbfea032e64f8313f2ef2bf5292e3946912c

SHA512
490baf0e74b20c68a0a9250108f36cc33761b8f1921b42ef8d2b34b2d99d3cbd2238c57325478ec54baf8a8889080c97e1dcd8adb36ad310422d76881c1d7a5c

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
56KB

MD5
2028922f1efe0e319cac69c194e4d0f1

SHA1
5d91f47d41a538c2bf6b9f2c7861869985238216

SHA256
2291f981c3c2976c76b05e43faed2741c51fc855ddf310d71ea66862f42c94e7

SHA512
a0065436d80e66d4eb620359f2b9181fa3d41168cd9e64a79f2450fe570f9a8d8e4c117b9d73b3d9d298bc343aea33d79050e15ff7eb1ddfb6868bf6e1e45639

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
56KB

MD5
3b278be6ebba7d5729faf7a8de28abb6

SHA1
828d52e454f9c0873c452b5323b80ad441aec4d1

SHA256
6427e07a6718755b77b5265142bb3cc34276e910307e1ae0c319bc52a4b0196e

SHA512
e934192f2d51f014ab91150b787a8331899e86ff7d8c0acd4ea7cf97d790c1366aa15be3d5cb5e9a0a8daac3817f6f574675a81521abb32faef456b56ec789cf

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
57KB

MD5
b2c273c845812356abb5bc52ccf3a20a

SHA1
9a2b16d764672e8ff68f6fe495b2f880d6dd73e1

SHA256
0f51db3632d2357085851959c566e4a673385c4ec5de2f943c199b5aedc392b0

SHA512
c5a8a58656380face31a7a03aae84ac9ef12bc95925c08063985e93166da683eb2c0f0ed13d1434206909efae1a9221a0bcc2968467e02afb7273d8c9eb86f7f

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
59KB

MD5
82b84796a1d697b4a895c7a07d6cefb6

SHA1
e3e12ea224368080716471876f3a46822666f98c

SHA256
9073425ceb2bb153019657482566a19ccc96f78bd6d0c3a026114977c8878a4b

SHA512
8d4d3411e5151fde26d950e49e11871d82dced87be4b392b453439afcca649cbc497b36093a99f427e73d0e72bc9d0b7271d821f85be4790118788abb1be2bdc

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
58KB

MD5
32ca6c70185e8599a15db560a6233bf4

SHA1
ebaf4c9741bb8a5e3e53551de1f85e042bc02e81

SHA256
9f20d4d4ddd82f603b6f9abd6e601a0f9b7b27e0b9f3a4b0803a3f2d836af81e

SHA512
e2554204eeaea30658968f9be7c9c2f2149c95602abd8f2c420cd0a3338be099c660e0dc39c5faa381ca67fb8aae8af4ed591b7befa6b933341bb2c04dc70c4e

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
57KB

MD5
676127dddec73ce610cc8fa10a2d8e0d

SHA1
2c2f19ad97113f314dfc0dcece0ebfd08d0aa091

SHA256
029726ac595d10ddc993da314aedc086bff3b2966ff35bcf19587cd8a2ac8130

SHA512
e7458cd6f6176d148e2cc5ff601be85a3b44bb80f6b204ac578f8306b6f600a587a527d20dda26daef5eb1a6228c70020225f9d0fc573c286cb221d03bfddf44

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
53KB

MD5
a36207357beda4e5060a5eba4d0df610

SHA1
920472162dd5228235a2dae880faa109ac6b883d

SHA256
104150f90218be36af23e5df3c583b6edee42ace7604f9b44a77352eb63b595b

SHA512
138e0f05a41ef0cc3ae1a763429c9b441b1dd31b0394911c38237615d11b66976713d9c6dfce61543a67a8fe350393fd9bc58caacdf9cf7aa73b3357784687e8

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
59KB

MD5
151038c138b133f8471102f3a0a992da

SHA1
64a0fd58612e5e999f006cd03f61156b91554621

SHA256
d9a1d0daad4c022ac68721037729d46492a1bdd5f74aa2e0af833196dc608cc1

SHA512
c1f412f9f5e7f3920579b2e0b01d637580ef5b45c64475e5a24cff62908ba46aadda01caea5cd69312fca8835ed9a6738cdf98f5a30b784186be6268ed5886b5

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
55KB

MD5
8b91de5e99e4f27611e23138f43855bf

SHA1
1c77ff7b9eb636d35444c3365bae2b1941d77389

SHA256
3c6a5fb14e15f239398d08d873d0f15e5a70a839b104cdb315e10c1be910e19b

SHA512
1db35f49fd844349ce4e0f1b782d6b469bf01adc07261783fea08415249a9a2ab5c62e5a376f1b444362cafc5896a2762f330ac3003291889b6efea86dedbe99

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
57KB

MD5
c65fe188eae5f4dd6441074935054920

SHA1
3ea7b433f5244d4ab71262d6b4d71e6db5c90e75

SHA256
5585cc6626628cab283c3f33d52831fafa7ff131efb52be8fcebc05f1e19a88f

SHA512
c3c335cbaccdb540b2e251876a2db517a8d645cdf9aae74662ed409135e3e3c587b28ffd50abf218a22caf85cc144110052cc981148ff3fd654e7bc03fe9a2a6

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
56KB

MD5
c328b18dd557be25fb9878542515b487

SHA1
c149108bd0983298f6caf8aa7cf76776722f4dca

SHA256
33644612c4a3bdfcaee900bafaf5467c5e8c41a036f3bc1ccc3434a60c07533b

SHA512
201d3202d16def665c31ebbb38b457e15d43f56a2f19db4657751a9b9058d65e66aea3900e6e241d1aad2cd73169bf43a2c7a967f221f6f8b3673d8bd1ed9fe0

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
36KB

MD5
d3937005ff98cb91e1cb9da57894d7c6

SHA1
a18529aed265a899f3b736172c3ee75fcbc553f5

SHA256
cd7bee559b6ca4896f6f2cebdb21f2a16349cb94b589bb317999420ff9c184b2

SHA512
38806b500ba8ffe99e712038c06fcaf9a784a580fe9afb749c897489ff3321df753cf13d5e95bfedafafe9d3d3fbe82d31ce16eb27e17862b176801688bceef1

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp

Filesize
54KB

MD5
3cb0bb530c2b4eefaac4115caba10989

SHA1
01557892a2841f504c265fd5d35b31bfdf278b48

SHA256
b3e2fda0c653c46439a92bc564dafc180d08be355d2561ea25b8f5ac116ed101

SHA512
57d08c2752130134ba96be6d6a8cb7b370c5b712d919592f66ad9838090b2d7df6bc0746a11a76bb5decb36d208bae68d317d6ffd3224c411052858dbc78e4ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Math Input Panel.lnk.exe

Filesize
47KB

MD5
ef68cf7717d4a7354b8e57a0eeac2612

SHA1
b68836346e21d228a5f6fb6c7a6bae0b7dac9dbf

SHA256
1e27d1cffa1966cdbac7dabb0bf85cf800f6922294ec8239b5e0f266741d0d54

SHA512
3171c0de8e21f4d290515d6ee506887ebf9ea0bc5fc1e917c0b397987f31f0d8bf4f3730afdadf76c8f296a17e2faeb89b0df7f627424ab78d0c8e0a9a8f210a

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
43KB

MD5
961a029a5c72506c0e96cdf90b3cd30f

SHA1
41d35db4c29a5a66931edd5e4983f20bee874700

SHA256
6668240f615284cb8a0f97ba64a7a05e35d3ad15eb32431c86bb11aa0794686f

SHA512
407a3b762dee0b82b6833e4abc1717afa95c78d7125ba6c31c5e826e6a0bb3fa8098b11e3883577984b6cec467bf72bb441d2a9d09420b7144edaf9763f2912a

Download Submit
memory/868-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4224-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download