6a5e9d197196aea5ad4b5e23cef0b3908d0633743fff8df91f17eb838ef37d99

Analysis

max time kernel
119s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6bc3c68195d5c17c02af47c2d2eff20N.exe
Size

75KB
MD5

c6bc3c68195d5c17c02af47c2d2eff20
SHA1

98466f1ab0fbb13a79d3827a0204acb1f2126985
SHA256

6a5e9d197196aea5ad4b5e23cef0b3908d0633743fff8df91f17eb838ef37d99
SHA512

e75ba683e43ebb566808a1c318743b013ef8b196e916a26f3e1ad76891971aa3ae312b5b9286f1eb826e34fd2cb483542cf46cb850b7ab246ca2af04882347c1
SSDEEP

768:W7Blp+pARFbhBgnKL+8t8NZy7Blp+pARFbhBgnKL+8t8NZC:W7Z+pAp2nKLr7Z+pAp2nKL9

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4745) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4716	_desktop.ini.exe
3748	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	c6bc3c68195d5c17c02af47c2d2eff20N.exe
File created	C:\Windows\SysWOW64\Zombie.exe	c6bc3c68195d5c17c02af47c2d2eff20N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\accessibility.properties.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NetworkInformation.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	_desktop.ini.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c6bc3c68195d5c17c02af47c2d2eff20N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_desktop.ini.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 3748	4536	c6bc3c68195d5c17c02af47c2d2eff20N.exe	86
PID 4536 wrote to memory of 3748	4536	c6bc3c68195d5c17c02af47c2d2eff20N.exe	86
PID 4536 wrote to memory of 3748	4536	c6bc3c68195d5c17c02af47c2d2eff20N.exe	86
PID 4536 wrote to memory of 4716	4536	c6bc3c68195d5c17c02af47c2d2eff20N.exe	85
PID 4536 wrote to memory of 4716	4536	c6bc3c68195d5c17c02af47c2d2eff20N.exe	85
PID 4536 wrote to memory of 4716	4536	c6bc3c68195d5c17c02af47c2d2eff20N.exe	85

C:\Users\Admin\AppData\Local\Temp\c6bc3c68195d5c17c02af47c2d2eff20N.exe
"C:\Users\Admin\AppData\Local\Temp\c6bc3c68195d5c17c02af47c2d2eff20N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4716
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.exe.tmp

Filesize
76KB

MD5
e7727e9cef78cc227b70f141f1c1ed46

SHA1
fba867392dd526203f202649a1767f83324e7bf9

SHA256
872c478f4bc678a35cfb64746a965172f8a12b10929b86c8b03e7180d18c55e0

SHA512
4f6c101881517053866e6f584132944745db6660a4298a52cf1d5e885fa4a4699756c10bad1ad209485a181b57090cee252b0184a2cdfee3709e71ca479dbfdf

Download Submit
C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
38KB

MD5
3e091ea9fda9e5238c6c0058cf2c4184

SHA1
4d4b33d80e98111fdd99b9d8684063a6174a08b8

SHA256
1e7bb18176b88c652ccc740a0997e096470f08d4eec9a330f8c9cf20006aaf16

SHA512
833e4a078f34b98226118e0c0802ceecafa3d1253d3d164e4172d8b93d74fff83aa90b26b2b19ea0543e87848ec7f267b9334251b8fdc5da2934ee0cf04a1a6f

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
150KB

MD5
94e3d09c42c9dd52c538e3b3907435ef

SHA1
95666af51f67e1e366f7a1e838b2350b446a4f3f

SHA256
8a3d73105e88e62067ca1797c082106812b1e8dc50f615aa7e49d2270a83d8bf

SHA512
e73c89803b39c238e32e4430c07b84f256f7501bf7c3c61b4b1052e40ed70b91dfcca9c26b3190f8a4fa7009b8bb089a14cd5ad3e8a7c2aed40a01ee68fe1342

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
137KB

MD5
878676af3b8d3eb65f446aad8b4ea6bc

SHA1
df1bea3603cdc9f2c400108ce252180e34c00660

SHA256
fdc286243b08a338f3e8785f04bdece0820101c4b331cd3817f64e03c397b087

SHA512
fe52c544e140468e96098cde0c310d154833845e810b6f80e1eccb916702acb9f958ae41b054e2d78a2bafdf537dfbe5aa196aa0477c8952c1ea2d9e6ea540ae

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
88f4a2680e482295e56ab15daf4c084a

SHA1
7875d47900e5b476107c2751409c470e33056fae

SHA256
def3940ef8df5129d5ece37185bf67adc60cf9a450681f80029adb385d97afbb

SHA512
6e2e469bdf306bf941298f2dfdab62ab3b1c536a2395682d5c6bd2471f2b1044243a9b1c3868614c1b2f51b8b385759cebfe2ae3f6af1065c94fa1cb903d3ff2

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
582KB

MD5
d75e43a24addb424cf41e3693e5b00c7

SHA1
5eee28d1fbc8e585ba09ec832a8c02b92f3b2cb3

SHA256
8b5d326f1e2e716520b480cfaa25787c7749f2756f07347d70af59c2c2df975a

SHA512
c6e74b3d19c66c93bbf6424655b74c0057dbce9ca9c2e6d3f6c997218d87b8a08cbc1e96c69c2a59f7f7f134d03d07b9639fbe6d12dbb15c4846a93bfeb013a0

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
247KB

MD5
147477f29a23139ebaaebfbc1549d7e9

SHA1
6e58ed4c677f8b3633e57f6815eca1d19409bac5

SHA256
74a3441392ad007d5e70cb33e3cb63d8b0583c590172ecfb2e6e3dd7574e5c8a

SHA512
853c41913ef3fd4c2187148b360478a52993778986c8ea93f178081a4933734f9ef8f0abb1699f6903209a489b34b717b69bf1937f8471a656d45e55293427a1

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
226KB

MD5
7db7abcb76da73b5b087ad20748cd2fe

SHA1
ff23554b1476999b52642fe3ed2944f8d6febc29

SHA256
4d76ee8e624764e6d37f68d1b19395e8aaec529a89f202ff4aa540113e6e55b5

SHA512
81dc5af0d62f84cf9fcd6681b3d2121a6840b5e4d056da16c1a307c6910ed815202a645fafb936827ef1b419ce0b9afc4b23e717c9f086e8000414d50b3e3c08

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
744KB

MD5
53bf255602070f3260450c187c1bc733

SHA1
9b2bb2cda7daf54887daa7128253b8cc869953da

SHA256
530d93da2bf0bc115ed0d43a50a7b0b0e2180fe0f6cbe9ff4b705c0b7c6968aa

SHA512
56cb1c0aa6606ac647790c6173dd6967ecc306603a352f4d7be0191b6775a982f4380067b1190a62a885072e48838e54deea55a704e2d0bce238990fc2693146

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
968KB

MD5
cb4da2c7f7b2a18866d6086712993c4d

SHA1
941a3e89604d18b5bdf64fc30eb26ed61ac35d66

SHA256
43dd60e7d56cb1ec56020991af6f962c1275ca98e465f050cac0cebb1a278bc7

SHA512
5081b8a54b9213528b1666319bfc1b2e2088e4bde2792334fa13065a4b542f1bbe196d41af19837ced04928b217e475e42cd99aeb50488ce4963faf70f45db64

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
722KB

MD5
146b259bd953d411e6be28aabacdac5e

SHA1
3680cd8eebca2fcedbabb33371e611f0c0958dec

SHA256
c1f556bd16163df05d8c3cbf93deff45752f2cb292651c0ff78699ee1588c74e

SHA512
1152673574c613be9b889d69a72a2256dcd29d0f18dd846cb2d123ba261edfb6ce97ecaf2b86954ac4bac8a5e2bad337aab97e22b30bdece5ec91bf44ff53b6d

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
47KB

MD5
d5374acfe26677437f82f94cc52d530f

SHA1
253a993aac6a15b35adfa4b5c4bb22224a0d39df

SHA256
d3336d3f693a5e54a4b96f023b98d0a70e7dcccffaedfedaad7b01ade96afc09

SHA512
64737dcb9db0b646dc762d1813b6b630f10b59a05151d18263b089c936f52983d4392fb2b4fe30f428eca89d77d6f3056dfdf15aeb0902359ca31eea3776ea00

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
49KB

MD5
8c25d286c2ed67d9f9a025379139d973

SHA1
9fdcf6759dc71044635c92b2ccedbb59624dea8f

SHA256
52d148ba8c890e7a7cb9adb0fd41392e2cd42a99a83bfde023f8d6b6365d9bc9

SHA512
05ef91e80e4b8c791b13a3ae7544e83fbad545a6c3317e0ac5f37d54bb14c3bbbd082fbc1382cb6be536b8df1052170eb7d1c056cefc5d6a497adb2a148b525d

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
50KB

MD5
68800511f1b886e5b5652d95d87ea99f

SHA1
0cb66bf1ceed7807cfe9c5752d66157b3256c567

SHA256
ad18a90e8f37d5a74544c5366213def1450432e5cc7b4a6809d8d2359c0895fa

SHA512
4f94cc151428525fcd437c641059f85775545a059c3a289538b9828d5b0b00ad0c9aa5770e0d918f19d75867c1e886db5ea5580c56370f709876fef3e0bb42a8

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
52KB

MD5
9205ca8c87972db01e2535d8b95391f9

SHA1
617e2fe143fb0281f1a0461c41be2cfaabcd3e34

SHA256
f04a6dbdadd2e7b9562be63e86928014d1b36eb53fe1782aa9410695e4cf28b4

SHA512
56e1d794c8bc519785e708d0aaa446f2f498cc7a77f5c6134681da437ac9b9fb88c01d3bb4e2dc82109e69218fd518bc9d134f2e9117d5241a2939ce1b3466b3

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
42KB

MD5
e58816e8ce7a3c3b5a29629f35fea8c6

SHA1
d41792754558fd96660f01ef8e90c9655f798ea7

SHA256
91bd47ce433d73231fe4edfe7627ad138e434f4d8c52045c783d2c757ca39849

SHA512
9d7bbbde2838b99b8eac3308bacc17f6a99f5df8b350a761e9dd9969a083d1a659ec91fe0b8ca845b4139cfe5675793a92273f33221d99909d15ce85e38ee531

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
47KB

MD5
de0128c8534d403a4c5acc340314784d

SHA1
7c17f2dbfbf010182c0e3bf7e46fe4c148ea684c

SHA256
1582d505fbf3cdab363bb747f1080b758095d76f99f5c5b389f24a3b4cb0ed20

SHA512
1a5bf5e57d072515d28a339b882df39b7d810dc72b4a1db4f92a9eb7ed771ada02d70354107d4b567ea60b1a238eba3a1d2e0c0d7913c2ef72fa9bd3326814e3

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
48KB

MD5
23181024e178d5a982f62877720a30b4

SHA1
bf79873eed9d60f9668040ddb09967346a22df4e

SHA256
0bb714708aaca5b8d4e53aebeaf4a0ef58adba0790708d7ceb251134858d7051

SHA512
739af2addf5af957aa02348c1d00c6716e3dcbfac5cec04a300816a09b1a5268f88e18053578826fc58c5f213dd001e3cb4a7ac6dac0999088cda76c3669ee9e

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
47KB

MD5
10130b5c95beb4ce7594fbe3f33e40b3

SHA1
15d6f64084eb3ef284cae821e70aa0871b2ba3eb

SHA256
72c7c310f675141d8ba720415cdef752b989132fb55bad0d360f0cf96b24a58f

SHA512
bbf9718cc4140a7a564b71d47eebedc73627834d41a6c9b112276020f8e13d790849bc448ce4bb826eaa4ababe2c0829b59db105210b8ec4b5b3b2783549e652

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
43KB

MD5
de69f8e70ee069153b934448185a7466

SHA1
5cacd48e3cf20794c66a1a970d5993af030e43e0

SHA256
520906c1fd1dd6a7dc2aeec470523d426de86ea1b45650552e08ef1c94b1f928

SHA512
95b57cf78254aa518128c3fd7339be965da87af960cbe409ce09624bd5f31d3fe0c66101efbb994adca374ff0ac72a9df7f98f0f8dc764acda23df25bb62847d

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
54KB

MD5
c35730a9bf272bdf786350f2e27955f9

SHA1
c56b38d2880eec81753abb9d9ae479a3b8bf8025

SHA256
7bc3db18006f507511b152378cefd18999cab1b8ed7f6a385a4bac1206238a31

SHA512
c39be49e8185f318034db84c6b1860679a9c96f7f60d5972d5952b887c7e058bbee4492c8942a4852ab93d4a66fc23197f86f136fe6d9918f685cb74836bc628

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
43KB

MD5
673ef8539acf98a1a97165c7ec1b02d0

SHA1
6e572ba0643b7c08077bc6101a0bf0be8b5b861b

SHA256
23356a164979e69dab939c14b923a8e18d6053858bdbd7ddbf964773f7d50a8d

SHA512
0d8a55eda86098599c5f4eefb4fd5a13d4573578a66bfbd10da2b8e8e17b10d55c82ed52a952263695c4c5e77af224cb1bf2e9ca9c6a33f7a04f8227b847102e

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
47KB

MD5
17613396d39807a153b9c8def516e19a

SHA1
c125d2e5436de4f4b17c08e959e683307a3f67ed

SHA256
6d2ced81a9569f56815500d394b0c7706969c7f3b7eecc99efb7bfac5e39fad3

SHA512
ea91773afb9a25a88b35032c3cbc2ea02f9c6746050f0c7cb6225060ed8bd71b45c428ab29b992d171c8f81d5141c70df27f7e712fe37b7ea0a4026609abc2ca

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
45KB

MD5
e564364f1739b80e819da181a956597a

SHA1
80226cd3b1e5d8936f5040329dcfb52db6787835

SHA256
703ded80a59b8105ce16f7eefd3d739bf415573908f535eab323044ff6bc2b89

SHA512
ee7c173d3c244ca255cf77ddcd03de346d34b97c7748de771e385bdfd95ae4c5e5f394b969df07728b3f2bc207b23d310535adfcd37687504d4e31ff00fab14d

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
51KB

MD5
25d736d1ba465772d8c4255fea81b7de

SHA1
c09f496aa7c7beddb783a1fe5a23d7d9d1ab43d1

SHA256
bfaf1af31c1584a81b2f28dd1ab6930fe042faed78207df560faf3e34f436e39

SHA512
fcd91f13da449131d17d5fe97bebf6504947074e1fe8ff6400921b1e0ca1dfea91bdbbd8537fdd867e3c5d0718f33214c05a5f4c7f083f6030176f7d3c5e3537

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
46KB

MD5
ed031ff28607426884c2ba89275ec23c

SHA1
10c4733cc84b1bb6a7f49dd9855da540a72d8b4f

SHA256
589911fdf4c6e9b5af4f33de46098e776793954d859977e0aafc30a6692cf4ad

SHA512
0f454ee11d6dfcf3d54e1b025a04f98f49d386253fac38e69f50a77ef6d9a565b61a978f2c4359e8e4eb1610a84ded5f616889c399a881c734613b473ef5711d

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
38KB

MD5
6bc51ef68b9dde468702ea5935d48221

SHA1
dfe54654523b194a2c6807f934845048df158022

SHA256
52853e408aa313f492833801442e20524d13e0e5f77f7e6549ca76ed59fa1ee5

SHA512
13cef26cfe0bf3a32afd2be48e97c1a419340c9a2bf2f9a8a0161bf6922a8cca01b53cd7dbf55b82a85b5897322a7f1a265a11f77360453e5e9243d4a98b6708

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
36KB

MD5
4aa94ac576683d3cd8ae2eec44b4490b

SHA1
0609e1b64ac0a01fa241ee2875afee3f670a9091

SHA256
efeea90d9f5f858e26323b1a0755b150dcdf96a27a5be9d083e8e71ef19caeaa

SHA512
9de23293555e6b88c5ff2538a5bfc86fcab392db8a4c52f71f510e06dd95e805f010f4c1a08a0495f0d5ad37fa9d7150b9db6da1a388267fb7a2b1f0637ed90c

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
46KB

MD5
fe7ea6a348d10d8a764a61d887cf69b9

SHA1
b182c0e924cff692d4ab4550e9581127c2a5604d

SHA256
329b2544710b8c46796aa008ae5431d3ece6c988ce8c4e4b1f7f088ff24bd6ff

SHA512
f850a363ecea4fea388a62bea75f60f2c98aedb6e40bde112dedaa061334d3aa1559ad9fdafe358cdcf2a84dcc9013dea28b957950b6afb55bd4285dc62dcf20

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
47KB

MD5
19d8b35a503f30e4987dbd119c2aeefe

SHA1
4a7d7bf766b123854d039b69282eb4a520cd16cd

SHA256
fef24cc1e6231117ed80a6a842b83fbd228aef9a83af9fa7397566a7ad656d86

SHA512
779275b8a386daf5a2a85e23b5442ac290e708e1e28e0ff0cf5ed40c8dedb77bd75da02f5be7fa79f17a6bf133de6e637f14818f4bbcf88f299592e1faf13984

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
55KB

MD5
755c6881986b23fb26fce3b061b6847a

SHA1
5623776547de9c6d32851d06a81ee1e0f77e2040

SHA256
fafbd9b44157b73d15ae3a3a1a685d2d7537e5125481eb7d10328ec5958be602

SHA512
4ea5b87424ec664ed277c737f607162b5bb4055b8bac5af6d0dee69389501b66a36974ebf3bcd8f0d6ec284d3bedb15fb58fd17deb70e2fad9e62534a715c7c4

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
49KB

MD5
bbea5add1379dcbcf2978583034e7b63

SHA1
b16cf42fd685429b29f440e6a836792fb91e6b97

SHA256
6b8a26cb242c15c76aa30fb9d9ec048ff632ff0539405d5bcd5a6c1bd018a9fa

SHA512
60082dc288f31423d3a1442c63032a6d6b2656416865e215933c38fbf0e96c6d4094b6260cadc75bf892e0b65f12031b1502ef3f037e3cca214d6797b2105690

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
37KB

MD5
f34d6f3d17b50d53825d88ef311217d3

SHA1
b8b47827e95a13ee0c778107aad94bf0a998cd7a

SHA256
951d439b506e08a4ab728481ff946e5c2f2b81aa124ea8645de350dfd8bc8705

SHA512
754a15d9ef23c3da959e447f46a256e48d4f3ccf08eb4daad364d3df4ecc566b7df903174fd4e95897cb893162d74bddd9020f41ac2ce15cf7b0f1db50484c49

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
48KB

MD5
9a1af96885f2da6f0935ffd66c75ff33

SHA1
b5daac0210efd32115b1394a07c745985924e7c7

SHA256
c66f9258d32ec3733770a9f17383aa2c2449e98505b61bbcb46a5ea70a05361a

SHA512
879fabad699be196f834b76bb5a579e26c90a38bbe9f71b54e42eff3432b79d5fc09fe215a7b677a90612ed1eb1e7edbe02ad13e1ee9feb5f0b814c9ad61b605

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
52KB

MD5
bc08c6c7b99a6f158610dd819ffff51b

SHA1
09ce7f6e1ea7b9307b242a97029dadfde8f3163d

SHA256
5b7cf82e3081fd30e58e6715583f379c8c7f12cf194fdcbc383d4e2723042d95

SHA512
0fd856471dc59262d9481f0c089227a12108ae389974d243b7fe35ea3bb26862fa95600bcddc27b91ee662c8397d31c7bd7d19e57598f8e138bb95f3552a5952

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
46KB

MD5
a2fb4933a16825e3e8989f30ec2de7b8

SHA1
1551b401c71c8b318f19bc22bc5680f0fb577dbf

SHA256
206f89dbcc7976897574848908ac63e3ad89545acec331e5d2c6bb2b2a44adf7

SHA512
82bc9bb646cce73e1f2fd57ece75d670bdda1d1648f7f856b470d3aad925a9a35989128c5d77c3b242fabee63aad083c4a4f9cdba7a06e1f7f380e42e575ea60

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
37KB

MD5
078a909c61a7886d1b40d7c22fe346c7

SHA1
fa2060739f9a295f88ef45eb3ad2ed1705ddec52

SHA256
dfd0861d526e68b922b4b7ce14c15c8b93d58c60799686d4a285cacb6d66436f

SHA512
5f6d78f179fa63129b4f0ca812a7b99e6c6a16eba0282ad3ee7d66d1f6d5d97ea836cdc75ba2098bb3f9fa647728054cda86328337e3a65ad96444e5764aca0b

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
46KB

MD5
a4e9d077fe910d5290febe6359291f9c

SHA1
fb16bb2b8996eec1ece85df8a77dc9feaa400704

SHA256
85882ead06342ce7e989a797fb81f5468b4acf9c5e6596c8bd3ce6a1abe1866c

SHA512
a4be98879a7cfbe21d8333816925cdbcca271283657a4fd402b6dfde43cf25b55bf4e1eaed3528e159b617c8b02e5971dcced1161c5c18d35fa9747270020ba2

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
50KB

MD5
021f03f9f24de120b70016320f1d5669

SHA1
dd69cd675c8ade3ae11192f519c8c34f51fb3889

SHA256
acc95c2c9e8bd315beaf227c3843ae6ebf7e4ca25588aac3013d6b607726a1a8

SHA512
4eafa9a0997520df65cf8ef14b8dd3610eaf4f48d15bbaac759bc999c36945f4ae672e9482561098e04e2d08504bd8fd38307e134fd7b13abb4247f46fb3e2d2

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
46KB

MD5
302ca00c7c369c94f0aef4b5f1516e92

SHA1
3f7e4cb2d56f821e7c56c12229dcdfba8cb653d2

SHA256
16b5b25179f33dad7023504d648f4090e9b79e1fdd3c4f18c4e9993607ae43f6

SHA512
97fc4c9d6c338db3be72d47ec6065fa89daee8849322b6a087d7a968ba302b60fea3d27a8c1c4614f11d165ad06af0fd88dec76c8e9b5e389e18565a5ef40353

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
46KB

MD5
2ac2bebbb4252307b75449634f0d1d32

SHA1
44c4dd6f4f3b16620d1e095d47f6212aa2fb3f0d

SHA256
7575b005eb29cf7a9c829f3aa7e17572bfed10139b4770f48d1666c1ef1ab3e4

SHA512
3423a347d0398a72d58c7abc3ff53203e2b0853fd53443758abedd604d40076337381a5b6fa865bd206503046d76c2358a41b42590bb00b3bd1e526f9c1a1e4b

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
48KB

MD5
aa2a81d577de101fe471e9a55d6bbd13

SHA1
340ca12ccfecc2f7a33b9f05797f81328d1a12cd

SHA256
78ca867b2d63be68d907e8cebed688f89219ab26e350efda16f8d1a4a52e9d5b

SHA512
4bfafb22c215887ecd91d0b4617f9f68930e861cdc079692e8e85325b72862f2c07d751fa880e17143e8e4394ae6c676534b7b0a7e2b694666008d2df0f10eda

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
50KB

MD5
35578eb81e41e046abaee78803460b8b

SHA1
200b15681618535645a79262a86b17fad1d9e31e

SHA256
66f06e7f57a78da3c8604c00e43c7036c0e046176f46522ea927cde09f9581a8

SHA512
87b3990f241fd1c088d8a597bc00598a4804801ec61364b227389b17f38782c9fbb94ffb6cac71a6e6f0b1f602d5ad867f8485c88d86cb7e483f4f29c7140811

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
47KB

MD5
ef7714229c7e1c7b3bfbf87525d870fa

SHA1
576eb9cee6d079e07168d787c9a13da102cd9bba

SHA256
08b1bedeba46566e7fb8a7b8c3fe6c441f3cec02dcf64f298c943f3fd11e5263

SHA512
c88095192fb58dfff4b7e456f262b42edc8440c57f704d7f83e31512d09eda7ed138656c1bdb30b83fc29aee97a27883e7eb586c8b32e4f8d96d7415ca20a4b2

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
43KB

MD5
3f60ea3c0b966a15667b61412cb4fa6a

SHA1
035f455fa335a4081f4f1a8edaddc2904e5fb39d

SHA256
1a39c39656a7e2c01fe84c71fffde0a4b6becacba65338d73fd9c035550993e1

SHA512
bef442c19ded09759ee8c328fdbc9b76e294c32aab9259d5c3cba2a37cf8e8c4208abab2bf78cd834f52c0b7dcc2304dae97ba760e4520a8b8b9e70ebb5c7f0b

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
46KB

MD5
505ede5af1454f2f778e35f35c31f333

SHA1
7c715d5c304aca699ef5806fa126a559ee003377

SHA256
b57f8a02ff8a935bffb4f6bc4f84102e3870210dc6679f10189cb483fd25b9fe

SHA512
ca5258e0df419b8bda9127b2cde371039060d53a7fc606210ba84e2d6910b5737ef0a6f994c47be356810c7825dc241fa95544523e07a1b485624018dfb669ae

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
37KB

MD5
def2ce6a571cd103f48068ba1cc59816

SHA1
7769cee45d16ee8c33b2bb320ef1bdd156d8abfd

SHA256
9bf4271ac93b41e0bc44bd4bebfe108adc8e2d51baaa4979c33d387667eab886

SHA512
a277550679732476393122c764bb8d00cfd4b01a4b659c0f075ce2aa58a82f1745b27f12f2ef71f96fb527ec613af914591a864e0ed5cdbd50701464f4388242

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
59KB

MD5
1544efa844203c84ba49e477e5eb19c0

SHA1
5433b2054ad8ba3acabb5ea9842c76909efa6d8f

SHA256
13572a074941dda29069cd53430ab10c55cd0a419dd45eb1e4770e714d71d3e7

SHA512
e602593c1a2b3af341d3e3ab1cc90054b1aecd0216f1b74c9767e8cc310f82df6e076effe9bdf871563166c308268931b34c99c8a8a8a35a47ea9d6d4e0e8734

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
43KB

MD5
5157c7b7fc992726876ee9b60bceb9b8

SHA1
8730a575e64a46b2a79d662351ac600ffee9d1f1

SHA256
f2ff0f6a0f42c0c5cc71fdd8149291a004cf24bbfadecd595349c7f01f490691

SHA512
2d481d54cb5ef61a687ecb721b0f288d3e6fc9904b2d76e261aa52adda5bd7fa6a872696f69c119498813c7b1fa05b5cbabfa7cb314cb3c2574ebdfaf0633644

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
44KB

MD5
529e13d66129e6ec36aef4970fec8328

SHA1
51c49d5e8090ed42a1b056d858192ae713cc7c51

SHA256
6a1faf353d5d2467128fb9e37490201645f3132652a691e66580907efdeacf1f

SHA512
b19dd2931cb1bfa7d4c5fe1536ee3820491bc985e9800bd4b67456ea852f919193291df128a27ce1ebe98c1df23141e805523d314d439373faaac325349e9150

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
47KB

MD5
df2283847c83743297ce03d3fbbbbc1b

SHA1
b9be66dd0d47f510355812962ee0ebde7f9e9865

SHA256
3278c5215992f6b9186721fbb4069b5ef0071ecdba3e45015a60c543a9b199f2

SHA512
94abd6fec90b647881250996f5db7cb8253a201728b6cfbad5886af2fc0c82bcab10703f91396f71db7227db7927bf11fd9bdc83992be2d3d86f85e4a6dc61f0

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
43KB

MD5
f16b0dd61ab6b58a823e70fbbbd33e17

SHA1
08155779507819eda5831f80b9c88002f24800d2

SHA256
430352c7a28598843f6d26dedebd59efa89249fa1a8cac737592f941ab2b09b8

SHA512
63cb7dd56cb881654717b97d1d355d73879d49b866de8db27d003a2fbd5def880d3c1d5bb40dce6deea9b9ed9cabe5db7a3397d6263adc2865b5957f955da577

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
52KB

MD5
c69614e59e3912774aae54df3e5679f9

SHA1
23e5f22a54d2805ec6f085aaa336503f066143a6

SHA256
e1083f31aee884051b01643979e8d3b37af9784578412eeb86c46a924944e761

SHA512
fea14ad64b554dfa295ef22b3102ba13a86f25ef44cb02e8264f4fdaef786928442ca70593a07f13dd4a28da9aa057a1fd686c3fbd4fd812bf861de1e550427d

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
47KB

MD5
cd94e6542f1cf0573393a359cc0d1d16

SHA1
65d18a0061ebd72978ff05355fa2a6aae8a06696

SHA256
ac0bc36505e63cf2df107be7ec850114faf8fe02a7b62408361c1f21df7b1d1f

SHA512
58b86716336aedebf19f431ff3a27a50d42033ef5e6452eebfd07746264c0c5b0e6579fb67fd6cd97c917f544253c4891939291483937038690b9041300b87e3

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp

Filesize
43KB

MD5
2eaa778c8b9441eb4cb9c839bf620fba

SHA1
edf3d653bf674cb93bbe8f34c12c47cdff11aed6

SHA256
6845eb7615122adcb34280982f08e201839632bda55456a28add991f57cad2c9

SHA512
b75de0f166495d43df3bddbbc18a64a1c6f5572b6abd511caaaa33d9910b4094bf77a5d7de60b82a1c4f53695e6a9284240a099bb261f0826894acde82564b1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
38KB

MD5
e28d24b898a6a09ef235cd41e6bb7dc1

SHA1
a8a9556e2c43e9be383e6585b05ce3dfcd82ce73

SHA256
ce7e63e6cfdce7bc808a2db53849f78cc273568cf968801ef3fcf1290da9eadd

SHA512
1786ab13407934c5908b1331c4d5d41b013ac46e8fa8ac43bcd52fc83ca0ee450d829592bf8d7234441e047629e21ac94a8179e3888814d70e44146a86b5fac4

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
37KB

MD5
49539054b3f58f7275001e0d9bfc11e1

SHA1
d5aa13627d8e17b91850bfb151dea60cc6baec4f

SHA256
23613ad35c70a286130e7e2fb078e8f43dbc14a48e038a42ade849b150566241

SHA512
bbefd111241a0ba733218d37d0d94bec78f313b7a43c86421d376bfa3b792663110867eddc71bb7a6e57bf328b0b764338776d5068b4fdd23c9addf464b9d6fe

Download Submit