e4e23302c71c493902cc8a072ba27553bebd4e3f1941550f1e68cfd93688cbba

Analysis

max time kernel
120s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13c35a26ba0d930c9b47b54857c79170N.exe
Size

391KB
MD5

13c35a26ba0d930c9b47b54857c79170
SHA1

0799d49d135ccddaf250ca1dab771d1a407bd24f
SHA256

e4e23302c71c493902cc8a072ba27553bebd4e3f1941550f1e68cfd93688cbba
SHA512

1ea56835a219dfa611b29575c8e0ed97822806baf07ae1122ae8dcdb4dc98737107b894f48b4eaf1c7eb94ab625e74856e7a990beba31a2eb7c5d1f9eb9bc70c
SSDEEP

6144:RqKB+tOkWKR0iJ0lTzktqKB+tOkWKR0iJ0lTzky:v42TY42Tx

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3612	Zombie.exe
1492	_desktop.ini.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	13c35a26ba0d930c9b47b54857c79170N.exe
File created	C:\Windows\SysWOW64\Zombie.exe	13c35a26ba0d930c9b47b54857c79170N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\icudtl.dat.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\it.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Concurrent.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\LogoDev.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClient.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Permissions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp	_desktop.ini.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13c35a26ba0d930c9b47b54857c79170N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_desktop.ini.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 1492	1820	13c35a26ba0d930c9b47b54857c79170N.exe	85
PID 1820 wrote to memory of 1492	1820	13c35a26ba0d930c9b47b54857c79170N.exe	85
PID 1820 wrote to memory of 1492	1820	13c35a26ba0d930c9b47b54857c79170N.exe	85
PID 1820 wrote to memory of 3612	1820	13c35a26ba0d930c9b47b54857c79170N.exe	84
PID 1820 wrote to memory of 3612	1820	13c35a26ba0d930c9b47b54857c79170N.exe	84
PID 1820 wrote to memory of 3612	1820	13c35a26ba0d930c9b47b54857c79170N.exe	84

C:\Users\Admin\AppData\Local\Temp\13c35a26ba0d930c9b47b54857c79170N.exe
"C:\Users\Admin\AppData\Local\Temp\13c35a26ba0d930c9b47b54857c79170N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3612
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.exe.tmp

Filesize
392KB

MD5
3e5fbeaf90e1e57b0a809793e6d19287

SHA1
b82645d7157b7dffcd50e6886a126063e2565cdd

SHA256
9d3312c6908693826d64cc0bc3882002e1c0c16b55b9443a3d2f4ab007613452

SHA512
8eee9ff5da778598f08d0b8fd0dbbf814f670473905644ff7e4379664c065f003ec4f8f3d8e51bf551eeb7d4cb40897f6f1c83b8120988bb17900e65cdbcf53f

Download Submit
C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
196KB

MD5
b40a3d316acaa7a35848dfdfef0f84f4

SHA1
b56ed45ee94c205aeab30fa936f24d10c33c1ed4

SHA256
de3d48859636ffa298ab92780e11acdeaba7a3b716c56a7b54988731a857c4f9

SHA512
1293dbff3a29ce34d71b66951f7068c16ff9eac3d62012133a6b1d92eb1da373b55ae615c82a12e69f4b82d84ad4360b8772c616f1f1dfdf17600c5977429361

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
308KB

MD5
b52e74098cd35aec5c04649f22090420

SHA1
74f5a4749b3e5c0bdc929e6304a6d19ba4c7d9a1

SHA256
2bfe9f5c8520dbc65403a122e5706e0dfc40f3a464f490db1225093629561738

SHA512
899ace1b4552e79bc870d79f796fd44aa9e59bd1669f021e88c125a8e84ab9434c2f73a9c0851cab769f7a9b3425fd37988d0a0ef2b0051dd91233d11f802ae5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
294KB

MD5
7bda37bdf5f42b6ecefc4af1f5482f07

SHA1
63a901afaa18888d20401ba672f1c273a42a23a9

SHA256
3847b4acf6eb7d8811591c2f30d6f90a75fdf05c355f9b00a76bc41f39584d35

SHA512
b6e22254af0e6c9a1ef529f620368fb5d3ce0e8bc7ceda3813ea1ad87f6e056ca68a106bccf85f2ffc3b3fa46d7c37d4cdb9e094553a9c73d18ae4f64db958aa

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
3fbe2b748ac97d6321482542dff23fe3

SHA1
96774e49ec083c271712141568c70669e2afcde5

SHA256
e9d61fbef201d30556ce7d5c787b60d6236a2d6fb6f690b139a7e8c08ff7d3f0

SHA512
12c427e4d490fce8f71169de9a01de782a7ca7f9f72cc6eb6691e120b78b4da572355401754d1d788d0015c2832107470a1f1d5aeee78914e0a30860272b4e0c

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
740KB

MD5
49f674b7e6c2214644f0d59c391a1047

SHA1
cb3b2fdffc1807e0b9634f29ce8b7f304dddd9a9

SHA256
860922c493582d22be8cffe8276b90166b76a1adff017d018bca55751619f458

SHA512
0d7523470d879259486d6a72709f8144761714b5197e27b58a34c5f71cf7b6225c76317a6abbf00fc5f67241959cdc06c64bfd2b63f4859a0f2be6736847bc94

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
405KB

MD5
a122631472ca7ab0ab29d0182bda8b2b

SHA1
cd7c20698e736145a71909959433a3b7f05a23f0

SHA256
47ba19b5e4bfe80871a55bf66f9d4dc9ab07f8b8ca02a79bf731cc3c857b9a9e

SHA512
bb07bfd8856bfe23f7480503c2e7b4e1cdb486ca841468e31fd14208804a716c5f495e1fcc80a7337354b9685e1c7347dce20481d172a10f2071d65d82bd70f4

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
384KB

MD5
aa1d1a3960cfaf3835452b777983e47d

SHA1
d4a922cfff9be52c43257e3370f1fa721eb77381

SHA256
b2702d20f1e93511f3f2c65cbed1a0919882c50f323bbb067848c3948e6ca39f

SHA512
c14e2f052fc38a276107f48a770457684c9536e4e1326e1dad0190a3fe2959cf9cad9aec30f36f4cc250ecd3e9e4576dc4a3f6c09ffbe03fcdb406b3862eddb0

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.1MB

MD5
c3fa917c7f1f647ffba797a228c06a3a

SHA1
b2b972f3d3fc252d16d5d081fa965a3c194da6ce

SHA256
294aa0bb7d4bb020cf9aa0543b5a066d9eff7ce3f6b2734519425f549bf53e9e

SHA512
793de49c9d029e5eff4ed749dba487c5aaaf31ccb099553610f2742701add62cbcafa67f505d53c727f5c3696ffad532976f3db1f3cd74f356f0933192860c4e

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
880KB

MD5
cc251d75cdc4d7e0c8a1390f51960198

SHA1
e87f08299dbc4711b2d5988483d9faabd0e54392

SHA256
45a11aadf9ff292a02eb9113766be3b5b9a6ffab63deba6e50fdcad11aefad69

SHA512
b494b416a3647c19162ee24f978180f42575996a323b0eaab4ade22d4e25f70ff64397ac413b0cba12442d7f088a18fdf49e00c49086591c96e953a468ddace8

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
253KB

MD5
46542bfd84a1771d622998706d63dd3e

SHA1
aa847fa3baccb2d155d067a659c1e575e979a7d5

SHA256
235cf9bc10f9ae99991df3b37d9f829bc185f035a9f4c6c8fbcd23d308cd0b07

SHA512
66e716c8cc1b323cddeac1c325c08d4eca718ffdbabc248817a605e1f178798eebb78cb26f6fae355b31f380c0d2950dae987f7acb0a16b52975e5b00f9a8ac8

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
206KB

MD5
d54f9b8584d65dcc87dc9363971c1569

SHA1
82b905521c1abf953543b292aa53167dd227f9ce

SHA256
47059d33a367337a1b36afa04f3cc36b8c740cc875babbde59d21df47a91f4f9

SHA512
c60ede8c6397517e9c9ddffa4716d5a1ebede7902d667d766335db51eaf0186712df03ce54b71de7bd96f149847e2487fdeaf4a5e4d64fd651a2798acf7dc606

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
203KB

MD5
91553f97cb10e53b084bb311b8350299

SHA1
b83625fb407b282e01f80de91b1f3ca406ba1a0c

SHA256
fe21dc09db06faac81f06db32a93d0686c742fc394d7cc70895a9d2eb8abef61

SHA512
af58c9e780fb6685766d4294346f33958a312466470a1508b33a0d23e55034a8da73c5150ca82dfdd256f8e9db068ab1c3d4932eef4164d47fb74d13bc8ff052

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
208KB

MD5
f7952c1b144f32511c2a69d93c9d267d

SHA1
fbd4da7625da21d8245e493dfe0ef80c2be6aa49

SHA256
d9e873ed9ead5b925eccc6495934816ebbfad57e1acbbcea4092361ec7d2071a

SHA512
45f4760ab2c2cb3f7e17dc7041cad2cdd05cf5f61d419ee65d6d031f447f5efe8af99e438aa4df0396fdd5c7b6c48d858872848445f2f2b6a16eed2bf01d2e6e

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
201KB

MD5
988ae9915583556c5923108cd2d3d432

SHA1
8cd75bafd63ebcfb308ddc05d479159f96005642

SHA256
f56c0c072cba6c88f6f930dd18d5252f0d081536b749073e49de95e623e0b5b0

SHA512
0df700be9fa6d57c3e2a27cb4c8dfa2f6359418cd1b5ddadd9c3067bb1ea8d8164a0087e46f5cd7937f7bebf869dcd364a1fdc4d2ab2cd1c2c36c43676bb5cbf

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
207KB

MD5
0a71444d154ec4420410443a13af9c59

SHA1
16499c2c3c52c93610dc0a69332a9e8d135add7a

SHA256
54e6b4dcfd75104948fac05e95957bf25ffd26cea7377f5d03ff80f7f5dc517e

SHA512
32af5da57cc14dfa1ab82939b6938dd19c5480b4af3acf41e56888cb813955388e104b8bc7c15aacabda6f5abc819e7792ce80e4f25f246b425e0f70f492a130

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
208KB

MD5
0e66aa33a7f0ab7b523c2bed522eba27

SHA1
3ee22527e276d17453aaecbb5be1b167a50a343e

SHA256
44053f9df9ce6a7c1dff74610bcdad7a5a304ba714bfd8bc30c718ebdfe0f1b5

SHA512
9c71a3eb04acc13441dee655f9c9dfdb39fee774a4ee0b47fb41ed3b0f0adfa82bde91ec50cd85a4c566500ecf980007ab24f0095293ed461cd4d5239e96d41d

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
210KB

MD5
1756f6a6bcf2c8d9131955323b20cbb0

SHA1
4376718795c46c571a994e767319585a19e560fc

SHA256
a7c8377a375d4fd2ea3cff715168e051c2f891fece4ec6469728dbb6c6bbb2e0

SHA512
075144e668268dbc9e7fbb7c5742e506827b0d6e8bf241fe8810814e8c257ac5f251b42712ac9bf79a794267d44f303f7530d381f7a5d640e16d60e72c907bf2

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
200KB

MD5
0424bbf9da3b0bea9a91b294771c63d7

SHA1
0e1d1d8d37af62271a2fbf913011ede25b3a0a85

SHA256
ebd232bb6e04d45e6ed103564f164ce5a1e954f6abb33ab0c12ef8cafa53e4ec

SHA512
2f4e75dc0cc9b1c510e56e38b9adad1c8c7d60976ada9c3d409cc1865e4c00e2af45bfdd1c04a7dd53c4918a6c3083d2ea4d04506bbc301cdab19fb522d9f556

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
204KB

MD5
02a71a1ead957aece4aff3e2950621ea

SHA1
2f6e99c8761e827e4578358a7ef38a8cf7408d68

SHA256
90354dcd69a29504a324f2f3a13849c2d6e9cecfacff67e255638562e51be3f9

SHA512
c9cf2704480256cfbbf7d2e757fceea727531343c9ea53994b9da90a1677c6fc9ae8f9c3b7c4a9fa6d540724203e20823975bb3c25b1929b05350d0b49c640c6

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
205KB

MD5
acda5e6a465ccffece316203b717dac9

SHA1
3d05fc31d8de4a82a26c4dae7865e8e7f28af1c7

SHA256
08ad0d9509a05bcd0b585a385ca7f69cf15a1089aca83a21b49cdbcdbaba8537

SHA512
40bab5e58fa1baab673d449ed59721939e4ba1f46c32ee3111daec47d42c4742332e9aeacfbc5ed7f67d9199e7d3fb9498211f7f34a4ee530ce9c8b9836913de

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
212KB

MD5
650775db407f17c19627e28058d0d474

SHA1
a05da1f9afd373b99cc7ab74c0d23c02f68dd608

SHA256
5dd30b7be0f76530af1abbf3dccc90d9009b8a4add700a21012a70523ea4fad5

SHA512
cdf0818ad26d1540f8fe09d6da2e860ec1e3648839bab455a4dd4a26fae931aad060341762df48bc3184548e2f2cc803106e1d9f0c5b506854f96bbaebe0a175

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
206KB

MD5
c54339b82830c54700f2d986833da612

SHA1
9a420fb5dea27c5abf4f099941c3715d955cb6e6

SHA256
6462607cefdb242cd73ceeba814fa26c60469fc5d0c04ffc2e6af397335db07a

SHA512
f119f9b96ad7b395b5db6293acfa6074b24429fff4884ed8f1907485f7390c9b28d4dd7d5591c1a8fd390c76046d929db0bac4da40b390aa2dbb95187ce540de

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
204KB

MD5
5ab0d152c0612cc3566ead11e60c51a3

SHA1
6768d45e8dfbdda21a4c10898d5ff4b98cbc75bf

SHA256
6ab086019a1383fe150d60f60e5bb0e76b6a4c75128403907b8aa7688737958e

SHA512
11e41ef0b1cd1e92714e2b3abc4f96d49e8b8fbf18d1cc55fd399893444e954ebf7bcc92bb3361f1bdb253227b40bcaa5bd58b0ace483d0a1ab42aa9880c2f92

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
209KB

MD5
f8471b0d17fea8f3217c867281b41f28

SHA1
3233beff27d847180a1bf84010c8a2afee593a55

SHA256
9ee939a72dd761497f990db3bba1a9cf109e0e912ecf03eeed4cea163e6d2382

SHA512
a3408e48ddbbd118c112a9dd6a11f906ddb088b6edd897022d2ce33ef52c3cc7a54d5284c9c7c6207ecbf5a14cf454e347920d7f648031321da87af8c342b778

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
204KB

MD5
2f5ae1e9f317f7cbc50d49bdbeb7213a

SHA1
14d3259e4e4a531c45cfbc034f5c5a458a765c18

SHA256
785b325da83009b0301d3184c07e6d4582aa67241d432eb226275ca43e34e9e7

SHA512
1fdd66ef991c700a50acde795afbf18ce1bb266307a683f9745f999e3cee19674da7dc674cf15c1bd783062fc9602d6286c97ab6bfbe071209a7d5530c88e17e

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
203KB

MD5
a2f4dccede2eb8e55087074aabc55906

SHA1
990ed2146e1b840eee2509a21c975062b84e06fc

SHA256
52210b4e8c212c5cc6c7573d457f3d181f32c3c6ce34b2152022e6e614ef84cf

SHA512
71513c1f6901c5c31105eb469df525eda38e5f41a65b0f278ed0eccf621e8af6566298814e7d62d3dc73a07a76a180f58c58f9307d74df839a33e38574e229ce

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
202KB

MD5
01fa2be46882135cbe0407c5d5fff900

SHA1
6a7d1b69ba82832dc47f591e806ccb3835aeda43

SHA256
e498f6cf04041598bab5e8d8e8294c5d345bbcf9b4e383e474eff2323bdcf501

SHA512
6e466a5d882a8c3810640418e41bae658a717a9cfacbdf4cf915ce55d3547ecf5697a3ec1763f4bc694c1e906764b5bd31c865627af7290197ddcfb24cbf7b98

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
203KB

MD5
6bbbe19ada68fe89f4c444b8f75e1d05

SHA1
1f4d31e57a36d3d6dbe923e536915c00a21876f9

SHA256
4d5848ef1cb9e03aac9b8e949ee498a1cc2b75158f528b0e28123c76bbe43992

SHA512
78b7eae88f4d9b998e60d846f72d5a21dc2567c0b5082fe1dfdffdb8b8fa4d8294f9713185cbd0c3ed55323c3da89bd54ebb45fecbf8c9a70f3847c65c3ea9b7

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
206KB

MD5
48f6c82c62d7221f12af071b29bac5f3

SHA1
1c296223b20cff9d7dd550989433fcfaad10de9a

SHA256
a0ba7611cf5f2a285bbe596cffb17778be752e658bd8e34cda47a179f6dfd607

SHA512
4215266a5a09d9af1eb790bf52ad89a0e300ff182559b8058ae92a2e0305857df6c7ccbc1063a3bfe2bceb1fed0a6557248b8e35853402410ef3575afe52c1e4

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
213KB

MD5
f9e052021ef5ef8757d04a5847cf1c9c

SHA1
7f44ec212f9d2aa459c6ee4fc1f29d9ce694cfa5

SHA256
ebc8d7624c7ca0ac17bc44b19de1a2e524236052e86dafc3acae45ccee7c37e0

SHA512
35f3ecf129606a73add3bf40c736389ae11cb7f55d3323f10a82a7b34b2017491c42e5991aad12c19da406831ca800452571935c3787cabb66a0e8042d367a11

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
204KB

MD5
e004c88556690b6ade240e5d928a94f4

SHA1
b868b20c4004fde3545ca413e9d27cef62cf879b

SHA256
2feb1de925fa77330d077f84b3dd7986c1392eb575ffbcc9321ae98567d6d1e2

SHA512
e989b1ef79fc7f0e76179d61b59012f1bc70c41aed29c02b8b6b07379eda1fde9ef379b09083ef7aa8b6aebcc059ac5fda07cb1c0dbc909b86042f59cf3c897e

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
206KB

MD5
f208a3283383f699964485fe1cd51617

SHA1
58cf6db043c635ef13a0465a2cf770ce6006a01c

SHA256
56106a54db0a337a0e7436b8712afe3f78b52d0f26c47ad9bbf5d52a4bc99d61

SHA512
742a0de34206ec73cecedab78d5196d9902c8d98f0d0ed1739f3b54b57b65607fa563396aaa8526010ba5cf14cc4e5530d27956aeea5d9a736bf859259fe43e2

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
204KB

MD5
ed4ac270952d801ffb01d708e7b4cb89

SHA1
07cf7217b70f206185eef262bac61a7d021b3f11

SHA256
12045646d89c1eef6d4a72c3547f2b554ffaa779678aca77b0ef56463189dccc

SHA512
f8b91ff02d3cdcbcbee415f43fba8c0ea54cb55243b028f4799d382cc4293e149bf791ebadacd2f9ba83834e26b7aa4e268b37334203cbda7c7760388e407f18

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
205KB

MD5
a48af97db6f8c21391c64eb67139bda0

SHA1
2cb0a23227350e19bab45417acb2cdf3c47d2afb

SHA256
f0961074b146b5064bde4aff2291c5e992f2204cb48e571b1769b6b044f2499d

SHA512
aae215f25ca32342fb39ce67cc6c77d03901c4eaaad2c4178dde5155f207921f87d79cfacdd6dc886bdbb03ec64eb460a097f2fcaf40264697cec6a5c6e7fe0b

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
207KB

MD5
8ebeb2cc23db291ed37d20343f2d1b9a

SHA1
fb56e7897ddcd168596034f977ccfa8c17869581

SHA256
fad4a01a721c9fc831d2ca920a0838b01fc88375a4f5d9dfce42da16df00c63c

SHA512
658efa9032defc5e81e471af8d51738ea6ee1822a0da22eb24518bf85b33c36392114452543ee39c826c0301f5275db0db8f939af4d765576c4a2e277870f13c

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
213KB

MD5
03adc826df9c64a0186f082a3f1274b4

SHA1
9da5b9b28dbb6bb46cd0aa8cd2e860fa34331d0e

SHA256
aa24bb409183ab7d494aab4f0a9d1d8bdc64c4b912019c56eff24df1c834f532

SHA512
d90aaaab3d06a284f9553dfe175bef2484f43dc9cf0ae06fec59a271ed248af4fbdcb0b403eace464773ce3309e8d531d3571e462dd42a7306ab9e9478f6f4a8

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
204KB

MD5
33c9600208383ec766cad17ed302d149

SHA1
ac599aeeeb4589338302f48a117d4e6f42b15659

SHA256
dbcba698ba20f31f66368747b445192bb1bbe13d3031bd2e61387beb45d0a8db

SHA512
f363b8ced0277cfe7d41c4397202a4b5507d90cd4aa638edf70788ad1299a663f60208a7b4c9a00e6aed66b0286cad0a084c89db4195638da6e5beb2794991fd

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
206KB

MD5
c268c93ac6267d94e1e9bdb529098c4c

SHA1
cf5ca9c7198aa3cbb0038cd841081d70f124f30d

SHA256
d604a00b1b67485eea55ad0ebd7808f72c8daa9aca2bd68bb88039ef8c47e06b

SHA512
364bb2eb4b346176bab39d48f825d9abeb3371a10b1ad1dcabade3746c3f8e924e4f9e2aa1ec668512dd29e86ab3332405e7f23bcac84e6186a6a7aff33aa83a

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
208KB

MD5
7a964e0d4dc46fb993e72ca3262adbc2

SHA1
15a46b1c09f4dbddaa4e67848d452aab80154e7a

SHA256
90ee83325c44a7f9a6db0af5fbf5a7d981cce78bbc359d36a1e34cf7988d3aa5

SHA512
b383cb5162c09795904e1437b0463b170eda4bb89c45e014b61deb2c863a0cc81a1cab16797b7b823f4dbe4f32e36926ec694d0a9eaf68182486bd5ae678cb59

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
201KB

MD5
05d034a9f0258bdbadc074fbe4bee402

SHA1
3cbc678b93415a04507df39b7b9f80de679eb727

SHA256
9f78a59b90cd0d5af371cd52db4fc85270b8e523226b3c23638e7f210336c64f

SHA512
7ad3b4bc098c7efc55ea5bae336240f9fae9cd94ab3d9025d9f01950901eb8363b40cfc3e23549d411a6580496007f89996e82956a8cdf0cc35e1feb181dfc90

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
208KB

MD5
f8e2da412822491443af72e2952a4c92

SHA1
7f96f93e96a3bed5bfa0379ced48553839bed616

SHA256
aceec107e7c864e8c26f5349edbbeb52fc5acef9470c079a86fb23a57dbd43fe

SHA512
62c8260f9117635f23ce2c9ee912c1a371e17baeb6e085f6217c83efc14d69cfd00f801b998333018bcce1a7ece0e5a51496742309ee2af0599cbf609a14b1c3

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
203KB

MD5
3ebba3e9dde01e8d47a340f9f0de3bd1

SHA1
c1ef6caa984fd2b5f27a23a894b7026005f40d3e

SHA256
8a1e871ad2a4aefaee37a2a861fd2b21bec2ebc8f96eced76f6d7283651ac131

SHA512
dfd44f582d8f99e0374698bbd480640f4003e5af1bd0e9f6aa90b93db30ba5a470f64833c23525ed341781655c9368c6d06909639863ac030057ec893423f328

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
205KB

MD5
9e9f44e2ba0490b7485000e174bb4a25

SHA1
19136464b12501c30e6471f6695d88b623396c34

SHA256
5069ae2070fbaaaeb59c191b4f2ef4de46ca5a6e045d6578d62e9ea77880a637

SHA512
37597c3404e209e2884572912bbd2bb4df06896941768aa89ed61346f4cfef8725054e437aee5754d89eb1fde94f2bf135f1d1d2c2a322e6b0af8e253754e01d

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
204KB

MD5
f689a18f353db442c63d617a9d940ca4

SHA1
b3f2f169cac77c36c5279ddd3446ec32993a9736

SHA256
3ca5898c7edc0361c533a5e9311fe978d64ff4ee0796f0ea1c10e69335f20e18

SHA512
21333441081550e41201af706aa930c0bc439046ff3473474966ea8d20540a764c17871670574bcf91871fce6db8f3e19154696d7ed943c96ef9af753022b6f5

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
215KB

MD5
552b14f34fd7a716ae25e88cb7f14b07

SHA1
3260a39c6224877c2b3c9bcc37019b86e8997a9e

SHA256
74327895bb7338da7c46552a6fc366f279f304283b2b2508bd10b1c2e8583e2a

SHA512
a3557d8bca55f750257387ec549b0a975d1b93b3c9547f8221e77ab0d33f5e609eaefad1cf655db080d3e6fbcca2606225bc897a8c85535a26cd13fce6e2019f

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
217KB

MD5
83ff510b235e89ba5d18c3866b7bdafb

SHA1
203042c99146865b6c7c80f589345aef03d0f2a9

SHA256
dd2eb247277a0208714d62f20d5a2e6c0aeaf4f18fc2cb8634a0e3923c309931

SHA512
158c9e9ca07776bb0e3af6ef629d09d0b86bf9e1bb58af304000360c628db251c3c5eef695cc7d3784f226a4d4cf03d9c4ac6027cf3651705dc8441be3c181a1

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
206KB

MD5
e26f03470302c0ab7a8d5091429dd2fb

SHA1
54ca095dd9126526889783bc734914c9330d05f6

SHA256
3ef048381cb4b82dad0573b73586ff8082c72dd5d89d21123fc6d248f2d5422c

SHA512
bdba13b01094095a870c3cf923222a2336ed378427b423a641bcea2a27d333c2478026947ad9b2ad05295fb4ea5f0c713fcb40aaf75e2e76e7ae960c1d259dad

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
201KB

MD5
f81e23d6517002f03ffd2bc969d676b3

SHA1
ba02703b9deb4e084c1c537010dc5d2ca24ead66

SHA256
0022e3c6ad98862e493fd1d77cacf05192675a18665c6180e2bf86de9a85841d

SHA512
961e048ab4271d7edf59f6610a982d7e23a4e6856dfa80f7a8b506cfa93a719ea6d0f2b870f24c0bcd8e4936848caafb5675ff9972ed4b50c3f9dddfac1df612

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
201KB

MD5
b0eb11af28e71848bc3102ef438e9659

SHA1
0d808c03e9c73a135691965cdbe3dcb0ca7e0e13

SHA256
a5b8272cb4881cd79cc693f9185f679020df7faa69986aa067e0bbb45eecef2f

SHA512
d796d3d26014280be4f3016e92ff42b1b993499939b85a767f0094256d555e0e0851300dbf428c507fb8df9ce40c9c52b8544b943dcb2fe622bbdf5420f5b973

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
209KB

MD5
ff1a1f1d535168721e0abcaf44d0fa7b

SHA1
7e6598cd21ecf48ccc10e8f225cd6145fd526fc9

SHA256
9bac45cd9f40c9b52839e97f9f448294b2908920605d8c96b513d722fe6cabec

SHA512
c397c2995a53eb9f43a6b2284501db1969bd7bac9099d68fc7d14876684d41a2f2c46a1f3696fc9f0fd4a67d947148dace40806f372f0425de6288a2d6b1daf4

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
205KB

MD5
a7dafcb4505914325b4ab00d511d6faf

SHA1
55429e5ca4f6669bca8f9c2809196ab21a567729

SHA256
bf446bc771b02f0f3ffb5fe8a9592663d7edddee4302c17474943fc72499e862

SHA512
bf750c80b5aae58d9b6694187c6dd5dc8ac0a7cbf4bac39a0754758eb14411edd646094e4915d058da8e9c420d415c45e01e6186070b8108af2073d6d50c6ff1

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
201KB

MD5
1de0e638297d91b11ea22042c55127f4

SHA1
edfa847e45e496984f551ba9629511222e499119

SHA256
943dd0c9290afce14a62252df3fc1420a87acba4fb28da5f185cc43179149aac

SHA512
2fd5be3b2e9284b088c8a8497e7ea07c9fd213cc9b342f8d9902aecf57d78c5ef81fa499f835f7583237001b081e5681619ed76bba2a287868ca36b29ffb8f8f

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
205KB

MD5
2b3708edbeb00bb52a3c2e7eeaa0bfd8

SHA1
41bed6687accd42743a21b26a82c8e7ec13fabfc

SHA256
ef4b3b9417af9743285603a0814f98efa042c276e5103c123b3e28c251f04787

SHA512
c2d398e9d437fb8efdc0edf7ecdc1ac94b77e1c994654671cfdc309dd8c914edeb382069c6a48b9c43ddfccf071ebf46a476696260d5dd98202069bccef734dc

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
196KB

MD5
00f6cef211ec6d79363c5a7e47757d77

SHA1
c0740b53c45bb5195960dd57454372ef2dde5aab

SHA256
734b7d3e437cc69660bda2852c9b2cbb3ba559657a44044a012af0ac80250876

SHA512
6759caec1cd6564a4f0300c2868ff304026673f54f3eca3d73706dcb62733fae2f0096d08bc660b79a214650b13c3ddc559581f54b26debd08a3ac43bcea738c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
196KB

MD5
80f139dcfabb855827b366895f14ac61

SHA1
50a6b9b988b0dd6143a9513f9a81539379e2f88a

SHA256
a155ab97c39123016f3467941f7d01766faea7c44543573cdb1050315ef49ef3

SHA512
c7aee7ea8432be9d5056fc68e30970366bba8f0a875a9a1ef952d9a49c354602c9ebe81e80531e73eded74c3e454ca19b3d7a6174569533aaa90b9336b34ea23

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
195KB

MD5
b0e53279402a505ad0ce58fc1722a19d

SHA1
756471c1dc77b40b9badc1ea1810531319067408

SHA256
c4500ebd8dd625ef86a42d5b40056397860762ef8e905fb041c92fa42e881b22

SHA512
e05c55c661bb027bbc092a5b03e5bdeb280c14c91f59ba456da034a80e3edf3776543b9511df5ecab9f9074baf1485c70a2347ec27cdc98b6f55398bc1776677

Download Submit