98bb68961c790db9a43065236d22ad10d5c5f010f66a61c9785ce385163634fd

Analysis

max time kernel
120s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23bf094acb6ef3654c57b735b147d720N.exe
Size

130KB
MD5

23bf094acb6ef3654c57b735b147d720
SHA1

5d0064463e8557fa3dcb992204bf45a64d2b5297
SHA256

98bb68961c790db9a43065236d22ad10d5c5f010f66a61c9785ce385163634fd
SHA512

873a712dfad41014cf21fcb685f06ca0f26be75d8e86042d8e6a4f01972180128299fd2bfbe7abf025e3424a525f2ed43d0a7fa25d20ba8802c93e004df389dc
SSDEEP

1536:W7ZppApBULcfpHLcfpX2/Nw/Nwmxd137ZppApBULcfpHLcfpX2/Nw/Nwmxd1J:6pWpBwchcV2WxNpWpBwchcV2Wxx

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4779) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2032	Zombie.exe
5004	_desktop.ini.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	23bf094acb6ef3654c57b735b147d720N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	23bf094acb6ef3654c57b735b147d720N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\hostpolicy.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Writer.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\he.pak.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsBase.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	_desktop.ini.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23bf094acb6ef3654c57b735b147d720N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_desktop.ini.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2032	2680	23bf094acb6ef3654c57b735b147d720N.exe	86
PID 2680 wrote to memory of 2032	2680	23bf094acb6ef3654c57b735b147d720N.exe	86
PID 2680 wrote to memory of 2032	2680	23bf094acb6ef3654c57b735b147d720N.exe	86
PID 2680 wrote to memory of 5004	2680	23bf094acb6ef3654c57b735b147d720N.exe	87
PID 2680 wrote to memory of 5004	2680	23bf094acb6ef3654c57b735b147d720N.exe	87
PID 2680 wrote to memory of 5004	2680	23bf094acb6ef3654c57b735b147d720N.exe	87

C:\Users\Admin\AppData\Local\Temp\23bf094acb6ef3654c57b735b147d720N.exe
"C:\Users\Admin\AppData\Local\Temp\23bf094acb6ef3654c57b735b147d720N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2032
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.exe.tmp

Filesize
130KB

MD5
637e853b2edf70c1dda824b8c7830c4d

SHA1
2b1045e6f670980b32fdc2850e28f7ce64431fbe

SHA256
2ed24ce4c32383dcfd6313a5a0548e391a5ae6e61905226c72b31b8486222939

SHA512
7f3c7a1cf06503c45bfc8a4ad59d8331162e81d5b620d4863240680cf19651c2e3a00cca6cb19235bf784b1a3f5519aed87364ef21916db9ef9fc9aa6db5cbeb

Download Submit
C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
61KB

MD5
ceb1729bf121a2b6371d74beb81c4414

SHA1
cf4aeee23fd68ca5bd13ae23a2a8b190825bf4b7

SHA256
4a0c002d639a3d163b2d518d1b132c9e0fdfb22f33bcdf5eab5d4cde115fc32d

SHA512
4da5c4be85f6515d0bcad2a540272c289c85fe2f820f9c0a5e4e6684bbee2f508341735de27b7f8d91e607cf23d53441cda1e89d0ec411f7f93ab86dbec4f8cc

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
173KB

MD5
9718755c168162b704b62605d584b4bc

SHA1
2bb9302045d95259e15d297160c9795ca2b927ca

SHA256
13cc29cea896788d7c3e2759c97fb9a72bc51a0f9d5ec7cae51c15a6425d04fb

SHA512
2a968d997afa4d858461fac55a23ab7effa1ef0abdd821dc40541cd2f467c5ee79cb68c362996534c5b4f530f25a55d02b0d08f1ad6b4837808d7b4af046ad52

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
160KB

MD5
1203e39cf26b96332731f2263ae75cb9

SHA1
6829db8ec388470eb9697c524f0aa278fb36b6b5

SHA256
a636ba6b00edd58297daa670c93df24acb5a5c0b83cbf4fe3271b92b1be08213

SHA512
51532eb08753cee96bb01c75620076fd90dee8b2078aa125eb98fd8fafb0089c711a41851afaa675184665edf0e283c1e5639642e3e4c80604667f77c14c2bdb

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
638d7fadba289e0b0442ee72201b5a03

SHA1
f19c7c435f29092bccd157323d8a303e4ddbe4c1

SHA256
63176ac8d589acbbb602be1dd008a7bdb0459eb0fe5727037926b4e4c0660122

SHA512
a3cb6310906c229a2d3b0f0e8477ec79347396f5d138dfb84ca2af690a7487846b5ee7e520335c896da2dd9e1600303c9273a4e98fda77f2c63c0d881398af97

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
605KB

MD5
7794d298118d97de08147948624e2c88

SHA1
7af0da6b2f58b6d24ae3a2145b45316103b81629

SHA256
f4710c6ec4b3707c5be553441cab10db7388a52580998bd97decf4cc2d29732b

SHA512
16bb3bbdd3f0f18399119fbdeb5db2b83b7bf8bd8bd94f065fa664a052471828777c5a7c53256743d9f7a3b3eb4877e91df9d6a302a15020956ece850aca8c41

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
999KB

MD5
cff76982dd156b93d197b1fce078032d

SHA1
5c27309f0da16de65b28ec8d50d2404873090d9f

SHA256
6ee5edf8a6c2c8048ada4546514279c09a755907e73813b1d9382c6879e09922

SHA512
7220c11b7186a33d9e99b22c42171ec1eb57d3025cc504fe292577dd0a25b198b716c89149fd661650fd367559cc46b6f0973de8b6925cf10b5048645c52fae6

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
753KB

MD5
8e5890527318e2bf0ebb82883b87418b

SHA1
d99dabcbf5a97901b16621234b2cd1901a7c60ee

SHA256
77eca99a82e6a0a9420ab8e99030da954eaff4561d59001bf4da5877fcafc23c

SHA512
15aef1de6ba0f18f55b2a95f42912854cc47dcd3d17245009ae158965f22afe27fe34ef1c9ec70f918eb0c602a0a362b72a3661a64498a58da71bb257d95d695

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
70KB

MD5
91f1760a5584f720086f7c63476696dc

SHA1
97a5d0562b959fac28a954fb44c9521b51c6367b

SHA256
1a39f949326b7f216c8f0ebbbc6889399e6a71dcd74f64e0c64f9e4335684e34

SHA512
6771a3fbf21e6bb24ce6a57e64b36860bdf8c821512c883ad89f7cee79155475d3395878846930541837413bab3f65bc9e0fc874cf3914dd298cfc1647044d7e

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
73KB

MD5
35fc1927c6312a4afa4d25b674e08087

SHA1
720b7d0cf5b91c7ec6049aa61874e2afd787d480

SHA256
563c6ee03268c8add7f6c5bbe84cbf3dce37d53901a12e4b9dd9bd11f4201b41

SHA512
1086851e5388298fbeca91184ea10400bf8e5e7b4ecce981aedaaa0272f082508af9a227f1a2b48be6adc88ee7edc5e07323f2914cd0d9c8f61cefe49cf46ad6

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
78KB

MD5
51c855eb82198a2efe169d67d337e601

SHA1
9573f7afa79f156013a934189268daf914e62900

SHA256
66f5b1b1b17a4e8530e057d7635f09b816272c11b46bef2898dbd2b63bfa226c

SHA512
ae7f23333523e76137b3bde3f5bb3a245ccbf3645b916a096fbe18fcf7b0eaec949c3edcf03b04bd7fccddeae93651583619633e29129d89f17d8388fabbb8aa

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
80KB

MD5
763354f16dedd4b5817d881f4bd25769

SHA1
c6639fde7b7f4ff4fffb32a255158f8edc17a221

SHA256
d8a34575f7f3a4660ecf0cb89b97b0f6984645d1e15306e700279477085d1474

SHA512
a927820f681a05695bd2030170b21e7667a2b2540fc216a5514c39d6af243e419e75ccfaf78fd1b9b2d0d2e8eafd57ecaa443f9b3fbead8275183a1ddac0b225

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
78KB

MD5
46cc796901f8991341b6c37f0ac1c4f9

SHA1
8e0c5ee4ff6e7a3ad86082e1498c21fa477313d5

SHA256
75a5dbf01887886dbf856cc07ae6f875ca60de86c934a7f032f6c3c798e034de

SHA512
1d7c17e9bd15028cba604083660a9c57c21f069a2cb1a4661339b0a506b6aa79042b4a6ae38c248bbc782d2737b44f3bd82d78d0d1af01548475f101734d246d

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
80KB

MD5
fe8859bc78905df6bcbe00a0384df370

SHA1
8b74bb548012eae0cf3b9604758fc42bbbcff448

SHA256
914d217b9748d64aeb828c1fb877403cd3e65b2db68f55c4e60bfcf885204c22

SHA512
3647248d68669d6bfdabbd87cfa1b8c98055bfd7425850e791e6c69a7f4a8bcd57ba563a2da97a8d3e3cd76c862eb9463d29d471e605a7c852e9bf54cc9ecf1e

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
78KB

MD5
84910182c7f10a1aaf0655973a853381

SHA1
8411c6080c8543f7c7608d5ce0187aabdd68d3ca

SHA256
e2d3177a4d8c933bba546432780d98babb09c49eecaea4fe4fe7af8d0597b8e2

SHA512
847989e2007b5acc53b4b0bd7c4296a8d62fba0d3e44557e40c390369750662154634a528854c6bd088763cd71d5c0ea1efbd67b3304c5db7b325da100a6f7c4

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
74KB

MD5
4615fa61e2a16431805e65d604992c87

SHA1
f864ffd555b534a6ca416a1db0ece88fc2b2de55

SHA256
b296a7a5d2ab5ae9c1f0822b15d31233ebde12da4c5110ebed81ad3c4bc16981

SHA512
a130bcfc3bf6680295617d964e8e938358b1653603769f46cc57d643cdae8c1b1434b03812ce644c56505060801b018877556f11f5e20b424c718f4d4ec3b844

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
77KB

MD5
7df763859374e8f23f07b9ad255cfa73

SHA1
ce342370a78e08f54a1f1158b4ed381d1b5a2442

SHA256
8e075c5926208a2d006fe520226713e5aa318da0adf8a333011ac790cfbe57f1

SHA512
4c46ec87d2d69fd6596ec0007b3e9391f9a014787df94c761b6b0e32de56c5034c8fa85b148dcaba22870268d3943b108359b559eedf5e12d43814fff3c85511

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
78KB

MD5
4c291e4fea79e5758bf3b032d703d16a

SHA1
bc0796818f1a5e0aa0e9deffe895db8278d17a50

SHA256
15fa461d0b99c42681dc30ab886ce750e5c0b11b8d9b5dd42f579002d74bff0b

SHA512
608448fc657f2757f8e33980616e0d6a10898ac8d53c60c9712beecfa728d76505e38ad8a6a8ed3aa2f5f38291c18135707452eb18aa3d01e9d567c3f907f2d9

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
85KB

MD5
6d1949b4d509369f98195fe620db5eb1

SHA1
82a9687eeb84b881061f38faccb2e1365467f203

SHA256
0a4eeee9723bdde20e333ecc9d84ada8ca1f5d7295760ecb3659e83ea8cf65b2

SHA512
19197ceeeea378cea498f62fd036ceeb3848a251f301ac3adc6654a190278b729b2a83776f20f036ea16abfafdf9991052ce91d30930d754fc778e698b796485

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
77KB

MD5
ab1c0e88aa7d0015658f185d31ece90d

SHA1
8ab7b021bfee53cacac76e67bad2345a09808fd3

SHA256
a0be432ca9593c804feed6fe652b7acfd17e2dab41c2c6e2c73807c1c66c7f85

SHA512
0c710c965212b2467015bb4ea9eac155e859324a2cafc56265a1224955571500138de24ea06920ac88aeaccbe68915fd495827e361db4cfe5422fe38c4373791

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
68KB

MD5
ba04c620dfc2f39fd970577116adbcff

SHA1
52310ed678cdef331379703667e1a0544d11005d

SHA256
5dad688c34f3f923659c3d5d932786ef6845e710db55284dda78615ed29803e4

SHA512
0ebe6fb3f4cd4d2e8c26c06fd09e82cd217b9a330e1563491ce04966b5e9fcac23db43cf743823cae7c7edc461bdce7b3591d246d712023b92d4782ef8cb936f

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
74KB

MD5
a82f1276686529f73beb6944c4d554c5

SHA1
abdc5646bbd200462218cc39ac02d4da0cb579eb

SHA256
63509b759007ac5a21c2799587816b6ed46f9a1e25dc078c2d1fc733c68db520

SHA512
e8e207faae30a530d5e8579fe75b9fba55bef78d5c33edfa3001763cf0e9184d68834ad46b00f05b188c2ec984c12b8db19d76aedc5f1a3d4dff72d622691db0

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
79KB

MD5
f95e9af684250242873b527f7160a857

SHA1
983bde2e8cfad2e88c975fcc5c4935c7a382e139

SHA256
40053c862d4bea527d4b048b0d34e27a905f05fac07eb94e5d2563e5048b2265

SHA512
85b78b6766d39c4d19a90b5e650ada1180a73380a92d31180f4d4f9ce1e6fa609425407a26d05681a3716ba0a71b71e9b235f9180be7b84a3379a4ba648d8996

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
76KB

MD5
0bcdc3c2214c005c103606b3a52dcebf

SHA1
81f754b222dc257a097a82428de5620447bfb1eb

SHA256
eb4054659042a236953454dfe91546016729a544b52e567c37a606e120185c36

SHA512
fa3d48a2e46f1edfe047a68ba63c5d7a91fe50f34c8cc9d864838c23224a661b40539e78f80fd25be143d31dcc50752232c882023bd18de5ea76230b5a84acf5

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
78KB

MD5
716afa3c68996e8b287287867b0055a8

SHA1
73df0a8d026cdafa6e8e8af4497baf99da16ab84

SHA256
69b8d4613ca9436a50506c34e4f315d58638807225a22a846ab6023e74d03e77

SHA512
2631ee04fabe97b53c61fbcc3336bc7cd7c0bd63c25bef10661f6c4221067826bdef2e36b39cd1449d18ccb590311e0475b490adf8d7c8764ec9b917e28810b3

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
69KB

MD5
9753b06ed3b604a68413b914157d6648

SHA1
2e040bcd758eee8c04703caa57090c84ba9c91f4

SHA256
ed0f08be40c9f318295e1547b911e8b7460d56e3f7ddffc4275d438cabf1f490

SHA512
70b994801f5e951e5edd28516cce08aef5f16cfadb24bea714001cf51cf5a87e2057a5168f33c143939e0510b60f0b70bcc4d7f77d15e2975b6594cc697a452c

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
74KB

MD5
e39bc595b7473abb5842143953c61f7b

SHA1
5445ade18b054b7b1d76619e070d63f0048da5da

SHA256
63f901ef45dfbd56157c460765e48d9c55625a36eb6496871677c177510ae36e

SHA512
922394e52d621f94b591464279cbb4cf668fa937906c576aa98d01fd25420358723a949aa558d25061d2739210949558b402f17cfa153fc673adf8101a1c02f0

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
70KB

MD5
ccf09eac9f85cd5058599a81f079105b

SHA1
32b6fef525edfee0a3de6e7dfabc58f35676f3d0

SHA256
7299c1845a7a66188dafab38e019bae2e3688b56807317ffa625d4bf7d5b3f7e

SHA512
76874f405a069ee76d86856bcbdee533fd8511f97dd709c527a2d62ee068227cb399fdbbda08ba3d9dfca2526592d10791b1fa302ec33104103168c6ddaab214

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
70KB

MD5
4879c265a4f7fce26914fdc7ff128221

SHA1
af7b45f69487bba7fe402ea288fec20f6a179a36

SHA256
447f193ceb11080536b55a162c56cd7df8b95b276f1f1fc98f13029f1599cdae

SHA512
8c2f25b92f447688da0ab137e572dcfe46dac6b9b5bae03984259a0ceed05f62928cf691b32048640007327c6f923e5b3027d56702b068f76c18edb84410c908

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
86KB

MD5
6b60f0f121796a72b2b2d8c6bf2a13b6

SHA1
36c317d644b8ad8766e0b02dc9a9931e5d96df7c

SHA256
9e27626a541db0ff2ad89113868928e2cd4ae9678cb255af96ebce11dfafa49e

SHA512
25738e432bccd2bf5ab3c6ab41cc149758111fc73587db758b37a6d3d2bec1ed427f915a1cddc3ca84c7f3999e281be76bc13eaefa493ac3943913135f224581

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
77KB

MD5
0225da50e1b42535337b59eecff41ca5

SHA1
19d12417f9dd3b7668f5d82ced612ec66447bb21

SHA256
399f83a62f5dbebb393783a1917ea8a7f2d071315a2808cc5cfb693e81200052

SHA512
6231efc8b28fed05ab1052da4e64754939866f8cee8040b40a7c5437d7d3a2584a446ffa0146c6a0dc95745f2b1ab8daec51019c13009a7ca6ec06bb2f30f6b8

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
68KB

MD5
527c3ec04a7dff1bbf61e507108056ce

SHA1
88a379281995ff6ae5d9a1f7360e035c54896381

SHA256
e68c60e90887d3f35a518f65e0c3127a044a0d839cb8519ed657c9305cc29407

SHA512
232d5d927b0ecd20b3f087b542ef808870d555af8a8dbbc14dfdb442f2ba8d02049fc5c81141a90feea5973f42702a3edbb19dbd18c8888adb79105609fc5d4f

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
79KB

MD5
51ca1132452031beaa927cf5979508ae

SHA1
0a57cc46ce5f23989c7c5400d6053de3b7d4ce00

SHA256
8bd37158e3c159caff1b8bfb78809e1a9ee079828988d1fc56f4caaff6d7be1e

SHA512
f68db1848ff4bc9fd9820812b13ebe573788b60ed10148b969c23aa6e85671f7586933d0dc6c2cb98636b6b6e23841f9958046c580198cd41e3d0035280d7fb2

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
74KB

MD5
ffa5d1bc6e1c197cf2e51310a8f941fa

SHA1
4e03b824f793ce466c5255c5a9a9f29a4a2ad4f2

SHA256
e6e3b3a65ddc0808dcec90cddcb7db0a8ef6456e0ce20836baf6524d77495082

SHA512
c59828b5602994f0ec00c50a9353700950b12efc829d5824214e2779d0375504938c67e7f7bb5008e4bb4e1f57b1321582e6af26d69087d81f035b7cc91c3b84

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
69KB

MD5
a964541ba86523aed92425a95ad6b216

SHA1
9818b0e0255e466a86337577396ea785dffe6673

SHA256
5eac991008cec3b0f8e060dcbbe2dd3f8432942e893e5ac27d948ba40d58b292

SHA512
4d34b5dc80a0fdca80f7af4a1a54104a950f58647ff3d248212a8c836f4242fab3a292870f174cfb4a0b3ee61740e09d508e1a88bb53a0cd88a383a59708b753

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
79KB

MD5
47599556b6cfe497045ffdd30b187246

SHA1
cad443262e400d42a7b0d97131361c12e4a1a880

SHA256
b8bdf1c2796e7032ba8e25d690393cd5974779af2e6aee3efbf7cf0a440367c1

SHA512
e2927039c18e79ce0ee8dce779870610fa472da56136237725b380d52aa758bee406ba2d589b66a9be658a72aa65760904e70946d8085a40b214f98a214e0b1c

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
78KB

MD5
8d5a35c2ba2287c366be1800156a99e3

SHA1
4378e2e69062507048b8876b2f4c9ec3ee3de122

SHA256
43bdb13233ccfc5b72bc248ec5e57125424181833cffbcc86f548e54198ddaf7

SHA512
34c2000ea638d5f9b991712f58cd37e0039b616efaabbd48af319cbef16401e20a111a528ac604eb02acfcf59a2075f97494c93f3438ec8080cf867c60d6b270

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
78KB

MD5
5301e83d070315523ad3b828d9f6bc2d

SHA1
164b0ec588a24592e9fc82ed941c5758fd121fb1

SHA256
b66744b14082db3b51bd49759061a11c65567df1bfbbdd7903e8e13c2e2e7133

SHA512
a4d9e89258230f93f3f3cad8b43d9810b7201d8791690d3c597cd43dbdcd906f3c17154eac8b674b577ab564e0c75dd659d43e9668116ff74e5546fd0ca6ba40

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
69KB

MD5
8f7d6f93fd3d9dafbb89d894ba5e3822

SHA1
f1cbf700277999fcbda84286f7c95bf41efcb6a7

SHA256
7c91c867814622df7db36abc6d681e6f0fcf6ad7549f8c4cea06976dcb8d2783

SHA512
9b1a93251be8c70867ec3754d6d86bd0453f8623ca0354528e782de552e3ca2e9ee1f751068e13fb18a15d7b66cb3289d52a3780a5960228f8cb135936b55192

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
69KB

MD5
4419ff5da07727c2b0fca9e9a1d561dd

SHA1
1e31a9f04d4ffcef89f5091e76e2ac316145cbe2

SHA256
1509d50edcbb456ae46fdc4682c4a900dec8835e9ec993a01006e60f4a6383af

SHA512
13d1c77ded13f9ef4b2d4c62145d517d89d9df2098c3dfa08c553d6d41f2b1271bb4645f505fd0e066f9cb05d5b8276de5f55ac540c019d3a42d939a3eaa7503

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
75KB

MD5
4c4f3d8aac4d90432cd481b0343e3309

SHA1
e0321f922a44f5d9d16018aaeb2937347d9bc347

SHA256
9add23d61963755cf85402a5701e50791def3e94061a175e068ba77e551ad54b

SHA512
d71933fb8e5a8ff0d3a74110120c65cf5028fae3b703bcfc1f27f4fd9f2cfe5fb7ff3533e3e1f825fac91b9ff0f1734fa3c2cfa6bacaffc2ee5e9c4d5fd5d210

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
69KB

MD5
a1cb85e8301295979d273091ecc06685

SHA1
4cd20474dd9a6c5080703efbb434b8a69e3d09e1

SHA256
7c1fe2545a21df67cab6d2c3fdc3bd5aac7178d783a325b592eb5f5e4013932d

SHA512
b2b11f65f92d16d7b26f1f2e02f0dc0f4e77b46300470523efafa3bd11a56844c4d5c12b218f55b549287af8e015d577a65a3270c5a9430d484eba88805954bc

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
78KB

MD5
28f9f2e76e0ecbd6f8c1bcc6cffb57c0

SHA1
b1767b8fdfeab34c71f6edc4a9a74338986a5952

SHA256
b089883b9fa52296c71ee59016f2ce7c1c94ac1e51789057627fab973f9ec874

SHA512
4ac53115432bc91af21f21f36653955787021fc1c3eb202f2f504373f2593beff71e1991e83eda3da1b082ccb6c8fb795bf2bd8ab48043e9cbec2d816ff07e1d

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
69KB

MD5
2af6deb983130473e9d425189466a980

SHA1
c7a6477998513001b900fc05494f30454bdafa89

SHA256
8d22469d6cb8d31f6c81d929d6bf0f1d042c5602423124cd8260b10f906f882b

SHA512
22bb91b70578ee7f2507589c663a0239551bc71282e48ad6e0f5034482a94f45c9662401d058ad1541697358717bccf81ea655cce275a65262cfab3957b462ab

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
61KB

MD5
6c959beb0684877e3f8c292bc30a0ae6

SHA1
b652991432c38b8170495d7f453a2c09a050f1cc

SHA256
1aa0d1d0529a77ca5e285ee2a00ecc3454f52f412c98d6a423fec1703536eb9e

SHA512
fbae65b79889a849d57a312c54d842100377cda1d734f7d6155ae94fbebeed45dadd8b3499a5ca5b219cf7d54718dc18f09da594fa6e4046b9fa166ff2c70e7e

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
77KB

MD5
2f0e5cc142853a8febbd4847e9c541eb

SHA1
6f6167530e915b6415cf78e8a00e5aad03334eab

SHA256
20c910509a73ad97a06d0db662a98e6a96f8a3417255f220040f8f1d26884654

SHA512
9c3db7794cabfae6a2c948e81c7544827843c1ab296bd355310e699ccba5a05a758705f5c8f0e57e66120ec0e366437283589acc36b5b5b8a8a059e65aecbef3

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
82KB

MD5
a37c884edfced43784d04a1537d24d58

SHA1
b7ad1509c78e384fdbc0a9a61b299bb9992a7a4d

SHA256
764ffd466225ed1366ea3b63ed79803d4a16ef41f5b4461488e721a315aa7ae9

SHA512
47b7d41d118171f75859427d59b5abca7af4fcac5c5c00145d90c4e43150747fbfdfcba7143682a71f4829908cdb4dbcba82e2cf94ff0a64ff424ed5acb4f834

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
71KB

MD5
a43491397c3ba0fd71c39e3c6f543fdf

SHA1
bd8c168580c30f89d419e61abb7b246b415e0e79

SHA256
5808a1c5860b2a02902f84d91c1830728d050d0306cb90296f741edaa713bf0b

SHA512
b35e6d84bba02948595ddf132803445a28195732d3a6596ad15cc76074ef47a1ab76352c0605c96ec07512f7fcd0f5acd15e3baef57a0cd22e2f1366f124526d

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
69KB

MD5
0a2f829258c7fd2e7c607465bf582119

SHA1
3116daa2d52f779cb65420047e459b2d3e103033

SHA256
1eaac8a5619a8f88b684c1020d5314beadfc193b45e7fb8166e94a0d9d46abaa

SHA512
ad23509482b554ae2b6bf84b15c24449a8a452deb1edb053ff43b28f6bba7101ebf4418b4a3b999cb5bb710e5b8b3644977a992460bd97f82e13b1751b153530

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
69KB

MD5
7b8aa9e8349ff870505bf8ab44060709

SHA1
fd819d3f4cb3f371077d9d72336de12035b5bd6c

SHA256
384659741462dd361240ab0e25773a4dda28de8590960ddd094f90802247075a

SHA512
0e9f361aa02c839bf3b9ba2163be5dfe346cde94ad2b6961ab57195ed1a2f094e6d804177463c5215fff5d81fe9cb12d35aeff1505fdbaff068be030b4ac861e

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
82KB

MD5
ec713894921cb9cd32ba3188efdb621e

SHA1
d8ad3c9c2882d930d58dbe2a9ead2cf23b0d95eb

SHA256
281ad28f11242b3380a82efa5701113eb6dd6fdcbadce92d0f8a5c0524276224

SHA512
8a2243f15123f16ff632b79d115cfedba913173504cb0a98c21bc71414ad02e3e0ff7fa20e11ac8dcbf930d5602af216bdf34a9bd9522def4d27e8aa93606325

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
75KB

MD5
5f83b6bdee537d26336ff7902744821d

SHA1
95e566626c9c889af326fef7fc6a4b851825f49d

SHA256
d14d09a0ac61e35b8fc313d6d8c547ee33fc0b6cf8801dbd2cc9f15fab4f3401

SHA512
0486d99b30caffc5d705bda5f28ee309bbf5df121ee7d5c62daa47f0c886a6fbeac14a7c2556e862b8f332f1497a3102df0fab55f55d8b53053e2242ab29df68

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
70KB

MD5
310e8ac813a0a83f370bb14cb3de87ad

SHA1
39905394a952dee80172ac409babb50ba6b81c4c

SHA256
a680334e851be0c5e76cd62a7d3de11389768e0682a69afc55d8314f7963ff64

SHA512
541290e4ace4c38ccb2a80ee33828dd2bd667995234518c01241c4a8d8b36480d14aa5dc46543e050487b21da0a6ae2b78df811dbd1483173fffb1bed733aca9

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
77KB

MD5
d87f3e20563f5e778de119888d2f113e

SHA1
8ef7fdd2d6f27ccb9531da1000450acd00352cdf

SHA256
ff63117da5ea05d98904012bbaa23ba1d80584a907e55610e40dc0faf43bfbe6

SHA512
f6b29ad2b1e5438ea3ed34c2bb666ac2a67f6d5dbd814d02e1f584c73a61853dd78227edd78470ea4f985f5c5039470bfa6fcb5bfe0b5d55dac3d957a1ca249c

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp

Filesize
71KB

MD5
6f5bd872900221431a68783b84893dcc

SHA1
7c6c069a104cab62518a2fda0edcc8883288f4f2

SHA256
51c4a29d825b66eba91c0c0eb94e31975ad14a665cf82110363942959d2ce7a0

SHA512
e823889c30beedd206bf0dc3a168ecf4faba35416d45b443f8e3e18e5cede9f4e3a8b03b5715102ca08301ccfac361d0ec8c4bdfae4029b13217e6de909503fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
69KB

MD5
0cf3d2b607f7083fecaae9b4f2f566ad

SHA1
1195e9f2ae143ddc88c23e259a7fad880f537e6a

SHA256
9f848bbaf7b16804702e0a99632d2c5ea411577240b9d89b4b59352b4dcbe17e

SHA512
a395bfd7fe3af03b6ac346acd2e49009aebb2c34753050fd8f4f2d0f35a6b1dae72fd3e1b855fcbd94c7e8fbb9dad56737891f74df5dc3cedc02a7fade3a14e1

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
60KB

MD5
e38efd69b10cd43c98cdd3173a20d593

SHA1
1301fb9d4ce8f69e116dadf75b5e9a6571508f86

SHA256
3b021af0a7966ccbb1e0a5b01807d4d6a1addfa0860fa6bf27b99c6986947bef

SHA512
fb38bcb1ff77bee1890dae24101a0c684ddfcdbae01ddc59f1275a29c67b3fb985d85dbed24dee114384890002d2337b04b05add57d3ba539467f27165b4cc3d

Download Submit