6065fdb31ed171d137e0a724035b4de46b90986079480b1f1073ac58d1c09e45

Analysis

max time kernel
120s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8a5901a85f0fc79db816977d6ddf3400N.exe
Size

114KB
MD5

8a5901a85f0fc79db816977d6ddf3400
SHA1

8a4ad8b888265affdae9ca9699491d8364c21463
SHA256

6065fdb31ed171d137e0a724035b4de46b90986079480b1f1073ac58d1c09e45
SHA512

64680b1c68833467f1fa0ef49691415a77d6d5260055ff0b3c441ba76da6eeb0811b0c89c670179852b61647ecba64a6215a5a3a00abc25eaad0004d7048a17a
SSDEEP

768:W7BlpppARFbhFAxC7ntkntV/Zt+7BlpppARFbhFAxC7ntkntV/ZtK:W7ZppApryHt+7ZppApryHtK

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4807) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3236	Zombie.exe
3472	_Desktop.ini.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	8a5901a85f0fc79db816977d6ddf3400N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	8a5901a85f0fc79db816977d6ddf3400N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.ResourceManager.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ppd.xrm-ms.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\msipc.dll.mui.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp	_Desktop.ini.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.tmp	_Desktop.ini.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.tmp	_Desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-ppd.xrm-ms.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp	_Desktop.ini.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\LICENSE.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Queryable.dll.tmp	_Desktop.ini.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a5901a85f0fc79db816977d6ddf3400N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_Desktop.ini.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 3472	4628	8a5901a85f0fc79db816977d6ddf3400N.exe	84
PID 4628 wrote to memory of 3472	4628	8a5901a85f0fc79db816977d6ddf3400N.exe	84
PID 4628 wrote to memory of 3472	4628	8a5901a85f0fc79db816977d6ddf3400N.exe	84
PID 4628 wrote to memory of 3236	4628	8a5901a85f0fc79db816977d6ddf3400N.exe	85
PID 4628 wrote to memory of 3236	4628	8a5901a85f0fc79db816977d6ddf3400N.exe	85
PID 4628 wrote to memory of 3236	4628	8a5901a85f0fc79db816977d6ddf3400N.exe	85

C:\Users\Admin\AppData\Local\Temp\8a5901a85f0fc79db816977d6ddf3400N.exe
"C:\Users\Admin\AppData\Local\Temp\8a5901a85f0fc79db816977d6ddf3400N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe
  "_Desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3472
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.exe

Filesize
57KB

MD5
1856e5cd490c507cce969f0c1bf6ab09

SHA1
342b7e9e167b4489c11da95ba4121b4335382ec1

SHA256
2adb1b359cdda48eb9ff2a129808d8dfbaa46c702dd5f710e34a22a490bdfaaa

SHA512
887f16011b3f336805ab938a1e01b33a377b4dcf00218be4e5466895585e0b68bf8720ff2a2e93f07005204f7d11209f4d8cb70e313de8576f77e3c46cc30060

Download Submit
C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.exe.tmp

Filesize
114KB

MD5
dbc7aada0fd0c41e574d833e7258882a

SHA1
5fb33f372c35ab42c4b99869566ddfdd6ef16622

SHA256
f3cda6c7cfd13343f289f674574cb7115407805bf94f3a45d0adbbf3ab1c2c09

SHA512
6ee1e4e462dffa38a17e7df9f21172f1b0a5fa791f5d2dc47ad9e12c493d8185a6d75ed844a91331e5ac388cfb5847c753464e003b0c47af906b46b13d02ab2b

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
169KB

MD5
373c1754fa84debd6e82521fea5095a8

SHA1
1e71d74c6832f8365c23cc6e25d4582134570f06

SHA256
1454ea0cef2db30ef4cbbe9f4fe6aaadb9a077e0cb858ddb42918a0c7cb15300

SHA512
3119683f722f0ee3c3a7261209ae1f478bdc3df754a50a0624bb0575912fdcd153c9002059c6ac09dd25f82febbecf05afef1ff5c221f39d071731287861f6cd

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
122KB

MD5
c733487c23bd86434115f107ea94494f

SHA1
06070d0df92ec22dfde6a1f16a4cc3733786876b

SHA256
481b601041673b716d949b2e7bae78e57c4891a55402e77f27aa6f56b86b5bc3

SHA512
cf39e1bbf039690ba56786d850e8687028072e8db5a1a7d5a1a101c1c9ac0fa1858b266e32ff6114a0511e2609067dcff3ffbe4cff343d0219e39e6d20f34c11

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
86e1576e4249cdb8eb752ab15ab684af

SHA1
525e6ff5531e341f890d257494a00adaa92808dd

SHA256
c246e3087b40d2f4f3fd0544450c679d470c7c3794af254e0f13aaa9e0af6d16

SHA512
5316472ed4b49da3c8f70dddb8ce9761efce6de9a27405d26d51f844482ea30e622b26d9883758d4cdf5962e2f6bebd076262fb82a8897ce596fe46afcd49929

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
601KB

MD5
0d137e5d0933c6fd07914e67ef0227f5

SHA1
e128f9a077c72e1eb9391b1f288950e819b213c4

SHA256
3b3934cb6fcacd0358ab2a8f8a4e71a2117fc5fcbc4c0e8cb10fd7d0f5b86309

SHA512
0ad5ff60bde522e0b90f49e3653d4514a3e0b330dfa5f6a0dc8bca0972fd6b7123aea3be6733b05115ad40ddac8e44fad181d668ed5dd7edfa7d1a1ca13d3927

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
988KB

MD5
0657fb7853d0b2c5e5b436e4d90a9b56

SHA1
caf80e6a975d1bf8be15f4c0d59398fd7df517fd

SHA256
e5f36b30ac95b5b5c490f18fe09836e9c27e2e7fc3bd13c7b2a201982aaa9be5

SHA512
d3394c501765142d1946cc66617e43a8855ff6c4d78f18024b5928247d30823a7a68453f1b34ed43aca009d1fe3a498f5abea4fe239058b6c67c8cfb1d806575

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
740KB

MD5
f3099683914c9de3f7a5d2053fdc9a3d

SHA1
501b297d64163089afbc90bc4fe6abc715c4d540

SHA256
e25be21521a17db9776f2b4134d312444dfb15f080d673e9c34b535edfca6372

SHA512
1acfe1c45a5cb90e251696fd041975d8669d2c5a4d30bfc07d8367bd96406da7a2ee1eb9ebf7421835de47358478d405f91d8f2377c3adf5e9392d6c083bf1f7

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
114KB

MD5
55cb81088957779b0640cdd058035efb

SHA1
d0971149772538cb8b1667e72821fcc918d19ee2

SHA256
d81dac63578bfc5b749031e495c32ab02801a06fa165a042c79b89a5ed641826

SHA512
099cc75445ad1143af015bcc24e9b70ba947aca899fbf6c55d5048953511ed99b5173912deb69ec830ca5f4b6cda47bac4a90be2b70d8fa7fbe2ca5b09101127

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
65KB

MD5
bd3d771707a30768702d3ffbdcf32413

SHA1
3875dab37f877733b4e5d27cbd97f7e7d05fdec3

SHA256
f1e7c19b88841f194de8dbe94039af265f4c9dc09fa2a5bd9caa5de59b9117bf

SHA512
341c11da3097ef9b6136810c65fc2dff2131394e5154fcab95eff0a7bb2d424b51481dfb7dd0e36c566748bcabc4d96d6f9de4d2fe8a2f35d66f0a7198c63c44

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
60KB

MD5
cfdd35b5e0ddb10019b058b5190de5e8

SHA1
c66eb339a4c09e406d3c3e50662fd95d25ca5535

SHA256
af97198eae85892b8c4aba31cab34b5d6e8cb4d84aff29c8a8a60d3ba79370ea

SHA512
ab9d268f81e28a9053f540aeda0e0a5dff929926b9b28fcd588baa21c49ca849bf6aefa781c072419c2ba68497da4f06eeaed9fc67656b7e277f7d5ea142590d

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
62KB

MD5
edf95590e0314620cf34a84a525f5f21

SHA1
661ad545a8ddbad253adf00dae1a810e57ddab5d

SHA256
1392a793c33866f34c6a2fc408af7ae34e160e974113fe2e743ad3d6f94415a7

SHA512
f32794a6465d7d0a999e646fd485077bb150ca3d4e996d1569a2a16c541ebc73a84d5cb6fe4090089dc8f3664d3380b4c767278f195fb7c577e480de69c16a20

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
68KB

MD5
f5d2c15a7a66da7ba068bf1e0345b345

SHA1
e3b3b81d7009a4b4e732df1d07c37e37813d7e29

SHA256
c4b4185fa6573a0a8627fd1446945c3bfd745620c604c5886654c6a3e972748a

SHA512
56d887157b8a9cb341f15e016077178f6668058606afbb2e6af7347281e2133a0ff2fd6e3c816f3592509759c8efe1720afce7bc17d81dc619f2784651a179e4

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
68KB

MD5
eff9b9f282452eaa56d15ab20986608b

SHA1
1f491e4b7b03cc88cb67ac5499fbc149c5e3725d

SHA256
911968f7520dacbf858abe3a9e7a1d2aab00233f0dc4753039a9b58ba986e6dd

SHA512
f18bbb702d64ae95a6a905bfeb1642b19e02786d2614e543bf2211520d7d35f4e6c4ecdcefe45928e3f584ce5af72d6cf0f8d859f84e4d0a947ccea6e7b324bf

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
72KB

MD5
50ddf2a8989901dec1b8e20f1b0c4468

SHA1
1c3d335fd987f69a06cf8e169759be189338a27d

SHA256
b70ce25ba5260b6a31d944efc3fd2c7d86c4281897a9ca31f0e6723fb995f01b

SHA512
cd3a6fde86dba46c5692d259c67e67b3c58ed1b2beab6949a5f38f8d8df7e71e08dcdcc48bc5e2dfdd44f435627315511d8c7d86b1878ff20236a62bc0d34baa

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
62KB

MD5
94523ad9e1585d6801a23392611fd35d

SHA1
664a99658fa2cb105ae99326701ccff968921d02

SHA256
9e2a5cb50d24d21b547665afb435daadacbe2059b93aa14b8ff525a3e11c374c

SHA512
9ea31690a8ea22d4d7fecfce710d386935ba69e848c6ce140f924eb45f8c0542008dcc083fc8e82ac2c2f705977da2427745e5d7b3f98e98f8230146b2c4f511

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
66KB

MD5
44aa969307138d12e123cf0ceb1a777c

SHA1
77aa658c1a6ecbfd643cabaabd99638a1160230f

SHA256
c139ec09eed920905aad751b4eea5576d93fb1664734d55080b79215b11ae16a

SHA512
767e1cd18413a3ad3ed216800eb6aef8ab0a46df159cf3d28b2916db2e23e2376969b7c0cd9bcbc476dac4a57def740f659eb4eafdccce8c2b12747914972ee4

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
68KB

MD5
9c91b1ea92ceac9c0b0598f8678f896a

SHA1
27e88eb77dd9a94a98ed9f9053db4dc9b1eea2e3

SHA256
124610026fd9a800c4d89efea26bef0610a94f532f83a6e1b42aca90950aa3b3

SHA512
cbf3731bde91a9c2817eb7c98c2ca8955f8f4fd9fd2a72fe9ca3cef5d676d8c5f6f7a0d102cbeb160e713bd14762caf3e0f336c361df403eb8359f8237e5536f

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
66KB

MD5
46645f21d8c1be2ef436615a128cee4f

SHA1
2c6d30c4edd5a993bd91a7b22b5833581036ada9

SHA256
62b567a13b328e11083aff100deb699dc2693f898693d9eecdf532a95b9a5c8d

SHA512
9a2f1601bf4d574f5568ea636fdda649dac6f52bb45edfeebc89c8d393ceffb0966ce462537422f8df427b66095aa057a6984984ce3c96aa8f746653667dba47

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
62KB

MD5
3b031d2ae746ed09c58fe76b890b6b34

SHA1
299297a83a3919f1149e612c22acd33ff1edca0a

SHA256
9e67ee9c817a006191b17488412dca0ffce779b8d2659708110667fa96a7bca5

SHA512
47429cd1d22c41933f8050cf9e9615cc01bd36ec758c94702926f8c6145ed014d23f253c2bb98e41bc6856fbf7160584c2e4461407477c9abe56ff3b853a560f

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
66KB

MD5
659bcde4a7b1bb623746dbae30b0cbd8

SHA1
018c1f160c02141ed234e4bf5bef0d913fe7c6e2

SHA256
cacf5b3d023063e44d72eb9b293a0e646830908c4e950a693ef8b73bb464964a

SHA512
79f7018f38f964c70cfeb6f287dea966fde45da2388826f03b1a7d2bb045cfcdb91171df93b10c90861b50795d335bc049f554a44f37b1746afdc9e473dbe8ac

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
74KB

MD5
61490e3484562ce34c2834f783d88308

SHA1
6c65dfa0931e9906d2b27dd0b7a75cc0da2e79b2

SHA256
d85d8bcd11dc3b82452d58c884e23ffa91c77365945116752874182e0b6e72da

SHA512
34f54cb21a3d2dd23c885e62213d205d4df092eb71bd3c5ba4d47cbe541319b0f6f29c024901b1c97d6c7c7480d54ea40ba56a7e80086a134f4b9dcdce37bfda

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
65KB

MD5
9ec108888db1b3ae31e9ab63aa1b97bf

SHA1
79c7a9e4d2cc80699ee2fb17f0f3c46988e3a9b5

SHA256
fc4d625d0c259c74f1c61295be85cbd1b0a71e1a48d249069517e2ec5415b71c

SHA512
487a8ac7318434c0313d2eb963146a3e2e831efc4ab5a013497cbea1a415dc1a60f864030d2ba41a8863dd07a0e761880298004b4ba6d9ae49c87633d5fdc0e7

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
62KB

MD5
bad000e2abf465d3d6d51e9d1ca46e8a

SHA1
c6679a0e2fb23e24e84e03c15f17fc69eccbc7a0

SHA256
0a9a0dae506e11990f7c580d9bbbe2235fccbd6923fa932f9b58147ba1822901

SHA512
1e236d4f5a2f1602248c60b95574bcfbc320659d4fea9f6e7ec5d98f80a8cfa91d7e01bdd08397d9446fff2735e371eaf1124c92465a60815e5c8f352753df76

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
67KB

MD5
40e1975f8996aea4b548f066f8da4aa3

SHA1
86e2cfe67e05b9b4a303d292010b0be5ac8d79d0

SHA256
1373cf2ce17f84121dd603bb862c6b1af787c9a1b0c82d6b6b64d45ff34bc40a

SHA512
35da09c734aefac701d6fdeceb0a7eb6cab9175c23e4a324c130580ebe47a7829b582b102574e892af2f8afd9a9c77d0f030ae62360672a0996ecf70d38b3796

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
64KB

MD5
58b455d376ffb62b785e8b5f9cfe20b8

SHA1
dfc17fc3bc9663b101414a710420cb408b5c433d

SHA256
7ac35096af9b82b0014a572e5ed2294071872d52ee12d2e24e5f5b40f287d4aa

SHA512
56da8b72082d43ad207eab4aff1a8a7398b248e26c1c8bbc9bbbeab73f9384cc4466add5d5b51aaa61fe5f8a52848fdd66271008fb60894cfd7c1d65660dd696

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
65KB

MD5
9ab04c1ad4c52330970e46a32b6de45f

SHA1
3f73633c45277f6c53bb5033f7b15b44d17d4f4a

SHA256
d02dc749a7a99fb4072ce1b6475e64c9e3bbf8c3593d0e66a9b1f2a6f2f3c200

SHA512
4dd0e32d5fdc69a08e34cd0fdbdff73b15c49e8d8517ccb0b11c1fe0b39b46c4370455184e48d29d0a27f3639e9208a41e68ea79eb3b53a151ab53f0a2e61275

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
71KB

MD5
12a0b9d07645ca4e5913da713e9dc75e

SHA1
b738fb3f347c37601befeb6d015f9f3e69cc2bd6

SHA256
6df3b5c2c1235990583da2e4494409718e6f38198b1285b7301e0cc6000980d7

SHA512
fe67ebf91b6b71467b7f79cd3429127680089d2e4fcc7b08ea7ad57ba63f13dbd968166ccdafb29431468608b30742abe3fcdf46e62cbecef593f1bdd055c4b9

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
67KB

MD5
a6d56b35a2e8477ff2c4760ab8353b89

SHA1
13622a7b2d2d689435021aaf282955da5930816e

SHA256
f81bc78453a5576c5165e9f14bbdb1ea395d191e7f51280559c56a8565c60837

SHA512
735e59d162515f51472b605bdb5c5cdb05dd7fc5a4268446afcb2d777afa5d7157c14de1692a689a5381f4290e3b60d5e8adc9f7180bff7b954c4948d449722a

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
65KB

MD5
b0e1656ee6b5f40efd65d15b5f96933b

SHA1
8b343418d4af30b6bd1cbbdc2241d521bae89f9b

SHA256
41f21674e5677448994f90be2f45dce5538b53554e8e4051f8b536c31254b04c

SHA512
d0479e5e12d2db0e12fc5817da8ca45ec0546d547568d301b2792788409d05d3443d15225c73e19b752f1d7278136de56076b2793fbb8a0ab9ed22a377c2c513

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
63KB

MD5
f269407f3084390da92c72f6cb7f2c9a

SHA1
24e6feaa55cee4670abc7db31022a70c536e147d

SHA256
4e5f8035d75c171f1f16efd2b7fc794a579b2e9fce40a01c2a0a27641ab33ef4

SHA512
110c3f3fd67d5defc7fdeaa333f0e4846db1da05950b5fe2060a77851c12717877b49ed8741eff7eaa32100ebd35ca51c0a164f20909ec8e169259a51ec79154

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
65KB

MD5
ccd76de53ea931d393c116f783fe169b

SHA1
95b2fe2f2d1c3cc55e8351bab519510266668890

SHA256
2e5a32ac3376b1e1db77956e0872f9cb7f1eed24046147b12748f191999b16bd

SHA512
bedc88bd448df7c0f0ae8a9d969f030495ee57e2a9b670fca9325274c37d511c0c82c1d694cb3b2b57f8c3388ed7a2a4bcd23c76868f7f47bdf8b88d20ee1216

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
65KB

MD5
485d9934bd527707ce5db0f7f1527fbf

SHA1
e9390787a14b245c382064b4526aceb83bcdba88

SHA256
08fc82075c72e28fef03dc5e7a4bb9293f033f9b8a463a6ed8f8e776dffd2557

SHA512
a9bdb3c9846b27e61aa7aca739c9dc65458e8ad18faca055e7e1e89a95eba38e3430eda615ecba97e5a887e10347b32b67c9cde7f7d4ce3b5e52b3b9352ec59b

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
75KB

MD5
1b3a37cdb31a1769125dc786be0e44ec

SHA1
af3fb93a187c56f220fe83b8a7ea9b4cefe29a86

SHA256
28b8bf1690611d97afe6a7df4170eac482f8281579393342a7008fa31c92dd55

SHA512
0c058603323ea61e6e13b5e21a908e82cc5c8acd64d7cb02c1cb804f7252672912d6ace3ccc502243e56cf9bd3fa6649db8f385d177d6a2eda138f92c7f195ee

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
75KB

MD5
0e1937d53dbc67062b11e338c4e34682

SHA1
fb604fab14858ebaf237176debf4e9506e8d55b6

SHA256
fea611803eb9017731043cb8933704b4acb6d2d2cf7c94eb3f1d19804789ae3d

SHA512
257c0389d0b3783d3f9bdb7a7c955747dfa6b4b54addfc7d2674ffc27be3f96465d9c8e62801f395fb848c82090af9b3059d6348fd149d7dd85f287108afbb82

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
66KB

MD5
cde44cfef5360ab136483ad8eb98828a

SHA1
97854ac02827659fb566f4f7b2fba3af9c08c477

SHA256
7cd8e8aea7c8194833c49b73cd1b75f26e945724466ae9e1da13a439e2c6806b

SHA512
6c2665e653d6ae81716755f36dedf8bd889cb0d080868f96c1180fd2331a3260d841cfd912b8a73fe6dcb7b873672703938f8b77ccc6903328f59af79d234523

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
70KB

MD5
dcae44d6813d2fe8fb53c0571d371543

SHA1
7ccf58772268fccc5f1b5096cb4cb098bd37a51d

SHA256
ef75d12241691fa720a299b96946f50b2e1fb4dcaa47c0220d7ba24c33ac97ff

SHA512
b519f6e72f20994a6ae6de1cc4529e0a86a457aac7e855044142cd4a06687e285745e3b6e445b43b86373ca0fea22393d6f30250e963df9af77fc7007f09a679

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
67KB

MD5
2c62be9c58f8185629526856fea8fcdb

SHA1
f1e6f12e030f9f6a19b42ad9ee26b4ec1fb51049

SHA256
36e9d30ca9684f176c4c15daf04fd4dc327883d4cefcc81cc1448a32c29c4d7a

SHA512
90dc5a65082d1d2f74ae095298dc1c80ce1d176833079b80f21f142af55ca48876222aba111e8816e99ec310243181e347a5c5e6baf2583bba85856941cdc0c6

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
75KB

MD5
0c743ae74679025a2f64f01a0ea85097

SHA1
4a032a510b2ade99a9113759200e7dd4c8d1e079

SHA256
64d71864cdc099b083b085dd0aa01a98ea99fb053cc2e85e3d10f3973bf977ef

SHA512
9a5241a5edc94c400da6ea91237d32c49e129937684fb156f20db5e768818e26e96cc86e990124cc221b6ea38c3026aecee4e0195417d9c9fc827b41ea9b9eb6

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
66KB

MD5
ab79283c198fb7bc7fad8381e7378d34

SHA1
5e54762000aa1f6e1cd414870294f514ce19c4dd

SHA256
55558b06fab9fd2ac1e15bb882bbfd309d84e7049c8103124b3f6d531cc26d32

SHA512
ac17e20d5876e86c8c858d99091b2d0dd3f9852c873fa8d704d7cad46561908115de9757ab896a5bacf2aeff0c42d6e6a0fcbba7bcffb96453939eab2073a515

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
67KB

MD5
8eb05d22f3eec4736dce35acf95666f0

SHA1
abf55e15a780454874802ccd7b1c10f514d4c5d7

SHA256
5cd13d6ff9043ebbaaec558240a5c268a4d8718ed07dd6c271101d7ddec78c8f

SHA512
e588100e2fa3477737f1fed2745a50b643123535f627ad629883c7da0891f52f0cba0cbc65a83c9fae0e3f8e6cc4d1ec375aeaa83566dd2fc1c6a428c33be9c5

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
69KB

MD5
0a58c3a65c721d36d6717a52bf4fe404

SHA1
4b6a22ec878f2f2ee4fd2cf5b6534ed9a4f83013

SHA256
8477b1c0e745b36f21b0828aea01acc9e0e49cd3117379d603d1aa5a37124d9b

SHA512
a17827bd8c76a291b40e41115c005ab255361d6cf1cfcd3fa2bf986bafff04792a7e2448e326b57c99fba4774f264089cb2233aacf966bf6048270ba45c85d4f

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
56KB

MD5
986d30189c6a0ed037e5bc01062c4c38

SHA1
a506b1ad23053018cfa4eb1367b1f4ba88cc2a43

SHA256
f5783e0999ca96d55689b87b9e829d76af3a08aad4050bb52c3a75680832406d

SHA512
c2a42163fa18de78f3f4376bd120b7bbf30e4a8c90043d9fc837b9d32d2d68c255d4729ea73eeb93fd25e61f757a2aabd49e867f4726fe8730ac33e12e35ece5

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
69KB

MD5
23a695d9a58b7454c12489e3a42071ea

SHA1
6579e3b9a8bfce56cbdc35f5715986b48e695a7d

SHA256
d1c862a9e4f4b2a027531954316ce38e7315c32fa6f6d48b4310aca9490fc462

SHA512
cd626873bd77c40b31ede67219ab02bf98822a753311dc5a6bf813d1314e2ee7a6b304cc6a65344f05c2dac95d3fe6c42e447d7d92823b314bcb2a67c7d2e2d2

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
77KB

MD5
96fceec9b491d5c36bd11343ef64b8b5

SHA1
a6d68ceea53d64316e422f7e25abcbf7e7343897

SHA256
9ed6e962d1e6411d68286cd4e637555945bf748fd82c1543fcc6423edd145cdd

SHA512
4a268d179fe03bf78891cce71c916c481285ff49f87b0f1c6355bdbc16681090d0733f77094c1e2c1ed482132791b7995bc446e3e0e00bb1beb9b4703a6009dd

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
78KB

MD5
1ed928122d79c27534f72059b08d9825

SHA1
77ec000eb930402b15c323b0b3ec59dc89b456cc

SHA256
11fca08ce62db241d6bcd69c2f397886d87f4efaad1121dd7001c6d350748342

SHA512
b58f70f4702d8922abcffbd7d53f9ac8f2a666212cdb1cb75d14a3dc1ece088e5d79099e4dbe340c880ddbcc640005bc840edca53fb71303b1a18198ebc432ad

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
68KB

MD5
4371668b57c480617ab2460fdf32646f

SHA1
5fa7096c7ea0593a93598b47f38dedfa57d792ab

SHA256
c6ea96ba1a7a6d0fc6b4b3973f22c127f00b3abcd7fa0e274b9a2e32ba59f829

SHA512
fe80458fea1cc9d8fae9479c95f67e6855135d358d01fe3ab23848328580149e8adb88843d0cab584e63a8741861190f8f6317e1eb12ef1cf67c57b62fe49e99

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
62KB

MD5
a3583275a060dfe0935042bbc1eccf13

SHA1
55036af98c439d15347b59db7922e3c5ce06b155

SHA256
7050c86af704cc4f330963890ef82d3b31bc803d1896196bcbeaff5776cf53e1

SHA512
fa50b636c21e8066a76f33fc4f85ac565fce116073e11df71aaebab001357e05100554fa7a35c902c42fa318f32dc37ab52bd12e8ab98c36bfaf1aef3494cb0d

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
63KB

MD5
98767d5b07cadb67e8242431a9baa02e

SHA1
e2db167c111e080a8e54575f53f3e5eef350f156

SHA256
8bac84ce4a5c221bdeb30f2d2b44173ec58075e69cd3739c5694b0e141250b93

SHA512
99f79f56d5dd086177107ec3f71f15c71e134084b8cdfdba3f589e990b122b4054e9e01656c0841e7931090f394b5d5cdba032faf7d7be27db2d607cbee734db

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
70KB

MD5
dc3f725358782be29de8da26e5908699

SHA1
8ccb2a5ac83940acc08c3c1ecad432af4370a502

SHA256
9fd30eb117890ca60851b9be1dfa40c1822237c556d804c09097531aa044dd26

SHA512
70717e47f38c4e8b917ac30512a08edcb69e6ed75d0fe195706c2a4f2faaa13063cd4f36fbb2e4d8476c3e1c41c4aaf02e33ba455ec75ddbb4ee17165fdc2fe1

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
66KB

MD5
662a9d0018a1c2c0c2c53159a42facf8

SHA1
7ad29d306c95266e937931ff9b065eb90b2fd8f9

SHA256
ce7ceb5a54256c7a05b6b8a655c8558ae7926fcc95a258dda97f03c2a7b7c923

SHA512
8f6848330e445e3923b01a83ae2c9f991c6702b139b21cbece5b988db85da45280d6a92b218bdf37091756c338e56c37755c78631fa2d7cf982d49fd6326490c

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
56KB

MD5
098fb4f62c9ea25a633a7801fb938022

SHA1
95b876d4c7756859060eee8115b662affae5186e

SHA256
540b0a3f25c9bdff42378a0ecf9c30b9aacee4f55143753df6e0c4e5934fb424

SHA512
8ce4db97e6666b103c20920c1e5e4ec7cda5ebc6a4581fe4f8e12469220d77540ca0e56eaf3e5bde14f1b58b8ea2feda0aeeb31fa3bf8137d5f32df1419dda4c

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
72KB

MD5
a29c0f7dbcc6a5ae4b14256903430311

SHA1
17d626e585ab0ebf72a69a98f8a7e3df4e1a9099

SHA256
96de60cb54e606620d8db0cb8f33abaf85e5c5bbe2f043a7c6ae53f5abd52782

SHA512
0b746ac2e95e614036956d98f0bcd0c7f468c189924d58b0c90f03b9971397e4ecb823923844a1176c5fcaaa7699b8e6149b4cc2ae0f8ef33533a58b398b6b5f

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
67KB

MD5
c1471962cdaf0977edbe175e1caf303e

SHA1
c23ca913fd2ebea07b40d134063304741d28eb3f

SHA256
f0b2c9cedc318571965e186747259502a7da57af7a60e0896b1cb1be6d42cf45

SHA512
b3778a1bc7a22b8de4a51330191058c5cbcf16803ba158becbb38b309230a0a76be8a8afe954331cb3e7ec830a41529bbe93e894809aba9320a7934014f26cc7

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
65KB

MD5
e33a13352710d54e02927d332c07598f

SHA1
5cf94d28f1a3c1fc746d41e28cec92e3180f5069

SHA256
0827d7d3bbc0ddea4b164b053981e0b9b49b6b9b104842a5d6bdc8047ef62c6b

SHA512
0cbd69b0cc74fd6ad9826b1c39bc1c0488d2c601699375c1b345a075edf94981894925c15cb4c12971ef1862efa7d9cbfade6e01b5788b6a617697d593c27bc4

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.tmp

Filesize
68KB

MD5
7898fcd80eaf3976da9501738ae4eca7

SHA1
f95539d9048121cd63bcd85bf2d79c3384ab7d7c

SHA256
9700d97ab35f029e61e231960ea6b92e9ca5da18a4dff93655b75f52a0453743

SHA512
dd4e7991a6df446a953099f44d564080da028920eff1177cf06edcbad04168a19095603132ae774a2e5dedc7436ecd652fd305809a38fd5dcdc024b196ae71f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe

Filesize
57KB

MD5
c005d02c3fdc440ed418c01242478963

SHA1
325bcf76021c8a37b53c8772cf36bd6603064cb3

SHA256
fc9e6132c78657c98087471b5813ed6ae32ebb417a1f46a1dc719967a0dc1227

SHA512
195941e58f3fca70d9fa20839e833ce98b9879e73e9523e0e680e994d56ee7961967ba95f1bd456ce80b15f7973f51d66dd038a7101602e78dbfe140a4967402

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
56KB

MD5
c3d7541ca0daadd2b1627fc6e7d75ce5

SHA1
21e476d61686ac18805ddcfe2c17030d5e8d7af5

SHA256
ae2374445851c5c01c39ba2eeaf03827228ba2fc05286111a628ab1fd3fbc516

SHA512
00d11f9e83fcb72af96b0ab952a2f04447f9d450a16f7372c8d4d1141e3a21381eb91d1c281df20d542f4ec6d553dddbcd66cee49a309fea1881bd5e9a27b772

Download Submit