b867f166fcc7ca176b7c0ed3df73472866d543e32c93e2b21e897ad6c55e3d37

Analysis

max time kernel
119s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2024 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96f7979700619f6131f6883105049d10N.exe
Size

124KB
MD5

96f7979700619f6131f6883105049d10
SHA1

26a09f9a4a80ed9b3d5a43ed8dd14daab62f386c
SHA256

b867f166fcc7ca176b7c0ed3df73472866d543e32c93e2b21e897ad6c55e3d37
SHA512

f03a61fe712457bb6d352a76b1903f9df09ec5ddd611f75f2f73f6a74c9093980c167507490a991831845785d61df920e81fe55665ce86700ff3a936c840ed9a
SSDEEP

3072:62ssWpcU7lK1lKgkb2ssWpcU7lK1lKgkj:MVyU7lK1lKPVyU7lK1lKD

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4694) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
320	Zombie.exe
2952	_desktop.ini.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	96f7979700619f6131f6883105049d10N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	96f7979700619f6131f6883105049d10N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBROAMINGPROXY.DLL.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Pkcs.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\currency.data.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bg.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\HideEdit.ps1xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp	_desktop.ini.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96f7979700619f6131f6883105049d10N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_desktop.ini.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 320	3732	96f7979700619f6131f6883105049d10N.exe	84
PID 3732 wrote to memory of 320	3732	96f7979700619f6131f6883105049d10N.exe	84
PID 3732 wrote to memory of 320	3732	96f7979700619f6131f6883105049d10N.exe	84
PID 3732 wrote to memory of 2952	3732	96f7979700619f6131f6883105049d10N.exe	85
PID 3732 wrote to memory of 2952	3732	96f7979700619f6131f6883105049d10N.exe	85
PID 3732 wrote to memory of 2952	3732	96f7979700619f6131f6883105049d10N.exe	85

C:\Users\Admin\AppData\Local\Temp\96f7979700619f6131f6883105049d10N.exe
"C:\Users\Admin\AppData\Local\Temp\96f7979700619f6131f6883105049d10N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:320
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.exe

Filesize
63KB

MD5
42ef2256b93e7aabc23a3cade425c927

SHA1
c9b97ffe3a596f85552c8daa6575de0e7506ad27

SHA256
e25de6d4f1993854dd0f25922d6e3bbba59d3c3fdc6fd7ba5b8d71c6ff956007

SHA512
4da63494e88afb1f9b91b83639124b7f895a2710e2ccb8784a30fa03e71c4db8a8d532aa6fea92029b60a91f8807091788630eac02dab09b41ae5602359ac801

Download Submit
C:\$Recycle.Bin\S-1-5-21-4182098368-2521458979-3782681353-1000\desktop.ini.exe.tmp

Filesize
125KB

MD5
79a39f821647d0213ea5b7e604ecf7ae

SHA1
7f2251b224ef0f397e4ba2e47db0da370c0f113b

SHA256
5405a6c6b05682e14ec8ae2c1ccef5dcf771b9a57e6556e22b053b66ceab92f2

SHA512
b1b01866687b40ca9f007b9ca3116f255d28ed7ce877bf108dc0c587a2e458a20c93407079196bea03a801cc998bda15381b3adca8f802e69f85ce65092307ab

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
175KB

MD5
7fe76b50d70884e0059de12944c05065

SHA1
31c472ce1380ec84a055318faa472eebee961141

SHA256
1664ab52c48fb7f9124d66d4e2d50e205fb1f95bb8550bd5b0a8d53c86facb59

SHA512
6e4addb0ef5b0b91616c3bbbe7dffb84b2bf1747dbfa78381cb1d74049f8fa5d9cfb5c7e1f9b7e611a5f8194add0d80ebe6e9ea4e75231acdedb4517dcaca709

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
128KB

MD5
e25d9d67d89dfb7641b7296d578fee7f

SHA1
d2553827fc7971aeb105930b40853062b1516f15

SHA256
4f07e1e99e47f58c61538d35320f0a657d69b69f963c6fa4d3b99f40e07a5984

SHA512
ac245c6cfee425a980f3c41740c99e2335b0a6053198f880821b5310c5ed75f446ce99f08239f106f6c0fe1a1dd1c3b64f7e725651d736a5a11568ad79bffad3

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
429b6a01b0ec30bc0998d9a10c41b699

SHA1
945a3be0b596680a755850ac84bf09c97e00144c

SHA256
274bc47bbc4031d139edab1ffa2ad3d8731ecf4705405c5b76c9a12229e3f996

SHA512
341a11d3337d4bc3934590d397e093490b7869078728eeacfbac5debca79f269bc9c3ce0702f18c0644aea6d812e31864cefe1bc47837c1abe17989ed43b8dd2

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
607KB

MD5
2aa7b086c058d0576f445c970651e49d

SHA1
cc70aca98789c1685471257f0fdcae574e22b7b3

SHA256
67150ead7be98682202219f27b25ea47c53501cd7ac6668e9bd01a3e8abde625

SHA512
1f20bfab770730c993e0de4ee6aacfda164b85011d56c67329eeeeb33ce55198f6ebe92483f5f74ad2ad39d97b33ec264421599756d4b7d9370143963c793170

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
993KB

MD5
c4068ae9ac6502b1efa95a77c8d75831

SHA1
e823b2be5b2a2679a0abd8611344829ff759c53d

SHA256
bebbc4dd7336dc4c8b3696bda5743393e31fb23b9de6bdb10e4a7e5d2ffed80b

SHA512
8d47f76f8e66432ede00433b192dbfbbced1fb529c672bd41425c5e2ac219148455f7bfb8bbb9436454b60ea1c35220da3e247f9aacbf9d08fab6d85d5e39db8

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
747KB

MD5
173f3e3241e39b7eebb53fa74e2b616f

SHA1
7c4639b2a583cc79c8e3331ec67b9b1fc1990cbb

SHA256
06c7e197d16ad73795c5283cc720a3a279e81a9e65a064ff628d700c555cac83

SHA512
4190a411ae2c698cb3c57668ab4d9186170888f2e7cb99355e54b9d490fa5ab2d1544bcbd6f701e7ad045d20fd9a6b1a05bb1164659ce693b745c799138de204

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
71KB

MD5
2a950c053c1ab57bec7d22c8ff8ba1e5

SHA1
019295481e23dd5222fe2196cafed8255055de22

SHA256
2ad256d9cc9f5f89ffbdfb4d5efeae95f2804eba5fb862b07e89143e4fc52a61

SHA512
3723a05d912e7db25b14585f58e3b6ca9864f8f3fc055de17e90c0b2e5999f8ad67640ebb2c075630b8d295c9fabcbfd595418ed373e4060166dff4a8e5c98f7

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
69KB

MD5
f9760fb333587d8c92ef1b2622e92e4d

SHA1
3a27e69cad14bd19b36d5c89f75937bf6f0a2651

SHA256
91d83b17c0487f803ae9f3d08a68416ad8262aab3d202799de74cd0616afa0dd

SHA512
bfa268f8c13bf274d72639a6806a7a2cb45fa37218d422cc2e45ee6b81f176bd6abb2f290f89d7230ba27e1b690949670bb5b55efb07f0fe8702177ba7611319

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
76KB

MD5
6117956734b8576721831fafced287df

SHA1
6741c8e6d221a41d6a96e3145ddd6d893f0fb2c7

SHA256
f14cec2b22116dacbb1ba178878ab1640ed0c8f56bd2e440fb0a1ba3cdf5a1a7

SHA512
eafb3c8cf738bf9c937d23d58e777ed02efaa6d68b7e231a4e872835f06e6335c3d619ccb1c7a08f8bb90db1c073e6314b008ff5f04bbc469ef2c74cce5c4e7a

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
73KB

MD5
5514d587b7a3a7d7e9876caee0f1cbf2

SHA1
861e0e49e29fd7ae86e9e4800487f6db14ea49b7

SHA256
57a9bd7608b385819e3c17e6096f9703cbdd29b3383beb7bf7e5c6f3a70f75b3

SHA512
75b07f7821736150c4df68ecba09de553a69861086deb511a36fe2059f2ead2f9548e07419f5a72d12d014f8b858159e24ddb1801fc9a76d1064bbbcda04f4c8

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
70KB

MD5
8699775720ac8a76f532e0581d36385f

SHA1
56f34382b117f6cdcb86d1a31e5b1730ab6228d8

SHA256
1c69b7af64d1181c65ff77b241ed93f6360757dbf35a44fb7b9103253f170e13

SHA512
aae356e3a27776cef208cd4daac30e28fbb9db2dace30c6d1a8ee79b9ed2831bee24fdc142f165b90534d11297de622195123c60b93465ff71e31b6a1f4da3ee

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
69KB

MD5
b74c028f665c17bb4264b166c152bea0

SHA1
ff06b0384b8e7fe65d0dd1b1ea438e1716956a2c

SHA256
fe1a5ae69d06c518691d6498a9f0688dcf80574212e3cfdedf1f4dbf5906ddd1

SHA512
23e2c5846b267c190a33c1f228a83eee8b2f15d219a1837998ddea2404ed7e98ba7d29c27a1edb9293d136d8fd627536626b7f7c7f64d3efaf800c20cb0df7bd

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
63KB

MD5
6e59e993cce357ebfabcbc4283d42978

SHA1
885ca7c58d7b7a12e7482820227d6d0a46164b94

SHA256
ab122351083fd006a1aa235a39509b463fc92a9c816930c1d0c78708753483fd

SHA512
62cc00f80f5f6ee3c912ce46060f4deb55082ac0d592b5ab8c1f4d43d7c0ea4096866a6b49a5d4f8329590c7f653789e2dfca4303ab1b02fa1ede50a09cc3f34

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
66KB

MD5
91579123a7bf574241baee06198e449b

SHA1
7c1e8c882dab0a2fdaf0ea01a77d2060b61c77d2

SHA256
91805c8aa6b437c42483965a1bcfc8282ae529a579a55bc2bd4b6c0b5860c3fe

SHA512
b9b00dc1592d16c2238b4b9418650911998c6208eed048bee6ba9fb2ed7eb41ed04e76900696fab9b04c66f459333296fe8c37dd6ada8352f7a2a7ef6fe4eaea

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
68KB

MD5
1d4f214016534b80765a483af2b310a3

SHA1
fe4a2bc626b4335e5984e72a4587367ee68c61c6

SHA256
514e1b4e07fab795c200ad50de8cd820c3b6eb3fc4c1a1d5d687c979df6ab869

SHA512
f34bd25158b51de575c84cf4bdeab1cb085aeda6e562b1e6991c5be6188007f42f829596d7ec2baeb01b3a5a2666151231f22a1db84829755a18d560231900fb

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
75KB

MD5
23af5211c50f219eada6f0af87fa571f

SHA1
a37e23b9fb94cfe6864a1996ab99ae0d1a094622

SHA256
0308d777fc46ceba9df44ca74e16a41844dd96bd467f76003c08680f9b67d038

SHA512
5244c39d59197f8e54d7d37643df6f55998aa02afaac4e5da97fb34a17e4ca8111f0364a570cc88eb492b54187f2f6af5022a996046ce141cae594cd9f2f9b15

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
69KB

MD5
a25cb41743f051aab76c4c02c87741dd

SHA1
373ce9079cfd5e5765e420bd93c0c485590b5332

SHA256
406e6e84e60f196faf6455db1907b635a44d070c0caccfa3ba8adea833d35dd5

SHA512
e8bc1f81e77fac1dea58b3292814c4087fc9acd861989fa02f1515d2b73da28ac1b26a254252cd38880a4051b34fb08a2e0fa97fbb535fe8f0550cb3160fc3ea

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
68KB

MD5
e30efdac6b724ff0bf1b6838c093795a

SHA1
916d3c889f14c0ddff1b305ead9784d7a9a168c1

SHA256
282e4a3945bcc04215066f1b73f4db523660136a52f7a3f65fa030a961373f20

SHA512
33931782725f2acc8fb2c96456635556b274b90fa2318581222b026bd5ccbd3f41adc833891148e0dd387c2d0096cbd5f32fcf12c7e0f050393772d19319b10d

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
80KB

MD5
dbad77c1d0ec0eebf332f89444422c85

SHA1
68137197801b6691701bc8ed7bba304847e26c3f

SHA256
dc04608ef8eee6035d8d05a9c82a532dc3803f5a7dcd9c8beba4cdbeb9437fa3

SHA512
132626a9fa1d42d2d92f2ab52c4a025ba1960da1e93e4507980f37894917a8a4b24c6d2410317539b9aa278c1fb80594f2d7029ba81853cdd585fcdef7554bf4

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
71KB

MD5
d1ef2e9cdf8be46a6a71d9fbdf3e8b8f

SHA1
60c75ed7eb2dd3a6f063d1918956a2a617b5e542

SHA256
bec52dcf0e558ccf8b7935883f00ae5304c564a3181f4e4bde586ca334ed2f48

SHA512
fdd9a3c413216796644f532dfe69bf0a16e8095d2d2adc2054b6557bac703149ebfa6c4f3fa96c63ed01fcc7f501f59b91f9d1b8c6cd14a3b9ea327c594714ad

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
73KB

MD5
f8b0c541535b2e0a04af633e409cb78c

SHA1
be8e06e0574502866f6cf599c8bd7ca68516562f

SHA256
837b87f61946af80dadcc8b39d55599b28e920e5b0b122637cd88a82c4b8abcb

SHA512
eb6b7cc127e39c53f1adfb34dbab5d8081cfa80a94927fc224b9796aa3422a8faba75009531d230a240d1fbd021d9b303c1e022e2690f780a8747078ec2bcc4a

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
71KB

MD5
a96ecbb6710858d9ed387a6242cd6710

SHA1
f9b8d3681c6d0e258ec6c8130678e26926642594

SHA256
dd69f40ba4726e86be806272e8c582188101360522aaccc937e95e46ba783ad6

SHA512
65beac546ab4f8664d995a7269db8c47fc67309a5ad091590570423adea6fac1243c1d6b6b2a6eb2785461711a3411200b2874946afd9db57792632260c1b62a

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
60KB

MD5
5ce3c028031223833a999ba014eff027

SHA1
261696546cf84bb12d3b58481199bb86fd93b1eb

SHA256
26d3e1426a2a4dafe927a41c6097e4dc1099c40415acc073fbc86ef735bc549d

SHA512
31c4c674d74b12e3ba197ae6326cd2cea90814db2cc71ec8278c5927bff359b94d134f3eab573320e882e9a4f422dd5f33ffb5f19b8f6c925e5b0bf595509139

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
75KB

MD5
104ee6779bf2862ef0927a93b9854e6d

SHA1
a008dccf7cec831c6cdda1c583da815a631a2daf

SHA256
7cbac1a43d8e6bc15b2451bc493dcde8235f9054e991c356c3bfc758de1effce

SHA512
f14d66e6c97f222567578d134b7c508b58aa1b7ffd4454b43dce3646f90922c74e1e77e11bad45a7cbff47b8a7d898c8a18c6c217d3bd9393ec7b926e00009ea

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
69KB

MD5
25488a0ec6a68ec8aa4ce572d0bbee74

SHA1
2f13d8b6571ebafe8d72e6bf4ddd455dc923e042

SHA256
a7eec4b271274f904ef866b7c8364c7dea6a76196c33d1c859641962400265ba

SHA512
4f00f2a0284860ec4bdcb6b46aa9d043048de1d3eb79e49e434e25ea7cd2c1d0286e9f18bcf030e2b9e1ff9e6dc84f62fee910b91122b3e9bca88977319c225c

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
63KB

MD5
8e31a74a019e7e971bcd6b41e8413e56

SHA1
be0dc750dbd19526cce4918f5e1751e4cd8fc2c0

SHA256
0fba0c38c79775cf1ae9930c1620306a9274b7b1b211112209fdd604ceb896c6

SHA512
ce8ba2fba1aae193f5cc4d557e6a0b08e8ae3f653e739cd48aa606a4df94ccb0e4ee4d9f92778481495a850a2778180287245a2d9fc1458287766754bc3d96c0

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
73KB

MD5
badd083e9fa051532c7ae69d24f18890

SHA1
1c74002c00df829376d740d9840af01a91ca424d

SHA256
19168ec8159d8dade91ff7722e8482601121bac412b5d714af4521e3c7ec65a1

SHA512
ba0fd8f8d59cc7a76ad40068a52faf15ad7ac2734a513feabcb5e78d1bb5fb4ce58741137b2dd74802ef28dce57fef2655e749545e422825451a93ac2861c743

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
73KB

MD5
829649acaae2f71bac3419380186f16a

SHA1
7051a1042d719d5f7a1d8d5cb7c97021e2468eb9

SHA256
a5ae369426fbd283296cd934386cb552e115ee77fd9d64c1916a8db28be18db0

SHA512
fd22872750ddd71e8365e3b540b552a91dcf68b6bbc1a15e8a65c7fb2f8d51345610a8891981e11d097c7538726d105ecc9b3b3e3931292948d63bcdf6d8895e

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
69KB

MD5
48d0eee6097e2153bd49a2ae903e80a1

SHA1
ed48b97a7e67ed4e01b0859c5b5f6d632f1b3f19

SHA256
f6428f8c4f56b822fcb4d35860212ed98b59371b2faad99c0d3a404cd5a5af11

SHA512
f6d3f617b8feba9cf3c73c3c2945b173f69461456df41dcf11a3df47aa07701f476d2b62994c5c90a8fed9fdb44b8687274ca426a736281085136bb9faacd044

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
71KB

MD5
64254eae45aba7e084f5179e71d85197

SHA1
d60aabe6941ca1b0705549b9c771779bc065f400

SHA256
5b9b70bf64c27d647a40e0ce991ffb9689630273da89c069422d1a649b1a751e

SHA512
00e1e52f8c7ee0eaa30909beda840c5df9108e4da678ce232d9986642f6e79ec96fd83d63de2b0cf884b3e2151ccf9974d1561ea211103399fd114dd609bffd3

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
84KB

MD5
6113d2e4dbf1a51b3d76d76a53962c58

SHA1
5fda84101b7c1c8754f62f2285f3798860dfd335

SHA256
facf8ac585cf12994c03c2b0e1d06f38812ecfe24ab0aef7d2eaa9ecba30114d

SHA512
7f966c4989e4777d074b386557b4975fde8a16fbfa5c52edce99b2830acfd75ef2f860da65738bb6b6f73b8a628cea65c2a87c6493a8bf6dd619d9eb97c94036

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
68KB

MD5
64344c45c6a6f304125e44709ead8d2f

SHA1
178454c8cd5733b17a7cfe220e767f5a99de836f

SHA256
e8cd5f33dab197c1d84fb91df266bb9bea0c454649153ad85441d01c93c4c44b

SHA512
c425cfb6c47acec9f76892976ada4a5eb9faf4200f2c5fe803cdd2ccf8abd2f016e1652a558900af53d86eea6b51fcd055f72b3c4b81fcd051cef992a708acaa

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
76KB

MD5
500986b3fdeb0f0621658fa752754cc8

SHA1
e2391302b0e73cfb475a0989375d77e889736f9a

SHA256
bfcff6016844bc2a6141c7ce417847f3c13022c09386a15fe5f3aa998ab9807e

SHA512
2467bfe8e738367fa869224931750cab25f6114126c5cb9ea097621382964213d3a9dd7e14cddcf3c19a847eb8075558a8f1bf1e5fcf8ed7b0276fb69e5eb64b

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
76KB

MD5
46421082c24abf672d718354ee42098f

SHA1
ebc876617fdec46e4219a9aa417a3fd84c580d62

SHA256
3cec6a8dbd426d2da99bd57e8cc8e4f6f3b18e3f642fe26239289c20fc17ac60

SHA512
25500437129b64f499085699d326f7805792798ba9ef4f1a81da3aac00ccf96fdcda177b5e335b24c702381b12d42203d704bf667341de327c645f691ad9d29c

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
71KB

MD5
0debc822bd9fe86bd6ea6840c3ffa7fa

SHA1
11cf96e9a0b397e139d5a083d6950af0c8eceae4

SHA256
01e93b0cbc898809db1d25d19a82fa5e1c91a2b1ae434aaff1904c02cf3fe147

SHA512
3871b5dbb72cd54a825d3ed4b1ff407326c071d138e5b88ac828f245ec9bb7c707106d85f38679b6e4301416dad5d242ab8230564d1f45820554ffbe54a52f55

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
63KB

MD5
cf5d5ed4ed5f028394ffa113cab094aa

SHA1
3137cf34b1d2a16ce736cfd9af9d613fd8bd9078

SHA256
753dc99043dcd9d61c1763966abe77c8d3ee8caba59be8dbaf03f12fb28568d2

SHA512
c0a892e1463f69dba93c5363cd51d55286c726eb1edb5ade11949648ff78a9c6d32bf4bdeabcc2b464cc16da41e3d0b8be9c1ebc2045796ffdca3ac853a2b572

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
71KB

MD5
3aa4b09611a4392d7d8800fa64ed934c

SHA1
21aadc5586b19a0d5258dc5a9420c1937807d182

SHA256
4799b7e3a677dc138b251fe14a6be1d33ee32a81d96994ae15066279cf983960

SHA512
b529265f808ed4c9a1830437ba0a9cdfeda46920479fa042ed87b188b1740f7a40a301c1c0797fda1a773ac2011b508119e67739620d995988fae5c41679c511

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
72KB

MD5
bea7f031de8e3c305e7cc0e9af7d1883

SHA1
aa7beb5886dca7bb21bc3b2db5b79ec2fe4d0483

SHA256
2b35485ab18fcc6987c5f9d833131f5809d57205483a11fbeff852f6a115edfa

SHA512
2cceebe98231a8eb530995113901e53daf2e09ee8b342c56b0dcc1bf76dc0906515f5e15a32ec5ae21435756c696e0b2115957baa17b57466e0732266f4fff52

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
69KB

MD5
e4accc3e2b25cd59ecd8f6ea8db89315

SHA1
691e03d35216361557821356c108ec5ae39044ff

SHA256
ed02f73de376985afa109cd44f881ac8345c11bc4d2abe9f83b9434e6f9d4a3b

SHA512
8d2cd008f667c73dde9ff3207b4377c9a4fc9a8b5101cce83b85b13adf482c1b4aa03ee8f01b55de63a75b397de44f5a59404040c619d255efce8d3566791241

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
81KB

MD5
9ac24e37f651b410f9fdc90190fce315

SHA1
6c2a01a3f231a7971ec0a37cdf6a410ba7abd7b7

SHA256
dae366506db16740a95f00d60cea5e2f6f203ea34c790f31933648d6945e16b9

SHA512
23747bcfc51cb15c3e7edd20c3903dbc9a67b88c6ab1beaee9e227eda77d803e054a16d95bbae35ee783979e45fa2136e626bfee900369b7862c458bbb0970d5

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
72KB

MD5
b6fd7fa485cbf2c9abff26ece3055b56

SHA1
d0c7e13cc3b0728e09ccf2dbe84e5cfff1c65331

SHA256
186d70b670e4df1d2a07e57535763c4fb6702ff2f70a68b50cc00cd15033a183

SHA512
70b3f97b982733359cb8f61eafd513b21e913aae03cd5f0168a58c19e6491fc34dfe5d7890ecef9254f5dc8137da709ece5885357acd8424cf045b72b2f8a967

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
71KB

MD5
236279828d2498aac738d66e7c64e9b4

SHA1
c897d75b35f9faac3ee57c8e372008496a21c1a4

SHA256
bdf1e0a8fff0c3b5732ff775eb2b18a5841d614f31d72b32ada1e5e588dff9a7

SHA512
7f4d230c7c2b30ddca7ab126893dbe3cd437b60bfcec13b12d7d087d8630c6794c03d70ffbe439437943596cda1c6bb6b8338d66ad014ce77632314d59f0c333

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
69KB

MD5
8bee0564d93b5265fc7fa283775ba72b

SHA1
93e916eea814c89790c640e330c301090a40c1c7

SHA256
f31686141be32fc083ebd5ab78d46e0182d7f35d1c928c5987a9600de8979781

SHA512
7fe2ea36b9f472809c64aa6af2bfd544c8cfe8a665adccbbebd864c6305402fc12e776f64c867885c368686d6cd4fbaa40ed6e9bcb98fe5abec7596f5973bb74

Download Submit
C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

Filesize
70KB

MD5
a958682d3ab1c945ae3b90128a0713ee

SHA1
5ce89bb50f78503f829700cd845cf784623df3b3

SHA256
4ff0c79863c92206100422c54a19ccf62ac3577050b4914621152eb8160e2019

SHA512
ee77d2921b52b8716fd9062fec25a177a3250113d50bbf3bc0c86a9e1e5cada6c41fc8c0a64013e0028d20ac8991b99f644d37743cf5e0228566b2771d709417

Download Submit
C:\Program Files\7-Zip\Lang\sv.txt.tmp

Filesize
72KB

MD5
116328b8e525678b3f294e516d6d7ea1

SHA1
2d4a92350008a056227a9510e109027de037b397

SHA256
cd35aac80f441a835cd8f76d074b62907ffdef996cdd20e916130c294b407499

SHA512
9e73150d84c0cfb1cbd8b427926507e1d0bc651fee1116c4746adaa03f1f4d7e54b57e0e2b209a848f50134dc71aea14d5ddc7268ad61e4cd3414df402d9cc9d

Download Submit
C:\Program Files\7-Zip\Lang\ta.txt.tmp

Filesize
73KB

MD5
2c18e51f897fef82e53f5a9c77685cc3

SHA1
af05d7996ce78c0950b74c628b53275eefff0600

SHA256
fb280d6d6ed878b74597fbefc1f958a22b3ddea4b5fc4a8e54258dcf4f974a1e

SHA512
fb83b33317ab931211b401854ccf4db9f12eb26aa57702c204a00d58e14fe62987ff9aaa8f5e47794023ecc740fb8079054139909def5aa89d20ce79dea99299

Download Submit
C:\Program Files\7-Zip\Lang\tg.txt.tmp

Filesize
76KB

MD5
6d144ae2a40f9db5ab56375d43ae176a

SHA1
debdd8dd7e565f37c13ad38b22bc2d0b49118ab7

SHA256
05564e5861bf21e57058cfd0fa07ae14763e043d33bed89708598401b5e530d3

SHA512
21433a913fbd985f214766dde3522d4ea821f55bada84ade6e1250a8c94953c0c687c7eabaf54f809d147aad7c0c6fe36cd8cee4348b0d58001f3ddda74f6b2d

Download Submit
C:\Program Files\7-Zip\Lang\tk.txt.tmp

Filesize
72KB

MD5
c5228b38699f768f60c6ae54da167170

SHA1
6dc204c574ce99976d64d48f91be4607f0848658

SHA256
990b8985a755f3ca90f29dad6dd326d9cf588785f1159d8fb302e13f7ad005ae

SHA512
fa2ea1b8ab02aab011bbb560271d1e8ec03bdb2ced687510b0daefeae133ee5d895373a14b5d9b97d95e6c16e7a228eef834fa13a55a31dc0c7ebf6377ff1372

Download Submit
C:\Program Files\7-Zip\Lang\tk.txt.tmp

Filesize
72KB

MD5
02869b9289545d812e5d81ec7dfcb009

SHA1
24b72f7a88030f0a49ad4062b8bd51341af3a5b4

SHA256
14b25cef59065fc0b1c525c831ca68a8b4bde286c6f404d4faa07ee2ef671ec5

SHA512
20b5d69e31af7946f821f03f6dd0e73938c1c36e498021eac63c592fa655320ebfc815ca4522bce5b4da614e1e14c6721f9d75ac5e949ff8996b10d3ae6d4109

Download Submit
C:\Program Files\7-Zip\Lang\tr.txt.tmp

Filesize
61KB

MD5
6bf3a7c012fabb71d6197d432abca30b

SHA1
0e2800220891942a41aea444c83b23fffef8abee

SHA256
5e295ab574af99567d69895e1208b351e8856945243d2c93d1ba56460fa1a01f

SHA512
6c2cf3ac97e075020b3389eb504f9e21684fa4f2f1e6dccc53dd1c8b73c9ca871ac04a07178a8d9e0f005c3057f663c5fd1bf04fb377ac55f2a7860d04acfb4a

Download Submit
C:\Program Files\7-Zip\Lang\ug.txt.tmp

Filesize
74KB

MD5
5e507d5af20117894e2c4f99606ea3f7

SHA1
840fcff216ecbed3e4809d8a74ae2844fe15d865

SHA256
c15d63ff3867c8f79fbca63e1ef36a7c317839d1b09fa52f8ed97bb7bd212bf7

SHA512
be41b8d98ff1c528238ababca5c98ff61e46c76a8c85e4c7e57328176dd6fc010ce18a0c41a927a531bd178e9b4682b880efc7ae4954011bbb75ad6638e4aec2

Download Submit
C:\Program Files\7-Zip\Lang\uk.txt.tmp

Filesize
78KB

MD5
7874d2cc6c3ea7b1d0f5d340b224730a

SHA1
8385c311eebdfdfbab422372a2fbd56392aa1c5e

SHA256
4c68d828f4f567517477224fa68c858bf3154f12243c20c5b89d8964596e376d

SHA512
1849ed3b8f8c863a850e3f99d7344e18aab4df8c1f88edb7311a090930a6d87c7d47129fad619483967af6b5a9b7d53d63a6abef13bc25e0656eec3fbf0b0999

Download Submit
C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp

Filesize
78KB

MD5
e3e24503bd97c20d7c2505e6490cdae0

SHA1
3ec2e6325c146711438f5dc0495c20dc0a14ea93

SHA256
34afed2b4062e9ade71832f70de64985c2f6dfbdf406e062942d088c34b79bbf

SHA512
11433ba0df545a3665c5b756ee3ad23796243cc66e6729b19d8799c503f79f4c4bc7574b6e14e98e6bf402b582a7e09d95bad8e7680ec29cf6b465ae2f8e74b3

Download Submit
C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp

Filesize
69KB

MD5
dde4ad540a5f7c33379ed5efb291e5b4

SHA1
cb9b359206da082352777f368942fe3ef0934886

SHA256
51c102b4c5726bd3edae539587c5ca4e6638d7a754c0ab51a8e4d1f39749556a

SHA512
fe1c88cebbd90948f695c130ba18c0d8f621de6f34d54210464725ad2a3da645cf26b736bba5e4d0500809484fd64f5022a5aae60625de053b756c8d55c10019

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
63KB

MD5
db8eee89bc75f1da78ee7e2534ddd8f1

SHA1
4f3811bf61b4a74e27fda4392934baccfca08800

SHA256
abe8093fa0ff39c3002844b69529ac35b318ee12c099c6450d2d51b0c23d3f04

SHA512
aa6e546b846b2f082c1194e46f6c5fb4f768451d1709d428e9fa1ce9f1623b4658ad1dfe2e22b1719997f529dad38a8cb2fc7af9329287b1adea15721b412c91

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
61KB

MD5
3a198f9bf9bf9ba1c1d08538eb347efd

SHA1
346047a4e4b46de3a4e03eb008558ed59c6192b2

SHA256
82de3c5cf7c741b0e7cf8ead678caedc88546af6356ecb96c8fc734eb106749b

SHA512
cb1ca5276e67adcdb9c6f1955758c0588a82414591bbea2521afc6e38396ce898d35e6b675a81a953ebdde849e4f2ac9d11558bdf8c526d98b80024782aca25f

Download Submit