c0ac6ef8645deba773ab2e797a0177ac65b3b7059d91e4d41d6e02089097a891

Analysis

max time kernel
120s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c868484aaa4a464d0d5fc82cf07b920N.exe
Size

112KB
MD5

4c868484aaa4a464d0d5fc82cf07b920
SHA1

ad5c1bba396772ebd7a41a90cef58531a3333346
SHA256

c0ac6ef8645deba773ab2e797a0177ac65b3b7059d91e4d41d6e02089097a891
SHA512

885ad510dae15379e9995e038bb3a58f5ee7fccd533adc630e578f9bb748a97ca6220a022c6386f276d7b611cc534c11df7139bd8833b99b730ecb32283c9760
SSDEEP

1536:W7ZhA7pApw03vR03vcltdtSsU8Tu8Ta7ZhA7pApw03vR03vcltdtSsU8Tu8TH:6e7WpwYRYUtdtSsMe7WpwYRYUtdtSsl

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4675) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1688	Zombie.exe
648	_Desktop.ini.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	4c868484aaa4a464d0d5fc82cf07b920N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	4c868484aaa4a464d0d5fc82cf07b920N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp	_Desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	_Desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\jawt.lib.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\nio.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_Desktop.ini.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp	_Desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\vulkan-1.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	_Desktop.ini.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c868484aaa4a464d0d5fc82cf07b920N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_Desktop.ini.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 648	4572	4c868484aaa4a464d0d5fc82cf07b920N.exe	84
PID 4572 wrote to memory of 648	4572	4c868484aaa4a464d0d5fc82cf07b920N.exe	84
PID 4572 wrote to memory of 648	4572	4c868484aaa4a464d0d5fc82cf07b920N.exe	84
PID 4572 wrote to memory of 1688	4572	4c868484aaa4a464d0d5fc82cf07b920N.exe	85
PID 4572 wrote to memory of 1688	4572	4c868484aaa4a464d0d5fc82cf07b920N.exe	85
PID 4572 wrote to memory of 1688	4572	4c868484aaa4a464d0d5fc82cf07b920N.exe	85

C:\Users\Admin\AppData\Local\Temp\4c868484aaa4a464d0d5fc82cf07b920N.exe
"C:\Users\Admin\AppData\Local\Temp\4c868484aaa4a464d0d5fc82cf07b920N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe
  "_Desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:648
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.exe

Filesize
56KB

MD5
bd4f702719f4a83cc3bc4af62feab7e5

SHA1
7fc7135c23623aec54ecc19808d2778f363b3fc2

SHA256
fc7a3c0e3e446bc07333755d21b0695fc7a4d29ffbd1791aa314b53de3b437f7

SHA512
b508abf30237c3cef583558619c259e313975a805631ed5eea848cbb79c0540a7b5d61ba5bfa0fb26060e0593df3d8c68ffb397ed97b6dc3a362787f32ff5490

Download Submit
C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.exe.tmp

Filesize
112KB

MD5
5eaae771ec5a3f80aadb5e6fb15a27ef

SHA1
12699f2c920aa525c7bbd5aa57abd97e4b75616c

SHA256
b7294e38152e9bb6a3b1b9545f7a72f4d742771864a9da7ce71e3baaf8c7acd4

SHA512
db6a2de8965c26a9f4e70a01c76a5e484050fdf5370ce1be3d09e2bf9ba2d13fcd2e42b692f707b419e2d243c36a1df5225fcda5a5ed0e5ccea73c51d4b09f6a

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
168KB

MD5
201f3ecc391e794b93dc7f9465456b73

SHA1
aec0fae58b722b7192c7c8e7df130a43e4aadde6

SHA256
ceabe77d0860d6c9b6ebb31b4243d563a2dcd24af35f58391fa35ff4889060ea

SHA512
2782ce72bd3f32856977a77c86b3c275e615aee2020857634cfd08c023ab6dab0e275443bc9cc24d090f3a573630bc45ad2a157df38641f1dcc10a2d082b5ee1

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
dcb6eb98982103aeb8c2602fa712d10d

SHA1
7871901449b83b85cf07f4cb9c460a01ae635c5a

SHA256
521ab61b74a1e12b7c555b36fe2b290da7797c0306d3ef65442a11dd65474e56

SHA512
ce39b0584967ba6119c06fd3b5ac3d920e9809eacbdc895d5dbc4c582fe3e83b45844eccbbb9592aa15ced210c814e765410f964b0cb4b189756f4d5e65e1872

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
600KB

MD5
2ae9fcfc32ec4bf9a2c8d2fcf46212d2

SHA1
a4399bc66f6a0ad54c995d28b521b7d97025d33e

SHA256
d6b1106fa1142e28f333b0d5df4bb8c2c1c5e5847ae518614c33c52a4a8a77ed

SHA512
b61b476eb9ce046607bef42ace0f561db227686b7c13f51d0bbe57e33d53d36b431ba0e373a724276f1046281ac63b7498cc233bed1c4d8e43407ab0d77bb983

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
265KB

MD5
3e0ef8eb9db10210be60e391c8e2ca45

SHA1
eb401e7b7726578489d78aee7f701f4fef640177

SHA256
2fb2e0c620d11082660b20c1a748072fa48cdf7138a99452ba736fe8cb0834ef

SHA512
9800c2f519b153af4fe1521cab061bc0d487ed4fbf76ab6eb4261daab74b734e202f898ec69303b387eb0ee68edefdd99979b0b5cea5279d1a79a6cc6bffb4f4

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
244KB

MD5
dbbc800fea6c902803c9a0a03b6d3a9e

SHA1
1f83ecbf1712ed4c5511758cfd3d78f54aad8292

SHA256
9d3fca8f0775b21ac790ad1a175e821320aa133777cc391bf9138dd10f2984c5

SHA512
0760836001edd6bda79bf861bbc28c3c9c0383a8571b544127e4366a78c82f7ef04090aae76be680d59a891ed7af899ea07397542b40774ca59e554755900d3c

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
156KB

MD5
ad311465060ff469c7984a74fea1ec35

SHA1
14e866e41597ca8b2f4e674181213bb00929d522

SHA256
ad4393d9f49b8d898f5c31e8d925492022d6c460bafa0cd7458ffe52aef6134a

SHA512
f1fdddb2aae42a058637209d535e86a9380bd2d368a795aaca5eb38e0e9c137a154f565d9d56c5f390ba6e74c381363cb0b7e740b06a7fc9584e634c84c9debf

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
740KB

MD5
c97bf601323d21f55970203e78d26b5c

SHA1
9a75c8c492994d0ba7bc99c1b858bd3e7c26ca13

SHA256
5c7a376357c348768000cde3fac4bce7d2fd34f02afac87b3d21a37f4563868f

SHA512
7d61a339ad1e576f203c265255c19a4481bd6dc2345e643bdeb03f315a521e0c1ffdbda7216406f18a4084dd816d40707c033273ae05233fdd5483aaa6effe81

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
113KB

MD5
b6c49801a5a6e6e0876c437418c31282

SHA1
5190dacfdd2e910021e3daef5580a6661bc22053

SHA256
10847e6d24a5a066f9fabb8443cb4f249278af9b6a09262f69ce4d3cdad9dc11

SHA512
183cdfaeff52609c97c504b0a62b9b13b5dec02b92ee88eec6a40594f997cdbd5a19901f5652a4eebae9ebb9e213d5bf934388de38dd6d009f6113b2e8b5f0d1

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
66KB

MD5
c06d3ff09b8f4c31572113bcdecd92f8

SHA1
6bd795c944270b6c45422c1d8641e690cb35d86d

SHA256
aa33c15e0ab61ee5c9586fdfd6b284db0c02e5ae0cdfaa9b2386fe6189e2167b

SHA512
f196c6acc6af68b80311ed5f2fef7df6259c5eb0741ccb4afb039188dd64d41d42384c04c10ee8ed7c5638819b6645a934dd41cb7c959100817766fdffcbbdd7

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
63KB

MD5
d9c90c115119287a236285d299ebadd3

SHA1
36d9edcf6de522e8c3f2b91166a71b38030cc018

SHA256
fa1cc277411c4cda8bb64a5396f83ee70ebf13a3e4bf24b06fdde8332339e323

SHA512
b2bccdc220d89a8b3661addceb87fa8035b36637bd0d50677027a68fd95ab65f2c8c1b15174c2eac5f630b1664a82dd0676765d734cac72782836228536c38a9

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
68KB

MD5
098c4e36d175a5246078bbf961b3ec2b

SHA1
96d3ed8faa3eba854e0afe7632a17021799e30f6

SHA256
093d0e497b3a03174e3b535476f6443eea855ffc4f935e5862a14ab2fd7f91eb

SHA512
5ba5f88395d9f1b667b9da44e26ee3c5ca2e79d6c05f4043dc61aff4dd5ebec0b6af5361892a5b876e2daea581ce9ac9946e7b61037622d0207d6c723f695104

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
65KB

MD5
0c01b583c97c70b5b05462d069a4c767

SHA1
0bead079569b1a642b9733b22df10f9b217cc0fb

SHA256
af0d66e16a4f398fa3f613a8fecbc7aef20098a0575ce51b9704b92917d0be92

SHA512
2c562ac358fae7efff73cb781ac0f33c87a555af1502f7a69786e14e788eebc5d4e31bde574dc6775bae0acb460fea263aba9e99e7e7cc4e490d4ab812b563c1

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
67KB

MD5
24b56ce5f4260eb719b0ff78e7b523a0

SHA1
7e363fe378e92911caac0ba79543f7cd8aef19fb

SHA256
9907ffe2fcdf6404ba0e7d4c9b2a355240d3c0df782b108f4178b6f38c8045ac

SHA512
835e484abf1770a7c07a2697557571097fe74cb9a551b03c7e244cd5dc84934a408224c960be5dd7dad7ea95cbc9b69d3d0ce735a67dabc3c937cbb114842d9a

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
68KB

MD5
1a0d744d7ba6329b85bdc454dcc3f580

SHA1
4255ec91f125a052e5c9d847ce97419487cad6f6

SHA256
c07a05756429b549e6f4c669c4f09426abc6cb283a54931b76c2844e2bab7c79

SHA512
7687a7327351327885c1e68d29173de0a1d967f05debab7ab205712e72f122b7ce2aed4d10b48472b00287dd536c4cc9136823ae916f60de4304451f6276bb45

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
70KB

MD5
4796ddaa093a09cc0b45cbc0c30c7019

SHA1
0cc3a52507fadeec1a7ed89a004a49d233cde7d0

SHA256
2ae1f7cd0d104c25e16c886f326c1d02ee72dbcb16ca28b516db3e67c816ccc2

SHA512
c8992e3c751c945f4bb25f8c24dceb6fa71461697f41ec7cc10a9995b5b4bb698a8a7010030fed4e9fe241150fa0fabd4ffbc4aa9868a012a70995e933a34a2f

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
56KB

MD5
a04e5fb72a99367f6efa81a08b4b7ad1

SHA1
bea032f12568b7aaea1a9893b8f16f27bc434ba8

SHA256
0c77e599467eff0ba029fc5cc31b4db4d53fa9686cf3a8e0f72b108bdc64f08c

SHA512
bd48072820e8a010612de2a499836304d91e13d0317509d411edf672b86e18572a1b8687c22583793682480698c507b09ddc35a0b540680208e7f74bc44023ae

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
56KB

MD5
32a5a031cc518a1dc101830496b8258e

SHA1
1d05ca00ce8d58b9ace1e8507f39f31be091559c

SHA256
8b80bed78f7070dbac44e2680649708977e8c516a8c6647319690c98b3b3d077

SHA512
8d992aa6f0d98d69c46d527e2e1213c51a64ba82c471d7f54d7c7bb2923795918b66013fd6f8e9160dbcd224e4d029053d3f4bc6f3949a6a9d36875304675d38

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
66KB

MD5
228416a416f15b46e15e1f90cd998eb8

SHA1
6d89d3ad12d9833b5b81d1f145484c5b51e20a7b

SHA256
d8f59be11eccf20bc9b1721feb914f1f89c202b69bb1e0b30c664e1c99f137af

SHA512
a6368007244a965a0b4b4463adf443cb19c4267999ceaeb3eb740d750439d01f269be25b47bb4891a3efbfb10a3921466d837d05533ffacae9a3935e5a1954c9

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
64KB

MD5
e269ea22a527118fa0b8de032d81f98c

SHA1
fbdbc2b2966de5d42f9319cdf666abaa60c3aec4

SHA256
ab2be35a30fe89e9f8eb1d1362c9b5c7e996aeb498279cad76e94d6467477de9

SHA512
0fb548ccb7183dedb5f6ae1562d6f6475c4b1302965eee0585f9e617267ea0b2966286bdcb5d905b050c1ac85e0edf21a650e41e1a8b0b52f1d710b50136f4b2

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
60KB

MD5
c695c5bc82152204a34369c60ff7c998

SHA1
de0afc1e982139ea88b47170a0eed147846b543b

SHA256
2ce97e48f51395761e8245543e0512fab71d9955ce5dda058c76f1fbcfca9634

SHA512
fe4f2effc86bd7cd2a436b18a0ca85feb20d711a10a7b3ad82b51a799b32c11c50923d3d9c74b6b0dedff9867cbf327c9bdde926bb593bff130ac0d87798c5b4

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
65KB

MD5
468dfed740fe800f4dd88d456a07a83a

SHA1
c811e6e8eca89f8e054300d7815a3d07b150c8fc

SHA256
937238dcb39b851915e24a1890b0e403ecb6d59e3f2d808381ee7b0700264566

SHA512
961640c67d4ca014bd45f12ba2ff30e4e1d828637f29d731062714b8a51a56dfc9ae1dea130b5df8ee9046821d02940ffa18562d064aa496b26a19a63853b28d

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
63KB

MD5
040ef631d763e752fef5e308521ca32f

SHA1
3f91fcc960f101cfb5989ad0b7f8a8d7953f9497

SHA256
211c159fb78321ee18ba3f6306b352cb497a508ad0608086a5fdf859080e721f

SHA512
baa8cf20a4edc4bf63e9d43a7d287df091551c7994d9658c0a83c199810a360fe52aee91a0fb7f4f584d7fefdb8df759f05103dc53f5edfaf79d18639e609f3d

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
60KB

MD5
fd1019e2e90d5c1aaba5365b9473d471

SHA1
786a8aeed3c901dca6ad5ff52c4c3ed7ffacb696

SHA256
a7895e81180a8cc9be0f34878fb21f585632a23260b9286abb39f56b0042c84f

SHA512
fedf2a42dfa7ceb3ea58cd71a5f1ec2ccafe575e8a67f070ac4a9c555426a23955f4f82cdc81d749e4bf3796dee1101e46c7bcae9725af5791d58ed35afd8053

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
64KB

MD5
66f9ade14b6c589d965aff73772d7316

SHA1
e19eef90948b404e0239b99a79d11978cd1b80a8

SHA256
16c8b018fb152297c5881b70151a1260b860798d98396d68820eefc1be42e6c8

SHA512
61b5b2bca059e84833567535e186ad8ff8efbd9de8fa2827eed6f98a626b14507077651ecfe1a9c30ef2fb9abd0ef789e39391f7d2e2b7aeb68b241f17dbdf3d

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
56KB

MD5
2daca47d6ba46b54cead170458d2d95f

SHA1
452c122bf7cc3064424f8d30dc3159e5598f9bd0

SHA256
ccaf471f5070608ca122a44d2c10904757f096b54066a9379c8431123583f8bb

SHA512
93e6bde26679b1f706a0af6f68ddf1e74b9e2e016e01ba45c7bbd8a61312dd761dea555c88da767df585c195db10acf07310d2419e8813c2e7af06b1ba664e6c

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
63KB

MD5
b8a9da3e8ddf2b0eaab1b90187387d73

SHA1
617e1ee56efb4e2e1ecb36a868c34eaaecc75d18

SHA256
e43fa0b0f8bdfa8fe2b94ff8d6742e906985e9133ff82a13fca9441dd5ee58bf

SHA512
b8b62c6692c172b01af583f2eda1276aaf8a7c98a4c32b3f703b706a6bd8b981e8a9dc27a66aee2ed9221f88e0e47e139e5ee441e8d3687f673e3af57b08c649

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
69KB

MD5
5b0fbc965bdf4af32aea1ffaafae6952

SHA1
f055b705df3d99d3e2d0b9535337901df1675fd1

SHA256
e72813e8d20bc42b76f11693adc1dd8dea154050b2652a1fb8759ad9266c37c7

SHA512
57f9980bd02f99c885505db720fd8aaaf76951987fcc325fa1fae9833ae85effdc1f2381b76372edca59f36e86c8fb09075cf8f268f645209240af50a81e13f1

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
69KB

MD5
15d62f5bd1f63290196b7929fcb47b7c

SHA1
c7b0ad51541339e362196416bd5999b23890dd7e

SHA256
5b5a0f64da6d7185d33368b2124545c3ae9681957085a1ce8659b6391852128a

SHA512
a918a3828000e941bc4bc706889ebe3d63659a9517448c3be42d2ecc2d4cea3cd7e75fc499f654548d8d7b81b8f6b9b1a101cdb78d4b887804ac28641e84d0d0

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
65KB

MD5
e6243e9110b9a0542e60452328248ee7

SHA1
b04e9e4531ceeaf9c297d15de7eb76e76cbe7a35

SHA256
be7897cf17ae9e737382965b219dc79f794c10bfba33b4b15ea7cd54e800d6a1

SHA512
f4fe18475be4f5d29a86873a39956067f4f78150e1b7adcca84785a899b05a3543d5959090b63fdfe7aca064871cef7bad58bd741ce551eb294f44bd41758c97

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
55KB

MD5
0dfb7728d9cd773f13f0fb4ffa93e770

SHA1
936f9d225ebefe0f505aa8060fafb2fb65a10c80

SHA256
884e7553b488ce90178169f6adc84aa677b5238413a6a542b07afa8f682d0d09

SHA512
af3e869af09387ebc12354191d63b70c0b9f04a132839027e7262e8122bfb6244f579515dc164cefe80591319a811a4825450d3c7be5b9eee725632479473c22

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
64KB

MD5
9e694dec5c221fac0b80af90bd800c16

SHA1
daf73a7d80283ea8d2a113b571123bd2537266dd

SHA256
a27cbd00143e478beaee6e96a837a5980e39911dbca951c4fa27ffdcafac98cd

SHA512
68131ebf586aa1cc8f3c7f734415e70db57cacc183df748c4264b9442dc0355972dc6d4e5275cf8d74d4f229bd5370e50bd524ed720c6b57c935f602c6d427e3

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
65KB

MD5
ddf3c351135a97602118f528eccd55d1

SHA1
965b9adc90de917f01c37a2d18ccd76900d3bd0d

SHA256
6c5b3d39334fa7e1e5b39f62906d0d2b2c9acb517413cf4d548f34a3b489ad68

SHA512
bbcda887450a8e7c00e8af52cf21b32dba086fa5b4aa48bf1537fb95a4ac78e9553a23064ef690fd3ca962f855f8a9f8e9f23562b25ae8719b94781dfd4f5710

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
73KB

MD5
7f73d82874fdae42c3be0b2bb7afd290

SHA1
c7afa8e2d257dcbabb762dcc3f2787fee5ed4578

SHA256
408e79627950bfcb88a14735da6385b1a66a1183362bbb965fbfc897a3f76ccc

SHA512
dea1256a8d179f348e9bf83dabdf4666bb9e86c89962fe1f572aa514960d1abbbfdc289d8561ebc843bfbb65594073206075787dafe0e4797060e3fe4d5ebb34

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
55KB

MD5
7d45730d4efc939d5a52b8afae7975c2

SHA1
b462002d48b071dcbefebe11ddcdd73df19cf8c2

SHA256
98cf81691cdedb27fa01a61ba5614aa0d01e3f4f5ea9bb39a2efc678ac1e801e

SHA512
49e46171701f28fb532928021327318f0536551f1838b90808449ab65a09179c3852b77a82be9a2ed7551c91f42a45a83aec61c4d71ba766f3d8d0c9782dc5f7

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
73KB

MD5
022db1fa18faf1594b9f6134477867e5

SHA1
91d2743fa505da9d7525952e3bc46cf84650097c

SHA256
a529db19505a682e3611356094d5657d9da30b0361b2164b4eea4d996c48f214

SHA512
fd06ad2199d926f690639e24d6cfbbd033948c4882c15db09b0964e9c7839902b92b0ee6fc931f34188bc966d3272a8d2226d15f51592d8af278b3a0e4e3a630

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
69KB

MD5
7932f1c231dfbd8621c360f16a19648b

SHA1
e9935765bf94d325b4ff2d42950d0867efb57c60

SHA256
e1be9c9f40e7d2b5b609bb9f06e648a2000c386fd0808cb1a7229f1cfcef7d17

SHA512
2427a7517b2d142e41bb36853b34bbe4ce50336270eba63fed41f59ca5da58f35b6f868c1626a41f06e361d3b4e2f833a5ee0c54b2ac8f9ebca4b5226833e60b

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
64KB

MD5
ce4da33def75ea685bf89dbda83d2c06

SHA1
c7a6e8570e1ad0c5fcbd1d0a19104d04bda955bd

SHA256
1f62f4564082d840aa2b44dc6f119bfa04311cd964f06db535c2ac54ef585500

SHA512
94a86ab1dca8c1d0d2a2b18e02c237b2c07ce049a3625ed9846951d2c15fa2d337cdfe2f83dadd600fc758cca18b3ed71df6a9edaf879d83367f8f5c9cee8af2

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
64KB

MD5
99086bddd56b75013232159026e0e342

SHA1
896de662113d328e13b2ac80a651325835f17006

SHA256
a1a74fab82c067898d2cb2c576d7b92f7b206eb4a4f76252a47294f188a72324

SHA512
3342cd95d8171d53f524e9a825f6aa2dbcf5a3db751314952310c3796dae2e8e65054a0828a81dc26f101385fd8193b3f3a54462bf9ea398fa6cd050c7fec6d5

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
55KB

MD5
2c1e893f61472395010343902c78591c

SHA1
453bf21eb7929fe10e1f9743d6631acedf892d10

SHA256
f036c3eebc0a0de17e08a272ffd7ccec7ceb38453136e2439bd67a38eb72f971

SHA512
e315fc0c10de1081806bd8dcc4e250632c18c10644ca811701a76512966fb6b374882af46545041ea6b2e529ca7b05568029b6f41c442f750b7bd1eab3ef0e17

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
67KB

MD5
cc2fbe66ffaa37d3a345806521321ea3

SHA1
52a91f8eb96676d322584306e66860236a700cc3

SHA256
03602c05705dd7f0edec72c8406787dd592bcabac4e9d8ddf72e92e3203c1e3a

SHA512
3ad7a6706b26eb2892cc18654236cfa70dbfe089efe67522c5c682fd15dd249fd7fdf4afe45da8d8944da7989ae5f9395d92a10b89ae704998d5dfeafaa19d94

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
74KB

MD5
e070c381f3071ee669fecfa7edebc120

SHA1
4318ff75a8867601c41a2e6f34bd2e20edda9c11

SHA256
985b4422ef97bc9e4dfab8df8fd1b2a65e440c5cb19539b7902c79319491d7af

SHA512
f6caa091e6ebf44e933c52f9bacb1f74f039bb33056e3062a2bc65450725d38f9034811c8af9e70af95bd3f3828b16272ca56f0fb2b0356c5afaf36193d99dab

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
64KB

MD5
8d843763a2fceb8744c8bc5d6232c9f6

SHA1
87a7a91ab9bfeade9db8fd5e9422dae892956c79

SHA256
600187f34374fd7fa454c0934f8b409d2af9324497913e2e82a5e69d56ee908c

SHA512
c9cacde074dbdecfa6754357e229f5f292bf22044eab0e77d49d0dcd874bb408a417ab54482fc715a9a4b33ba56fe5c848c3dac934bba98d04f63dd9c3d2ceda

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
66KB

MD5
bcf3b83c07062244188c92e879b422f6

SHA1
54b9a7fc764462fcffd048729b81afe8856de890

SHA256
b216f3b0ed07f4b06f73a08c2f576ccd2f6104f92bb0190a1c101d4a8bcd4918

SHA512
56092b053490a308981d3632559906cbb7385aa5ae751d316d2bb22f085c95807f2c209cf31a6ea25746dfb90fbbf7a93a27b02793b070b35a5bc452bc52218c

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
61KB

MD5
58704ef43b0d19d35a4fe60f964e705c

SHA1
3037e2f68728a72de3af20b2768d77bb14cc88b6

SHA256
1d4be05560042d8dda8aff98262e03c0243e4ad840f778a416c6bcc2d6949b57

SHA512
fb5d6bad93bc93d9f350d2415f566170554d2ab118260145ccb0f55d1ad1a8254646ca23baba5e35226301849be7e8919e6335a020e4e7f1e5b8246a920e9fec

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
63KB

MD5
7752c219e5a6b3ce9b0789a7f903a861

SHA1
9c951ca1358f64ebf0042fe74136cabf42aab049

SHA256
192455d59400faa415dbb98e91cc4f5993caaf95997e8c9c18f1c5ff85766a48

SHA512
b651cf5aa6d340f910c9b9eb18e221d46f3144f06ea564d39900acbde589bfa011761a6dac894c5895cb37520d30fad74ffdf2e659e55b3496dfc00bfdcdb106

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
65KB

MD5
8bf3352147cc2909dc1e92a06b892bff

SHA1
478fa92b5f0d48fe954419bb027b43fd3bf5080e

SHA256
58c03c6a20d5a5385e5d36c2d393071ca59a92bb1c938ccd9d423e2a24642459

SHA512
5afd0d4a2c38cd2f17c0189ce8dc89426df3f7b9ac7a9f4930279fc55c4d784d9cb74664b3cde9e29013882ade436f7bb0284ffca573fad2a155cd815fea31dd

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
61KB

MD5
bb5ec544ba80734ac57ea113be99b422

SHA1
1672c06d973bfad583dfa0acae3f8f8ed7375fad

SHA256
9ea0d15c5d0d5169927eff038f0a435056fae4e74240785a17ec2f08bd9949e4

SHA512
dbfef9ad8ade407cc9a27be0b50708a4a92c93cc293c00d351784f5c3179e34b4fc0dde9371ed3cfca1c78ffe526a681680c71d93949e959417b635bce7eb44c

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
64KB

MD5
9436e6917b547fb4bbf9959e80ba75f5

SHA1
8d9f93b82ae87f91c37680735cff1b1a128f3ac6

SHA256
7485532bd90bc8c661ada609bea4f3b682f3b7c4a8949c867f36545fa28a3acf

SHA512
18a3af97bb27cddf1e312d9be97c23b68b1ef59ed03076670d17b258f9b27ec429c4d788c2beca2773484fbbd623551c4f51703c4d050984fb9815d8ea740645

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
64KB

MD5
950f833273067d2495c560a00dea385d

SHA1
4b8da89951144e70a04a15a48d3387b6f73b92d2

SHA256
0796e785b2ce2cc76da60560aa2f55449818abb089417811cdf31090c26069a4

SHA512
83a6bd60ed38d1f5359d50fc102072dc9d49853fc5244bcd201aca777a4ddc3fbdf30e9c815ef5b06f57b5323c2f73542ccedd51bc395683c17305ea07ea7055

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
56KB

MD5
87b4b18465c8d37ee3a486a037011132

SHA1
112e5a7dc07f0ed282c82dfe6f524b1048b9fe52

SHA256
750f1557fde7265145d5598a3cb4374741c73a2822c7ae5b5fc139e8a3b7d471

SHA512
8f8638d3f3d787f9c7b8aaa6f0055a77599fe3454713fdf1c0a619a054556913140d6ac7722cb6faecd53b30302703635fba7edb8fe3970e1e617288d8055c2f

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp

Filesize
66KB

MD5
319fc88312d229ee85672ccc3b2cee79

SHA1
dc8c0c69cea71d2c520ef6483f28b7b5659ee939

SHA256
9858aaa80152047b4c9d9ed7ef573a2a367a5be7e469eab658dfb4ed906225f7

SHA512
08763d48e63fa1ece34bf74ab03d1e53f03d98e561fea6fb61c7d90c607491c0b622eb34f7cdb64e370c4926f393207c26343709f482ed6f20cb48ca10e3989d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe

Filesize
56KB

MD5
032e3e4e2a65ad249aef24cf9a6ba1e0

SHA1
5b60329703297afb18f68fef89d883ad5cb26ece

SHA256
feb2841e1599a377aedd64db95ed4510bf8afe91073ec28550e933fc83fe539a

SHA512
5c9b6e76523856001924e347177952ec6a89b340e13f100a5f3942702cca0509ff4066849b70979fb2a5bcbcbdff53e1c50fb4459ce2189ae595637bffb0d95f

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
55KB

MD5
b0ffb5143b24c41220343dbf3c6de58d

SHA1
3945560cfb0ccdcc653f342c4f087bc687f0fe04

SHA256
d9fbe4c7cf8ae0af236f6d7d0a05db691d78780915c62b24f4991f5388af7124

SHA512
2a059b24555c238fb186b661461de04c074e63864d62196cd729e5aa99f80d993eda027c601410a2d4bf04365bb15c05d1d47e89c85f738dd774f0c9072cd2d8

Download Submit