62d2c7eecc2caa6dafdd0256efe22a4e6c6c916f2a17917639dc4472e7d05a3a

Analysis

max time kernel
120s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b771bce0c287a70318f1061ed943a070N.exe
Size

154KB
MD5

b771bce0c287a70318f1061ed943a070
SHA1

734754bbfc757da37f4e37cc917b848877c93ffc
SHA256

62d2c7eecc2caa6dafdd0256efe22a4e6c6c916f2a17917639dc4472e7d05a3a
SHA512

66d4a3bc11683ac1c4ca0fa6e26bf3bb67d70fc0d4cdfb9f5ca922f1dc4ed39ed52e478ec72cb3d5827087e5e483fc88f69c6bee27b9fe4172525812cce31151
SSDEEP

1536:W7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlt7ZhA7pApvOsOKM4HBhaGwOQ54xEIjlS:6e7WpRaSljle7WpRaSljU

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4588) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4396	_desktop.ini.exe
764	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	b771bce0c287a70318f1061ed943a070N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	b771bce0c287a70318f1061ed943a070N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsBase.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Windows.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	_desktop.ini.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.exe.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\BackupStop.midi.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nl.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b771bce0c287a70318f1061ed943a070N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_desktop.ini.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4396	2476	b771bce0c287a70318f1061ed943a070N.exe	84
PID 2476 wrote to memory of 4396	2476	b771bce0c287a70318f1061ed943a070N.exe	84
PID 2476 wrote to memory of 4396	2476	b771bce0c287a70318f1061ed943a070N.exe	84
PID 2476 wrote to memory of 764	2476	b771bce0c287a70318f1061ed943a070N.exe	85
PID 2476 wrote to memory of 764	2476	b771bce0c287a70318f1061ed943a070N.exe	85
PID 2476 wrote to memory of 764	2476	b771bce0c287a70318f1061ed943a070N.exe	85

C:\Users\Admin\AppData\Local\Temp\b771bce0c287a70318f1061ed943a070N.exe
"C:\Users\Admin\AppData\Local\Temp\b771bce0c287a70318f1061ed943a070N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4396
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
77KB

MD5
f20a2005ca7bc163f869b7d64d02432c

SHA1
eae78f99c9fbe1d3e4eb0fd9cde768194baa7f95

SHA256
529343e15741258d60102ab9d775f73313d9a9e8e8228dd02eafea3942672e00

SHA512
07cb8fa2d81a31da2f649368dfa6891e0c13dc46bdac4a6f73ea701c671add703f773ed0aebeb955d1dd21a861544f80912689d70239a4a1860e92077bc3e048

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
190KB

MD5
91772bc235ddd8ca2aea02a767edae9c

SHA1
5dd31e62d88cc8d8187a0f1f7770404f941d19eb

SHA256
312194ac8c08efc6426e1a191c6a064ef1a4f8cd706e9d30883285fbcd3ffd3c

SHA512
e07c0dc6ff2e325fc23bc037c95f6b92c532c5a2a3cc5e37e9fbaa391d8bc5125d97fe2648b1f79703bfb64e7b3e3d768a76d76e9d22d775b99c0f11d47db2f6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
175KB

MD5
01140ed65a23d9ac9544e95716bbeb4c

SHA1
d0e0c055f0f7edb6a9255bbfde1fb5f74fac3ed0

SHA256
23e1337b2bf73d4d277aea7705ae43953e781813502b82cd39fe090f55b61656

SHA512
0f3a4105a0442e66692fc7aabf33faf8eaebfb88733e35f4f98dc4f710cbc6060abede8b4afdcb10dbba923a7c9c7c1fbc781aa521b7f621deb03807863928c9

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
f4937f9caff2bfa8a9f9234708a9ae0a

SHA1
d9a4c2a6013d8cceaec365f05b1a0f1d10a4d836

SHA256
d4f896e5c3dec3b80ababfd62ae748305008e1d911d952fd171f51509188ca6d

SHA512
6a4297153ca7977d7d5bcdada550c3e6c6d59d27796dbf6d5838195d4eabb433a0f19e2e1fa11249bbcaa7326ae3c9534618e3d1bb0c45891d8d86f46d013614

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
621KB

MD5
c736632a4fa974c62a39c31593fca6b1

SHA1
b86d57998a40e8e80c2a8f2a4a5220e90edc58a3

SHA256
c02cd925beec3108767afe8703066b6e0f11346e7d99c8ef640799b54f7a0d95

SHA512
f46858c633a026b2beb621dcd050597b00010ecc954645e22ba5ad11e0d9ab510b849a8eb8f86a818b5a14e73ee2eb788ac783c430721d084331b5e1474e95b7

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1007KB

MD5
17df4b6375498f489004d4f75c97c530

SHA1
a26fe81cda666ba777c40a06cbe2d789dcdc118f

SHA256
36d7f2ebd0669225a7de51f805a6883b3574faab9a859e4aab7c389abdd417d7

SHA512
ac628f70826e7831154ccd7e679f3d6e58a69dc31cc2d0c554691d8f1aab5c767307beafa8c8e4251ca5d4c836298413ef997ff3f261b4ac399283877e7e3236

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
761KB

MD5
ee4b6ce8cd492b8311c672ed60165bc9

SHA1
5e13c328d91b9c7839649ae2be3d0662fee835ee

SHA256
9e61506e12bbb61347b7525cbaf3c4353fbb1bab2705af0d16efaec405939adf

SHA512
7efc29c6ed2a8a2e32507d0000cbb403554caaf38fed0b3134467172a390a6b2681bd39fe07834390b11183958507c52ed7890c2b10511b4142f23e913ae8904

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
87KB

MD5
f501b2e558632e27b7b795e3f984d67f

SHA1
0a919bd6908843af6660a1ad69009a377fc45a30

SHA256
732ea3a9c26f313626aaa87ee195b7f20b8a039e349465876cf1a1956f3e25f5

SHA512
96cb1084f27eb0dd91536977edbd020d395d242ed7974bd2582f730a7b42f244783fac63e42e29e3ad5d75695c7ca5232a65246880bdb2a768a29f0c357f8e17

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
89KB

MD5
95dab07bd20b55d64651f35631246480

SHA1
544f9b0a1ecaf9a8bfdaba9e7282227f6884300f

SHA256
060f8971eb3c9adad5aba42abe40d65ea1bff5068a7931549f90008fed4913d6

SHA512
baf4ab95b72c8c50aa0e7402e32264b105fff2c91aaed2a38d1349f3aa3d16ec9d8a4bbc39cba0538a6130bf1bcc9e387c25bc1c9347481103907f9a65ad79aa

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
90KB

MD5
018013ee92f7f08e653309758ec8c701

SHA1
b9f543a3d92aaa615fca7b0359e4e9c4d8d23447

SHA256
4cf482ba06ab92cf744a429ec161d7bc9a802b71fb4918e6122cc8034e213f40

SHA512
ed99aacb025a928c1bdc226c5cf4fb5ae73124f0c8afb6a6ea6b2c4b049c1525b3334a0738dc9e5b82e6eb16fef5fff4068032ce4be3174f9f9e4fe45dbd75ba

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
76KB

MD5
169f3bfefbea3b422881ad6939a79ca5

SHA1
c81dbe51bbf4eb4be36b13c0182dbd744b648bb8

SHA256
4b19cf066075cb399490e79715face5024f48469b10baef7959632fae986b3e3

SHA512
a165cba0056508b46f2e226e9f0df1297a4bfc5df2696d175f2b1080ce6adc17c257ef2931033ea0c59a3ec0d274d704a642c842143e59ee11fccca12f3c9ef1

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
88KB

MD5
e10e64617bd1870f49c6afda5d308d4b

SHA1
2c116d8e7390d0a4b6655e57a485e8cf2f611ea3

SHA256
91c26f2eb0a0326be57a063bbad7fef5ce9baf39bd41b9654eadd6bd40bbfb58

SHA512
e9d7f7a394fc6020431d8a163f9e9f09fbffaef9649a99a1b016da310478a2ce724e9a503f8151e12a6bd545d16e945af42d51f377f936d53c71ff7b5059793b

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
86KB

MD5
26bed64b64c7cbf66658a6f0aef8325a

SHA1
d8eece27ea7819d844c159fafee2879c10e72f7c

SHA256
49c7bce0032f3fcffbd0647204e84e5a206d728300dfcfe5173b753d1e73b721

SHA512
55019ba20fd89750cb1eb4ee698cf3628881dabbf3075c9c5ee81e43afd71346430679b006b222b6ceec7982aeccadd034a4ca3ffac8c4bc88135261af07f7e2

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
81KB

MD5
556b3cda6137294239cf0fe0bd2ed763

SHA1
270afc70d3e7069acdfb05b95c98792c1f41097a

SHA256
953d632e61ec124858b75de43ecd1fa558428782609b466bf63e73016a177a2c

SHA512
bd8c5d98c5021518bc4b215b336efea075b43a4a7d355f9e8f8865e9f1b9e47570ce41ca9f191c1208e50bd68e62c403fd35de3884e1dd57b804571a5c44ca77

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
85KB

MD5
ad26500428e06ae60cf71dc8edca5fa3

SHA1
0eb752a453728d93e15e748d2b5710d78f76ebe9

SHA256
12b590fa311a90d257f78bc7a4e575416a5277ae7ac35b7a63ea4e61e51f15e7

SHA512
62cc284b4de3d9ff6c0ff09ecffbc1d164209f363b5cb824b010774c3af559c9e01cb6b143e959b028c01412238b1778b099f3a835a92a4850a8137cd4c622fc

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
86KB

MD5
b4c63504d5e0f9fb424c3ae37101c728

SHA1
3c30bb0f45a3b8481e86125bf1c9cb957b226933

SHA256
ea9a33d9ebace28af1aea6202606f0dd434a13f53853b36fe3582b1e7e1c6dce

SHA512
025824ad2a6174e4fdc1ec4dcddfa36ccb08320edd89c88a439553a9e78a7f16cba88ea40d6c2c8a407ee157b74b1c551b6313caa1d0f80667be650be366fbe3

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
93KB

MD5
4be3b868a2fd0d9891f2b2c1ceae04d0

SHA1
dab4ca071ef40914af2ae0e0b5926439a33a6749

SHA256
5bd87dacc5fd568946140f9cd2354b5cdde2e5ae7fbdc511330a7f3882775664

SHA512
f20c9922c865a53912ead52ad2c6e52ad930bd4025d56f1a1872bcf52ba2aefa437aa2b71dc48b108b55893d78ec16a898bb72d150c2a273263ef1c853512832

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
85KB

MD5
bb7608a3f76606602201fe011e552bd6

SHA1
291780bebdc52ff2db55de5689bb4474e637bee5

SHA256
2e54a046dc752e95bdacb58a817d57600a9a374738e43dafc00769544bf30521

SHA512
f76438211a3ee96033434c61adb455987b1e8697cfb1470dbf2df21a084fb879e920a8fb2fd6904ca9ec60dabd1b68ec96f67d1bbafaf1ac0a5bbfe5af677123

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
87KB

MD5
265e5a05d04281c93d1e0c0533501d26

SHA1
71028801400e13a2959f42354c8cc495aee32ace

SHA256
39759363df4e758bad6b42eb263c363ebc1e0f6b53c1b0644d58eabd1cd472fd

SHA512
37f3b8f8fe2b7e7b0800fadc9a81e4b53dfc4768e161adab9e2d6ee8fbd95cf4909c08a1c46203aff27b4c56349a0ffe48558f5aadaa35148e7f4170081ae1a0

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
86KB

MD5
fe7eb670aea81603da7b24467a39fb51

SHA1
190cf132948788edeced575d9067ee88b3763f6f

SHA256
3ba29292a2aba9001dd0bd3bf08e119676fa20beacc67931ecc1fdba589bbe98

SHA512
964e1cb2cf5146bd47159aba2f2eaa028eb791acc405006a1a4a7651d07f6b4a2283e8397ea0c99ed7fb82813be8d78a925ed267914edb12e3b1d4a09f7bf679

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
85KB

MD5
be6ce9efec9d2d0465b65a684dcc84a6

SHA1
10792ed4337671340d6af7eb5c8d5d1af67eacfe

SHA256
f947eff77d3bca6a7757e0554707de1a1d3fc297a18240298bfd9980fc9b6635

SHA512
eca5af4903177da967f106949cf75ea0a060eab6a76504541ba9ae659f99ebaf7c73227b2de81603a706b0427960189257d33d2e09d06cd68df0aa249daf7cdc

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
90KB

MD5
3e1f6d32ac37b2b7ef0810b87b42e358

SHA1
45c55ae5ec0762bac5d2809483ee9225df932980

SHA256
e37df522f36e530df55abe135ca45cd921897d9a3e62ecf7a06cd1ee8bce20cb

SHA512
24de07800be8423366497630d57fbb487f3c0cedd0159765002e0329d0b4dbc4ca96f36a0a1ec473f48ca2ba1929c252d0296484a328a21c61e6e84d4f988e33

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
86KB

MD5
f880def4332e74eaf3420e1737ddd87c

SHA1
308ab316308089d109613d4f846c2d44b1214ff1

SHA256
403a34c7711448fe958ef295e0096d43892182f4c29e7b361baf67ebd5a9b057

SHA512
87f0fa2cf88114ed65ee63951711ee013b0b1d5215820f70467489237b1e95ba838f346d85f15ecb749fb144971c03b2b577187a92743eb6a393d3632f3c2ee0

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
87KB

MD5
3b6386593a057f3f38f74bcba3c0b127

SHA1
9436574b67eab18d297b4fe836e58b81d24140da

SHA256
d99fd52dc5ca37dfb8239b4de71171dab40eb9ad09283e52780a11d79bf50a79

SHA512
f3779ca9385f08c0ee359c882671be7be996fdbafdddb446f999cbce79f2ae30ab5db831f14ac2440ce0e9fb1eff8a5ed8b74cdbaeea896ed24fbd29a98853fb

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
64KB

MD5
7e5f93dbe0cd9b525bc36a30a047c1cc

SHA1
ca7e4d4f7abbd87c65a5d2eab461156f79fd5459

SHA256
7ba84eed729c6ab079e0bfa675c5057190d14790722499a0664e46f5f06a7b1c

SHA512
a1ac102a6753ef034082ce5dba5b62c30276025f9e38ecbb4178c0af4557c0304b346b31b3a0903aa5a4d41fe27f634b2298010b13f6804e00849ec8e8ac9f79

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
83KB

MD5
076ea8436fae9a2a538005100f492ad7

SHA1
5f6ba37f5a43ad6dc1046cabcdb9339e4b05fb50

SHA256
0c8752c686b48250ee7979cec2908e6fee7d72bc9bd98fd70512509e4fecdf02

SHA512
e7b252bb6151ff675c436bb162f1967bec7b1519b9f406408eecba0d26ef2395e2ca724604adc9f430fd0b01573e597661651b8b55d05964646e59a84b7a774d

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
84KB

MD5
802680334c543381d72b20ec9c519f0b

SHA1
cd5f3a089a99992ceafc3ae57b8d338bfb450820

SHA256
007bd2e6f68fc7d8c57b57bd8381c0079722063b0c2619299c6f63aee4bbb3d0

SHA512
aa8beb757e2a2d487ab91c5f903097d589b715467ce68ae67f075615f13fcf145cd8f0b4b8b2185122772506c85920de4ab54cbe716491e13d1c2e8ece4bb471

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
87KB

MD5
c4605cd09fcc3ae866e2c48558200510

SHA1
ce6b92cfa7e5ff8fa673151b976503f991512258

SHA256
9f682e0e422804ab898f12ff09fde0c50b06c0b63ecbf521ae95f193636fd5f5

SHA512
572ce4aeb2d6d6a447756bbf3b85cafcdffcc080dc423b2cee6a93a058b45beaae131d3686168c2d7cfd6b24bd7454f11f3f6d7e678dc930c1b0b15a415454f6

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
94KB

MD5
b204a5492b98dc97ebeab5f0cd802729

SHA1
c3b5f48cc8ecfcb5931c7cffa7003c00b83082ff

SHA256
02e9848dd49728fac72e4bf3c30e00c9666ac790ea6c44d881b46632fc1e8d0d

SHA512
d6cc8d8acda399812a0fd084467bf42e30386ea11faca327bc0d7e3bb6de92f220fbadd11dba1ad7b9453febef3a139fe466ff59fce76a2038fb436a0b8fb4f0

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
86KB

MD5
cf030d4a6abe60dd99df04a1cfe07f3d

SHA1
28ba4f0b37db2b70cae1dcf7a5d43a4c5db4e6a3

SHA256
b31f56bc33328997d03361e81a6a157b2bbd7801f40d5e8188ea3f0190c4d9f9

SHA512
7c8d4d92c7f30f5c4dedbf6b8eb9b076af78d70452842c37c06b468ffdee171c373b1afee5f7d2562d090b2d5e73234d8f43725e351251a5fc37e74993209aa6

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
77KB

MD5
40e82467cbaf3f918dea032461cc808e

SHA1
5f29c1a92e09586b93e659d2e6d48b29410702a2

SHA256
a41cee897db91c5ed6ac55f4a2a9ceb2cb66506638379f3ad1f3d689d9520604

SHA512
68a8d7174cf3ec3ddb6609a5f02cc0ce2f5fa3c4dc9a6e9043f75f8bac38a7956115211fce19cd056f0fe395444a634b80c4196ffa6129dbb9fc83ca13077726

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
85KB

MD5
1a77c6694402ce9098068bbe36d32087

SHA1
85bc6b60e625bcb7dbf27f2a4d39be4ae803b80f

SHA256
eeeff721922a23c1ae04a12ee8f74f7ca62ee4aafe9d29b01db1a3b0b689bc4d

SHA512
d11529542f2e001112644163cfea8842a5b99cbb49f1f1c5940de42af3ad0f180b5b339fa91fb06bb207ca1f4ae1f03aa5a302993e123d90e1d34a113cda74ff

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
85KB

MD5
81d419533c072fc027bc450036658cbd

SHA1
a2fa30f50148837e68a41e78f2502cf0a9f437d1

SHA256
81627f6a25318ecd2daea2e984f3d4fbc97978381efd7fa65e9ea89542bea35e

SHA512
5611f1791f8eb4617a6446f1f9b8f900bf56b4f2f13a056c2ae60910fe6ea8877b8254439e6937f8dfa0f2930afa2c0da93eee95a4f7fc7d214dea0e3f4d6c4b

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
86KB

MD5
a039f3d679a1388227395667d18911a2

SHA1
a4be7c3e496fc63d1cb98030d602d319132ef2eb

SHA256
f0d789d94cd778a6453484c3fb9b86b8c43ce965d96b7013e6b5314a744f5693

SHA512
f475ff8ec318c2f2f2103bb70f8014f4af820ec0f58e4e60f1af6062724199f845fd5099c86b159f843f0678fe601cff9f91c8ff96b6f4f585b3b6ac9875858f

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
88KB

MD5
20b0776f4cc3ea9921dcc345aa94c212

SHA1
65f895cc33ae610e5846fc0ca309911b01a09162

SHA256
3adede1e055c7c154bdcf14ae9191ba3c0bbdd837c292ac689bd071f76134985

SHA512
5fea7013ee283438a1991d74db04c90d8c1b675c403edb164326c6216ea8934916551c12d335618226db8b3e3bb749c3115f3416b1b3954bd796b45b34f580d6

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
85KB

MD5
6ea1fc6abe098e7c6f2ab36c812578e8

SHA1
bdb0b912a0505f8103ccf88984aadebbecad7c60

SHA256
c20ee6a59a80832e3c4a4146e7d0e34c53ed2f9746f436a6589f95e0ce845bd0

SHA512
f5b5613a8b05673adcabdc6ee9edc3cb670035d404d1a0b6025f7d7e409c842e5674377b4452aaddb39ef69e96b59e08a9be70c0f8bae926caebf6d7e1da5b36

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
87KB

MD5
531ec51c33f41270ebbe142e0e29571f

SHA1
04ad937ca5c1b60c20e007c13a386a6da0093ff7

SHA256
ffe437c16960a23e0bd05dac61566c25978040e3ad967154b4df87b08da2aa76

SHA512
8d43f49500e8a56b5d0dd20e62179a7275e4ab669f94939f51f07207acb9697e0b81daabaee16faeb4db23f056c46f5b0c4b8c8e388fd426c2ea53416b0ec3a7

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
86KB

MD5
7ccfec4a4b9efe11b781d16bc669bc9f

SHA1
06825cba165427600b3ac65016e59da92245c47a

SHA256
57a357485f6c57432f4bf8beac820e2acbe71ff293e642a917306a7e5f99e3d4

SHA512
21e14aad5a47f74534c4650ad15cccdd98fd7a938a06d406e796abdefdd266520b40498fa72048aacbe34562557c5c9de1ad671cef642a7b4527c9b7a72d6a76

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
88KB

MD5
62707639a22ded04da21351c9eb1bb2a

SHA1
342e2ba51cf8bd1f5aa9a87a6f654e1ccbc916d8

SHA256
b29e90e1422fc4e4b3b28d9f38af5c6683828f816f50f5d1abfa4bc3a29d8d7b

SHA512
d0aa2bef714f8fee663f9bd7870fd32210c67320dbce28f46e4c63e13eac730b771d7f1e189b266d41726d78f783312d67c9089bb3ffc04fc35bf09f839ab013

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
77KB

MD5
9c2163c1275c23629f58c1d9689d36ce

SHA1
9acce6ade3cae77082b95c6071000cb7ebf2afae

SHA256
68866ea147f31d4ab9b1cab8ef489afa722b007b0a8c14ba2a91a543faa0ba50

SHA512
2efc4c9c8c30c73ae90caa31be278e4795324852bf0278f3f9c256772584c1dc53fa3650f67832dc6a76f36703bbf793fa49f1476b3ac0e22ce6bf4270685e9c

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
89KB

MD5
6d2c4df93863f4793cc1d6b6b6b31767

SHA1
77ec796705dfe3f10b287e7f8542ecfd13e90627

SHA256
68f15f9ca33c05a9614392a7f1946841a4790e708f06d7a899a0b82c4410c2e2

SHA512
c9265df9667f55755870e9747a5f5eccde652ed0e5b1c31e814eae8d5781eeb202ae7bd5611420a9693106fdb1994787d30d8d9d486587faa0fba906bf0848d9

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
28KB

MD5
4e8a2c6667768b3f0c21857fcc50b1f5

SHA1
dcaa8f510f1dd7fee5ea35038ceeeec39155638e

SHA256
987197124fb0e40ecc1c876230e736b798d64656a6f3c46ba7dc99e5ec0ea93c

SHA512
381957c3cd48e7e0c89671ace6882d79ed3a67ae41b8f5b3c07995044aad7ab84eb234a9aa1e879764f5a91945b1fb348975d4b2ed10620a58c3cbb583fa608c

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
86KB

MD5
ad338a95c7e4e80bdfff00150aa96695

SHA1
67d3c323fe5d6ef1b9d33833ea1e30b17aa7a080

SHA256
19fd1d2189805263aae9cc75970c8f781c2e346e898a57c94644bf9466c9fe6a

SHA512
a2990b6781c103fb054034e7bde2ecdc9ead874e637cc3da94360101db5a57edc3f3c138453f3603ac6b5ee09958040792f57b2b9a0862a8e9afcbeb555a974a

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
82KB

MD5
e7695aaea023c57af2a966b24096b097

SHA1
c5f862641f386909c6863d40952410ec6846b01e

SHA256
f04f2a1135cef91ea810c66efa8a596d46f978df70462322df85c03b4039d4a5

SHA512
0b1cb3095546b6aae4455693bfc0dca81bba94ea10a130c71b858944763aca955495448fdff49bb46c720eb9083e45fd95b32a8dc3ca427bdf7e6526629b9d6b

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
86KB

MD5
9e9219ab079c04879a68ac923e899df2

SHA1
eaa3753fa3dabde34b29c6ccdbbaca615bc315e2

SHA256
3e34378e9e74aa8d6b625144fd7ccfe4a12598a56103d15f9a6e3887711c628f

SHA512
1ccb21192953d67636174439abf94e3ab53bd1af44aef8aa9c419518074eb48713628d1653bcd011ee6364b1e6a671365fce46155013f9c1f8104a76e7ff5db2

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
85KB

MD5
edba6ba39281238c8ff9f7d9cf3d6a17

SHA1
ed4d7459aeaa87e66c39a6601a110bc9078a16c4

SHA256
121b27354c17bd7357f241b5cba7c9ba472e190b5fc964aa5548b044b62beeb7

SHA512
29af7173828270eac7bf4113d62190f039ea679942434c6e665b5b5f8e272dcbace3c8285842516a05f042918a0e931749de254b24f6d074943da003299bf263

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
97KB

MD5
8a937dea6edd0de709c26a2f59103c36

SHA1
c096caed50b4bfe37e50d3b4184227a691750c83

SHA256
9b302586e822291df5e60e625756a08462f289b414105c5eb007c189346f107c

SHA512
3208872f58e1492424f5e2b61f238ff9ffb789ee295fc111fdc0a9b15e73eb44fc23fea2b6b6ef8b03be63f265fdee6fdaf08538f22991decc8a94d7c8affe8b

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
98KB

MD5
1d8df34eac016e328f39f3ee4a252d44

SHA1
eedfd4eae98c6cecd71bc873b10c215c75b1eb9d

SHA256
f0b76387f4e17e19bc17813b99b9cf285048a51be3412aa3bcfc315705cf5507

SHA512
229afe684d3f9b9820ed91c117a43953ea1e99d487200cd8a7a7781efd03816cc4a291407a25765f1ad0bfd781f0e20b909364aeef26d65b2fa0a0c78cf7a8f4

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
88KB

MD5
0687c37cb173f9f7d4e6bdbf77b8286f

SHA1
48d1acdf29b0858498b31c65a71076cb9207be77

SHA256
a4826dc645e19f352b5bd4d36e8b2a0b05af31aa864b76b44d2d83c031866d8d

SHA512
8ce84c13e7957bab41c1622ac7a945e030888c45d81ec0fc043dd2b71a44c1f420a9014d8244b2e71f150edcb13ed177fe23d2ffb7369139a310deb8070e6b28

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
82KB

MD5
770a97c1a6e3b847b68fa193e1e27393

SHA1
a41e66457bacff3a534f0873fe0ac260b85edffe

SHA256
b6dde1ffb4db2a9cb04dd774328477250c7a496f3ba546fccf14bf4662ccd3a4

SHA512
52871d3c7b5e8697bbbb9717995e31a1f8c73cf8010a02cd0536da15216ef5b0804a47045508ff13e267bdf52989beb35be477aff3d92243c436bb0730ba44ce

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
83KB

MD5
54c63a613807702f01191fb97aa447b4

SHA1
01b5b8a39c08f753d4ced100f13e6de439e6c0f6

SHA256
7ae5a90e9b8170f2e36411f982f72f06d9e8c0b6eaa53e0b54055636041dc028

SHA512
ebd76fcb047202c9bcfda3b290711b519dcb156c1918a38309566af0d676db3bffc0fcca8be2be6e5c2d9e9837fc47300a09116722f26cbcc06e09989c14c5f0

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
82KB

MD5
f2ae61075f52daae1bbeb3e695c2f531

SHA1
df9867f05c02251e594a5de274cef682c5480fee

SHA256
9cb525a00a6923349d263fae460ed39af3270e956944cf79a06331e23ecfe3e0

SHA512
a784b9e0115e7923873be3078e981d390e4601bd759f555555237333a9dd6bb09e729a77a289a5cb27bda5b94939a0c22f14784baa149820bcf0c5ec64ac5b23

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
86KB

MD5
48dd0074066d3a60b82fd036d6dd0a88

SHA1
1821738fa62204ee78d0d3af70434d301fb80f50

SHA256
a25b642b5cc5a426278faba4743a190081cb1e9928bfcbb13c1efffa225abc21

SHA512
43e207ece4c2fa98cac945bb79d93cb33a69fbeddc55f7d9119b75422a83c257dea8cb44687a011cca8cea3a929d599bbcc1e1c0cf7db06cd88079294baff106

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
85KB

MD5
74b3b14ea768fdc4ae8d91a9522ec31a

SHA1
899593cbeefa6474d9fa874c20d6e17587a6a529

SHA256
10259ef5a05e339ce130454697788f6f353836d89f3366c7461f04fb2e3ce145

SHA512
bf157c97fd768ec2044be967cbf3bbd9374b0a001df7cf7691578f66d24dd97320378aca3e95eb1bc931d809d8f2c6988afdb08281591749befe534a32a8b9b3

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
87KB

MD5
88dcd0cfc60e366961d3abe0a554b83b

SHA1
dfb1142a6f20e9bf0898ebad9520cc96f7db0c8e

SHA256
3c544198a51d5da4c12effd00168fc984183ea6f5e20e4c459afda04233b2215

SHA512
e9beb25efa64fa50912a6e7f8b7aa5fc7b88e9f9f2e41611152f583b73aca00b97106f93a3d6a425817ca6d27b2a92c966b8ee034ebf8b0aac396388fa4c78af

Download Submit
C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp

Filesize
87KB

MD5
98a0551231419524e9150922800263da

SHA1
8ba7f7a9b665b2bd2c874adb73584783b61523fb

SHA256
13964d61511448013286453606a4a52d4f874bcc3985ddf7922247c3b6d74ce0

SHA512
bdcaac5f891cfa41ac481178be055596ca5675cfa1e75862dd0fa750be686aa1022f3a789426dffa9ca61e422ee57d939354f29034e2c9c8554679e33c5bfdf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
77KB

MD5
40a73892d013acff28e344ace2bd8544

SHA1
a56576135ce99a621b64fe30e856f184acd7b492

SHA256
4b9bc73ed3faa6d8d6793c8f6974bab082aa47a86965e32dd173b4e8656aca6a

SHA512
4cb0f544bef6cafb3a6d8c5278245af0243c32001c5072355bee58ab01c738e288fba38cc4fdf537653d03680a5dd3f54ea1d27d4e4ff5f27c902217a3866ac2

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
76KB

MD5
d466947c94be353f4b66e18154cbe51f

SHA1
d4d3d3e80f64521b603c58880ee83f6f52e4a6d6

SHA256
91152169d83253736a1549a9a40e870f1b21e9cd586ca0b6605dc5c4d2a779fb

SHA512
daf21afe3120bf2e33a4c979fb993b115cdf53b1d7bab1ff5b7caf498c8f666f595a89032336513880cd74f7bfa2202a8e02b42ea093e0ed76e4f6ae72b0b67f

Download Submit