e9598832d28ba96c4fba7bae7adaf41d9a8825682d0ebce1d1cf669460432dc9

Analysis

max time kernel
119s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

65d363d170a32fd55cb8ae31f5acc540N.exe
Size

136KB
MD5

65d363d170a32fd55cb8ae31f5acc540
SHA1

4b59b89993001f0389bfa6e79a8c933c8bbdd4b1
SHA256

e9598832d28ba96c4fba7bae7adaf41d9a8825682d0ebce1d1cf669460432dc9
SHA512

99f2480e298cf79d8a1e0000d200f2f803bb98b1bee89a99a296a6dd484d23583f74033b63c3176b82c6f1b8bf63ac15ae1b5757b35270371e29d01c2fc74d2f
SSDEEP

3072:62ssWpcU7lK1lKgkh2ssWpcU7lK1lKgkb:MVyU7lK1lK5VyU7lK1lK7

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4651) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3740	Zombie.exe
1328	_08 - Homegroup.lnk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	65d363d170a32fd55cb8ae31f5acc540N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	65d363d170a32fd55cb8ae31f5acc540N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\fontmanager.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\netstandard.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.exe.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65d363d170a32fd55cb8ae31f5acc540N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_08 - Homegroup.lnk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 3740	4780	65d363d170a32fd55cb8ae31f5acc540N.exe	84
PID 4780 wrote to memory of 3740	4780	65d363d170a32fd55cb8ae31f5acc540N.exe	84
PID 4780 wrote to memory of 3740	4780	65d363d170a32fd55cb8ae31f5acc540N.exe	84
PID 4780 wrote to memory of 1328	4780	65d363d170a32fd55cb8ae31f5acc540N.exe	85
PID 4780 wrote to memory of 1328	4780	65d363d170a32fd55cb8ae31f5acc540N.exe	85
PID 4780 wrote to memory of 1328	4780	65d363d170a32fd55cb8ae31f5acc540N.exe	85

C:\Users\Admin\AppData\Local\Temp\65d363d170a32fd55cb8ae31f5acc540N.exe
"C:\Users\Admin\AppData\Local\Temp\65d363d170a32fd55cb8ae31f5acc540N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3740
- C:\Users\Admin\AppData\Local\Temp\_08 - Homegroup.lnk.exe
  "_08 - Homegroup.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.exe.tmp

Filesize
137KB

MD5
c148987802300cd7ad4ddb504481ee65

SHA1
02b4c9559f4ff02b8fbb6fa119e5bb9c743cd2bc

SHA256
07ba1aecf92c7010b7fb32d3500af5c43f3fc9dd57cd97fca2efce59ab932111

SHA512
eb1e1f3ede41584631ea3c7aea79bb563dc7d5d3ba8bc9ba9e5428b8141150a658bd7778dffa3538efd6de970b94dc77c60e566a70447e114c50727fec4dc6e0

Download Submit
C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
68KB

MD5
f9cfe1f177dee3f4739daae455d3f407

SHA1
262e0b71dde2862811509b3674d2204402e605ed

SHA256
09eff6acca67a73c7334e17f06ca0bd795f6af38efe2f713e982e72442140d1d

SHA512
aadcea90a72b9143742794eb831c9e1644b7ae6f91a90b67989e997347b3f312cab0ae816ad394d7c31e5c180bae132f7f12b5b32bd3592cd2fbdf5464bc5769

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
181KB

MD5
0442995a9421b0ed25097593b92f032f

SHA1
5a56fe9ac23a0ded3651bd32cc8accc580851dbb

SHA256
0d80c87f1428e3c891064f6b91154c4fe8d79cffb42c8f510dbeec516970c952

SHA512
1e1209bc9072e8cc30a8a58c5fffc2e90d5fcdfdcf0e8d25898848a377384e398f34d43c38f7ce7a284d5cedd4212712440ea23fa78f912aabb3b2345c9ae929

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
167KB

MD5
d0da78bbc4ef453d8f1f180d3bfdac21

SHA1
a234b97303f22715a5f91bb6df68260e53557263

SHA256
a4e9219007750a068b64e0d422fde9c33227f882b26bc7931b54fb466514f807

SHA512
e46b07b75cb204c3760eac120bfe095b864b8dbc756d520b3a0d06cc6b71240ea613fc828674f633a5998cd82dfc5c2ff51a76a0cea540474ddf711cfa5dfe75

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
612KB

MD5
9d1ae5de937f414ba4b0103a98a0944f

SHA1
3ae8a0dce2e86ff6d5844b05acede33a6055ea58

SHA256
9c5753847ca47ba0e58c8e64e0e747b06213bdeceb5d8e2fbe71831cd5ad56b3

SHA512
83fef18ea6b9b5920bdc023ce71b615aac0de803b04ed99ad8d1abe593165b57a9c19a1ee841101ea29b19dabc30603ca3e62e39b34792856551605ac30620e5

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
278KB

MD5
9314b11532cd0942ed2880476aa432fa

SHA1
69287759485ecbcf9489aed8730d7bb504370b54

SHA256
8cf3db8fc68628b441fdac2c0ac10cad61eb4670a7905337f43b0511c2883b07

SHA512
2a74701dc7ff79bb71a17f1bf71ecbefc25b41a8dfb64de29a502e65992bc57c5f2575e246835333d323ad2e865e3503ce791699aa830f55fe505aeab5f3b2f7

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
257KB

MD5
56f5462ce4f6ff409a438dc0c7d26316

SHA1
e8a5b89d55a9379b80dda67b085ec8999ada5805

SHA256
5368a99076d4080c5d1d7e8b0636af80d9f99c4b37fc6954ab9a6a8f1dae00c6

SHA512
024a0aa6b84d809b297e491c6076092ad704c6034345dbea50bf22d7cc7da0995a3a3d6f93d9cf21a24d597f596e73325dcd19a28000b6d694d5049a146a50e2

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
999KB

MD5
dcb17810e5c0c9bbf5ad68b7f7a5b477

SHA1
6c59d447666bf1896cec2abc35dfdd410757f5e6

SHA256
3e5e3f8d53d63f4d2d108f5c8ce178843d34bd61a8774373bf6de2f361f6ccd6

SHA512
b9d39484ef5a54ca6de634b565298cb4261fc9823341ed675ebd58bd675b008b80056835d002ea3d8f209b11eb1649f9c098794c0a2b16431259508d0cb337b2

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
752KB

MD5
77942c9b7858d8b3092d40ff62786be0

SHA1
f47d0fb2334175cfd4640f1a117d1dbdc42c1008

SHA256
f6fbc77f1db0ddd25ad4f952e7a43dabdd353e0e9b53473e9f3adeb3e800a856

SHA512
cf4ffa11fbbcb78d799aecd21fe5702f67269848d68b9292ffdd3cfa63801fad0f11770921188e8746edaf0c3eb6919a87bce7802a83410570ffaecac9f286f8

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
78KB

MD5
1dd0604fbd7bad6d42f751e3d69d5b5c

SHA1
b6267998e31d5f177c0fed7c6c5d98e4e4426788

SHA256
caf66561a4d3583449e01c3fdd94b25823ec4daab6ae8f5cbc2e80af94b8e9eb

SHA512
74cb65a9682c69c71769a23f3e07f2825f96e25f3bcd81284e683dbb1f057146530b5ad49845a9062b221290f2d09a9956f114627c6572bda40e5e49aa245660

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
81KB

MD5
61b6a61fd00f90d499655261d29e40b5

SHA1
31748236f75a4b3b7c44a7c972b405b41ab0ed43

SHA256
841c9101891451ba8c13bc192ba2f452458a2641be60ec8c409bc1930b9a58a2

SHA512
603fca503a81ef09b27571eca329a17b817ccb6722ff55a202cc699a7b2862cb31b5f7d4d0f4d803d5ac75ddac8b8db11818d19014783d3da6ccd48dc27da7b6

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
73KB

MD5
9b5504b3d55e1406af604a67185636b0

SHA1
73bd1c842928aef407ac86f61cc32c4b20b0f76a

SHA256
ddd752359bc34e196cbbc1821512cb569984f8894e023a79c13cabcd2c88609e

SHA512
95f9c86804498280b27c856fa65f8d011b577bd5a9f6ffbeef0563363e8b9e945338705c6567551ec93f6288725061a175ff5bb9e3f893efa2f7b5ba4b0157a4

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
77KB

MD5
75d2be3bb1f73d31c918d47fa17e03cb

SHA1
0638c8c4124e19ad6d328e977834d305305f8e67

SHA256
80de8e877867951bbb01633c28b99e57fc6a9ff25ea468b9ba4e16ebe83e54a9

SHA512
7374e8c700f4e9b6c01afe99a33b26088b431f3809bc6aeabd9181551ad222bb5e2624be42482d3362f2172c99c3184a99928d29b939d5ff7120bceca64e1695

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
79KB

MD5
f3309a4d84fe5e1528811a47f71b773d

SHA1
628a6670852d7faacf889dc61c43e6fd3b35d160

SHA256
ccc477c6b9510491acb6852ee3e4b9a693f53f5e4b2b871bf30c7081444ed78c

SHA512
f37ce3598747daf50938f8569d79546fb8f655f6bec342419541f876fc5b802fee665568815eb9473ce0147e581ee6c2781a3da3264d1c142864dae2b572a75f

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
80KB

MD5
b3668b3e69dab406c13f104bcf149e21

SHA1
16ae0524dff214407a5a386dd16d293a0fd8caa7

SHA256
f355b96233df3b74e3cdee0a17621177972e97172c75564b8470ba60a23f9f6a

SHA512
aaad47c0b0b46ae0b479211e3ccbc0b9c0900c126a26784d2181d963daeb75ed8ca9dac66d0a46f045b8a3b1b90a9cabc31f40483f6275aeff6cef639e243978

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
83KB

MD5
73f430ebc2ebf4de9ba92af8db2c2e57

SHA1
0a4e08459ab8c62c9042efafc1c52db59ac99029

SHA256
62b8fa0942aba37e56d1690b2314a6ee8b88b5183a1540c35ccc1474fb5a1862

SHA512
d3687c20a03a3fd7119643053b752023def0fb3ae26de14848c65d5d254c584d380cd53b3dc02b91a828ced079467636aae581f0df1a70a5eb53622752e11c25

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
79KB

MD5
4c5d4ffce6b448c997fbb5feb85430f2

SHA1
77986b292ad433c5a01ec63f354eca19295b3624

SHA256
b10c2d907274c0fda866bcd962a97fd69140e27918a317be5476e9bc87a9a3c1

SHA512
dd9ac3407a5a9427207bf3cc3038c4371c5a0f234547cc0e4cb6804a2ea834ed3358fe22173a3bc3cb908253ef7fac5adfb1e3f2b9b736d7307d038f2c9f0712

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
77KB

MD5
d69d8c2317e7810ce17d1da2802649cf

SHA1
0c54a51b60083a02194317d031c38065ff10d292

SHA256
9a8564ce677a1418e736ec639b7a8ab73665d30cf3df60802e06525bb119ac1c

SHA512
32ba81c7c18a0d211c6a986346e06e4537b8d8176acdc19de53638640b0d8993a295b23969037ce7d47e96be4c48399aadeae2204d9840409e913fd34deec08e

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
73KB

MD5
52b0c70d7294497057e2c87e3d8174d7

SHA1
6183293056743e0a7c05bf1f3110b832752258c3

SHA256
8a145e9c37d514a43e20d910cc0e1ef5e0846327f84521cd57d78703d08a8aea

SHA512
82ce6cd182b915233b4bc94a94b701524e39b9179ff441fdb06ecefad99f5227c33c3719b0de78dd60b4af0cb78b1afd464d7be4bd11be521940018013b00ec8

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
76KB

MD5
71e35c1eb74f92495ceb1f84e9c85afd

SHA1
d5d4c348c2b62dfe3d71573978c172d363672cad

SHA256
a80919dbb55e2bf65007cb8d7cfc1ee8bf4b6f868335dc25ead4b39cd85a0814

SHA512
aa4c97f2b78079160fa67d09e23b48ccfffa4676476485b0499c3bb8497e5f06d6dc02be849acea94fff108aebfe8ecdb41bb6bcf4aa8369ff86d3f6062778b9

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
76KB

MD5
6531aa6e9fac29b1c55470305c73835b

SHA1
bab90f4125088ca6acb9aad9513d3a95aed3b5b9

SHA256
da084961393c6af536aff4a0b9ce8bc2a5277b9a89a5fe9a8783a8410c15402c

SHA512
4a1f2d80ba65a1c04731ec49dc2ae818f912761a27987a70ef26347f4238a4e76c004255273ec3dbb5ce5bc7ce6fdf4b6a76b35fa364e48f81246232ca561f84

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
78KB

MD5
e90bf94db810c4ca69c2d3e999ed1c49

SHA1
133878f5c338fcb78e8f3c99d74aaa80c300a252

SHA256
44b1d6b1cb271dbd0dded2070dafeee9b9ed363e6884ca62c6cb1e18f27bb0eb

SHA512
da9485d8d1a6abd24b7da1369c66629fe4087b33f42cc7cc27995260597c259aeeb45269187c34d39264d555d63e7b39f0adcfec07ec83b6655ac5bc739b9c96

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
72KB

MD5
2e639e4a86caf43779ec7809bb355def

SHA1
c952c403296077822990d67a0466ab8b198ac173

SHA256
ab7215672fa5952492755402595316ae12f635441b08dcf4e7cfc29078ee074f

SHA512
f7a2f80b21d3687ebf233eb4b604edac7ff86cac1950c2c946d55e749a7ecbb9d51d6936e0b95785a9e25e70de12bc04011c4f9112b0e2ea0ff058aebe30e51c

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
75KB

MD5
c9aa60b1453b5c3ad8b16c581dfc059c

SHA1
1f7473beb251d42696a7a4afe6cdf33d336c65cf

SHA256
d523f8cdd3bfc028e3005d3e7353970e422352217412118d7d2712673235c6f7

SHA512
60221bab7ba67165ba331c26f32f0b80062bd55c472946a5f732c4ab2c9892dbf9e80f6c74972825bd6a5f9fc7dfd6a28a0a1b84562f5eb317245779b3d87111

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
78KB

MD5
929a4309b5d29128e53d62130fc44dd4

SHA1
d836f289fb7c9a0f54df88ac7d404c191dccc0ea

SHA256
bb1f39ec2c4b959dc49cb88f74191dee8969d4ab43179202c0e7a30185b1c82b

SHA512
c8f36db6c94373c049e15694329d8687ee48eedf3cdb613bcc774080679a11b4fbe2f22796e5a225880a914872e2de14b793750e3f0cb9b121d125a6a0cacbc5

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
75KB

MD5
5fc19fcd66a3b6db9332f3cac86b9bf7

SHA1
ab160f8262c6abd1365611f973e469137f179a40

SHA256
9aeae9dcf1323618cb68b1bc353d1ca40f16cafc4697f736ac74afa75072ef2b

SHA512
046faa23411d4e5ea3e19a7ff6d31512cdea213b50d40351e4d8e151ddfe7847ef93c9afb172ddef465d1920b28b9260bb6c7bfdbdd32eb0ca3f3567deabd10c

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
77KB

MD5
05cd3800c8a586175391be743a381a89

SHA1
05d4df005405ddbe8cea0cb6c14a23e1038be7bf

SHA256
2f6658d896bfa2d8f4e86341b6b3d5d7db56dba573a47d90d71c995d173265c2

SHA512
17882f7cf04ef7d48836830e445f6174451701916f7d37ae32b86c689663f5854964937f9a8c6e4ff632ca4a0ffe5861305dff4c06d33de8d18be25f7fb2328b

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
75KB

MD5
c87c28758005d04d8dc9c14684c39fa6

SHA1
78166f76949518b447e1b0c5f184754b5a38ef57

SHA256
3c7bc34013b0577d11b25f2c79ba58953c0f1f1341eb2490c9e949a58c583830

SHA512
3945461da6f2e368a99ddaaae3f190de8e1c49e055ed4dcad47692f646f2ba14a957caa7c20d295d160515de1b34663ba6bb639baffcd175b29e7a7616de37a6

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
82KB

MD5
ecffe45675a15b08caea2600b8f4edf7

SHA1
b7d0b825f8492751d4b4f413291cd4103b323bbc

SHA256
cea239b3f6933d430b9c1cc7eeb7f1f3942c019c512668dcf9eb93c899ccbc65

SHA512
acd858e12c538b1509937db597c3d8a2b70cf9080a0e83148fde208ddfa70a88b698e1f20065f5ab168d81641313f30858bd0cc845577ad59ca4dec353cce846

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
76KB

MD5
c214c0393cb84c5b7fcaaa7bd28ee9f3

SHA1
e21f43c5983b52c967862522d10d4357dc67f268

SHA256
d31f99e412bf9fc114a00e80b841a97867e6f1bbb967ea5d45a77739b80999a2

SHA512
f93b94d2891b6a91980dc0dbc450568d94a24aff557ec6c76839f034abe48812a3524d5ed1b4209e6e2a5d3f168a5b78a5b89e77fe48e0cf50225cc3d863e876

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
77KB

MD5
f22bde5cca37e229f72b80a02d43e96b

SHA1
46b0803f5e4ed76ace356292e83ca86f1b75979d

SHA256
967dbc781df1dc04e14e5e56aa55587edc85502ad8e0a2dc8be7e66b4400c80a

SHA512
dfcb11e1476c01ce81c7fc600e3386c71b5726efaa251fe507c5dca2d7e4bc6c57a4e4baaa2968059eb8165ccff28adada2091a6e6221f7e6ab02e7245195bb9

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
75KB

MD5
0bfbc273357441b0e202cae45f67d492

SHA1
031b88f3c046158ba6ec956f0682eac7e1ec133f

SHA256
fde4747f9edaef1fd92afdb27fc2fa5b3d6c6c4f6d720541d4298e0c3ec7444c

SHA512
a742d090bd6c84270ccc7623d3d4533d8dffcfe82a01e7e3ede98fdef8453d9867395250cf7ce14d7212b3f0310d45ee42831aafbd440d01abfc750a5544f386

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
79KB

MD5
7d061e0febee498bb50d9531f7b631bc

SHA1
1bedc7669394854feaeb16c61cf0669e1108b43a

SHA256
5a9ac4a409a8401d3213b79f3596ad1c79c6e5fe814a0350f1ea93fad3b7c6ff

SHA512
d66d0ea654e5e1c2e4c7ac0bf8db324e23fbf436b623558311966c297fc13cdde3ecd25ea04ac124790e54171a6c2223bee46304c35fed15c0fb863f0b5a1b0e

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
78KB

MD5
aa029c6bfaded8db69fd5b6c424ff007

SHA1
b7134eba024ae31a94ef0908acf0fef22757fe0b

SHA256
48fda955391aebacdd46f5feaf2a84605447b2b6f33bec0ff8493591f35ca38d

SHA512
b4677799ac8bd1104b191a034ad11e7731d0df0f8b5e5a6df0aa92a0e9fb33034ee6041f7756298d8f97300e4671772e14f46f5fdf96dd208b6f8de607c51099

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
81KB

MD5
414986eefc34e7329e2fa2c10514fd59

SHA1
306c325605008130a511a161e33ebbba07781328

SHA256
df16913038213033bfd96d4de8c7e2a70de5a99cb313494ab5ae68d94a7baec6

SHA512
303d427b47ee0a9995b9422af15a5ba85d3367ae063fd69bfa62a710472ba829f68653558d5a013afe654d317f4d744a7ded2673826b8f41e4434868d4488586

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
77KB

MD5
76882f47bb216ae464f97f6fb567bba6

SHA1
c6e50b595c420414c0879586099c102a2175c232

SHA256
9fd197db28107372992150695d3df6f0b53dc10ef0a3b1cf74be0c0b6251b43b

SHA512
198a87ade304a6a10053159467d3fed50f82e2e9119894c7306e0b8633ecb8f15394a1dbbdd9c15687acbb1445f60226e9e0d3ce30d0ca4bad0b1e3bc3284250

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
77KB

MD5
e5757cd3afabd162f225c6a817c673e3

SHA1
dc9e235900fb990ae7200bd19622a25838c2c171

SHA256
31bd702fa82f1af160ed258542e557bdcfe436c641d8ba158c4ef9d7b6dc0693

SHA512
0307052069894be635a50617053fc83316090e19d34d8c8319e8665dcf1a0aee688e7a849560cbe18f47fe3abae4fea08a6a81f8cb9ed2aa6243f67e77dd9c6a

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
80KB

MD5
1937b5aebc4301d161b18f01953ec5e1

SHA1
91ea84bfed9a9e45689e7fb4abb4cda71a96da80

SHA256
bd4db91a5d0790a9eea244e50950136cce784edcb06bd6c561663bccca7ea640

SHA512
424a4a0edcebec2f301da6dd6a2a5ac1d269b2524017c1ab6537a77fae17607217a39c2a44463f69c24c46b1b7149ca9d27ac40511f4ba77138eaddd106f3308

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
86KB

MD5
813729cf35d1661482c2ae1f7ff04e55

SHA1
4de36385590432dcc7be42982e5d0c126a03a606

SHA256
cda2d50e3360b34a6a21fd49399f772c5c67daeb86ac60a02465a5c4782e7c54

SHA512
2604c6ab089b47f161d6638c47ccc9e38d7a69f7b7c6e08f3e088e241ff424f4ffa1fd389d76c4fde752d0c1a4da0ccafdcc326c8ca7aad48f8bfbf22a046ec4

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
76KB

MD5
affd11f27033b585667be35f638679ce

SHA1
63f56b0071a9622bde7ff60144ebb2f0fcdb8275

SHA256
6e926da2895b0449058867fb87ff1935c88267f54e33b717f4e408b8a39a2785

SHA512
93e57ba924dae3618c135f36b18fc15ff7961a98f6921e4387e9aadc0c358ccff86903b88e1e41e5f3de580e36dd41d7b6da45c4b9a60f9eab4be3d087e974c9

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
68KB

MD5
7c45a7f0cedd54211e0498b3c2039d5b

SHA1
1bd33b53fe4084de6861b28ba0f1780b4408d453

SHA256
aadad6e81f52efe75ce2e016c64570082f5035eae1a86673ccda7df615e6135a

SHA512
c4e5b205cd3f2f4dcb73028786b12924b5fae7b7b72e0813f90f13803a078ecfe5dde27083bfda88280e409358b6ccf326edb890e7e2955ded15f34a118b9748

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
78KB

MD5
fbff0cb953b58a7f279439a9e7679d53

SHA1
45e82f7f52069859c55c43922bf0a7a3d5d0c8ce

SHA256
49ddac582846c69ac5bf9cac3068eece32290bbf64811b596c6a6c46f5ee51c1

SHA512
d307dd329ffd0e3f56a6008f103c24db21ca7d1a7c2f996450731b1c5a68c940c634a6f3c9c7853cf1896dd2e83dd110dfad27f99e98a37e15b89f898af5c298

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
78KB

MD5
9298f2888c545382ab1022c0f630a24f

SHA1
763261a6faeb7761737dac13439085653d3fa371

SHA256
2738f8870402133b1901cd703268c4f9b814ea6b557895a2bc501b3918ee48e2

SHA512
e15c0d1a5c7e12034b75ffebf59af30c27f9f91984632e647e06259ea922e59ac0298f54453e6f34e38f90c29f4505e0293548d446cde5feb62442aee55c8868

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
74KB

MD5
19dd00c56413b28e0f22f41c47b78ce3

SHA1
093c7cd7184960b5a72fe6bfb08cd67930da770c

SHA256
320be9bb2e94d67eb2f862a1e844a6d58a72a9a72c3e6dc042f08bb2c1039b31

SHA512
be194d1ee6b52300a75c078f74b8780612988f1dcbbec0ed4a0662cb4dadd843b005134df527dfeb09be357a049f295779baa1699f53c3387317d4f72760c8df

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
76KB

MD5
7ab1ecd574fe5a2bb48db52728336caf

SHA1
6eff28e736787f78d08bdb58dbdd1992d40c231d

SHA256
3c1c536a15f9a455f836a4d4ede790d1f3c9767e965b8cdb374b6c12b8150a34

SHA512
d870e3e1da66a43f92d1238efc5ba9e3237744b3ad973596ddd0793fa05dd8e1297129f587b736f18e660cec419e2e7b06931090e6077055b17ef50b9a3fd80e

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
76KB

MD5
7e959159fb094bacdd594545ccba17cb

SHA1
7498b5a8d6daae9396d43b24a3dce1fa98c0baa1

SHA256
06606a6a71291c9c95df5061573f9f0fdd64f8bdfa1de0e77c47c7b8c124af84

SHA512
48550987d4b841558c5cae396f2b4f8b78ab8a9057a61e6a497508f65cc5dc0a17cbd7177e3fe6ba9aa9f3e85a6adf1a28414817edbbab7252571e6a1c3332a0

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
68KB

MD5
536d5cfd75f43add62c3c3c22eef4429

SHA1
dac5249f870e1ea9650483189b7261a04a2075e1

SHA256
4939145119bc1880187e7baa89bc264d27b6faa8aba2b58fdc26234ed9cfad55

SHA512
4e8d88a8a4a1656a1af3e996225d6032581e2c0a01f51e818bf91625f04fa70efd28916e1b39066f07252fcfea6d72e5198c20cc4a9ad93dbc2b051fa5bf3616

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
76KB

MD5
11c4b784ab0bbabae608bad5252239de

SHA1
eff9029c56560ac1b509ad45cd7129dc5e560dcd

SHA256
832c557a747b6864d498d2ba2cc5a9a472f4df739df601cacb9992a580ad4d7a

SHA512
0a1df7221b96b2b574b0e76ae00bcfb0b3f2f0b665fea803a74a2b8fe1ca8390e7e5b14a7444601bfda32ed835c346282db58eae125f8b1320f7927096133500

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
73KB

MD5
d564eddab2ed751adb764cc6f6927f85

SHA1
881df93db8f1e0ff3ef564f7a0f7456e9c955074

SHA256
e71df3ef5a3d643b5b9e3d5f26593af8277348e988e969157a88ecedae298e45

SHA512
1008ecbe3124328639d41f1feb299b0ce0043aef4f89c415549c5eda77aff46df1ad20c7dc187fa267c5788e8f4423b7ae7130ab86ab5ab07f813710fad4e427

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
68KB

MD5
220111531a1eed51cd8871130ce9682e

SHA1
c8861eed2976b560d68a535909a898b7b6722b66

SHA256
54ea126520a9bc4c4f0cb7fc349bf8cf36b63cf2ddc3782f4b9ebbfa2aa0e2ec

SHA512
2bde5ed7c0f4650b48be45bb061e088cb370890789714bfed9aed8431ad883e6add2659b6642470d21ddddd1f2c97a3008a6660b7d8617c865bb549a0c167327

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
81KB

MD5
360021603e7eb66fbdd308861bd41ad7

SHA1
4c86ad60322de8b05d409f3cb2221cc892e5d2a7

SHA256
061d7a546db5e7e63b9e5d443e5f79af0c8ac13a058e72cffca18bfdc09c2f86

SHA512
d0e6f84b45191141e1ec27f4ca826d3c65ce9dba002c932d54861f820178297109d9746d047c2e05b7a935ea723f65be4253965dd6a414feb1e6371cb60e5f6a

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
78KB

MD5
ee74a3228219dbf0af8d1971a5ee1a41

SHA1
425452171b7012c4ce1eaae6d60c9623bd3c1ff3

SHA256
48b88825b6d951516ba3fcdba3ab886b86cda22a122c257f3a89e9c39404adad

SHA512
21cbfd12b636efc237699c4463aae333a01022cff4d61b6d83baa60214629b157040456e65e3983a7bbc3f8ea0010236d595cfa04d037f56f55dc13e71e315c2

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
74KB

MD5
3e788f3f87b449cf5e2091e7a84811c0

SHA1
d9c8db1225d94be2a88fa7d96c54ad6a838aedce

SHA256
495955c73263003405a879e21df33362b6740351f7dc0b8b61cd054c504f16da

SHA512
1aa1a3fdff8b800f442c7b351361a5567ef4c93677493e045f09c783a3f545f6eb3b347350fd1f46a93c5d924d838860f7d765b391886d6d46b2bbb60d0ffff1

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp

Filesize
86KB

MD5
5681616f490b3c7aba43ee9afdb6ce0d

SHA1
9d8ee9aa8302f11e45ef2ff6505de7777bb64acf

SHA256
dd4e5c20fe650f35b297ca9d3a4d90afe42537f0b0705772ad812e97aff496c7

SHA512
9587b0d49b80920a2b7aa06bddf7dd6ff663d95202eb624aef074c1dbba4d14d1a861da484afc63a53f982a46ce203f6bfeee827e9e54ccc85e2652608ac586f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_08 - Homegroup.lnk.exe

Filesize
68KB

MD5
fbf2b8d2823eb72c4620acc2fb2f077d

SHA1
d3bcb24dfbf915a8c506f13c44d5f75372e6dbf9

SHA256
0d3b395ec265ffaf359b86c39003dda08376530405443fffa68937b79cddc648

SHA512
d277ad5eab7972e5721688073c45ed4c6ed4ed63eef0d0f0be4aa6310f32da8b6ce63c8843c43468d7c60fc878479c53e1b2ac9a253e04a812edadba72c7eaf7

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
68KB

MD5
faf0a269656aeaf3f4871d3ddd6c7098

SHA1
a3fa520675603102f75ff149d6ef82143a59b4b3

SHA256
b88434ffdaa79a1fa70d55da66994b29eb941b16abba536a41f98e3aecde06c0

SHA512
4dc1a70fc41976146f5d00befa3207172878adb7c7ed4a145505b75a2e0fef455d244976917941dfa98f513620cad554c54998735d2b59c3baf4e13ae52c721a

Download Submit