4488329d770ff27bcd4adaf921e973bbd2b566f6ad1f22d335c20af79bb59b6b

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 06:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

26d6c7132a3d23c3053820ce34460720N.exe
Size

86KB
MD5

26d6c7132a3d23c3053820ce34460720
SHA1

bf8dd862946d0169b9ea4ce7782b3efb1fecb243
SHA256

4488329d770ff27bcd4adaf921e973bbd2b566f6ad1f22d335c20af79bb59b6b
SHA512

274b47cc8599d486cf37703d33679795dc03632bc6247dcf2b39f175b70bb5672a57c73b1636709b0ffc05b478385c8ea32bf1b1b08fae01487970b492e5c4f8
SSDEEP

1536:W7ZppApBULcfpHLcfpyDuCQCi7ZppApBULcfpHLcfpyDuCQC1:6pWpBwchcwDgpWpBwchcwDb

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4829) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4424	_desktop.ini.exe
5004	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	26d6c7132a3d23c3053820ce34460720N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	26d6c7132a3d23c3053820ce34460720N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png.exe.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.exe.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	26d6c7132a3d23c3053820ce34460720N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_desktop.ini.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 4424	556	26d6c7132a3d23c3053820ce34460720N.exe	84
PID 556 wrote to memory of 4424	556	26d6c7132a3d23c3053820ce34460720N.exe	84
PID 556 wrote to memory of 4424	556	26d6c7132a3d23c3053820ce34460720N.exe	84
PID 556 wrote to memory of 5004	556	26d6c7132a3d23c3053820ce34460720N.exe	85
PID 556 wrote to memory of 5004	556	26d6c7132a3d23c3053820ce34460720N.exe	85
PID 556 wrote to memory of 5004	556	26d6c7132a3d23c3053820ce34460720N.exe	85

C:\Users\Admin\AppData\Local\Temp\26d6c7132a3d23c3053820ce34460720N.exe
"C:\Users\Admin\AppData\Local\Temp\26d6c7132a3d23c3053820ce34460720N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:556
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4424
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
43KB

MD5
23d29f329b1052b636fbea1c1bab25d7

SHA1
a3a4b0dd1a9a03e41239dd1dae3bc688f6cbe954

SHA256
89e8dfd7fb289c68784cce9533e15bb28fdccabe24247bb2141fe9f04a53e377

SHA512
87e3c87bd74cd04668160da07bba04f81e197cebe3fbb7ad5d17180c2a4f8fab26b2e42de5afe8d88bbd0b4fbefe59e6d4df8db8d036b9c98fa1f841356ebc6b

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
156KB

MD5
251178c5f8ba107281dbe67d48b7de0f

SHA1
59a993fa9aa799f39eade97f451c8ffeab2bd84f

SHA256
2095be6e8ddf56863c4a6b9d51b2b33eef7cfb56e6a999ef2801cfb7ea77f904

SHA512
2567c47edf26b3c57bb2d0783b83a028f4b44b7ecd5070a50dcc403e92dd78e04d9123b0db587c8a4b98ed133e0dc9cfb9ad51789f38998ba74b20f894d7fa48

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
142KB

MD5
8b8fdbdb294fb8d30fc4eebe9917b302

SHA1
4bd4b267bb37aa7f434fb7b5808452ae9f6bc7e8

SHA256
6cf49a009144a2844cedca41d950185745225cd8b835aa7c52654135c44a45d8

SHA512
e11ba512de41301ccbae2effb8cb3c95b8de00f2521672a93382ca54f129d856f192d22a8c4033fb3c14018c6fb6e9cac4ed985e377456cfc1ae9ca84a3174af

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
680KB

MD5
272278723171289b3ff4089924ec83fb

SHA1
e87c9caf60ce584e60f566431bc095a68257095b

SHA256
1333a5043aba15bdc5c15545db987baba9daee8414fb86f956b3ff6f1dc71480

SHA512
d68bbbe9f3d95153610fb2d155fb14f4ce25806790304740938e9b5a1b470539624dd6a97484db1478ec970e43a0543d181b976fab3ebd50e216ea5a3e0c7c58

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
91d2abed2deb4b93a3141a17cc2b9867

SHA1
d7311740841a0641d9f85e02090383b74a91dc32

SHA256
1ccdb6119ddafc67c3224c5aef90b1e626b8ad7827df0cef1d466a907f3ff9fe

SHA512
cc689dd7b0915eeb8148c8d0da8ad7ebaba63c46178f8ac765b5b132ff01a98ef20afbec033ee22fb09338eb51734d457c92a3746e730450cf9a0020120318df

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
587KB

MD5
10615b1c54a1a116391a19f970092cc3

SHA1
d778a626e3bc473a334137b36e2068d44d854b79

SHA256
064747d785652eb2aef997cd6af74ea502fe2106d596dda12183c10525a54b3b

SHA512
2bd4704243dbccd0913b3a0322ddf5487314e26bdb867eaa802e37d100f30139c1d4a5f56b9c67d2346f330e92e177472dfc12e4c10c5264c70bb495a058c8eb

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
253KB

MD5
d5e41ec00fff929ca21e23a04b58847e

SHA1
12ae4485941c5684f77cbaa8ac7f94601ea89de7

SHA256
c7f2ccbbf2ef31e1bd35ef5ef22d840903c6ba3e5bf24c5e119a3d9c20a2e48a

SHA512
1b3a080464869d28223ab48cb23c7f0bcf34bd041eae45d439b1bf25c8479ef55119000ad2876043f2433499ade308b41c4da2f8d3c0f2125605f1e678517d1a

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
232KB

MD5
04bd81ffb9f812a7705960408dee3b09

SHA1
b7dd510c15eacadae5a19407350d02b4a581822a

SHA256
0f453779b958d1d7aadc7f7a170d0f84433f80853f6dc8872d3cdd471167f7e9

SHA512
c3127caaee342cb053ee8e8d8106f58829227700b6eb3fea3d356f88460bbe8d57185c2666ebb6e71ca3e90a4b8580fb6115838f3673669c99475ef34a7965b5

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
974KB

MD5
9710874c3ac055c749247a8076cb8b12

SHA1
b92cc345ff0dd28d950ca916a3dbe19167df92fe

SHA256
52cdf3cc601015cdd75dbfed327f3ef582bf06201cbc4fcee79879d828938e2e

SHA512
601fd50e268b5a98b0625389a1890fa59c4f901d81950f1ddd5e5a074fcc43c53da7ae5b8cff7ce9a93c5782b02d8ecdb4c70e857e94dd79e14eea2f6a670c5f

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
727KB

MD5
7e9b7f13cfc7c3899ec985abcdbd34c9

SHA1
5ce38ccba337ffd94b379375db3f73041b25e5cf

SHA256
bdd949ee52c78ac509d2598e9b12357403499c1cd8bdbb877b62b1531bddb4ab

SHA512
fcff606f7f9d7be4c264986dbb87dc27a094f3bedf866c0b3f398e46b156dd658a77797ff9fd849ae91585c185948fa761ca6e5eed6a84a1744ef130394b01e8

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
100KB

MD5
8432d376b4ecc3414e0f149e9bfd27e8

SHA1
a530deb4ce65cfb985d6dd0e1b964b67e4eca0d9

SHA256
3296969b314246d8fbd959e64c9024f5249e7498bbae108c6767138513a1039e

SHA512
f8e600d654d923e303ec58fefc85423897a10edbaa5f1c936cba226b59fe3edb3870941a828a1e8d240009ee8003a4280481e865d77aa5b7a2f53f95d7eb38e9

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
52KB

MD5
0cd70fb628f5269f70641c31569c9d8c

SHA1
665e2df6a4bf67725de402f2b90464bc7d3fcac3

SHA256
dc19287df440b497d9a2ab9b3bee1f179052637d2136cf428e6cb9b00378a16e

SHA512
bb021ad56153495ce27b5f0e7d2e8a3f2026c02b2d268cce35baaf6b217970e4b8754cc74a4b7a818ebd65481ffcdee9bb02f4ea3905acfd6ef38669f356cdad

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
50KB

MD5
8201e5cd2865902f41ec5f2c2009341e

SHA1
c40ef5715658ce81c52835ceb971ac09bc1cb6b5

SHA256
87483afad0892f4ba3eec69ae7166a769412dfbc99884b3bae977fb66acefb9a

SHA512
ae0726ba36ff5bc3d1159e4e2ad4cb87cd565d44be5f8239569976a6afe26042ee6e9203ddb137c8a25552f71ce713cefe9b7ef61a9caada24cfb2379f6c2445

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.exe

Filesize
55KB

MD5
368b4fe8c97a667173502ec74bb7038b

SHA1
3f89cf7a2aaa14cf7f8bda8a0eb9f1b108642bd4

SHA256
6cadd06f19e55976b46f2d7de2e5f8006582c64bf1bb31ff5eed9ce0c4ae5c84

SHA512
0774ccd779eada86bbd26ea0d616da1bacf29e056332b3e1edc9187e42c1b5f85844b6371b42e801fd20e964735b8bc6ae6bd55b28e685692c2208f6ce3d4844

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
43KB

MD5
ccb00e42a338eaea2175f7f4af3e68ab

SHA1
5be6bc50a30139520084d0a310f31da8f001133c

SHA256
80aa36add096eb7cc955c39d7c498dfc19ad215cd9714b688a79343d74f24b47

SHA512
c11a5c57baeddbeae5495ed0c4bc2ec4e73b9942a370edc2128fe1ae8fcc749ded68472a13d3ce11fce85aae6be1f2e0ce8b1dba97c53563519824c233b26fd1

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
59KB

MD5
3cd27e6e46aed3a37612df2d6ec1806f

SHA1
b524a49ec15390171f6bf84445184658c71925f1

SHA256
da2ee2d8d933e7c69e6bd46ed73a2b194e769566197e1d3073eb49feb7fef1a1

SHA512
7bcc57340e3ba0c3c7a5fff290d5cfa86e7732553cdcf9d243ef6d72f93aac441e8a471c7df9ea001b8365c685cda58ce2c655a6eb8ba389aec3956fe806d4e2

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
50KB

MD5
45daecb1d60f56c36c0b799d04090dc5

SHA1
e91343b86a987dbfedd99c401c9f1398b02da6a2

SHA256
bbbb2c9adfe572479b78fd5484859245b080fa57f81e28a68f0cd680215b105e

SHA512
2ca1de7abd13206c62e3b8f15760c0ed7b4beafd3c9dac3f4fa257d098883bbdaf2339b6e967115bfdacb9b47a4d1fc10857ba25d20663eac21a7ca3bd794ab8

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
52KB

MD5
4d1a0c1968174339dc0fc83633e6b40b

SHA1
b4cd4ff2f34408ac816bdbe7d6c525e66a30a942

SHA256
0d0e7e8525f0a3204f23341a4319495d9360cc3db35fbfe331fd668515d39dde

SHA512
3bf531bca80c258f2b38cbfa13459e5d47072a3d5980a4d82857ab29765d1190c6fda9526fb65b9918e7e3bd64ef685ff07800b3a637b51b22761e335cd7b9ba

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
40KB

MD5
cc1867fdf54b43f17fda8ca9bb40e6a0

SHA1
d0ad9dd123a4c0fa54f528fd2530027a4bc0bde0

SHA256
f3169c0940a989a378b321edb6705951f88f8f8b2671a73745b77385ece0a6bf

SHA512
07c53b124e74e62a06ffc8d27e2cfeae79756b7433242b7a0bd9af3268e1388597784e36af079358759f5511d603194d86621849c4515ffbeb26f85fbb251514

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
49KB

MD5
3dfa221ff43fa8849caa825195d34a29

SHA1
4ec5b64f29596cd7a9442752a5b53ee58436a755

SHA256
bb3633090b860842ed66c4aff38052a87cf2ea8a6fb0dda57e682060f699cae9

SHA512
6ff2269aff24282ae0e0685a67cae1c304b81312f7fdbe90b5393d21317a8a598778a99b9b571a1a57f1a3d884d8b9e79366608e7939630f0a1a2676d4b24b7d

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
52KB

MD5
360c5f48ccb2f4bdd25c389c06446113

SHA1
a3d0bfdc3ec755e21c327875d994e5e1d8c335ee

SHA256
371ab50389c81cd1ee897d3b3be99f51f5e2938ba9d3bd4cf3195920c19a87f9

SHA512
b79a0d0b7c97cfe78af40d4c571d7967d9c0cd89905f2776dbbb643464f762b7ceb1f4804977bffe6ab031d8e809807b67807009f45dcb7975f58b3351af5b06

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
61KB

MD5
661420a1f2e72b7966874a25bce98879

SHA1
68d0304c6fd33540f2a2cd6a0bfebc34d6119e14

SHA256
8a6b7e5a5269a359d0932554011673973edc77c42972ed319d061c52c0f0571a

SHA512
d03f493c889a987a360bff514a5496647c17729245ce32dbaf583ae86687fc2c332705e663130e31efeee35b47a32102b4f07cf0c4811b082b324b95ed0c29b7

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
54KB

MD5
b8ce267b29ae83a4f0a6ddc7c29e4cb1

SHA1
a719f08249a9f8b717bc40c2ba86d84b0b76a9be

SHA256
c62b2af0714db78e1d725f5e7ea528cd2e9f32f9e0fd0b39763feb60706af5bc

SHA512
c686586b1c3f61c23aa03a965bfb0a84844f8953949c7df07c9fb7c7cf3da9fa54d9c0cb82e33d3fcebf52a7df4daa002cd9e7cfff14d738f68b04b146c91211

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
52KB

MD5
38339a4b1b7bd0f031db0e84015c18ec

SHA1
1df986ac493f880944f38ae49ea32b5cad66f8dd

SHA256
43dcdd2785fe87e6822906629118b2d29cb8a9617189bc759173c019120770e2

SHA512
0581a4ccca7618be8aa8b8337eb1b0fc76d59b8766bd9817efb1d40f9ad813031c9bcc80a01ea2a86247a4f4043d5c833c65fea8af23222eec554dec2d9c43b5

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
56KB

MD5
5cbd31325313478dc9f7a7ad3097db76

SHA1
dd04c4ab4ad761041e8a2002cced70a8136dd001

SHA256
d2879c906e34fa91582ec4eb6823d5e5205dfffbea6214c8f9ff145a6b200069

SHA512
7f29a5dce0612505a2f69bdce9f3c55a408678fc8b07b809bac2a90161d4796621f5cd2b6fb10042597e9151c39955bdb329bfd2b05ad1770b61f88897040a42

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
36KB

MD5
a03209b6ba62eaa416c9f5f622f471c8

SHA1
14829287de5e5b9d6c04c8464e2a2b314bc215d8

SHA256
0de1d6ee2f76fb8fa777000adedf31d2a1406ab35fd5ef0dd7f564333f5139da

SHA512
6ebd63b450692c7e6ca7dec7ba2d5f6993069e56516699e887bdfbb4a6c10a31d61a20e8710e5093e91ba6339c5ff039cd573b2feee7723156559abe256b7622

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
43KB

MD5
4ac2a25b6dc122462d70db0f593f8b8f

SHA1
2fb37b4355985608eb17c66ec011d6512a4f8e97

SHA256
75db1e30e15634f17d5a58dbe418f4428c0448be17f123311b95317d4057b585

SHA512
95bd66b8f6aa1426da8712f93f991145bc6435969000c083d73f39ec0f9a0143b8cf10e86e1787f831191e2bde82376b5d2de7cf977543b1ea628e5f0bf5484e

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
51KB

MD5
dda668a54b78c9bfed97dd0c0df78cc3

SHA1
8e0d8dd01fa2e63b5e0d947ba67d7790eb3d34b0

SHA256
9938a7f2acc76c54fd87cfe313467b56e1d893ec2ab4a745900947dc5d33d9a4

SHA512
e6a1a86a4c6791507a77d5932f7ac0b8f6ca309a07690c3da96221463d30d1d0f90452567c6a80b0093923339524df47ca7aae741810b887e4be32adead17d52

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
53KB

MD5
84298a045400ea8486eb16610ba85b7d

SHA1
0edee3a08fde41fdf54eb0aede799b9c38c5b305

SHA256
e4cdc73822acf4d4a8e3156e4f56b2ea0841d94dc0065e9eac33318070631e74

SHA512
cfdd69cc306d7e7731cda5afdd170ebaa97f401d672eff9e3343d1d7ca4a3aad507082e200a271bfd11fe0c00aec914605d439a65ce0df84e0d3ac1624f02c88

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
51KB

MD5
5443bfbc7f50d09c2faa9296ff531662

SHA1
90ef9489f777b6cf65e5c64411439d3967107649

SHA256
f0b08875312eac7e38f32becce0b1ee09a18c7049b9bfa18e7625f2ae585926f

SHA512
bde36cfb80c3621901911a78cfbf83ce28f753e7e22dcb57df0f44b199c6d3a04619474ba13b9ddb4412486054ffbf6aa6fa32e85ece7071c01b5e44878a9329

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
51KB

MD5
4643104d5e82439e6e941ad004fc532b

SHA1
bd39b4d11fd82cf1ad1b6470330ed0db78f01ca3

SHA256
79f678ddc8951c4121b1af5adeb5212a19249e5fbd15b4c04640f67a16877f37

SHA512
72a2245cf6d7b77aa8708c1840ee9537826f7daa59b1ee8d2a8cafca908bbe935347cbe64b767f4fd7c1bd3a219aa6fc8aeef510f867e887223f6f1656c2683d

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
52KB

MD5
099397e42214b7f5289379311aa21fc5

SHA1
71cdad7ed9881e1c9f05ef8fcec626ecd47b1ffc

SHA256
ed7c3d5e1014d2b4a5f4a808466e87f3c3ead2ae262897b970f0bd9a49d5d248

SHA512
f97e6ddc72b470e479395a42de119c0379152317b40ac82b39c3c15ba0602056915536aa7eed9418947d02abb0e32c2d19d2360890fbd6ffbe492481e260a4c1

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
54KB

MD5
2ad02c588c859a3c90b8b001ebe32584

SHA1
596225b596f0fe7859976cf8b609c9610a8fa02b

SHA256
ff59698be3969955cd59f3fbeb4950c4ccbfe6e98f55326c6c17c32a6de357a1

SHA512
43a63d9b2437a06410bd4b738c09ef4cff39cd3ba7890b5505be844730c7b7aebcecb36c73c0681b933d5fddf859bec240643b750e6eeb5ccbb8680e37f33910

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
55KB

MD5
d08baeccb1f3ab00c9414c157f69e917

SHA1
333ea8785a8fd9f26b5b05f3725d71f3ad96d523

SHA256
efa4e4505917626edf60b4d3449960fe47ab3ae8d6c67dd3e895d60923fd4a87

SHA512
679d16981dfcad344c3dc696ada9561490d121e6288357b85c90bb7485f34b5a42f548b625b5f0a93031a56277f7095be42f7397895478aeb6e3b6cdc663e953

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
43KB

MD5
eb305a18fa1c30f5d16490a8e2580710

SHA1
855c089cf67c8718ce70c5c57fb9f6a7aa9171ea

SHA256
0d566dbe619a72e8f92fd1c7084c7e635cb5b4b72cd5077f05b784c0bde2e57b

SHA512
3913b141b9f1eeee241d8f784853e2a3ec7a7d1504e16fecd1c965d9dca296fb3599df961c5dda49e6b08f65ac3094c0fcc43b214385957c08aa9684a765edbf

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
52KB

MD5
b86dbc0f4b40d9cdf20799df2044958c

SHA1
c905e4d101d31d1727e689ddaea0843a3b91a277

SHA256
d6d2849e8b384912f2b5502793fecb019064dd7d891d74ea3d1cc8ced245f4ef

SHA512
a4ff09c2456598a56a671c4104adf75740dc2b7c5f4f16af62958f22882a68fb67a9ed52e097f8dda86fcc243e9d69997e8a67d5a646ad772bc97f20a72df161

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
63KB

MD5
6954e29ac3742a5fa413c5c12e7604c4

SHA1
f65b349939367a9d916bc9f2d7488716a2a8d213

SHA256
1ffbc213d1e7cd573bcde8f5eebc3f916c899a69f2b58e8cfbc91ccea241b2c0

SHA512
72bdb5ced0a669b7387c4621366d8c7f96463044cbb41d811910d78c30424e5f4520c30b3886ecc750357d15f43730886084c27ffaf20ba8c8af4f5aaf8a84d2

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
64KB

MD5
d65937862a3770edef16041a48f1deaa

SHA1
7b7b990d52d61df4408ddc364dac3797b1950979

SHA256
93ac2fec45f4dcad812915917a7d4f282c34ff18814b0c618996716e137cc409

SHA512
1ad492cab13e9af5daa629973815e481029bd93e1b28f40116a36f626be81f85d446a9db28d5059459badbb5a9ed5fbaf9ceea4a41ecf7f71a499608ef00bb1a

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
54KB

MD5
fdcc0549e3043a84263f5b218e2b0774

SHA1
a38db75a11e850e5b8318ae3fd0b82bd31844590

SHA256
b96b46008b7d12002fd2b1f39c436af83ebb41c0267b318ecbbadc81258519b4

SHA512
ac629496ffd56d8eace40b5e9d9b96f98578a684b0c858521ae5014fd64f5fa10f901868a33d41459062a787891cad71aaa728f427ae8448e7c68e71d1011641

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
48KB

MD5
592fa0509e6ec667e04c5ba0920c7bf7

SHA1
47e54c70aa08355999ec077b21e2a86f8a4aab97

SHA256
32ef56831adc26184c090e84aeb33d11e8009c047264d734e78ceb1152075c93

SHA512
4ec985255140cd0e99a4c86f10ef8fa0e09e77d934bb4b5f474a9cb06f330375a8fc421f6ea4e4ad439c6b6a6c2403350907959ce013dafeb721045992856f9d

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
43KB

MD5
12a381f6ade7dc2ae5382db3b33e2587

SHA1
603666412bd1e9d1c20b7d2b7f7fa7e198f23baf

SHA256
d8060928b2d31c54b85c68f24f3a8c6fddcfe8e5c8f64fc3c5c54f023a65300f

SHA512
e3c5f42382c15b4c65bad6560fac47617be7722ccbc20910d4eb091b595585e5998a4a77221562e0d21854b009733cf90ba956a13a95ecbb2bfd1a1ceb199743

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
52KB

MD5
30ca7c00bf1ced5eb689ce4270522bfc

SHA1
f6e6423483a03285cb4e7cc7596a5d2574aae643

SHA256
151249a2488b6d347853e98458dc90dcb8edb98fa462c8356890915a5bbabfba

SHA512
69ef63b489811d7ef56ef568312916da33844efe9f69738a6c5a21ec00087f54b47f41d788b3c5f12bdbfc1df00b21f73efd5a162ab57532e23a812fe4d66297

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
52KB

MD5
c47894f94f73379ed01bae9358f4f3ea

SHA1
0d20f1a94a80c2dabc1e974f1ffb7fc824490512

SHA256
0b78cb4f22f40d29ba4b6784895fe08d440da2083a9095634da1807facf0d7f4

SHA512
35a7e2a3879075e73cbd087c381d7010fe815421042aafa0347494ff61f085673fba2eb9e8a9c2856bdac4d1ef914495c5aaa05779b620b1282047ec35a8e4c0

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
52KB

MD5
49e955ddb7d751dead9748671b37fac9

SHA1
3a36cb542790d27c8b2786f9262fa68e00df0c76

SHA256
d6f6c18c64e30a8c33a316547b0e0770948a187648870e8ec24934977e3661c2

SHA512
c71cb4ff1624f783ab3ae84efc40b8265b1ce23d46eef4c77d2c6675d3bceb99d7552c3819a5ebbef3d3e9cff1e3f8d91b0444e5125fc7769f3809de994c0b78

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
53KB

MD5
4fc36447c793c320b3b021309c7e8061

SHA1
724bcd32af7931190f403a891dcab35ced791dce

SHA256
4b0e3b7c933babade9e96dc3619dfabc4127b9680f41f261a951d4c17dad5164

SHA512
f3e09b0bb06c823a7768fb31ced5a35573be32c42aaa6e414e96f9ff01fe1d89f80f02ed2a6ce3246710910ebca594ae213feea61582ce2dfe31cd28ac3d079d

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
52KB

MD5
e1da0ae170a8b8c876b3ffc0649eb476

SHA1
0972db2e73bc5809f9838cdf4ecaf96bc8ec3e0d

SHA256
b299e92a1a0d7d54e3abe37f60ec205585fa49a87fd516c1a4dbcc61014b642a

SHA512
7ff0376d0cbdd8871b39a13405e3581f72e380c14720d33adcb3787ce36b44bb61928b9a23dd1e0f5c28e27a53d87f64a694cff63fdb24d741ff79c9125bda3f

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
50KB

MD5
3c1dfb5468951f267bdbc52d72f4b2bc

SHA1
690109a26ef2a0d9b275e48f7a944bc9a0b86700

SHA256
a257298f33376487ede80a4d36942ac58b5e63dc01a7aa076f28060ff81d01bf

SHA512
fc68c8424c4d17297c0c73997633a65eb12a17291f0361e5da609e7554ab146a1bb21a841e96f8b35494bc260742099ff8a982095d5a35cf1edfd9b8187db94a

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
58KB

MD5
b48749ebaf06a5e87281cbc266728b71

SHA1
46f3fb23ba54aa5f49edb741fa476686678ef59a

SHA256
d3d94350dcee41a370b041796b18c8c14e9a66cdad7dc6025b1b669eb4b2cece

SHA512
d7fc12e2a2cfb19dbafa9f0382ae2d5bf21ee33eff7cff2284ce8146840e332498259d9fd32140b4532c90df3b4c7cdb189a86f689f8d8320ce3ba8d286ba6ef

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
62KB

MD5
69b947d17ed42725f848f8cce002b597

SHA1
2a7d074a40b9b5008c291c29f167d2db52ab41d0

SHA256
ee9da1e02ef174d1d9cdec31b4ca9034dc892a6c867e33b78c3a8a74a1237c0e

SHA512
f1e28bc6ce1dd75440643f11a53083c12e962cdc8aaeaee697e4dd2a790874d5b69e5ee75762f01b1b6d56aaa6137e8e240ed1500ed02eda178a992e87581f99

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
61KB

MD5
4f25ac3bea138014a38898f5a3339ca3

SHA1
a7415b5b2e2fa0665c21f2517e8a08b0715c7826

SHA256
476929c43fc0833b4398462c9978cb58289467486adedfbc1abef0bb283fbc9c

SHA512
d4bec99a79bd27f224cc7a4906373b5299617d23b9d51ee25c3092f61524cc958cb0cb68139c716cef711bcb5b2cfc3bcdc147440d3dbbb19fa061c978253dbd

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
52KB

MD5
2d34ea642da3934d3c87cc692d79f318

SHA1
49b300031ef6ca2b2134f98cadee5797cf4fd775

SHA256
b25a34905af4e07a46f2bed31df83540f0b69fb1e8daa45c4412fd59166f697b

SHA512
7baf578d93c0eca095a614d48c562ae617a7d0138d5646c6a8bb10410ff9e64391bf2e943ae871132ef0f332dfa2057013d49e5608168c1ff111956bf7589940

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
44KB

MD5
0573ad4fe2908abef76214cec3c2d6f9

SHA1
1d893854a9d7a0a43488f0e0f891cdc4e795f5df

SHA256
df9c3b604ae31a42b02e6ea263cfae276ce0da8e1245be7e07445c3ddf8194c1

SHA512
6e25a1c1a890b93089fad70d9e150f223e3b2517c7fa32f1cc2de6b8632fa33f39295c46d8234c661416d0b9039941d142073fea1665297c6746af2dbbd4733d

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp

Filesize
63KB

MD5
7580b841f7ee1adadeba1a60fe5ceb3f

SHA1
6f444427c5cd4d9208ce5a6b87eb8533b0c7ca84

SHA256
3f5b5d126fd1214ae607527d66f4ccdcac1926cb4d54b0b4c7e612a02e4fde51

SHA512
2f1aef79bafa9893f098a8ad7ee75108de30253e0ed1bbf104921bfae4a07ccbf396c9158fbe3219cfe5ca57872f57c37406fbe9cb3d2bdf7c9405b344e25c4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
43KB

MD5
f50d7f6e0de85dafcee5ecc8f28bcc0d

SHA1
f27dc28b0526941d76c65bd211fbba37c93532f0

SHA256
6e3c88e32c7d98a3b8c0552b78430356317de91bfa1dcf76a455ff1049b65142

SHA512
baa48396f1bff914e7a3f8425937192559619988cd9e6e7c28a9fe89746fd30ae76af03a296ca5ab173b091cefe25193ef6225fd99aa4724d2c5d4a2330a9b2f

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
42KB

MD5
4c21ba217d4d37b1290ce3550ad376bf

SHA1
038443aabe92f22652db5ec6b872cd611b1f1f29

SHA256
8d5c219255e92624b6207dc7f5584eb46eebc3ba2f3898ddee1fba3d1c2d32f5

SHA512
74ddf7d2757f0f15b386c3d3fd7ae76a32da2755dcba577517cbc1e7cca9d542c1f734886913930dc9e59446d6e452779d97619733c179a226f1c995ba7d9b7c

Download Submit