bf23d70eecfa1ccd5b25746456dc8c3e0d02daa4f2555f3531289f851a6a4d35

Analysis

max time kernel
120s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf222a411f0e59c8d89f08e035371ff0N.exe
Size

112KB
MD5

bf222a411f0e59c8d89f08e035371ff0
SHA1

bc2affdf8fccc273556551715d23a9e3b6a804df
SHA256

bf23d70eecfa1ccd5b25746456dc8c3e0d02daa4f2555f3531289f851a6a4d35
SHA512

6b849497c5bf8c3f01e5484958cb404f1135515a60ad0550c4765f62caa4c9d817dacda56449acd3b41f3ba20bcd643e5107f852061ff258ca4fe57dd2a18733
SSDEEP

768:W7BlpppARFbhFAxC7ntkntV/dwks7BlpppARFbhFAxC7ntkntV/dwk8:W7ZppApryzwks7ZppApryzwk8

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4662) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4852	_Policy.vpol.exe
3280	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	bf222a411f0e59c8d89f08e035371ff0N.exe
File created	C:\Windows\SysWOW64\Zombie.exe	bf222a411f0e59c8d89f08e035371ff0N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp	_Policy.vpol.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	_Policy.vpol.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp	_Policy.vpol.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp	_Policy.vpol.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp	_Policy.vpol.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp	_Policy.vpol.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	_Policy.vpol.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp	_Policy.vpol.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp	_Policy.vpol.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml.tmp	_Policy.vpol.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto.tmp	_Policy.vpol.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp	_Policy.vpol.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp	_Policy.vpol.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	_Policy.vpol.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp	_Policy.vpol.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	_Policy.vpol.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_Policy.vpol.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp	_Policy.vpol.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	_Policy.vpol.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	_Policy.vpol.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\libGLESv2.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp	_Policy.vpol.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	_Policy.vpol.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp	_Policy.vpol.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nb.pak.tmp	_Policy.vpol.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp	_Policy.vpol.exe
File created	C:\Program Files\Java\jre-1.8\lib\net.properties.tmp	_Policy.vpol.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	_Policy.vpol.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	_Policy.vpol.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp	_Policy.vpol.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	_Policy.vpol.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp	_Policy.vpol.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	_Policy.vpol.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	_Policy.vpol.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md.exe.tmp	_Policy.vpol.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp	_Policy.vpol.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp	_Policy.vpol.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp	_Policy.vpol.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fil.pak.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp	_Policy.vpol.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_Policy.vpol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bf222a411f0e59c8d89f08e035371ff0N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 4852	1612	bf222a411f0e59c8d89f08e035371ff0N.exe	84
PID 1612 wrote to memory of 4852	1612	bf222a411f0e59c8d89f08e035371ff0N.exe	84
PID 1612 wrote to memory of 4852	1612	bf222a411f0e59c8d89f08e035371ff0N.exe	84
PID 1612 wrote to memory of 3280	1612	bf222a411f0e59c8d89f08e035371ff0N.exe	85
PID 1612 wrote to memory of 3280	1612	bf222a411f0e59c8d89f08e035371ff0N.exe	85
PID 1612 wrote to memory of 3280	1612	bf222a411f0e59c8d89f08e035371ff0N.exe	85

C:\Users\Admin\AppData\Local\Temp\bf222a411f0e59c8d89f08e035371ff0N.exe
"C:\Users\Admin\AppData\Local\Temp\bf222a411f0e59c8d89f08e035371ff0N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\_Policy.vpol.exe
  "_Policy.vpol.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4852
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.exe

Filesize
57KB

MD5
0b2f1ec52aa6509b490d894a5d5c3875

SHA1
47fd305705afaafacfbbbfd9259ae8ea17707d9b

SHA256
8d04393577760505fa11647d593cd9f7c8ce416a99a2cf8ae4c62ef76fc0d7d3

SHA512
c14df1325bfed23258e45cd761248cf9fea3fd4c0d0778e031bb94490e6372d1d877b6d112f125d6b233e60f03a70755b1ff476c41557c04905c9521622aca34

Download Submit
C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.exe.tmp

Filesize
113KB

MD5
cb49823f0a3babbdbf4ef49718ac180a

SHA1
90717595c7eccd4d24ecc7f1a55cb1af330887f6

SHA256
e3e15c7c98dfa4801326feec75b6ebe36460f4b85cb7d65854a46ac97f5ce0d7

SHA512
6a28f77c3c7531e6c279b56a5f157218c7733f4dab3a63cce8a3a4c1c5a068c5cbed54dc999d8b11cd0d869f1feb1a7d07b5325fcefea5d112021d6615ee17d6

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
169KB

MD5
b5edc41d1c146942b1f3753871d12d95

SHA1
27ccb84dc64c254b3f9e36f925e6bfdd0b3221bc

SHA256
4874bb1d206665d569cc6f657786eacf03661f5189869e867369df0f0720a792

SHA512
d853e256088576ad5472ecb3aae43582ee8e7764db06207177f30b216e040fd7ef8e0aad59c77cf063c7484689b684756aacf5c7d2c79f9f2a4abab3152addd1

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
121KB

MD5
b777b1bab654693e045a647383e1a2fd

SHA1
f963055acca2535d526d32691ac384a645131570

SHA256
dc3d8914ba7d711a9a489c6dfa82190b71433943925615dc5ded45058c5e0882

SHA512
06d93a1e2f05d5918d19069fed6be856762b6bbd8e49594d9004493bdeb02dae4ce84686b8d47d25d843cf15945059b5618f1136813d6e42b770af38156ac368

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
4cd77be375012deef4832c4afcd35b2f

SHA1
4e2c0cbd5b930e7bffa5c1bd79e5fcc8ae705230

SHA256
cafa3cb8a650b64f66684bf7f698ff74f3cabf7aa553ebdf3647f058ce5a5d36

SHA512
b712fc1938e0c674267c390a9ce54e60435af93c0669077b4ec04b49e25870ab2ac82dc3cea46d4a38382dcb59c0872cb47d4fc565b5faaaf1d294b9a8efd7bc

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
600KB

MD5
13af615563a2c5891019e1775ae64231

SHA1
4bda44904ae3a197c1927bd8cbd585b1f46b651f

SHA256
450fed505f108e95d147b4d378b35590cf8869d4f6c296793bb8a5eb7b4ce2f8

SHA512
e51fae9148e877a45af4c506ea3d0bc996c8cefe9b7fe77157a126f072e6339f883d13eeb26168da14295981ee50169af1f1a784fb31fb5a9b0783f5b3e2187c

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
266KB

MD5
c3524321a5e2cf9e75633374fb898288

SHA1
194557d76e3673c771b31d34969b5dbbeca0b9d4

SHA256
a9d5b504b524a32a6a3c553f313e38cc67ee40af956b8a9c90d09fc06bc0c734

SHA512
90b6eabc5e222f888805e188fdf0fe8ff25b211effc618aeeea245709dfcceb6a0cca5610ebbb21334909a907e62ed6bd874b70462bbf7070767721d31f2713a

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
987KB

MD5
d2e401692a641035dba305dc6cdaee97

SHA1
99eab0321fe9687bd89e9c329e56672f1b8a6ea3

SHA256
1c9d1062bf5a90c3bfe0c9ba067a3341d7232292ff2a7139bb6b678b84d59e0a

SHA512
e90589bc55fcdd7e480d9151bbef76a476b8697ed13ed28ff1cf5a1eacac64bb5bb8b141456f51f6c7317c41fc86b3a2be33dc5e30d74fec02678657fa06582e

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
740KB

MD5
e168239327aa91745c482033616d6ce5

SHA1
38d6643c853cbf631a793286039298f3c14c82d9

SHA256
a4626b43614f6586b9c9847399173be448ef07b3bd9fa96c5551e6d8934bdf74

SHA512
e33a416b627696a9ec2e66ccc579987d14468d8f3fec6a0e78c9d3e6a7268399722df526ec3317a9e1db4813bef1055a158145dd00f34e6c970542471d7c4f2e

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
65KB

MD5
27c1daaeabb30d3929c798851110c2b9

SHA1
6f591d793b01d6db8e9cb5f6793f432a16e51ce0

SHA256
bee06790e0243869bae19d28670cd3729e37c779213bc89e393e11fc5067b639

SHA512
dee64a0e142b0bfa1ee550ed20fa438bd4b2857951d096d4dc5adfe77714611b312e5ffc6318fad2e55b394436c9d8f1fdfad6d0a847a65b69e387639a15d29b

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
70KB

MD5
38585a5743f4a83fc866d802d581d944

SHA1
039b66470cfd1379c1162785c46e8f79e12a61eb

SHA256
81d1807aee0fdab4639aa9abca021e9459e57a1a673959f19d4680d193f7cc18

SHA512
adab740d18a0c451589da303992fd3e08c91d58d89fdd866019b461172c646a6bf37a392ea5c3425d4a5a5d76e4d811c345af22a788cd9ee62ecbcf8916e2a82

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
62KB

MD5
a6e318e63d3e959ed074dc9c13aa083c

SHA1
e55e05382eb791edced73dc37f7c414b3e232b2d

SHA256
529489547dbb0b1dc07cb62298a551a39a7b11ce981a69d34cea55b79454b185

SHA512
a5b2e86722581b623ac05a201e6eaacaa1d414afac03ec88585eddba2ef7a4e5adb007407335fb836790aae37ee30fc7cf84c33c1f09072cfc9a26d8b6e71ba3

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
56KB

MD5
6b4355df64c5d081595d6f4ba0a8179f

SHA1
6f3e0d51802a7bd56f91235580792beabab77c4d

SHA256
e03e7bdd22c8754a28b82384f8ef711970d676c0bd0ab42cb9b6d107590bd050

SHA512
a83848875ebc6faf678cf43f4d70535a3eafb20821b604a1a2eeae5fa48012411e63f8a98bc33c5d6d4010fccc508d503549c6de18d6f42d7fd8486f62bea774

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
67KB

MD5
53364c238060ced776780fcb6ffd7573

SHA1
6dba2ef2a689328e12b6cfea6040c2b30ddcf608

SHA256
8bc131979caf546eda0eedff826b9ec701734e69a303ec22d32395aaa320566a

SHA512
227ef1a599a6eb6bdc744f1cd5c7131e523854246ca8614649f4e0ea1225814354c462367343b7c4c7e0c9f4f2b5885881a4ae576c3a794dc183cb38ae6a2dd0

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
65KB

MD5
245198948cf303a2069b111de3caefd4

SHA1
f96e33177b965c0fb3383b4827c9108fec7e8ed1

SHA256
32dcbc1b820bfd11957f3c54b244dfec71e6a384fdc061c611c4ea71462cf919

SHA512
b9caba6b75d16bf19719573c86781bd501a620db34042b0683cbdbb0a0c56a13de553564c2ad43fc37a365e22b126dca2084859ea330d6c13456900152d29b96

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
65KB

MD5
cb174f70520d46fdb455f2a2fe4b1a54

SHA1
8383e965595554dcccaf810d8f335059946872d6

SHA256
d6132250df8bd46312bcacb62933478d4d540d4691790b8db654d9f9bc3c8a44

SHA512
ef38298e443daefd4aa97634fdd95d70c66b9ab365ba325065b28f9cdbf5c456179bedc3f5d9f978b63b2fe3329569b9da7f2386d13934723b61401e0f408bf1

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
73KB

MD5
f967b71d5f4bbd70255f3509dd36fbb8

SHA1
82211601ef7e3c2ad853bdfeb3aa959e748ca25c

SHA256
f83a997c6ca1daa109a2b295ceee291de32f0fe85fc48d22b732f0616ea855a8

SHA512
04d32aff618a7bc3863ae6a2e74b16047429e3d1c17c9a0ff11369322e808781156779baa7e82f5a9bb3eeb33fabfc2995efb149c17c70e999eae1c06dd282c5

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
64KB

MD5
13a4e8d448e358f8973c1e75dfe08352

SHA1
d0d33ebeb6407743ac4a48adf1e2a1dbb7aa8499

SHA256
479670f84e50836a217ccf9382870ba60ecb28fce789a3f93f29bb4ecf6ae7be

SHA512
0ac82cad3f7a12cdb51e772542c04049806a8d537c23a40a2612f345396109eae2dfb716bf1e0a088224a288fdbc7b13819aaf1feeb77bb501831fe1f432e763

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
70KB

MD5
50c4af7ed55ca2027cb7e8018290d77d

SHA1
cfd4a4128c030d20837ece798361a5520e685f5d

SHA256
c5c59b823fdc2e7ac74f691c69c32f0ae572317a6b9ad3c01810ede5879877fc

SHA512
220bbdd047fda1a7f5b6fe68bae51eaf5fe1f768d592b462fd52bdd99fa2664cc35b244b9675f8fc4c7a4b96cd50c1eeb8bb96460c6bdbe8e6a1b543ea9f7302

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
65KB

MD5
2f7c8c6e376cc55c3af05ad494a809fa

SHA1
258421b1ee0c5a61b18cb76fd27f52ea87f521ad

SHA256
92f334529927c8e63a9ab5dd613fead2959c1b68c98cce58caa93bf70258099a

SHA512
39300f399e99a9aedb26e178bdb8de5d29cc935d19d6d7e59891bb7709b5f112c7d7fef842f9d06a3f85b8691e944dd292b8b99a1f9454f9cd97ebd7a53fa099

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
63KB

MD5
b58f9f6fbfac61138907b3d8c45475e7

SHA1
58ee3258bbb08639528303139ba720ea2b5410b0

SHA256
5b723ae6ae1e0608b48a43a5c02eab9d7b0e53cfcf032597eb76572599c6a2d8

SHA512
e8b688fc39ea40cdc9c20ef3e6d7f574d15d2780c47832ea7c2f6f44464f2786d7dc32b12fa9baca76656f6fb636bc7b05bfb5b425e70367f919a4e78ecec7a3

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
64KB

MD5
8d3a954da53c5fb649b75a6a0e992404

SHA1
ddbd36365527e345486c448f84238d0af860c1ac

SHA256
b81f86b34733cf245cac505f086b974ae1793b7a348f88381d4cc04a1d7cf273

SHA512
cac8926360efac86d9ca76916c195f12fe39dfd9864c54df2092a4f33f5d31d4bca2b5cc2dd08f99474247e3066d69a603bd08cbf449ab9e03142f74e446fed6

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
65KB

MD5
f737f10ee3ced46a5bdea82f1cdf3e11

SHA1
cc6c13fbec08a899145d87676b2854efab16e4c4

SHA256
03add9faaa876af6fc5fff21f7c54921804778e098f3d5f694dfa6a5bfecc1d9

SHA512
d65c1555e1f90cdb463d9dc348be7365ae0e7f0acd104dadd0c7ed40913586573a572dcbc4671d3fc1a14b9dadfc6bb452bf03ec889f8319509f90e6a7542495

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
73KB

MD5
d9bc68c6e67239d86eb91b00333ed9f8

SHA1
23f5258f11c01c6730c8f6789e4ca830d8bf2b2d

SHA256
c1b5f1896ec2b75a3780015a9e7ed6d6e8faa8afef5d352d0377cbc23cf65fad

SHA512
023d75d5ca321a8a87e50c565dadc7236f22ff62c0567def1f5c289d569a717ae3a331c1070e678963a2129109cf193b25a1cce497983ef173b78828f597c929

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
74KB

MD5
b7d95ba8208edf9c76958b349d921241

SHA1
049862fa28d1bb42062c6882ba4b0bb9b8ad0161

SHA256
0ef4464420e55a05a02d844bd2a3590067c05d6af55e8d4bb192b1e7ca05063e

SHA512
751c9667f4a89333bb25668f4f60eb014ec9708628989dadda02079c5ababf17d94cbba3f53fa3b77a9c1d60f826dc8204f06844f07b13a559f1029beefcdb58

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
64KB

MD5
c9300ff2f5cc4c96e8015c03645e61a5

SHA1
f027c5b0042b61ce2835275387906a6084c7b851

SHA256
721352a1421541fb7c33b170be7b8e3f98ddd116cabced165ddf613e8abda716

SHA512
f7e06ea8c56de6bfc44ee054d1ec5745dc9956e427f03fc8fc0b85b6ea51ca8f3ed20cc93f1142c0901c08357918696a4390d852565403fab2a81ef33b1ebc9e

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
66KB

MD5
96a95c2111acbf969e804f5d2318ef89

SHA1
59a13b8cfcc7ce4a68b72b2ccd33fcf5619dbec9

SHA256
9c1e31a34678d0e3eef50d04320546f51955f2a4ca6a0d0e923da5fb70f10c25

SHA512
34d6930ee7c2dff493860f06b0d71d10311c552eaf444caaef876e4b248c03eb52ebc247b48938f239b58a5052b6c61d6802dfea1ad49e58c10fdf106334c083

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
64KB

MD5
184b51eafbd6d667a5d3756a9c228ddb

SHA1
543c0acd4b7d7a05f406ca6b5feed5452d5201b1

SHA256
85bbc66da78f396df54b9c9cd58eff97fa7f47bab8eaf7c04e287df8589be506

SHA512
434f4bd00cb56791218ca934d1c2af68eea3766f03d0108909945820e6d492b8462f55824e744640e43c6143c04a7da1bc36525c36cdb834c72980623d9e256c

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
65KB

MD5
fc56e072d6a7bfe9efb66363417337e4

SHA1
574acbcd6ea72c5b28004103ee348721d25a5c94

SHA256
a49e6b4301684ff1ed2bca2b6643868c67b95575499a4c3ad610d40294e246ee

SHA512
b0fb81a3afc0435b80bba25ca3d5fb5aa274ea6542116dd216520eb717f0eecb55a9bf5428b166ad4543204ca99de147c01766e5232d43e888c574e8fc700b09

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
64KB

MD5
0bedca0c85cf35efdbd753f8520e9acd

SHA1
0255ada24090308afb638a7c4b30f571455f19d4

SHA256
55aa8dab0914c2d1118f2aa0884de10e106275ee83f9d411d5b5135b5ef59320

SHA512
d6b14db5a0a5dc77fcaeddff56ec04923cb0af55cc4d94819047961283d90bbb32f922a43fc53a9658a39e51f7b2b046db75c04ef6793dcba557559f27a54c80

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
66KB

MD5
d4d5f4bc74b94b99c4047f3ba77bc619

SHA1
8a2383383cd8d9a227db05f018658fea2b0f2b04

SHA256
60c58b0f9964b5eca56f9a167ed4ca512344ae9e9e8467cf7a4338b64b502053

SHA512
3f25217b313be63686deb2a99e7db96354ccb2bc2106293d3dc3ddacdab01d6b10966b98f25f145c4b7185979eb45d5c91f5384a61b114ff281f2d5fdec6f047

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
68KB

MD5
cc62c81e8ecc8a8e841bc84081420495

SHA1
b56578170d231d55dbcfa5c43b590cbbfddda9f6

SHA256
8bbad479890c6a90797dfde3fe858e119821f9b32c54328431550650a34cb3b0

SHA512
97d32323a8962fc1f61d974abb449133d7ca3cc3ddbf7902d5d1eefbb7b9fdf75beb9e71122292cb4a6f350e7b7c17445eed25dd20d1c0e3f7031da04db0ac47

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
24KB

MD5
51855e64bca4f5fbe79c1e0601a022e4

SHA1
2bfab2738f81b483be46dfd2d881dfc58bada4e3

SHA256
fe466dcd259764a0e0affa44994b827b2fc997e4867533a083b38206b0907fb8

SHA512
cedbc5de3b7be75afc0043380e7ef9c3161bd4bf9c490f70fb16a3bd69f22083adef005b3d01a0aac14e7d3b065a67e070e1ec12a130128dc0b22369b1b51407

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
74KB

MD5
82942d66b1e4201f9896c9bdde78eb2e

SHA1
f075322f58e1ec73485f19314cadf2aefa96df53

SHA256
22fe99d992d0e97a5634832c65ca1a9e8fe0e62b0e321c8c22f060bd077e0e50

SHA512
7f1deaae11f8662584f12d569c59eed1de24a3fb6a509009bd3fe257c91f976b45abfbb1edc7739ede0852a15fd4f8ce101120ddc8be7c3503c2dbd16db518ec

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
64KB

MD5
25cf8496531cf440500b7de0dcee0450

SHA1
ead90113854e4e4ed5bdf8aa553fa12e0f3e3d0f

SHA256
838b33dd54fdb690d8c5edbfbd94d27dc6a410fc6ff32ca9c162474455bd81ab

SHA512
86e532824c9d01009e7480ecc4b1a263613dbae3e935e6889f34cfce94c40073e832963e328b2b2c0ae9c55b0dcfa9bdef505235dd10ea3e54228528ce8b5866

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
65KB

MD5
9bd0d90508dda599aaa8918fa9011ecf

SHA1
c79b7df902aa9ebd89f90899b5cc2792638d6120

SHA256
97e2fe745f01f686e8e4106dcfa3ed1563535dbdbeb9a0e1f5bcaba9de2d6589

SHA512
0573810ed45bba8be5cdac7206e36dbf144d3201634d77c289e96e1d74f072bcb070e58c9e4a3242728f79ab45b823155d7ba6ae6ab5e18a07184bb790e6f33b

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
67KB

MD5
ac4675aa333fcf2cbc187bb30a32ab39

SHA1
812c2cd3fbc79310ced067f4f4baddbd3f3636dd

SHA256
8b10da5ed4aec66d2cc45947eb83ca8bcd6fe28540a9632b0624cc3945c254c7

SHA512
ad524ab47678ae5eb7e1e1e9b1b89585dd1939c002b237fbf3d953e2b8ea2f79536d4016051550a4a53b12067f31881dfb4d3e76f62b1ea9842fa29291fa6ccb

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
67KB

MD5
004de06141c379826100686173cad360

SHA1
917fdead7bc41a57747d24201551b9e77a4cebe0

SHA256
781f1af445bebe30d15e9eb6d816684aff002f2e1b392b242f0bd97e1ae4c751

SHA512
18b2f9891bb69e1efbdaacb0136fc0846acdca6ac098c9502c9c5cee0522d660a5af0bb069434ace3c1f03b15293bbe2e213137a7d8b03714d3bd903c711279f

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
69KB

MD5
7b46db4940ff625ddc08293d1f9271fb

SHA1
91203682c4b71b45ec08be3add2604be4048d42a

SHA256
bbe8fcabc8ecec60cdbf08dab96bf8aad756186071c65aac7e4921f1949c7644

SHA512
4a63099331e89ac82e56b9fb3ff6cf27030076e6e46b34b8a5c0566772c2c95e29df6a7f929597ddc206d4fd3919910fd5a365c5f5b8553bba6e716ecb291449

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
61KB

MD5
25304565f1c592c1693c4e2f12e33d64

SHA1
ed7d3899442e6883adb11749ac98f72ef4432d13

SHA256
858bdb5263e27d1b03d38c536a0ac62f1ece443ab7a3bb2ac09669e47f2f48e8

SHA512
a430c2e443a6edccfd289c9ddb8cc30cfe13ae4cad78daa92d4db788e35118e799958c8e6396613581fed35634939c947256a59c7671a2bde1812ed1d7b60619

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
56KB

MD5
97a5419b7eb622b907ddbedc8d4266ba

SHA1
375112501317818d0e0cd30bd4d68ed5418193b5

SHA256
0dde749c96dbcec5fd5faba4c28b784a12c580dae3a1a7305d931f65c6203c92

SHA512
aa5ed336758f9cc906d29454b8114af8fab1fdbf907d92c0d1d89811ca7372931f628452a76ac9ce77c8dd9680407604c97f3a73ebabf4913e7bcfba550c51f6

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
63KB

MD5
5087321bdbe84ef3e46e82c4f325b86d

SHA1
5a8636b91b7d3cfa7c0ad62f134283cb942e6bcc

SHA256
b73d7607e90681678dfae3c182cbb59ff80320c62a01442a9bc5b2df347083b2

SHA512
328be1bb41beb53cce8f6f5192f12595c63a58260dc7f6f7a9b3b03cb4a7f70cdcf16a625e78ba550ecae954b46ca7cf01575fadd116b0eb4dbeb00b1964c300

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
56KB

MD5
ae0d727a06d78222cf668fba8b813020

SHA1
c20085e17beb0c88577a185b5e22446bef1eb6ac

SHA256
268c164b766dc1655ed482dea6b9191f82aa493dd19c4fed574cbde28cbd9899

SHA512
cd831965e3918b97d75a03714baf2002b4a15ff1c644571f71b417fea5e799c7d14688d826ca78e63acd3c5035427468d6e8b0f2ed4668036bafc60d25b8907b

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
61KB

MD5
570d5164b283ae646f9f5a472ef5392b

SHA1
edc43bea905754380b0bc5a5b38b07332030d9d2

SHA256
2fa8c8bd85bb168fcca937311fd22ca8ad138474ae3756d487f1cfe3c2a9e737

SHA512
587aea45e3e2e27ac59513ecd3d090533d1be330f817bf0a3269d7acc8daa3ea3523be7b112e892bfa56543bb807c5712de2aecaebd50339461ba829278ab5d1

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
64KB

MD5
09af9b37ecfc43e01cf48caede03af14

SHA1
6aca40c923a2810aa0768a1603457bfdb6f10010

SHA256
dd688812c97cd3bbe87d64f00b466a8fa7d32a268c7018134fac07fd43a67ce9

SHA512
5fdb67d0d3829e80f4db7146c27a3c26b22fcf4606911b5fcedf407e9ac6c6c79a882659d11856a917ba036d4332ca4aa1fb1115e5574cc89a88c4a73e2a7317

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
64KB

MD5
9412835cd0a3278121ea097b04a75300

SHA1
f89a4faed84eeb530b70c0460b14453abf3f7c34

SHA256
38428914466d13b3cb83b28174e6101c384d11de1f02e8556c53ef5d50ea338f

SHA512
b9cd3df866771c8b460d58625ad6ddb5a70f84e7a55aaf3d6ae0088de310fae74469f2a32a8c204072cf1297599ab464536e23770f6b52ab7bebb799cb00ddde

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
75KB

MD5
443c4696ad6733f307a1cdafb11f07c0

SHA1
19cd2327df5da07d31e99eb351f02773e7550025

SHA256
474c78de95204bea9ec69d8dfadf45f5f40f55f2cfbb3f9337309b886f0b319c

SHA512
a414d513df68eec75454c5ee5cc70d448bf6b7260958985157c52529a88b6eba136d94a58431669818bee2766bad7950d5bf95f0e76ec49689877d1d6067cd9a

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
77KB

MD5
df088a199c478aca60f724265129c70b

SHA1
ad5ec48d6fefea43928e523c3f4e54bb7cb2766d

SHA256
e69ca98f0c89df3584ac933969393711430fba30b81570d99198ab5778e5a656

SHA512
dda084f59a8f25994f7b51eaaf6ef215198c8da19ef3742d362f3af36612c940d185f748351a58692fa529c19bf7ee914d2310df33217aeb57206ea40e6520ac

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
67KB

MD5
9fab60fd962b3e590808200cea6b0ae7

SHA1
07d60834ec6be02406ac0dfbd069209e7e28057f

SHA256
618aeb7f39d5fc3974caaa4cddcc9edc12c395414b52a2b97ea4eb5fcf9335ad

SHA512
c52d55b447ab71c7d20ff810c89440d004f76a52eadc1b728b790dabf424b51b5388cd4c5ef314dfca1c8150f2036b884a827daedbb31891803dffc477c817fd

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
66KB

MD5
a5c7d9608148ef220db9dfb4ecfa265d

SHA1
2afd59b8373190938f5a642ca02c412e15972436

SHA256
962002e1aee5648ea3aaa8a03e1ccc083655f0c7e61c4b1930e4cdabe7b70e24

SHA512
b2720c454b6f0377da2c69c9b768a5ecabb27128602fe968fc444f8263adc72d4e53c1d763a56f83eff5eda96940f91dc9791234b013f2eaaf6af77c0277ec2f

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
62KB

MD5
c5fb59df6f25b86a321d9de15bae4749

SHA1
4f90ac32b5131b29cbe6c74e9ea5a9e1f80c2672

SHA256
15ee7a2a9a2b8f78d0447f44b25c969ea7b5081855763c9cfc4035e3f888e8e9

SHA512
75035497b55a7eb9ed0ced35647bf325a06f61354ca2f25bb4d7327d155c5c59b65adc87d3e7223cf307e5ae4b8676872f582f58ed255117467e9766f6c4e1e1

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
66KB

MD5
399b1096d7cb3d424bdb20372d308726

SHA1
dedb380ee32ab54fc5468f230d916b2eefe89430

SHA256
8a3f9b72175a9c76cef234d0ace10dff984eac08b8b9d1a52438b50d605944aa

SHA512
bfd45c5b5304f4da5fd5773043e0bb7732bc061538ee406729f235818f64b76a16eaedfdfccb35b20296b8f84a8cf9ed6a0c3337cd829fc98467521f9543f65e

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
66KB

MD5
9b3fac7cd52693caf49014dcbf301992

SHA1
669b92f3b1a433b66810af20bc576f55eedc7e73

SHA256
11438a2ae993f65c58b5dce1558b6ddac26011c4c067d77bcb1bf3f9bb39b513

SHA512
1548808d0f087f2cc8c47ea4cdb150ae21988bfcdc25b0731ce476345a018c4461c8cb6145e667dca5bb2fd8aa328abd8b022efd8e450e7c5354ea568b613e93

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
71KB

MD5
ec6cf522a9948ef1062a36bbcb07f942

SHA1
12a3daafb93ec0ccfe4b5daaf1c6ec651601e33c

SHA256
7443aae4a6acd99711e57c4a5cf70dd79ca25aef8dd0b8c00e983d95c56dac99

SHA512
7648734fa7dbf8298ae3f5b4833f6681cf04f9ad0951daae86208bb5742e88943c37143c42bab836c50f92a72e1d7f2ef911c4ff34c13c0834ec9c793dd21873

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
75KB

MD5
cdf305134a01f7e6c81f7b1dc41603d5

SHA1
e8c4fc9be8e1bf84cb3fa3c10e780434d9c73f6b

SHA256
1b710579e20cd25bff84bfa41f90fbd265414fa796f8e5dd714756ade2bb326c

SHA512
5426248cf98eb8de0a21bfb2563cc5cdbba773ca7c34c04cde73998732a539d9beb5fe75be1fbaf90035183b74548589c35d0d64467433ec646191da54a9cf51

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp

Filesize
75KB

MD5
cf787055172910b4c938d5c4616a38be

SHA1
c1c18b5b36d85f2001e79bfe295f252ff577b1c9

SHA256
a6f50b90b1bec2370f766fd158b900d391729ecb806a4ef24c28bf0512d1e0f8

SHA512
d335d9f223ce17d29b0bc7ee09c62f864766269408fed6aefb222804ebfccbe2fc2aed1aca417076ed36a58ba21f0b96e75af40c53af4636eaf6c6f56f0a093a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Policy.vpol.exe

Filesize
56KB

MD5
cb98dd6ecb592f9f55308ffa724628a9

SHA1
806dfe1d8df06e169db53af6d2fd53d14f408385

SHA256
af34c10c35754fdee65b2150fbc44d28210f8c66d1cd5e8b53ece7c868a6e45f

SHA512
731dfd4e29be71f3d0cab68656df5f976141d6580ba397dbb67dc7832ad8387f383d91e2b633d7977787dbde8e6a96f2131c2f244a99afc63366d1b410ff991e

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
56KB

MD5
f781767b3425accb5f5acb97985af4d3

SHA1
b2ad06e992b275353dc53b78510fdec297ba8d45

SHA256
91ba2fa82427574fbad1d4db0b507a5f2a56ebcc2dca758539bb031f9eb65c36

SHA512
4183ef96ba41dab0c40938064e902b1e4fbfd6aa52ab26aaf05aefa201d69679aa3ddf38c10607c94389afaa16d70ecc611804703365875f4c6cf07af4a09718

Download Submit