edefa6dd4b603bd08a1c804b214a73feb4dcb56cb968242df9a97c129db350e7

Analysis

max time kernel
120s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

debcc53f19981bb61c8aacfe1b4e7d70N.exe
Size

97KB
MD5

debcc53f19981bb61c8aacfe1b4e7d70
SHA1

d356d5e60aa7cc7b752e607c71e02fa3682325cc
SHA256

edefa6dd4b603bd08a1c804b214a73feb4dcb56cb968242df9a97c129db350e7
SHA512

c78e553f0929d65b74abd8a64b06c78b0a2bf9e9b811097e283f0e3e82f94399cf7adb6580370ae9768b82a038d1b129a72bcca40749a362eacd89d70ee34057
SSDEEP

768:/7BlpQpARFbhq1KVrhrCb7BlpQpARFbhq1KVrhrC8/+o/+5:/7ZQpApq1b7ZQpApq18///Q

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4685) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4820	Zombie.exe
860	_Windows Media Player.lnk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	debcc53f19981bb61c8aacfe1b4e7d70N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	debcc53f19981bb61c8aacfe1b4e7d70N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp	_Windows Media Player.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp	_Windows Media Player.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp	_Windows Media Player.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	_Windows Media Player.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Formatters.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll.tmp	_Windows Media Player.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp	_Windows Media Player.lnk.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	_Windows Media Player.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\VisualElements\SmallLogoBeta.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Custom.propdesc.tmp	_Windows Media Player.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp	_Windows Media Player.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	_Windows Media Player.lnk.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\et.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp	_Windows Media Player.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp	_Windows Media Player.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	_Windows Media Player.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	_Windows Media Player.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	debcc53f19981bb61c8aacfe1b4e7d70N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_Windows Media Player.lnk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 4820	1520	debcc53f19981bb61c8aacfe1b4e7d70N.exe	84
PID 1520 wrote to memory of 4820	1520	debcc53f19981bb61c8aacfe1b4e7d70N.exe	84
PID 1520 wrote to memory of 4820	1520	debcc53f19981bb61c8aacfe1b4e7d70N.exe	84
PID 1520 wrote to memory of 860	1520	debcc53f19981bb61c8aacfe1b4e7d70N.exe	85
PID 1520 wrote to memory of 860	1520	debcc53f19981bb61c8aacfe1b4e7d70N.exe	85
PID 1520 wrote to memory of 860	1520	debcc53f19981bb61c8aacfe1b4e7d70N.exe	85

C:\Users\Admin\AppData\Local\Temp\debcc53f19981bb61c8aacfe1b4e7d70N.exe
"C:\Users\Admin\AppData\Local\Temp\debcc53f19981bb61c8aacfe1b4e7d70N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4820
- C:\Users\Admin\AppData\Local\Temp\_Windows Media Player.lnk.exe
  "_Windows Media Player.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.exe

Filesize
47KB

MD5
1f7d37666010c94baeb388a1630ea96c

SHA1
703a4c0a85789eaaad4fb3ec7f187bbad2262b87

SHA256
35f4aaa702902c09dee61287d986d0cdab7df19f9ff4d85fc7c0f8d2ffac900b

SHA512
72c309de9450c4cb50b80ea55b55b0773c708dff7193a7c373371b8e8f7f8a3fae75bb22ce536da507446d3acfdc2a5d2e05a94ae03e9e1f6594c94a61c8da5c

Download Submit
C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.exe.tmp

Filesize
97KB

MD5
9f10b0c94b222a16eb4e5dc595a05424

SHA1
91008d38a04e82016d2b0c7cad8eee6ac01e9579

SHA256
3cfc8496a524bafcde6fff3cff8a5d8b21af80f474c3cf6b464732770e0dbe86

SHA512
81f9f6ad0ad04607c5aaa4a9598f3fd9e5a76b0353d9b607c6f17cf525d71eb65510ddf57924fc0ba92f67709a52ac9df59f3a6979d1c6d0de99138cc698b8be

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
159KB

MD5
6ae0b58367d35af89c3ae5c6a8b90984

SHA1
ef4cd47ad2208bd781d37e5e2b1af5b50a779a21

SHA256
1c04efa931437754c76d265db6cb29026a118ea64525829e6e0f13b5a6986b42

SHA512
1784306087b0d567639c5e93a9a59c47e91994204f8fb8071eb62bba235904acaaa06a7d34497e3fb75ba6eac5648225b2397f7afccfefbfa3603aa206266bb0

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
149KB

MD5
8ba19c640bb2ef82d572eb81e81f068f

SHA1
30b5b7fd0718fb673f0deeb3399deca79fe1b61e

SHA256
4dca4f43b38a0649815012be15fa6e31f4ffe3b0f095beda63f45088e4dbbdcd

SHA512
a1266cc63325b46b22305347a05535da3c49d5c79a3b901fa5b591aaf719248d234460b824123fcd98fedb2d6632fe2f8265b68794ef254da82785a276c04244

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
594KB

MD5
1f8de16896bd529240f4033d2dd5e210

SHA1
0e1544c9c1c1b046bf89bb562d9361abb43032d4

SHA256
a3927fcf9aac84edca8fbda3f7a27d58388383f51ac43d711c9cfbbb4e0aaf3e

SHA512
3c461224e52fccfb097407f5e23a2a9f2a7e29f6215f8d4bd7cc341bb9949c559d31f094cdb467a5afeb20a39442306951c0908b92ad79dc99538391f8b14095

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
980KB

MD5
3a3b575780dbab4c38c937b9d612527b

SHA1
7a6046114893a7aea2d4a84561387fa26b219d67

SHA256
822a024c25e224a7c3358c0836c67f62840e162b6478ac57b723143749873ccf

SHA512
9bbfd74ae92635cad5364117c56b4ea926af0467fd39fd7951d1d947c8eea4bd64631097057ad9ceb51ec5b5854ec4fdaf7e60941ec80c1ccb22aa343ac78638

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
734KB

MD5
4e9a29047c7b78e097d157f9a53dd8d1

SHA1
91354eafd0c854ee88f22df8786ccc84b22c0734

SHA256
63a6a3f50cde9e5a1938ea87396d957de1c2d31c8c4ff69c18c5950c7a01154e

SHA512
fb847a2d7d3111c45cd4b29c3945a84e1af19fc1c26e354aa03d895c0ecce111a61654328a586adca821786cd84e928a055fcfe7be616ce7ed57a4ad51350641

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
57KB

MD5
b8134ebadb23a4f592be3ef6778ac414

SHA1
7172b162f7427e94fae342360019bf42ca10eaef

SHA256
5d46ca6c291045b7652a7edc59ea0d943c79912ddf83c575ee555b1a4f89106c

SHA512
bef1b16340f679312b254e6cd885156a53152d2288ea81f67f0058ea7d30f716250f3c9d98331b7fae6931af212e8af522a907fe4994de54e84508970369910b

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
54KB

MD5
8c9f8e4bc32ea2edaceaa9b8a61da8e1

SHA1
069a5b5e93ffe0431d10836137080376bd1d7155

SHA256
340c4ed87d23fd917fa40e90f0d3aa4899cb408fecdda4c3bdaba2720c9894fa

SHA512
cf3644c7fa457845444aaf21ed4e7a7ba5c965276798702a7cf4935eb553eb339b1fa53974fc791a8708b72a747c88b205113a47c4123b4129d383db9f595f49

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.exe

Filesize
59KB

MD5
109e259e62a7d3121580fe09c953ecff

SHA1
11f0900cd454f047d1f3934ad4be02225c3196eb

SHA256
7a9e4aaafe7269764545e8a4891eaa709f200880c493c8d6b798a812f2c9e241

SHA512
fac3754de95b6994314b7a574bb32321b367f524119de945f6b9a02ec70b43203c3d7018977437bd28bfd07d3df9fe2d7331aded72216f5b62d486734b3e1e75

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
58KB

MD5
9b574fedbee3f293c454d67d91335083

SHA1
f36ed5fca786b611fe036ab5ba142a7edfca4130

SHA256
85b2bc7ad0ad114d0d4b947522ddee3d8e956a84413a1976a764c6463683cce5

SHA512
001d1341408764e54ed542872fc814f3a885e35ca39e38f9eeb9b8e9be85e7da7cd2e8f1d77d63dca16fea416415e6c5fac16422f1df36fd5e4eba216ab1ca4f

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
56KB

MD5
70a1ac94d3307e2aaf952e294c7a7f6e

SHA1
7406eb032329dd3da58c977c0c47a4f196dace7c

SHA256
f5c10766d87f4e5b7e05e22e25e1a8e2df0b37ea233ffae78e3ce306b67a3103

SHA512
f4de0f94bba4c5377bcbd869a4fdbc1055d7ccaf1206bd08eac8f9b713142ccb7bab2aac502979bc11626ac98b4d31c0336b2a37fafe6e167588466275805f14

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
50KB

MD5
2b13b5671346333d08fbe14a5cdb2425

SHA1
10a0038a7e900dbf1dac097351fc4fbeab19f285

SHA256
8257750ee9e550b2aaa6798382a8db135767b35ca738f06d477406fa6d1718a4

SHA512
60fac0a4607b0449ed46fb9be6dd3c614624c8bb25a01ac4d704daec9896b2120f129e82c7accc34c96d5a7977bd602b0804313327cbfc1fbe6d3bffcfb262a8

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
58KB

MD5
7d2cf70e4a40189a465ad5b83b2b4daa

SHA1
35bc7d3c94101534a855d6b1cf6410c95b4d9d62

SHA256
328a30487d781f94bb00c32471abc062ae447536f27228774d191880526323b8

SHA512
ca2fb54e523aacdf1affa1152bc026f29bf4ef3574d1ef19de2167f4c863b6b80df752236703343ecb1a31a70d43e930603ae9bd2739d0122c7b2ebd1916494d

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
59KB

MD5
27e189be37c52bef65deabbab5579a81

SHA1
2591d4097625271b4286e5f2d0a2fa8df6948788

SHA256
268aabda28219ee7c7f9e1ff101c442858dd2b05df218d3b09e5a4b4e9ec61f2

SHA512
c8573c55b146352e063415242b7a043a3030381e64088eec1e3ff22b02a584e742ee0c3491a5e49e226d8fec86e2c791b294218281e2b6953dd39077e9814132

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
59KB

MD5
d7a419606268e02d0666933354cd23f4

SHA1
eb957d3b67dbdac7e2f6a9a6834b25e70a6c7b71

SHA256
5d1305b0cd617b7e4892239d1e2c1fea1d738471440832644e56feaf2d2036ef

SHA512
116f1233aa5e166689b79eecd8c5e23419bc780de355c9ec6d85de25633bd6c05043dc487a6be1dd2c27b140c2075f0d19ac956e789a1d3397a3c985e615fec5

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
56KB

MD5
295d576533f6b002f6db3bfcde9679d0

SHA1
3f3e9eac5546c306d505f5de96fa67379e9a3573

SHA256
03b443d0fd27563cc8db2fb643afa88c5da8ce94288449571d81d4fedc950868

SHA512
7435e13564f3e01b30123d2b31b68078b6a1e3a36094cc6811ecd0fe3f9ffc841ebd0f391c311dd8bdde2fe0df87e98e6ba52cbc44074a09d161827eec196875

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
56KB

MD5
1a96dca0e245e5aadf0bad96fb349391

SHA1
6936f838ebbfdd8402b439a16fc58e8e1ba079eb

SHA256
c00826fd6c096f5c4ec9f94e8e4639cdfe5d41cb885cc11a58cdc00841afbeb9

SHA512
d81983ef322d7b1b16032a11c3d5a7f259ed9aa593244022b5539eaee7063bbfd2f05f2a99f108eb0d017ad94e7a8d89e6e094d444247e78c74454dbe36031b2

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
54KB

MD5
8cc24a81b10fbe768ea0455f8f657839

SHA1
44e02f5f7b5610392b4f2df50fc1da89e84ab2c2

SHA256
73ea5709c9e5e6b94fec1a0b78a38dc358ee831173e5d76cb3fb1eed8637275f

SHA512
97e86b6643568c8f393c96f3ed56a1e2648bc2c5f13d4093bac7f00bdb0cf153b831cbc8d610472e337f2271d6cf9bb51496350c1243861e1253949211f602e8

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
53KB

MD5
ed1a387022938193aed172bf512884c6

SHA1
bf843df943797909a2ddda23734a41df967b5363

SHA256
adc53f0cc27f34a1d4f73955caa60e7259d6e76d44df14f9213434b8002f412f

SHA512
cd641d64bc21954e09f4dcad45c39751a8f026911945046bc84e9734629c7a910bf9a4f6a9a006f13bcd46a8cf17dd211afa1a9d6259f06af15262bd9d8a65cb

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
58KB

MD5
c31a5875d032d53021dc5a897b0683ec

SHA1
11f0f17d91d6e8c16df30bc60902cdd1bfaf934f

SHA256
280c9a28ee2ce5ec3279ca97902a3374d3bdcdb4d20b6ed7208a11ad40cc77ce

SHA512
bc3df32b72b043ce1844d63bdd50aad6b161c45e9901293e33264a2b713150e1743ad616ff63dcc57363bac45bdad5c2b502e15175da392ce54f8c1eb33e8a7b

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
58KB

MD5
80f10208f7cf17e42d80fbe8aa67d9c7

SHA1
133f0311b8916bb1dddbf4111e5a2114a47ac77d

SHA256
638c19f5976fa572442ee37f5f3019702ab1fa2d370279f9d76294c783d53684

SHA512
28756fee7adf2ff3c34a6c2d9d5fa33121c5cd0ad7efd296361eb3776bcbb0a8f9d2ab2bc71dfc4144a29da75159bf266eba8a6b4be12a5cae715736386a90c7

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
59KB

MD5
415a8c1edbbd64718bcd3be707f824a2

SHA1
75d30c76a50f9c00ccdac1049eeb27bf1fbb2666

SHA256
db578a0eb03d9f979822a08971ab5e110977ad75e7e5a405824305c5181fe333

SHA512
aafeaa92d52c44cbfa873b781dbf83d914e721b5c6cf274c11ba4a4ee5aea3cda934c8c6cd726ca99e30a1caaf948bafbc6282a95bf2066743759922522070f7

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
67KB

MD5
7d0415932eb1dedc13a75d0a09f84405

SHA1
e42258eb84b5cd789b43c1329a9be3b2f6a4272a

SHA256
f66112d06f3eb5848bf378a8b21641df573915f4bd05cad2b1da2507aa194672

SHA512
e0fe4cde4f55af22c8a47de216b0364843a3e70daa42b4c8caa1a222823dd1f9eeecbaec0e5f31a9e7a1c985d71c11dbf816ab5323a61508cf19926a514ae225

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
61KB

MD5
493e62b50929ed7cd2d150e3a55a9a23

SHA1
972ec193f6ac0014eca610e7a5ab176cd1313914

SHA256
cfe739599dc1bbe75d0b850ec7584502cfc6dcb7de64307a309742568a131f4b

SHA512
23226d6f562daca2f30a0ec84b64f0eedf61a2de164c5bb39db0e1585c627d9d0f5e717a35feb9e4fa5e99729bf4ac558e5135c0c034cfc4b0b0fca68b3dd07b

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
64KB

MD5
213fb89dd73f389046df2e11ddc290d0

SHA1
bd4ea0c81d238bd8db4d1f47c6a7b004370fecbc

SHA256
f996b42a02c7d21d7c4d7f34c9e583180930b3231e2e0a0d079793f163f75e5b

SHA512
2263dd59fc10cac622f5aca47421e279c8067bf33dc90b29e0c69cfb8b078837790355ebb4179b31076d50f02cf42cfa5c3d1db608b6bc0d7d71f566d518c7c0

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
58KB

MD5
0eefddb8dde79d8c7891f26aca4e1c70

SHA1
e8c7ef8ead2167e007ee954256e7938ed51b6dad

SHA256
ad792722f238496beeaeaed58d8bc690dae927d218a76c20191a386180b7b427

SHA512
85c09c9ea327efd0e94d544105a9f01b11803ab09c3fbcac977517b3dc82eec6f8594f801f6f87e3d19dc2a86f67de4ecaf3d57d982b8b797319a0827c985bcb

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
59KB

MD5
00af4ce33eca93fb3c8339bdd820685a

SHA1
74c7023d33fb9bd64bc61bd3f6f498f8eb9ca4e3

SHA256
1dc6032af96582035d54468fb8a956f1f0861a25d8ad5735ed88e9c28743ab52

SHA512
e726d3793f3d143f550c6150fe02ef4b4594fdae9e3f9ae4596ccdac643fe83ddb8ea3b0579d542c6ea50d99327691518270c57ea7749111aa7cc2b7980225a1

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
55KB

MD5
d3925ab25e531779196940661cb2952a

SHA1
be376b178d801eab199e6729188ed51c7b6df943

SHA256
b0d3adcf0830425f4e101664c281194d26c388d9ef3cf32a678e05b1bc16d026

SHA512
0be63b6774e87f15f13d25a9a1d94f595cdcfd7d87fe24c6ee05b68cfc77a5d67689d4212dc824ad96fa255510a358b06012d4406ab3568d56db0d3587390882

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
50KB

MD5
efedf2ca1d340d4818885d18c5570327

SHA1
d5445f563dfd752ff3f7ac216513b964ccc4862e

SHA256
6dd305b8004efd0f9b30541e3990951061fb2f3e8144d086f07a1ce3e1cff9ad

SHA512
a994f0c0bab962f2b0a87e4a327ae5812a96d4ad2dee50f21941d6327559e2e8d5abf2d2d54ec5d03b622e4a6f6c440d05a89e78312babff423d84629e925daa

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
62KB

MD5
f4b992317e2c72f055e3a6930c7f3bdd

SHA1
f23d5302cf27b394a00f391d5f661d54b5bf13a0

SHA256
5e29321404c2974215a4f91f7e36b99ffa9c0df6b7cea6f7af580b6ec6a763ca

SHA512
4a280ae3e7fd03e71a7100ba93bbbfbb54faf3a16e3361c55029fee8718079a722e816f073f760e940dfcecb7dd30758144bd7a3736b9413404aaa879c6d695a

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
57KB

MD5
e3d461e40ace7435d4c6b8bca716b6d7

SHA1
f039a78b7f72028daccfb6981eeb73cecffedddc

SHA256
f7f5d91109d4cbb5ce25174c593d9219ae48b157cf9b05e038cffe5f33476fa3

SHA512
0cf415461c998b24613e8d67c62799afe27aaffbecec8d7691eda3b601a9d671bffd0d0094d3b1b45f4b91468c36849037d1f48b96b5e2a0ed66c4a9708bfd16

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
59KB

MD5
1bf4eac9ed4bf5f871f17e38fd16f70d

SHA1
a2351127e1238d07d1041aafbacf95b6b1227966

SHA256
d6b847c9692ce6d555a2118c60c97c65759830d615fbc02a5a347c530b3b1c23

SHA512
48c1c4c949216983c7fd33297895880c27142273d557c5a14338dcd230cab37e57a43224df6dc19758be6b786966d44220d19110995a4d154e59549a9ffae7e5

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
58KB

MD5
4d8273b2fb5306c39a1a218b7140dd9e

SHA1
b285a7e47db7d2be5966663a05f9366ef481398c

SHA256
23169af80e57f5e12f3cf3def239ee43f5b1417e9674ab2fbb606b470fe12a95

SHA512
e817de5ce5def00da2be51e308dba95154230abebefe5add766aea3cc4398eb848945a512a123ef880098f745cca33ce790ebc526d656ceffc44ec129fa34f7f

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
69KB

MD5
a6907da7645cdfd43e9e0af28e31ce87

SHA1
bf2044987a5ec2b2f681545434d4cae2c77b9b21

SHA256
ea53c9116fb9ebfb4e7682c7631172460190f15a5c92b86cf27e84a1a9a76d2c

SHA512
65a53a97905149eb0d48433b7a3a72adb8c5ee6a3d998c4647519a13fee80ccc0749190b13c81a1d55bc282fe32e18652d506932ff297d17ebed2da475b8667e

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
71KB

MD5
e40f0a7a93a90bdf929c96a6adf69175

SHA1
d831972a9a20b16badae8697edcf46c693c8ed84

SHA256
ab48c4c7dfea95afcf702207aea820916eae386d7a7a1d8dbecfa3fb43b7ae0c

SHA512
08dc687ac4fcf3e7711854662d8b908a7ecb37e5bda43677d9f8b75c6f692963876e23d18289e60933148afb2f2f193f2fa5b442d9a5c2a43f33d6c64a1f681b

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
52KB

MD5
d334f8d651e66aeddad957df3c9cb895

SHA1
84709e6e4d675fe7708335beae1c435565568247

SHA256
f36c18f6c9a456096389e0c1b47db2578629e330df062c5ebad8e1fbb79f0ec7

SHA512
08137810a0745c529eb7bbef538d8a7210e0d48602785c89f5299eace50a92c59aede29e4f3a34bdf4ccb1020c3cdb97859158c5429be94289eaa80541d7b9dc

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
53KB

MD5
ffc8b9b34a25c9f74ee273eca74df8d5

SHA1
abe354038afcf50966aa54c4078ed55d2b919414

SHA256
d56f4e25d150713a4957d64a1a0af3592a8044c94add4a6666f57873e6e59507

SHA512
20e25b0da12dd0d434b8ca42d7b032b0e5d9be0fb4b6a137c27bbb78bb015d579c5048503b172f4b733c592cb5c9b62270589cc23e387cdac17aca1024b6bbc1

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
63KB

MD5
a3944af2c7da6ae87fc64c3254f316da

SHA1
23daaae90f91f96763f97976cc98eebfcd55d010

SHA256
f3be518b3ab8978797a446a873e469957cf4270b314af1814b846176cd45d442

SHA512
003bf3d4a81350ffa8d899ae04297c2d6f4b6ca4e5a48fdac2c0e0d4f550eeb56d1d8e656c1b65d03eb3f5d4d2240b1990b0ab9b1fb40713ac4e92aad3a3d966

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
59KB

MD5
51fdf493ffb18c8d9cfb53a1b36aa62a

SHA1
78a0418e7e3b62c5375b9f5cfe40d2a88d3546c6

SHA256
5d77d1c326469fb3d67e9c13e8e33dc8b2537f0d20318fa292a84e54626f4fd7

SHA512
361c901379841027bc346b7a35249a5c9aa2d6d752c05cf41c669b5221e09dca4bca036720eecfb8473fa61419699f76794b303ba9d76c51be268e2ff7b33fed

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
61KB

MD5
db1a605d3ae0f568ebb11ada573e9ff8

SHA1
0588aaf5e8768a15c6649e038d47a45363433310

SHA256
fad07b515ce1f2501740090420aee4de6a8e7837ef0092e67c0ec14b211484ca

SHA512
2b4b80560a4256b7877535ad80a5aebfd79debe8c2b379358d7688af208d090783e5515a1c2a61ed4a019fab4c7f24566ca4a35efa5e7f4a4498a15100925d7c

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
56KB

MD5
ea29007aa36ef79c2b871b73ff22a832

SHA1
7ee76d62cd6cc80e736453feb5b8699a4d3343db

SHA256
c62ab9bc0e1587d873e6e0cd5443eded6f247cde61501b51cf9893b4470533eb

SHA512
f7fa6a917db221189b3d0189b4cb77f048b6d81b677173e7d83faca3e650aa98892d958e56c8affed73a3c58c3d9ed610ab1f7a9deebc852ebf07391851b07d2

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
59KB

MD5
6780ca0d380f7cda4fb1ce4b3882d216

SHA1
1bd909425969a8e0b9786714c105acb185b960db

SHA256
ce493e9cca6fee2af6ae0d980c76639c9fad9dd487f02108e110c152295433d2

SHA512
1331b9c3d4a280caa6b2eef92f625f2a512d6761aa337899711634d5a3be7ec40107afa882d82c435d49aa23d4e4b36b09ba065bf705da14de42d112842f89f0

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
57KB

MD5
bca433c570b222a6c2621eed7ebd26b2

SHA1
2288153193a7247bfcc1570cc49fc7f42dd13fee

SHA256
134401b9d5806332b0a710280be209ae07f38a159517a9d5aed29a382f3fbd65

SHA512
acd3c7d357fc24f8e4b7c464960c87c242ce920d6153ad62cde893880baa778f7db88187ae9f6221aaa299263cae352cda555d8ce119f232142aa0ad5c6acfa3

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
57KB

MD5
c47bcf6cb0f243e7517e724c26b2a863

SHA1
aef7137d2eaa8b9d93b799685421e9eb12dfbbbe

SHA256
27696251836717f062c03402847e8f3722ae35fe1de414b3c240118a4c481347

SHA512
d9810c3e132f23978608d02e51af27337d74d0e28cd6432a6189fa021fe4e6d0e32c823ce57e6350db709375189eed2e69d0247ade17afbfd1fabbf98d1ab54a

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
65KB

MD5
c8e4b64928baf50d0f269336d31138cd

SHA1
49a110955847e27d2d960eca2610fc0a49ee8d38

SHA256
b7ccaeb05b3c0f96a6d438ecf88bdc61663ec5f83d55d5446e82080a9c05f6b0

SHA512
0553adb0c5d9c08084761a3a036909fdc8540e8647ab719e54663c0b4eee841b6c3e5a0c9f76a82eee0da83d547d093bf62f0e4e7408dfd91eef1b6272c6b098

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
68KB

MD5
9c5ce8e53efa26eb2c5bf0549f52fc75

SHA1
4563845cdca74bcb6136e51e3642948ad90bda10

SHA256
898fc04cb6ea4e3d35a642ecfae178af105f020b51b8a662f93be4ba0500673e

SHA512
6b53e899e60fc3f1db8abcc791889ea6fc7dcd5358212e975eadab07f9c495934a3094bd765fefa3015fc83728b03ee76e4246be38132d42d97aa296150fde33

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
56KB

MD5
0864014bf926340037d2a834164db277

SHA1
1920d2a2ac814f9ef665baff91ad2cfdbe60025f

SHA256
51393884f805eff80234e5430f6b51d1bb9242a2122f1a86208727a7bf4c9266

SHA512
1cf43983a50222aaa0f7369dc400cb8f2bd9eb15040e1f0b5560c881ff6ee9148a46a75050648ea624239bfad684401954e6ef10b9a191f52e8bd4c6d73bfd31

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
53KB

MD5
d32e431b0fa38d484396ebebce325357

SHA1
25ab2c9078bc8bf9d0bead5fd993a5c097482d22

SHA256
e141a90c7e3b55ff30634a61d04b4d721e42559b2b951f2a176f936d343f3382

SHA512
fc45739e98ba40e389cfa2f6fa0cd661dbd6f9c7b1d646c896fdff14d305f1c5635e6c90388526e57a3f31e4ea176e460d4eb72aee065988ef52c6565350cb65

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

Filesize
61KB

MD5
8cd64ad4eec6a247a7be498dfe8317ce

SHA1
e4e8ee2ad248db77b2075c520e786cf038fa47bf

SHA256
eee6db3d779730f440b736a75a0603d53dabf98021cce03723d9585680bc7fc8

SHA512
558eb918082972bb84b1e977fdec706fdf503b9cfacf392c2125db5e59767f89dc7c2cc0cff8242418f1c98629e6db247d87e2993a528c1b5541761275546305

Download Submit
C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

Filesize
57KB

MD5
8736174bc781a162a0053daa837d363c

SHA1
ecad322765cf491df93887aa849d0eb25e8e674a

SHA256
c655f30d38eb76d2dfc125f4179232d344d52d8c61bc1e8e72a24c41c083c2a6

SHA512
3259b40338886fa89e28b638c29ea1aa08da4c9242ebb5ee2f27c8d5d9429ff3c759229eaacdbba8e7814de064a41c614537383c64625312fb64fcc007a3266e

Download Submit
C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp

Filesize
52KB

MD5
da99edfc8889bfa7e0214dfd11d1c808

SHA1
3b8c8c4cce2f1e807384a5a9d42da65ee157ac01

SHA256
76e233447d356bc534abbd56536f8db8e8923fa4ecc7556e83ea070d128571a7

SHA512
bc090c097a2feb84c2c8f326079c69eaaa8b1293de7c597701d2cf266489d64b80936f655e320155411488bc258d0b4a6c0fbea2669d1d7819ed9fe563f37a2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Windows Media Player.lnk.exe

Filesize
50KB

MD5
3fb69b07ab0c3689d3af5faf27dc8fec

SHA1
1706246c044c729aaf075dd5bf3e810064ab8b42

SHA256
8641effd116748cacd16362bafbb25db2bc9c0b97b71d83ed352b0bb52c82d20

SHA512
33e0c1266f3dba418983389394c27a182b34b84175307ef9b738e9ab04f515bd0e13daaeba7ef91bb70eb7bff2ef454f19399571e77fe4567940128e9c387028

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
47KB

MD5
c27c1335b8c3e0823955ad829717b632

SHA1
ff95292b903a9ec238b6ceaf67d7d75dfb889a29

SHA256
2e525f9401f456df9522fda9f4eacc4b0784aad37a7ebe97e1cfe6931b839c45

SHA512
9b7173eba68b4d06ab94c2a72fe7ada0454653f17215d1176a0756837f34b9f644e463399b6343b5afd87270d4f14f68f1bceee31fcf7305b1ce13695deda419

Download Submit
memory/860-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1520-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download