49b22515b9cf46ff541528c5307aeac15a75baf23320fb0cef2dd481510b31df

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-09-2024 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4781efc86e952bbf1e17f8e380f1c700N.exe
Size

88KB
MD5

4781efc86e952bbf1e17f8e380f1c700
SHA1

4840d98a5583274b937f2c9e34b29b990f11bc46
SHA256

49b22515b9cf46ff541528c5307aeac15a75baf23320fb0cef2dd481510b31df
SHA512

0753cdc1abc6d6b6d046bbe768e38c47b1cf0dd5006bfc6efef78947588e16be424ce2d81516e139f9c862cd13ddf5e4ff3d8a7d53b6be1a06f8cb855c67c9a4
SSDEEP

1536:W7Z2sspAp5YSfffynKDkEDkHC7Z2sspAp5YSfffynKDkEDkHwI:62ssWpKnD1m2ssWpKnD1QI

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4425) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4572	Zombie.exe
4556	_Detections.log.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	4781efc86e952bbf1e17f8e380f1c700N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	4781efc86e952bbf1e17f8e380f1c700N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.NonGeneric.dll.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp	Zombie.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	_Detections.log.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	_Detections.log.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp	_Detections.log.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\java.security.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	_Detections.log.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp	_Detections.log.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp	_Detections.log.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	_Detections.log.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	_Detections.log.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encodings.Web.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	_Detections.log.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	_Detections.log.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp	_Detections.log.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt.tmp	_Detections.log.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClient.resources.dll.tmp	_Detections.log.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp	_Detections.log.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_Detections.log.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4781efc86e952bbf1e17f8e380f1c700N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 4572	1536	4781efc86e952bbf1e17f8e380f1c700N.exe	92
PID 1536 wrote to memory of 4572	1536	4781efc86e952bbf1e17f8e380f1c700N.exe	92
PID 1536 wrote to memory of 4572	1536	4781efc86e952bbf1e17f8e380f1c700N.exe	92
PID 1536 wrote to memory of 4556	1536	4781efc86e952bbf1e17f8e380f1c700N.exe	91
PID 1536 wrote to memory of 4556	1536	4781efc86e952bbf1e17f8e380f1c700N.exe	91
PID 1536 wrote to memory of 4556	1536	4781efc86e952bbf1e17f8e380f1c700N.exe	91

C:\Users\Admin\AppData\Local\Temp\4781efc86e952bbf1e17f8e380f1c700N.exe
"C:\Users\Admin\AppData\Local\Temp\4781efc86e952bbf1e17f8e380f1c700N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Users\Admin\AppData\Local\Temp\_Detections.log.exe
  "_Detections.log.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4556
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4356,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
1⤵
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.exe

Filesize
44KB

MD5
647c024f008c96fbd490e8e69bdebbb0

SHA1
591a232f83cef3bf5b44443487f80912a03b18e7

SHA256
92982bde9156eb21335b27e6f166f42559ac3958fe7840829ce7264d31b209c0

SHA512
7e6824b96a1fb77662fea3a4f3efac734bb9a60662e4d072e20be9c9c27120f6fd514897291fc6d6499c9f7e98a90c4b03c12c6f922fdb92cdf301f50e6c8d83

Download Submit
C:\$Recycle.Bin\S-1-5-21-2170637797-568393320-3232933035-1000\desktop.ini.exe.tmp

Filesize
88KB

MD5
065888c0fbc7eafcfb609aee5de776d0

SHA1
2f2ece89a76ac0d2f068db9d712ace67a1b6dbf4

SHA256
409c2acc9af5f5b141f78571ce70a461bad0971dd996ada67702b34dd02c7936

SHA512
00382866d1367b0138465a3c529df45a1104d984492abfd14855543bb0288e9a1307c773114377958cfa33db56c5e4acc167deca8a489d2d5731549399556bd0

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
156KB

MD5
80dbaf600dd6b26c6c785b44d04e0d38

SHA1
c92ab1ad74642868884003f92c6e5eacd7eba656

SHA256
a4a5e0d51f0e2df56bea7d26c10b0e07f9ac348e7f09ca27957cd6fcd88dd50e

SHA512
b4ded1f7f1b22c6c2c4bda7b3c3a6b1121311e3baed39f9156aaa22cae8d3f575544c591cd2162561eb52a8e589b63cb33ed37252e6241e763f32e21e4dee567

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
109KB

MD5
d56a8b311c12340a08e3c759c76cd2ee

SHA1
5834c1eedacfe6250418bd8fd8b721b505debe1f

SHA256
3032959b69360be80b8c4676ce20da4cc788f95bf74870adc1880ae1e851fefe

SHA512
d98d9083884fcec978634a96fd2832eab4d17d98f93461b0ef9a4280460666a3db5e2affb5cdbe5831e985a7605d23a0cd6e6e71641ad045cd001a509a1346cf

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
e818045944492d8cb576850a690c744f

SHA1
b967e635de194383655e93815a6417eae05ad819

SHA256
0e36637592d08e7627255c0cc429b1ebd1cec014c1dfd9ee9acecbfe7afbf425

SHA512
dc6c7de99743597500abd4ae15ae72d11231c4563d948a689f437bf088556aaf06a1ad83863a711b926252fd45eef2f972a37c368b394d66337c2a6fd6a0a760

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
588KB

MD5
9d6424a61d6e5d10ab2fdd166da8e2a5

SHA1
78df5286af0fc87f6dc9b27f510bdcb876addb81

SHA256
a612cace366938775a4c0ab1898ea8d5142e54ff1e564a543575ea40977b1e52

SHA512
0a58fd0d0b2672f08256995145d064b7c82d6935dac37b49f0601952f0256e2349152a2affc5de5c4a48a3fede21a0a2c131107692e45a5b575993523042f036

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
253KB

MD5
62d3825411ba78a4e67d0596f7f15953

SHA1
8f8f7b76007096f06898926e1aeca5813e227535

SHA256
f56be4a122155cef6fb00f191d13e5b50b9aa230577d0a9b55a91fc7ba13868b

SHA512
d2f04f970094e27f33fb9778a8835bb70ed224c10597c076148e437980e35fd875ddd450f28e74d918d774da8bb5630301d385fe387d74115cee9e3005b537a3

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
232KB

MD5
a296d4e963179f64200ac4e26e5f4414

SHA1
91925e7e0984435fbdc0e27f25a110a9658d2873

SHA256
a68d19410e4fc3501c99b2de9a453c212e1d0b4980ec288644e210e193cb39d3

SHA512
d6f932e7845b92ec363aeca07332dce1aba6c38482437f46d3f8a82537d7f34d56c762f2b4f247ef1f3be153853ecb8fdd0ef6d6fd3024c3318ef1acbf0659c9

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
974KB

MD5
4e4021d94c1b8326bec67b1169cc9f22

SHA1
ad46e134ddbe02d176bb8f3e367abfdb67110cbd

SHA256
fda636d39248892001c2dd9ca72fdd0f2dede388e7b799fe517f44795f7e1ac3

SHA512
e6dfc1de04a716f9a16f49b92f2170da682ad09f7c5c42293980b5d4da8622ff6633f72ce8129bb61bc37ce7a7ff574b09aef11de5a91f6fd6bc7ce1374dd14e

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
728KB

MD5
d11a49fc1316b1db7910f665a52db164

SHA1
f58e8d4e9bda70e6f15c7afd3c36abfaa55de559

SHA256
626df8b30c625e4c476e8e13fe23f39c15af97ca959062cc4c42a9cea674683e

SHA512
b9e156b147741ae27230aac9312557a74c5ba980ee59f49d6d3d0ffd1fa789f553dbcac41c64e61526b854bf529a8ea194791d310777a121244e8f22051dc96f

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
53KB

MD5
591ed76335f155a4f6cd68bd23b4bc90

SHA1
a7c15aebbf53529231b8c1b5955b1689db7a8f8c

SHA256
25f172c54ee639a95c5450fedce68f80feab8f4163defd9591293608961c858f

SHA512
26b97c312f68f3c4878d092c9f1eccc09a97e222f695471bed590ee7cdd3b0e1a22878d8a4d274b9d372b757052e1178212f4d195c9b884f4582f74e2b6ddb86

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
51KB

MD5
25db89dfabc83053b4f69242b6de03c3

SHA1
2fb6594a3206f1e06d8b6639432c61f43fcb8966

SHA256
8f50e90da65161124a6233036da70639051028643162a32d0bb412c4d8da6771

SHA512
e8a0daa89e86e530bd85d5032c1c99fa594a3ec0b5723b74ae8169fddcc7e00b729c11dab5c472e75590afaa328c7292f088dc167d1378d58c62f41ee90ac974

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
55KB

MD5
377185bfdb73cf2d5e471ed37f94ee0e

SHA1
5a1460ba183b5d46cb04eee4449e3d4d6bd4a5e2

SHA256
94e36851e1b24fdf3a29bc31da067f4dd26dea053458d892bc219f05cbc93e04

SHA512
61701368e7add6d27548a1bd62d38a7dbb42354c016286eaf56e3cd9c64c45d75a3be8b5b2d4759f54179e0133d075d562a73846cd83381a9932ed12e7c62045

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
56KB

MD5
a083b6969a2c8cb142c06884c05725be

SHA1
51ed27ea8bce15e4d2b4986b7d1cc903674606be

SHA256
adfb00ec043d53b974cbf12f4e3497f316201231e89104a4c1f604e7b57ad9e2

SHA512
598e8bccc3b40d21ecdf0f6d28056b27ee6f83ebee5434feb2217d23009ee34e3da0c8fbfc48eef8e1ed8dd7cc0f7a9bb09c26497c038cfabd3b1bb60a87dc6c

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
58KB

MD5
7da52ba0231dd1cd4164354fbe254802

SHA1
f43ab6731cd05169edb3b8d56135b59702801c6e

SHA256
47bd9aa04f0228622aa1c170960bfb6311c8311dbdc52ebd3ddf7689895a7b80

SHA512
463ee9d70636e238b8143613c48edc2415160e6c1abf44c1fdc2066a3077c9a6ef8b8cd8bec182c91cebe2c3fada3b8861b6dab5af384b27049c1d86c3994287

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
54KB

MD5
c716a439d323b567cac5c3cf6e521b09

SHA1
ded4e0d7e430844e87def57debab2321ecbec677

SHA256
a556ec3b33d65f3092fa812a0cd994abd90b8f439686481ca5040e244072f48a

SHA512
4dd35de2e2f825085b0d6a2342a0a1f2c13ad7e52cbf375bd768da7737cef8d00906aaa1ab762cd1d45addaa78b40ffd910b5592c3ce52089ad7a3c4df416767

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
53KB

MD5
c51dd89e43b295ddc017ffcab02d6cc3

SHA1
0c2f94398288c6fc9e97cfa432780aec2291baf9

SHA256
3e364c3e5079958fd4c8ee4ea2ec39abb689e2fd407027abdacb1ec2dba326df

SHA512
1e908a4cec6ef1312c715daccea48f2c4272da156300bc7f8b7ad100b67fbfe6a7fad41103800be9694e4460e5b7614f09a0134674682cc64cc08b8e8042422f

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
49KB

MD5
ef93ec39f868208985ef559547e48657

SHA1
41216ca8c32c4e389a5aede5efb138e02d90f926

SHA256
6631d3b7efa906d08f4fa636ab00441ecb938ea8fe4f43a66d278e396a6972f0

SHA512
7311dffdb7df408039715dc9d1e8d72c92ab89f32b9b33133e5405e866fa7b1c8ec2f18733f5861eadade12cde6f78ec250d10feee46577b7c780139db58b70d

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
52KB

MD5
0dc83fc5364e4557a4f721be4933ffed

SHA1
a636ea2f55065707e0e68b8cda31ed85ef677644

SHA256
49a02293e25c690a0d5fd598e030f90d0048f1d8ff4371303121ef6604f888c9

SHA512
d345234797b9475403cc4788df03b3e9f1a574173d0d8247671350cd431b4ac30d907bb2b22678fe0e714ceb68d7a26be435d233684c67f8d204d3b5091fa513

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
44KB

MD5
03d559c9fbe19587fe82367006e99432

SHA1
d245bef8548766c3d46f205b4976f6a0d02ffad2

SHA256
520c815cbbffdc46287cd8330e71c8dcc130e792505db1ec9da8a405ce5cdbbe

SHA512
a8a91b9b23df26d07963a7bd872e64e73531644759f394cd8989f2ff6b7ebf740d9d5a5f04d723c4c57f8b572814a7a8532779acc21b4e21f48ab75bf6557440

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
44KB

MD5
6454c249bf64cd69ac8ac14b57ae7edb

SHA1
76364540375366934406a021fb1eeca2b0512ca1

SHA256
dd2355951196364ef0034bbd0e01535197e182bf4e7c8759fd41598ae4881d5f

SHA512
1cdc8e5ab24e49c2c32870a999fbec969ffe12b55223f0a5aa0fac7d283fd4088d2d1cbe71dd68a2da5c6911ead8ea07ad67e5d52452ba23d4eacdf7b18b2f26

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
53KB

MD5
6579f99e83eccad65e0131da6040d92b

SHA1
e92adc61d56e548031cd3e2b9cacc4cffd4ec46c

SHA256
4d9da9b59184e66e369dfc66828c536834b4c15b0e531ec651f092d9576acf4f

SHA512
91bbc6764b415ffbd8ff04afd6336cab376743dc153d2fdc694172c4db6615fac16ece735e653d61cc3e3dcdf27affaa343de6ecd4f7eb4519e458862af53df3

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
51KB

MD5
84497a29dff5269c29dc867a297d5ed1

SHA1
5175abd030cbfc25f5560dfbd1c8c2598fe50e34

SHA256
e8dd9fa47f9bce56c4a2cfcf2c8cb164d41e9ab11d0663d74791e0a1e047893b

SHA512
15e5d67864262fb66171a90faf255162e41304b960461edcf8cea6069d43f7aee27ddf5e71afaa709d77d8f6f551a354713fb76f640c0979e47df3f02aca7545

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
57KB

MD5
d80c31d750263cd1a05d91cc2e0e16cd

SHA1
7e4a06478d47eb3e4cfc12016804c4a3aa8b0c8a

SHA256
1b84b0d158c01d72f94d83ef8d2f67d024089e8c2d00b810a1d697fa4068dc61

SHA512
e45c636c235d5573eb406fa619e4d8a15bb12339646a8c6ead1074a1510045bcdfc2c147d15895573e36be8f4d86228022559c750c438790160439de17434fdd

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
53KB

MD5
af2be83fa99e0ddb12e7d62d963c5904

SHA1
ce88d546ef320e3604bc8aead185347b6a08a653

SHA256
33dab4ca6d5224d780ebbd8ff2772a30fa41343ea0fec89c31e25c89ac19f672

SHA512
7ecb29d4f6959c6294ef8a68809403b9a44a76679827c0235d0f56d7f21acc3e9e75c028afa65623b2b551e6dd2ad7750635c50b65a865ece72ea76087e6cdb3

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
51KB

MD5
fe8a3353e9417c90e23adad0bab46643

SHA1
8431a8e4c0a1bff410cbd04cdf642a3b5d1004ec

SHA256
9af8bc128341a030a401fe834203cf6f8fad366f46b61cdc8055e7b5d41de859

SHA512
440690f5ac2a396a851a8fe357cff0a389c403527c03b12169cbae1360288ac52256b417031f67cd5c7e16e533fb9e49153eea99c5ff908e2e4fd71bff707caf

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
53KB

MD5
23ea2d23e163de3ee7c345a62c11a4fb

SHA1
532e06e233ae7fb7eed9a74dff2a7110256796db

SHA256
3072f11d2f8c846fa3ca055abf685bfbc3d6405c0347ed8f29a9c4954f258caa

SHA512
bdcf06dad9433a03c9445e9e481349f82b3c771521112f52231f225df49f684f78dfffd5871ecc006dba1b83841e59b9f9196fb239675115c0cea850f3085841

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
61KB

MD5
b097d5957e85f821e76f80a5ff00583d

SHA1
564c53b4a0bb7bf4261c40b8583ea2945de5858e

SHA256
da66a6d5c2c9261afb599551527683fc95921eaeb136243a412c84a0cc36bd7f

SHA512
822059d679c2993c63bb0c35136ec25a3112a498beb000c0979bae38e9b4043c9a06d0734c736ff69cd48ba35d0c0b1720bca3264b1eea2e22721ff282d4b545

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
44KB

MD5
8fa0130ab0fb68d22f03a20346812e90

SHA1
2711e27afdbf226f2f519a1ed3b200b1c5227623

SHA256
0be8ac236686fa719242edfcf55f03c96b0f870b8377bf4b6ba16b37dfcd9ace

SHA512
dd4d89bf2c01bc86ebd28f706bfa708c0490826311d01287d10a2c48f5c7ac151fadcf634da01f7b37b79c9f8df4b470506dd4c82f54b8e86d60fbb5c85c0331

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
57KB

MD5
47b4349b5ef967f3bf4f7b05c4a7057b

SHA1
82313d3dcfe316d55b3930a1a810498aac6fc921

SHA256
2d6271e84c72bb80f2b5a109b0216c20713362fe3920d739b40edafebc62f1ca

SHA512
32009d4573a63b32550c10e04b1c98fed3f92b2274578bb61e6a10663a0020d5f8571b1f28092fe7d7b700a62a26b6cae54e54d6b37d1a0b4e5b27130912672e

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
52KB

MD5
a93b59419af7a724eefc6fbf080f2935

SHA1
fac10f707b10906acb3f59d971f44d05f35d8df1

SHA256
264be96950bdbcb4bf3aad6e1836d8b05092ff8073425cce373f9f85333c772a

SHA512
a96cf46a2a6d729c9774e215711c1e37bb28d71ba7a17015dda6d705e1d6563e5e915aa2a0db0a027f29ef17b7d48b476368fbdc8ca18d765014388046988b92

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
52KB

MD5
ec63958c5166520225cc58214fac35a8

SHA1
6837ac95eaec631aef95d8b3b59eb716baab2759

SHA256
8f71cd9fe272097c3a62742251631a43f2d3840a50c5aec0296209d9c67566a4

SHA512
893a92e140c0f061bd592145a3b2b21b51ac5b392be59417e6e3052dfecd0953022079431e725ecf658772ccd01835d3218378621666a775e45ce52b66057f1d

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
61KB

MD5
8cc78d144fa3c902a43a7774b90e9bf6

SHA1
917eed4508b8df19c1b1377721a4ab471da40491

SHA256
289be84ccfa376bc12ad48117a55ac3bb7408a312986b73a03b5ee3bdc7c7809

SHA512
7a7717bd8a4fed1ae5710a7c7cc1659a3b433769728f130b64df71cf0a5c56515671852b7b86b617807c284288f5d02674301ac1c5d5c640b3ccda13b350a80e

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
44KB

MD5
f9dc6365fe9cd40fa78088490ba630fe

SHA1
9862c89953a9e79358ba7cac2c720a2940f05b53

SHA256
d1eef3e9a259cd3cdbe50cac61fe6805d172ef91f44d413eaaa0e957c273a4b5

SHA512
c3278cd0652cdce96c1c118569ffa523021b76acd3a8200447cbc0124ad22a6b698bf5be4c174ed71c9e8d53135d7b68fe3f311fc3d2d70d341a55414ecac8cf

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
54KB

MD5
0b6f859bc5b8d1c5eb1e94eb3776a37f

SHA1
7d79d3f655c43b45794be60cc9012b8e51ff1457

SHA256
445d3984d483c8f4b446a1ecec78482c501ff7fe600510385cc8534e0538ba26

SHA512
80b9d8779f02067fbde7d60e5c78dd6caf9cc90b64df6c43bbb7044ba52de7aa6f7737d390c96bea48aaa69b2fdea62f30f2187752d7166c17283c02434a1af0

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
54KB

MD5
b672acc1b75dee098b21ec40a8feeade

SHA1
dcfc5a205c5900042c6b8f67d561b3b73238e9b9

SHA256
f7dd0c8cd28da47213f99520076bbc3f077683b1ab124fd5764f2d92ce3ad613

SHA512
afbd76196f084a343c89aa2cf3ff84c913dec54a0ce21e78e297bc8258e8745d52d99cb087542e375c1d4cc9189927b164ddd7ac08033e6899031a5f169deb5c

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
56KB

MD5
e6e66a733de4e8d483483d55156b504f

SHA1
437ef566941441d9b7e2a4b42f8beb7ac8630feb

SHA256
8a7e73b4a444439bcf5eef1073c3a0c8015d2eaa86b16b533001b2e8b8949229

SHA512
13b740bf96fa2d8ec0a40b77fb21705076fdc36bde4233c9a04dbe715430c1ff2c387afd4509fc4016e5d1b33cf4098d9effb42e4debcc72295a32e0a1eacf7e

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
49KB

MD5
b287584e5fa776bc170be92b7776e3b4

SHA1
f3594f9221903f02dd4c9a3dbc798fd06c9a0e64

SHA256
2b0953b0bfe47eaf4803b0fd52ba6e0b3c8fc703385d96b87d10282495f00dda

SHA512
74dda76ea04195c2ad65ea339a2cd6ea7570b5bb72a43da6a4acc95769a33d847c15d00f7e9f9292ef1618f3e5584eb92201e9f7a741f9ffd54c4e1b5dc77621

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
56KB

MD5
25972ba623be3ab6c8384aa6b51982e7

SHA1
0fc804327487ff5ac23f363613a8402113c44a60

SHA256
47714bc4b16d80c2034542cc0ada9874ad1131c4550c417aeceac895b85aa212

SHA512
e98f582bb943e5edd32e35d6c227da12f031e123ceef56f6a145316d17f4f463817bb4127e797ccee987106fef71e3053d39ceec72f83c84bbd52e950a05272f

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
51KB

MD5
abf7f73b682116f78972dd52711c69ab

SHA1
098c384c37451eaf0f3f8a6c2f0d61e1ae68c74d

SHA256
213b022e3b91b176aaf8eb5aa893e3c4142fd98b5e8a562a90ed39996ca8228a

SHA512
aa02534e30067c6023c8b699c0468f51e55b17b490f5f7715f8b4bd23fd79a067ef90e64940776932e295edc0c64609384e55bb77c874d90e790f905ffc728c7

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
53KB

MD5
6d5894dc33d58424cb48df0884f01ac6

SHA1
2a96c1609ea1bb589db8f518e794d980609b3fc1

SHA256
4122282724fe98fdbfc852307bb68ade8c9804e319ce175171b9973e5b691dd7

SHA512
9ba946ad5ab632ed30a25ade90c5e2f9340fac18a37e0dfbfcf5362497db57ac4caf6d2ff6ce260d30d27b02e848ac73a2b4220f08ebbf209601716f6af7fe47

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
52KB

MD5
0573123c1a084d924c01ee4d44e16485

SHA1
e6a4d227e06746c3e671a93ae7c7a67b758d52df

SHA256
76bfcb1f55c6a718e0acae8ab0500b654c61b1eacbc20fde14445af84b05ea4b

SHA512
bf371a3392ea60f849d1c1f91af93b7450cb28b302340580b6527f0b365543b2aae7693c35fcb6c62b34010b664ef9a5b3964e6398fe6420ae058f4e995550ca

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
52KB

MD5
36ec2081b053544472d366c2968e7503

SHA1
4c0bd0f40334225efa35a866170d33e10d3b51b5

SHA256
34ee31597b9f05c3d361fe24d482e2a80b6c8ab543aefd40d84383509279e5ce

SHA512
bdb5937b6ba976a9fe3e73faa686ffac77b4eabbfbe22c379503b7c092a70519060eff2850f7304971f2b60d8f49d39190fa0359f92c9a41d5fe29503bf5f2ad

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
63KB

MD5
c50d0798ec64f1589da885dfe09aa481

SHA1
3efb612486f6dfcb65275e29b3aadc53b48b7294

SHA256
8b4bb01f87ebf9d25722ad2aa0bf361972e0642823022f172500d33ab8b2417c

SHA512
51ac4b04f750ba227dde0adf52fce8fcb66237d345a43cc6765995e63cf099b360b893b1e7b70e59d2b131a99b637b6e78cf6d5f3aa8470fbe33d1190151f818

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
48KB

MD5
2e86726a95de91a78d04c3f9cdf91504

SHA1
b4d95f03de40dc96c1928ef4c6f1a97e07ab3057

SHA256
b47d5eb4f306e427f5a081a56d20ed552cd52f0de329cedf81478e86405d1310

SHA512
89ab0deddc64102d6ee62b1313ba10fc7e058671194264e79570316ea1808097ee4410b732b113a242b81f87741e736a417bf924d699caf515077c659f5b749e

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
49KB

MD5
895f0e8a68f7725af2645e7ee3b00da1

SHA1
c3d4d8d454f2cc279da4a4a3c099b945668a18f2

SHA256
226582309ccd7828fc9139b584482a8474514b02aee36b73392ca7ccd4798997

SHA512
664a149440d9f3635b96b8a0e4080c7481373b3dc3fe9619c0c88597deb61126cc0ae3d6cfc7f23ba0fe46438581629e9c2f13d3d8f030581d7bdbdb20bf39ed

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
57KB

MD5
77f38bc3c1463ec8468dfb7d4c370b9a

SHA1
340581c347652acd623bde7dce19da81e311d87f

SHA256
86ce400d6b21b8b7341b1884511a0a8e3461a206a90ab2ac5830dc64f7aead21

SHA512
ea87853822f885ee4a6fc33fab2c040ca07f4ca640d35e2f408baeeadd1f7418df4cc2be048bab886dc1e65957864ba8a8c027ef9dca5dfcf32a2101d9fba0db

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
53KB

MD5
00fa78e31bc49bc5e5dabf7de5fc701c

SHA1
845ef0a8b6b8cbc188c3d72e896e3e76b6134841

SHA256
2ee79d959e132355fb198ce319853b94ad6da96dc6bdee47353aa476da14eac8

SHA512
6532a8e2a1ba78078d3872987e69606d6df8d3d3c680cb3e4bca11c5b9c60df1be771525b7ae31d672bc2afc7e8c6998bc064fcdd09ad8856950bcad99a8f02d

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
58KB

MD5
aa9c508d40766a24d2ffae5a5b7f84ff

SHA1
d6549a4e6be611181499893c9a989643862931db

SHA256
b1acd37d3e08ba931cde2b661de21b9eaf9978b02597a350086d5a6a360e937b

SHA512
a9386615568356d856216b580314a7e62203821a9ed09a502400a677af5757b73a8fea84ad2848df6e547d40c0379fccf0aa0fab480d296507359e1abb7f4069

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
52KB

MD5
73f6c6675d31fda1403e63a309c6b9a9

SHA1
ec5647b843939409efdcbbf9dd0c204de98fed59

SHA256
7017dfbc9410c5c16dca4b450ec07f00b253f033b215bc00320eaee2ef02bd56

SHA512
437369bc159bac0be6b75e0293c41b5bdaafbaefafcbac65204a0effa234ccbdf39ff7bf230eeecf2d50b220d5da29a1ecae31380de7b4628517cb3f5ed6010d

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
53KB

MD5
fff3f7dc7c7d33dbec747ce2c184af53

SHA1
1cbfa129a88a79c9bb0295ddf704280c0887dd95

SHA256
a7c842588512ccae8c62d780d7df3aa933c004df91d700b253ae4d1f82334ba0

SHA512
29b0b4e75a51f4116f82a1bff93a9ad31bd754a5fc4e91d4e5241520db6f4fd3ec1056dcffdd748de49b1d9af89766db7c0f1675a410be0cbb39eb33d9810b31

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
59KB

MD5
8d050c72cbe5d276e032922383f42edf

SHA1
52234be3654c362a1c93a2a2894debe32e9eef09

SHA256
ab24020c276b03d83344f6264b8b4567c80cfebd5d9627f98acd2576a0d785fb

SHA512
ed992c2aef70c9a8cb7a1c40edff7f4c01a4bc3505f85d9e95d21b0cef9d26532c6467b4d59b09f52e38d9d795a7f568093ee12e73a7a024ed902f40380c37dd

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
59KB

MD5
83c256358314eabe9098ebbe4a486f70

SHA1
904a52f74871c5d72b9fe5605bb3472dd479322e

SHA256
e846f135f328a9105cf452197ca98dfdeb0fe23673b635cf96c7d4d7a03a58a9

SHA512
ed2fa18c420b4a5148465a45680e4cfbebcbadd92492748669c7fe1eadce799635ed249f8bd469f576362a0237737eb1aec459c699c1d41516a3cd254af3b0a7

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
44KB

MD5
67f1bcb55649d0642500cf7d7dba2ed7

SHA1
82b43fcf147590443c1b67a936d96e376038be12

SHA256
cc44bc4d6b72b007fb22ced1b0bcf0fe0e7d47da32a9ac1f8259fc0958b92748

SHA512
0b97152e8f71fb9dd98194ebf8faa7126d2e4f252396a45209ee71bce779f5a73520a59ee08c8cb20dfb1f943d7acb4de424db1b757caa294f6f63b42c17299c

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp

Filesize
54KB

MD5
2f3115a7680a9f0d28658df7ed8a9fa2

SHA1
81f68a9031939a5d27251f81671f1e0e476c6620

SHA256
fa4b221c0c0288e9145ee38fd7758119d5532eae522fad1cd1999e61e5b74c36

SHA512
fbe5f795a887559fdbc2bf19f9e31622b4fb032fa75633c8ba36caae4b5cf66f7dbfda5734eb8a205afbcc83a490d14c06f685e5796b351f91fa82e0216d0e73

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Detections.log.exe

Filesize
44KB

MD5
c12e7812a7649da5585c51f4830cedbd

SHA1
7730711fd1ff57c69f728d7bf029ef05ee2bce74

SHA256
1bb19b61920f5c227a17ff19ec96355ea01731b8350c09489efd57c7e55b8ee6

SHA512
58ba8fcc7e9abf404454e14bb5a0d32b24392192924ff6755050fb1857f0449a9e7f5cd74173f70293a58a05e677cbe46f428007a3a88bfadfc5213d02aed0af

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
44KB

MD5
0ab2179baf07b66e949ddd74db1fb2bb

SHA1
0a9172c88137264ab43080dd8247107384b6a4b4

SHA256
c42b4ab4afa79ada4b049d83a392b37983d9d5f6c6167130fe14eeface76292b

SHA512
713ac0de8634fb47e0a62be9cbfc26c7f423ad010a5117e35ff91edc6718e62522db584fdaed7ab0ff64deb909b2a5154bf4efa702232c8447c8aa66d8776dd6

Download Submit