a2d7724ec81f8d5848d62935cc7cc21dbd43d3872327903c81bf0e2103d5544a

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a2d7724ec81f8d5848d62935cc7cc21dbd43d3872327903c81bf0e2103d5544a.exe
Size

83KB
MD5

6329ce080a04b88f09e0f6fe633a9a91
SHA1

1fa8f2542f4318a3bc98e0355fb18a31610019a0
SHA256

a2d7724ec81f8d5848d62935cc7cc21dbd43d3872327903c81bf0e2103d5544a
SHA512

24da75bcebc7a9e83b4e51526a842405f511e9f02aa1c1689b214aea31ebc362e5c2c766edca20b09ffac9eebb3a439949915f085c782a58e6735d13d0cb5740
SSDEEP

1536:W7ZppApBULcfpHLcfpyDJ7ZppApBULcfpHLcfpyD3:6pWpBwchcwDzpWpBwchcwD3

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5294) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1632	_Performance Monitor.lnk.exe
1464	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	a2d7724ec81f8d5848d62935cc7cc21dbd43d3872327903c81bf0e2103d5544a.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	a2d7724ec81f8d5848d62935cc7cc21dbd43d3872327903c81bf0e2103d5544a.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN001.XML.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\eventlog_provider.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_elf.dll.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Client\concrt140.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\zh-TW.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\OriginResume.Dotx.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.exe.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OART.DLL.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_Performance Monitor.lnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2d7724ec81f8d5848d62935cc7cc21dbd43d3872327903c81bf0e2103d5544a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 1632	2992	a2d7724ec81f8d5848d62935cc7cc21dbd43d3872327903c81bf0e2103d5544a.exe	83
PID 2992 wrote to memory of 1632	2992	a2d7724ec81f8d5848d62935cc7cc21dbd43d3872327903c81bf0e2103d5544a.exe	83
PID 2992 wrote to memory of 1632	2992	a2d7724ec81f8d5848d62935cc7cc21dbd43d3872327903c81bf0e2103d5544a.exe	83
PID 2992 wrote to memory of 1464	2992	a2d7724ec81f8d5848d62935cc7cc21dbd43d3872327903c81bf0e2103d5544a.exe	84
PID 2992 wrote to memory of 1464	2992	a2d7724ec81f8d5848d62935cc7cc21dbd43d3872327903c81bf0e2103d5544a.exe	84
PID 2992 wrote to memory of 1464	2992	a2d7724ec81f8d5848d62935cc7cc21dbd43d3872327903c81bf0e2103d5544a.exe	84

C:\Users\Admin\AppData\Local\Temp\a2d7724ec81f8d5848d62935cc7cc21dbd43d3872327903c81bf0e2103d5544a.exe
"C:\Users\Admin\AppData\Local\Temp\a2d7724ec81f8d5848d62935cc7cc21dbd43d3872327903c81bf0e2103d5544a.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\_Performance Monitor.lnk.exe
  "_Performance Monitor.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1632
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.exe

Filesize
40KB

MD5
0e42ef45b4009986a21b0a6424ca06b0

SHA1
13d3d9f3ae5a269ff902d8f23b4e34bf58a17090

SHA256
75759770d71ac7245eb7894367e50b802bf2f3caf6cf3b5264b9f0ca6d0a51ef

SHA512
11e3fbb4568029aaa3d5f840432166265879a9f5070b4e8e2a860b13ff51b85361477332e459ac8ad8fe03b21e82bec5a4575b5eb19a70f92c28a4d11d3ae5d6

Download Submit
C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.exe.tmp

Filesize
83KB

MD5
c3e092ea5b0278e71aec961ad082cae5

SHA1
bebe6daad5b9b54baea9302922af0064893b1e9c

SHA256
0fe1d039c21d1b0f3573d7c62c5d960817698d48d99592a794b748d8b3dbe8bf

SHA512
02fce5663f27d302959321c62efb9d24168bdd5bdcc8329b72a050c617dc69b269f9533bac1e280ba94a3dd478d3a9617f6a92af501e7e7e7b08ba19a508dd6f

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
153KB

MD5
e92ace3dc08ba38d325dcdd694982c38

SHA1
ac06ffaee2166a2031b3ed5f722e7aff9208a40c

SHA256
2df472fd65bc8d6cf6ac013634714d998df432a65e9780ac40a88ed351dbf6e2

SHA512
71293103dd0e7e44cb3bac96466bdad88c4c75b339cdbd1f1b5b80aacf595c92c6c454810babc9d17befaea68d19fc3444fd4d796a9418a5456df6502da8cba0

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
139KB

MD5
46acfca21c59ea89b9f4f861f423fa3b

SHA1
8380acbd1d29b55d1c9687918a8ef3c9a468aeda

SHA256
1eeb16de1848429be01ede5c6fe305f9ca67c1b5d5da90a8f6f705d8e688c644

SHA512
d716e90675c318118bee6345c8f588c94028591a082aa4063cbb94abacef7e5e1222d37ee8c67450efa826a8e48a9292799f43cffde297ce716fc6530fcbb8ac

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
aaa185310d4142de7168aa1ee9be9975

SHA1
3ab346a77e6280975473d6315a4339d3e9ec05eb

SHA256
4e10f2020c37c62cc28b741b218019918c93f731e44c1a40143016da1d2beb8f

SHA512
c0d0e74e802b7b3551bbeda894dae29031316deda8cb3e23e1cca7a0b97001662209a3436fbf9c1486f9da4331e9c47030d933a74d91b1dd19c9884d20bb1758

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
586KB

MD5
c8b5978e8dc73466b682c24ee7e887ce

SHA1
1953c6af5f748efc619642a5efcff915fe319747

SHA256
d0e5b894978fd8d569039a9bd06930226092f159d1e70b31a0b26ced84289917

SHA512
a24ed91bfc8c74dd42da4854ca2b0c9c3958f0170327f4beaafa614a3ac0b2ef97cd8c16b66672ea0e3faf0cd1f1e3319114ad79a61296a2c4bf3c8114a281ff

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
252KB

MD5
35b50b28f7da1b6a4657cd0c3fbd6ad6

SHA1
8c4044ca5fa83372184f8d8d6884b941fba1542f

SHA256
200ac9ca67207f870ff1ffc7e9c5a7baa12dc8feb4bce1115f9a905d54e0ffac

SHA512
af1ce2efb78710741d9f0c001ef70ffb838bbaa19bb562655898f1ec3ebddca4b136163a338bfd3fd5f167ca6e22d6c42d8c441db6b61991d2afae66f78b58e4

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
973KB

MD5
17b0a2e0237693385c78e544abef950a

SHA1
fef92f6e801476c6d396dd01ade2eff34028e667

SHA256
a69344491efc2dea078c3f28b50f80ad5035cd9c1c18abf1bfffd97f8f1da65f

SHA512
f559c4a65634829d9c6d61dab86e3c0f8f17b88926b00273ea9c61fdeb04b3bc60f8423f421b15d2de28d19c20298eb805a4bd782a4faa20b125657bfff195cb

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
726KB

MD5
36370bbff04a59868807be0c16730116

SHA1
c5b9bc992c8a94e4a66d8bbae78c53c1a9cf343b

SHA256
83c9a1f72fa1b57f3d8f9bbfd53354c14c5c3d2d85bd8ec6d63d5f1e1f97bbb7

SHA512
cb516c1638abc066c3ded0efa298b6abb2147adc214ca1ad904fb956208342ec70a18210fd1e905a0dcccbdafc722763db05258ca0e4ce290dc608c40ae17413

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
99KB

MD5
4a9781b1ee6ae8020fcc90ad4f19b4ab

SHA1
b27ed84b5fea2db66f2f3eb92e2e5dd97fcfbd23

SHA256
4a26e8380e008511460482cb5b7c139eea15c651cf163bc9e0f3de6696f05c6b

SHA512
08645a87f7db5e8f481a05836430f19a50ef2071bd77b8d4b3814801ce9af7802b8e30869c70fe72b1b488199e9de170fc99d9e1dfd3b6586387eb8770699d53

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
50KB

MD5
6a6131e4f99b053acaaba50c7954200b

SHA1
b5c70a118cc5ae812587ca73bf530b7db19f87d4

SHA256
e7487778d8ad0db062653fe5c1f1fe0464d84bde356b54f2e59a19cab975ced2

SHA512
6c6529611316f6362cd3553d5a797bed590f9e7e63c5cd9c9df6300944caf7aa8e3a88854246950ef466150435e5e824892e2f679f96797f92b8ae59fdfdc8db

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
50KB

MD5
e9ddc2a9ce0b293d9477504bc4ad3c98

SHA1
f9ba14865587289948111398bcc003ee234e6aec

SHA256
68e5d6c1c3fd376e90d32029702a661fa8babc52ae0f51673b1c8c36024322dd

SHA512
6c3812d9b912a638d4d43b2b013ebd40a3f0e2f9ea99fffdacac9c72155ef7c063262dd99a74bb4c60fd94d90d7fed59eedcfd41ae84c8c7fb505d6da456dc27

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
52KB

MD5
75e81b29fbdf483aedd488d75be589c9

SHA1
198db4581ced530e2477ae688071831630efc371

SHA256
606d0d4501f456e7bb5b4d071635a28612c630098f05e6d45766fc22c36bd4ef

SHA512
bad1ab32db3e90a0f99ac20b854716c28c7efa25106ae2d5ac1e418dcd140ef9bae1c4d14054b53280f430edb47487b43beb124e5fc27320c5a978072a92eea5

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
52KB

MD5
093b345b4b9898e4e36a528f5a0384cd

SHA1
cb27f0738b705385c39c637e3e2ebc940a93a32b

SHA256
fd8117d55fb08d2f314fe46a69fb31a815663eeb37a9367a4fcc0ae28a3da4ed

SHA512
e9d4a8e9884e01b0689ee41b6d8ebac4965fe9d70778431e43c63c1d758ac96f4aa09098b1279369072532f489bd8d4b67daa2d91086844d953336efae3efc33

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
53KB

MD5
991052e2ad269cbf0859f9a7a59da968

SHA1
36087e739e29bba1cb2c350c12cd3f93b39c7b7c

SHA256
c449e9044a709b03cc177f84f0b7fcf9b63b0aaff9acc5378da34611231de4bd

SHA512
08ba334b52298a245c6441d9d90d3756fad302c32b9dd81ec5b72e8e7405890c287eb505ec1fe83358e56f916446dd5004e204f7074f42b2150b458463d226c6

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
54KB

MD5
6c8308a1d49f60f4525f5ce3cb60faf0

SHA1
4374678fc9426fc49a1635c9b66197c328d08f46

SHA256
44558a022d11577fb82caff3096429756633a827b47888d11365a4b4f0f3aff4

SHA512
bd0446be698c2c752c848689b6d0ff87335d885ffc8481061a94b32253a207e6ae2bfc458fe30fc876cdb6500d97c08c65808695335fe7114bbbac7bb5ff8a56

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
57KB

MD5
6c454a03133ca48fa9ee03f854100223

SHA1
795cd48633f9710cedea01a65a56961553ffcaad

SHA256
d365977b30209ef5e5c4dcfc4e54e3edbeed4ddf829714ed4a5a68dfb7a33234

SHA512
d2d33acbce9ba4f31abec11567377bee40b365b0ca3c0b65c71066467a35f43da50963a9bce0022fb04caeeaf283c6c7f466de9e7c629c480c7b8570964df771

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
40KB

MD5
350fbd9352d2341cd410b9e0bf72861a

SHA1
a63ed48a709b96233f44d29ebdaa685d756b33d1

SHA256
ca0c3bc4e29bbccf3b4b71e38ebbb967c5c2f004499c8168ae15ef0b99085e43

SHA512
216fcad9f7c7a80cc1e3812383e45cd1609a6f88a9e04871740b171814562551c8677cd73fddddcc54585eb65a46297a9d16b900f5b48ec9fcd5099f2bb324c7

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
51KB

MD5
8210b2a15af9b346a419a0233e4b5a7e

SHA1
0132ac49db91f2a9e6bb02bc53c4b0b1c5f6412d

SHA256
1108f34093926e4d1ff731759ddb25203a72854a0c86b8081036844ece970431

SHA512
1584ee4459628f434dcb056a033670876704755e35e5db1e5555caebcb4ef0d7b0b1675b3368b1f85aeb2d44c27ffb7687c4731377e409a23f704dfc4fcdbe39

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
52KB

MD5
64fbb7e6496da4773388c5bcf71b79ae

SHA1
5013416ac1841aa585eab4b23578fd947f0cf896

SHA256
a154a646688e3a0d15c99f24cf6f08bdaaab791a0346d1aa7156435906d71ea2

SHA512
f3546a2c3aadc64fd65cfd4a5f1d48f2f92d92009b15ef69dcdd348208f700d82677231dc6554bf9fc4344fff44c13dabd61db6ea0309afdd15258b8b8159e54

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
50KB

MD5
108af8df39451c8541af1488b76d6d87

SHA1
f517d8b265c95b7bf15e8ede41a2503f3fbdbf02

SHA256
f630847a4886bec8d33dfc6b710e617a2ed499beb5b1ea7ff5c768701ab78f4e

SHA512
27288bd2a9bdd43cd6366e7667357dacf678ba74983d4f7a01b2bdfeeab71910e0b6c52bb60a8ea17b8e2e6642dd240328a8c6489ae10008297edaf19112450d

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
47KB

MD5
9d33862f4350bb1e2b1c788cb7bcf463

SHA1
52799e1fca5d348d3136ae6470f7be85a8dfe030

SHA256
099a69cfc69395b540167660c00e4b4150596a77e4265c9fedd5593aeee5bca5

SHA512
2b92ecfaaca018caf07c5ca46b8bb5c6af9e8d4f54c7bfe777f6c457f49c982721ba8a7eb265891062cae955b9ca1b14588044722cc167327438499b718bfc85

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
52KB

MD5
b53f9ce55e17a2c96abdccdb6d95057c

SHA1
071bb697035af3bf42dc593423535a43ab2e4199

SHA256
98f78f72967b2259dc10af0c7287176fb686a3b2ad214fedebab63d9438b4479

SHA512
8f61ff5943f219f5f4f56df2d60d5a961ec161fb068d644d1eea1a44f3b61e0d61a9e110843ee7a9a858e8ee1ac70337d22f4b6e9edf32c8adcbfc5f2dd49007

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
50KB

MD5
a8ed72c9ee27ff8567bd6d6b09d3f916

SHA1
828a793585ba41fd0d90a6db83f8223d0c77f1c8

SHA256
e8d660a1e4d36c6f57e01bda914efa0ccf1179826598a1b36507b19fd1a4bd17

SHA512
7b063e20605514b7479d4ebe1d1a46bb435f93188ce6ff59ca6a4b641c17775284a327f4eccf6f5e06896377c3048ba5fbb8fae33740776fcdcb8f637c2c6b0d

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
49KB

MD5
3b5f9e1cc43b27215d4370cdf88e8377

SHA1
ca7ec52dadbc9760860007891ac7411895bb96dd

SHA256
faa4008f43aca310c949d6f44df0b5e46cb45addcdc1d61b3a21ada29b9b788c

SHA512
fb08007c6cad2ca8753bb562b64bb99e6192d9b62cce6ddf48c4ad0399b688bbf24402f7f9a869c8f8377961b72b400def7ab44b059e3b098ee01f6cb740efaf

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
52KB

MD5
ef0556e717aee737a56629b513ee9af2

SHA1
5626649df753b3ac9dd2ad6e1b5001c80ee1ad20

SHA256
e45792610b3f6dad653fcc50dd7722a42b53527e8e3deab080ae0503f70600c1

SHA512
4595595eecbf1fd2879fbacce03eaf79d0aa58f2a38c3571d15ed350c1928aacf23d3ec45bc44d0c4d87c2ec80202bc2f13b6ea2423f367c00956e1578da6ef3

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
48KB

MD5
a86325fb504f8fc184e960c310c3c8c2

SHA1
1c54390574599087e704e94550ec4ca248ee794b

SHA256
10a3fe92f709175036f231a64fa8be1cca5ba1df7a5b3e8e55734b8507ba064f

SHA512
4fd176e5061ebe4a15423c8dc2661e90b534e9ec93c27b450bc67b313dade4a27d72751624f87043ba4ded899f1bd4e7d952d103c20819601bf9be0717194e9e

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
52KB

MD5
248be46bc64c46e075ec520192455234

SHA1
5b0040947d1514c2367067385c6f6d9f027742ea

SHA256
4bcddfceb8280340da2cdd5fd17ba0711f3572d6afb3da4b75ffe0303a610372

SHA512
c2d53e8c68db3ebb4b72d71a7886fb6947ad71d50dc7650a6e8ef97b6da5a3738977ec0cda09943fdfd3129e1e3fdb2f1cc30eaf5fcfaf9068a032a4ba9d3dad

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
42KB

MD5
37d1ac189390f487f007ffd5af3794f9

SHA1
af952ab7dbc92833dcb7133ad1dab27719cc50ba

SHA256
f031472306ae0bc2812e76e1b8ab5699b8dfb9223b37491a875b83b9fbfcfeb7

SHA512
36a13a5a76b0128065d5c2b2df14e31359950607730e5bf74073c14e47f86852e00d4c5b43278bebbcaceb7c6953d02f34b32bc5d508fd18e7c8e127ed58d16a

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
60KB

MD5
5753ddc8df0816f0a34d45e140eb2f73

SHA1
cb6e9a884ae9c51f0ca1063a9bc20b1bebad032b

SHA256
a15d63f72acdfb0bf4f31a5842a52c68a8a910bfd72a011cb363136af6ffc318

SHA512
4aae38f0c64422e6cf2d5a2eceaa27af72c02f4594ad1d5fd9c64e5b490fd1585d97141902d2024d78798a15ec6777356470f194eaca52d4539f98d467c5dabc

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
51KB

MD5
7a944beb8edbd102ce20268d8b64f1c4

SHA1
585e7888cf288003a0cf82e5548191eb6582018f

SHA256
2f43b2f29817faf84c028d4e9b52eb0202f2f2a40c1e53362337e2574c56510e

SHA512
d63e1d00221273eadea1f910a11e468051a101f081c83a783389995bb8cd7e1cba97b4efe9778236ff577a3331d13bb2d5e10994df50d92f2f47b862181140a8

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
52KB

MD5
da298417d2cc371f3d1a412ee18f073e

SHA1
d77906ed57c1ed0e2fe3fa2a03d54b36915d412e

SHA256
6552158b209d982af9f7917b1662ed2d2a4231cfb534a1a88e23cdc423842443

SHA512
2c5bdbb3b0667d07d003048fb4c44d6c186413f5fff637b440c48e153ff95cb2e64f5f2258a7dc14151968df1c0fb5eac0bdb9d7bceca48c06a8c6357cc5dea7

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
56KB

MD5
350e2e2479ae5d8c3597dd2cc94471e1

SHA1
27c683faca5fde076368f57485c5b2c2901679d2

SHA256
9373bdb30aa2851cec6a5351608952a9a8ab43c2b4f4319308a3c4626361fd84

SHA512
19109894e8fad6ea845f611bc276aa7de3d2e82b004894449fee05d93951003d46ce7ee0ccae1f0311089183ed72044ae3ced7a79c4072659ba5ea745661638b

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
51KB

MD5
66c701dfd6d34d15d974181273a3877d

SHA1
430eff5c40c667fa633f0fe9464e873a552dec78

SHA256
d96fb8355e189b6e18e3033694d15826da1e66d9f19d8f322f2a5bb9988f4093

SHA512
694c1dd90bd42cb6efc6d45de556ea75ad9215eb9a3c45020937ccf545f4be6a980f305cbccf04ea1ca2dbdf1ab3862aa87c06baf79e80696989a0087f73b928

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
52KB

MD5
89755e824b171c00f50ad47d0e749114

SHA1
e93b5c95006b36e90ebc97eed2b69343d1cc78a0

SHA256
c150193b7621f2ef6fb009384c1147c23669314989cf7681f8a7a6fa564acb6c

SHA512
9a0ede965bc166b6d004d19d10c7a19cf524a684560fdece9e6836c53ca5988fa6fb8e0390bed17edf1e07ccf3429220788a0ad21109eb229cbc67ef24981cbc

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
60KB

MD5
f8c0fa10c53d3dcdd5ca3250c69eee93

SHA1
ba9f63494bd7e2b8af89edc1364a2d5af3db2f40

SHA256
a62408a95db79a42c246204640217111899c63b656c874516311e6d45349b8db

SHA512
1bd2fd2ac196a123d042db341e8fcb8dca8105a03ea44a5103c476695e4fd6e8547950df930eb826381c463c7782923705f76e50b127d4070cc2317541e1503e

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
51KB

MD5
3c2e6c56aec9409004375c60fcf216db

SHA1
ce7dadb9042c565273b882de3bde91595f60e9a1

SHA256
44c8edee2ac5f704e4a6384de2d7c3b7daa33672effbb02e9f4ab40dbe32988a

SHA512
cf708177345e32bf408d34c3821fcf6c7d2286b1bceadabeb1b2fb483b49b5df84748aae5c941ceb724003c970561f182ffe721c24c447906b32fa70ce0cb84a

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
52KB

MD5
b880d38cd9aa432a6c0b0a1e42e36096

SHA1
fd8d86be7ba3d09a966e926e84798056dc401a3a

SHA256
5afb74498990a263b63e499f07d9ecd6ca288310b077dd9f1a20fb5f94b36ae7

SHA512
d93183835898c0103420ad287ed0eb987ee2f78f729f9137263666f90c740aacea15a5058cba97234cb71301dc9f4ca0ace5e84fe22dc975b0927692f191bf16

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
46KB

MD5
da274f007ca067a93ebdbc04064a0d3a

SHA1
4b0a94f1060a3b3606e8672f51faf493560c5bd2

SHA256
5be85f76f499b789969e969e02daa961275e4f520787ee25015de2e6c2bb8324

SHA512
6f8b0733f919bedcb5467ee373b8daf64b28c46d8583b57c2d485081f00c2bfc8233cf14b983997d997774f0d4d191d8b95c74a92a1e432b134c918336d9f0b2

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
50KB

MD5
f01436f9ac72bc96cc4eaba891d54c2e

SHA1
4a370f720090f0c90bdab6da85638a193e58c6ff

SHA256
45635dd2ce914c0c806e248c35404f5980cb1d684fdbab0355a0a866609921a8

SHA512
435863d5009354935529151ea3f29bd1b65fd84f6e9817114398b29037b199557941b5828891e33f1159f34ca6d2a3f4f833a729b36a31170021b19ffa800294

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
55KB

MD5
fc7941979347a65ddc6b530a618f0b81

SHA1
aaca97838bc0ffe8237554cbcb70930e42d88126

SHA256
514be9c220d270b63365cf5bb795e92e61effdd97a53ebb7d05b39fdaec634b4

SHA512
c305223cae04948009b6af47fb16da132b061ad888ac01d9c297dc1ea2258ff205f7c4fa456391c5ec1f4308f06b669b818c2d94e85c5a450789eaf6336095a5

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
51KB

MD5
e229192d3bde2d4b2ddc9f7644c4bb91

SHA1
b489328860ce72945984e6cee9c9b61ca43fa9ad

SHA256
e31461365bab1e3387ac0e45e438bfe183e376807ec6593256e3cc63b9b54760

SHA512
8faa0d16d2724304134be7a352ca40edf8f1ff74714b845d400eaa1d11acb5a36714a5d739f0bc5b273004ebbee9e3d8867ac431c2bc9323fa5fc978dfa12bbd

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
48KB

MD5
729e671bd270ce3805f073844010c958

SHA1
35655c0425c127c2c8e4fe3ef27376e36eb28036

SHA256
8d9073afaece72d5d545538839dd2aba6f0d51d7aae3d2dc4778bc7a54ca4c7e

SHA512
5042d3872810042cbb7ff5b042039455bf3a4b1a9fdb09327e6413fdac99a28380c9c2697cda853034a5e81a0e17aecb89e3cf036f380a8ac8f172c5ad57ee69

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
56KB

MD5
85d163c58d314910aeeccf9b15473b95

SHA1
f2b22fd048584178aa54cac7680ee9d822f7591b

SHA256
b3f91ebcbf29951891e9c2ebc175fe3a8457c58110924c4f8d9a41ef54f19fd6

SHA512
10a841e9bc4f9cd8b89419b62e3c9a2b59da6f875e0fd83e564cac7476cce31db5b2dd82f8160122b484d793960b1bba8de960a156e970e3ee9f3f4ff30d9c6a

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
50KB

MD5
a7333b804028eab69e881b5d70223237

SHA1
48dc9821ffcc70289c6907c15f442c5a6aa490ce

SHA256
98c902eb27e977120388401e545acc5ae6a1b65e186147217a01f82abe770033

SHA512
a94b715bdd060589146a1b6d832f72c5732deffb7dcdbaae1ded58e2f76339cf9f26c8a24a3cd1335b94c2ac8e11a0d8ef4c4a13bee031be360412bb6855af20

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
50KB

MD5
e98edf31449c84db3a5bcd8d3290bf33

SHA1
92728518bb7328a79256e259b97536e2bea7ac8e

SHA256
df4a8587569315979501798bf2f6cf0171b88a02ea08acb497e8ca7e70ad3875

SHA512
771a852beb7300ebc0c96b21cb442874b4b8966cbd5f9a42c4cff68725816274244370b0f217a6fc81a696750072ce583c6c7dd620dc362a169a039a313727e4

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
50KB

MD5
54aee3f8147dc9bc582ca6a992b29b3f

SHA1
00d5b4277f3c322d551ddf9b85950f5a557784a8

SHA256
1566d66367f19254ed87710dfe592443dc141233284efeb8a41b2b9b80cfff3b

SHA512
dec47b3f599c28ae02d993223efe446719a35e369b11d43bce531c1e849939906b9b625af5790e281a9e86980184adfda1322d64d8c5d98fd4c5b28e6bc4565b

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
55KB

MD5
d60b8927ae6d42d8d08b46735ab2362a

SHA1
2e8626b2c698d6919f9a429451975e2156152a6d

SHA256
c7038f1ce6b2e05420ec7b30c5bdfd956b42cdac3e2810293ffa2944b7f148f5

SHA512
7a42ec09f7bb9b2152501d1bf2c341fdede9f77f5c5e3ac0fa4459fcee86ea012775f755531547a12900cadc30732195470196e23a39eb43643275512eb1fd63

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
61KB

MD5
bdb70b1e69cec2259fab0b7961b4a29a

SHA1
e0a4ef231c906436b2282861bca675aaa0ecc957

SHA256
60861485fa53901303fae8a9991f51b769ceaefbb1521ae551d72975f6698498

SHA512
688d03d092f78e27519e885a2f944a16eb1a587f1db84a8425c10541535c373e0b5a42dac235bcdcd17877715f125ec9c1d552d07b1e8e6cf077d6e95884dd00

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
51KB

MD5
59f84b67c79d960025b51c3fd8a07801

SHA1
f44dca3aaab81079fdc3ed8e4926312be2f9e239

SHA256
49eb64a92b6c5cb894a15331d1b76aa1d7c46b1c153e497e3ad99e091ba502a5

SHA512
81a0e85dd4c39fd4b78fb999b37d561b36c083970f7f6b03a959f773be507ce09fc720d3ac0af5464ed00d348b35403cf7dd3f5808521440cd115d24ee684f2a

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
46KB

MD5
0bd44361983b134d4fcc001842ac8ebd

SHA1
1c74aabc96b1f9f6662aee768f654f6aa6edba00

SHA256
f4f227f77c77d4cc75ec32c25c5316f7bbce52a7b5572fff4ec325e7bd5afab7

SHA512
8db671672b70e6e307655426a2b59dc8ed6b07366f20b9c64152af71b8337883ba00810d5e0e34ecb6bff1f995faab994d18f33f03a24baf651e8f5cfdf59805

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

Filesize
52KB

MD5
73b9ebb73e709097eea3caf14953dc31

SHA1
0c8da41ef6147c453d1b200e35e07c849adab98a

SHA256
a9bb6e52f2c23e76d52bf459547866d2464a916a8fe4cca076e0cc375151be86

SHA512
5c0ddbf7fe59afcc34d98ceb18c41dcb9c4348fd9ff48c5d1077f873d24525905a76048bf070d0ba5d87e4e67cf6804152a206386a279d381f295e3cf77a78dc

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
43KB

MD5
871aa5642ea57c2f5f3995cf811f4207

SHA1
4884483239c882aef6c08e788e3325451643ae11

SHA256
adb07d52043617b8a6ec2053696fc3627a2bc73a219d004dd8768c6fdd610e0d

SHA512
9952171b4c1588540a5a436c216e431be97a172297e6b54f71d55ca29f5c8cfca8f653e57af33ae8a10acc5ef09ee76544c63f334778add5b6ff2da16f506cea

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp

Filesize
46KB

MD5
a2f71be514f49f1db993042bf884ad00

SHA1
453a5b4adbb9e538ddd40709e0b1d57198db7cf0

SHA256
73892df5cb82ed717f9315e2d870058ea25a59c603c854c6c002e41144b517e2

SHA512
1fc01f0fd17d179b1e0bd8afda1123db78cd148cfaded43911646c7dc003e92a581156f6e8f9bc4b0b4b19e2ac752ab94b1dee152a3f2ea3e36eb4bc1b694f3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Performance Monitor.lnk.exe

Filesize
42KB

MD5
0c50f6279f80de3fb97b48c45d790498

SHA1
66b4f35d362e543042fe5040ac14917b8e10fced

SHA256
136970fcd2826e0aca636332e7994b54562753b7ff51414fbaa041babd3a44b0

SHA512
f87f1dd9f26f54b5773a61e6b9dcc82182843c1cc8cf45f4b5474dfec9b1e58e2ce4164194f5a61183cfa823a48d1d9e94b6113a74b57bf5585b10d0b031b9a8

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
40KB

MD5
255d925dfd59e3ddbce6c4e2d60dbba1

SHA1
36097cf2bad673bfb75926f1c3df3ccd46dac553

SHA256
95f69fb945bd8b43cc8b03209a7e0af9219f1cf4ec1b3c46940c3bcc705030d9

SHA512
9e5445ebb4188109fd4da565c5e0f8ac58b4487bd4b03d2b5bd089c0795304cdf9c6bb67754cfa10c7d657e2d316eb6862d21f50ef5ddc286cf1451b9a21c890

Download Submit