760b31963eec53e5b3bff84c7e81737fc811ca09104499ccdf4f227abaf16195

Analysis

max time kernel
119s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

df05e2156d4d18e333aa782a813f4dc0N.exe
Size

92KB
MD5

df05e2156d4d18e333aa782a813f4dc0
SHA1

29baa7815438f156bfb56cc46b52e6acc7f7f9a7
SHA256

760b31963eec53e5b3bff84c7e81737fc811ca09104499ccdf4f227abaf16195
SHA512

50afc625ea2e2e307d1028852ee26a9f94157d858c9854cfc7e7ff50cc511969eb865555936bf96632c95e95f3ebd06464ca71388312b4eb7ded869fd471b21e
SSDEEP

1536:W7Z2sspAp5YSfffynKDkEDkHp7Z2sspAp5YSfffynKDkEDkHe:62ssWpKnD1z2ssWpKnD1+

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4690) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1908	Zombie.exe
2812	_customizations.xml.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	df05e2156d4d18e333aa782a813f4dc0N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	df05e2156d4d18e333aa782a813f4dc0N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryLog.xltx.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\ssleay32.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationFramework.resources.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp	_customizations.xml.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df05e2156d4d18e333aa782a813f4dc0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_customizations.xml.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1908	4348	df05e2156d4d18e333aa782a813f4dc0N.exe	83
PID 4348 wrote to memory of 1908	4348	df05e2156d4d18e333aa782a813f4dc0N.exe	83
PID 4348 wrote to memory of 1908	4348	df05e2156d4d18e333aa782a813f4dc0N.exe	83
PID 4348 wrote to memory of 2812	4348	df05e2156d4d18e333aa782a813f4dc0N.exe	84
PID 4348 wrote to memory of 2812	4348	df05e2156d4d18e333aa782a813f4dc0N.exe	84
PID 4348 wrote to memory of 2812	4348	df05e2156d4d18e333aa782a813f4dc0N.exe	84

C:\Users\Admin\AppData\Local\Temp\df05e2156d4d18e333aa782a813f4dc0N.exe
"C:\Users\Admin\AppData\Local\Temp\df05e2156d4d18e333aa782a813f4dc0N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1908
- C:\Users\Admin\AppData\Local\Temp\_customizations.xml.exe
  "_customizations.xml.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.exe.tmp

Filesize
92KB

MD5
f421604a15e236c4257a0ad6985bbcf7

SHA1
8b364531ca8f49822b4dd022cd6e3ffcdb812b14

SHA256
07d5f8b5647425116ff278c6e4cde00c486030fa1b4017d28970387add326b97

SHA512
91e0463b267e179ba421d2c96cd28265cfd847f5960244ac79b9390e27ef9c89ee33f5f65132748e7c2743c2cf38a5ef59c450cea7668d9187ba1a8b41159d8f

Download Submit
C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

Filesize
44KB

MD5
d16449445be8dbfdc7a108a7019d7a70

SHA1
049708726a105f32c966cdb9e564f10d092ac8b8

SHA256
e56f6f8e746542d25ef0aec2e73a8784d6f43e3abae2a2ff70d0095465e481fd

SHA512
0a6a20a8754d1139117adbefb131524c284587cf5ad532df7d9fe12702cd6fb0bead4dc61eb298b440a2ef4766dc1a7012c046d6c2cd72c5b659036e923b4a96

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
156KB

MD5
41658bb275f47b4bb17ae05d75c4bd13

SHA1
f96d412ad32abae66c0c0890eb3dc39a40153778

SHA256
99985ed8e5cb041c8c4b978e3adc204ca53b4bf900215f7beac5a2a529f6c948

SHA512
98ee9cec0d7cacd0916386377cd116d5210e3d0a3e38ac68352de139e3293c680fecb4807e7b53255c3e3a4d7d449a15bfb3c2cc52798962701e38a6c7c0d884

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.1MB

MD5
61945b9e8f734445a17b5f58a2d285b1

SHA1
006a59bc6744976a118f68e51447227fea4b0fc9

SHA256
9d3f0ca6c1ea5aa8f856100fb83a2d72d91e9b1f7e187ea84dc27bea8face055

SHA512
69ab3cf45bd4bf38b39819f344888557c7d22865f4a204fc37d262d08c70a108cb7bc034c10d75a057d2421e37e55ff60c2b4d9b53c64bc11a62462acc31b815

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
5ad29f97dfe5f72aa050243db4a4deec

SHA1
b12b1efd015bc32576f66980b7290c03e9394b00

SHA256
f319490b1e8e406eac69d547c478cb2dbf87de972b21c4124267ec25b7ea2e8e

SHA512
4da0ffcbdc53f8fd3a27fec788389c4cec860f6d88076c2f7a3d83e0bbe9ac6138dce153bb69beee94674dfc2f8437c7ce5cae4417ecc5b4b186771b79dad109

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
592KB

MD5
ac2a22ef63d53a327717a53a208b7289

SHA1
07facba3f0a22efb5ad1d2ab6d01b4418f512064

SHA256
c069ad4a5290d0a009bb85626b39c6bfdf96ff2c81405e0ad6122a90cba573be

SHA512
c0ec17ec847aae5770e3f9f5d6c89b8cc574a53f57b29116ced9db1fc9f854d0b0e474c72406d473f47ed27f8db880a6a824630d464da9745f16c3bb3d6e0b6f

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
258KB

MD5
c1c72af592a28626585f836f7170ce71

SHA1
26745bd827800d7a350f22b51f4c8de704f421ef

SHA256
a3804e4183d10056a7c3b350943a66b82f402b321844cb0c4d5d0fc1f6920c4c

SHA512
59d0050705f4839117fed70b3e557a26f9ee2ec6e1a8673e60bc628f8e19040bbc4683761cd8c39191dc6b077221292df045c1a9c726595a16204a8876899c37

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
979KB

MD5
83abcf2b85a87c06cfb8bcd88bc882b6

SHA1
1de989dd903324e549ca3a11b3756a7e231de69f

SHA256
8cdd703114edc1529691b4252814a11f908a41c777f693af4900193073694114

SHA512
968a6c9020c4b3f3f37812b6fd216ba9f5c19e91bef167711a9927785cfe7cc92b94d68f81162aac2aae98bfbde8b47779e2da7d972e607f370d561507f9076b

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
732KB

MD5
e7d059c621bbe0c8c51050c2441e2134

SHA1
9402cb0462a06aaf8be5575fcd85429c7065240f

SHA256
2e941cbc2fddb79910f96286dc90910f9324bbddb0a8ea433a6baa10c31a1123

SHA512
022dfb73edbaf65cae40c4cc9e7903687e8a3d855320cf84ab97450ab8bfb3414d5017e25e7fd469315d234116554632235ac294d51fd725bca9c22fb80e40d5

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
105KB

MD5
6353b365c727bd47a3b64fec71ff8b8b

SHA1
e003661bfe8ea2f2cf34a2581e191b5324158870

SHA256
658475dd17e33f29126d5379323407f2b9da6e3d3a3f19ff42e2cfffbc33e59c

SHA512
9f412e2279ef9a0aa8001ff00ab56caf1fccb0c526b48e735c8e5f223376ef0fccbbc4a7575a71c21895141313ae28bf2942a4259d6e4a26392177313ebea935

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
58KB

MD5
857d347f20040b2f65fa3c6275da7f95

SHA1
c8c3f83f6c34dad034af24f9c4b81a48b4c641e2

SHA256
277243ce62fd499218345c7800f256f5ac07580e01f0d6b5acf5deabec849229

SHA512
5d528657cb567874d6cfdd573f3260084f59b80b2e3e089b582fbc3a8500ccb4286872a7e98d240ce629b7745eebc4316dd54592730e9017be5b95d4766b9eca

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
51KB

MD5
8fa67bff11a08dfc14fb127556a7038b

SHA1
ffc293692803005162c0f5016e5f2a1eed6b300c

SHA256
d40ea73decd43a2ac1a9953e9205febe178a8c13c1af6fa771c4bb6ccc20fa02

SHA512
241725330e7f8d42dc7b5590f9774bb01911a524e24624f2a1bf668a729c76c250ba6fbbfd550d6c14ffd6adf34248040d2cb335d2331d4efecdc2e1fb1462d8

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
61KB

MD5
ce513723dd5bc2c1cae633acc3487258

SHA1
b56953386a7ccc58ef7fd46a22812a72122fa592

SHA256
0df818077031132ba48edcf60361240582878298e73734e0bf77e444a64c84db

SHA512
9d0ae2fd08ee583bb5b74309f97a03d99ce9d002bf04df349928a2e5e2e0e90c0adac570632a05ddf5bafaedae543227cba5823286a6f1d5f6f655f2f5b242f9

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
57KB

MD5
53efd72f72196162e45bec4e710a6bab

SHA1
1adb59c6bc6dc18e13b56446efdeff6c40520a5a

SHA256
9ebf8dbd6d0f83ca24e7bca6f4210dd3cd8dfe36ecd227052ddf9d5d683b9ec3

SHA512
346898441e2230caf1e5d524be3a4e548a36f4ba73d81d91061860a6b6ff3c2a4f3fcb076a8acb1c21a84c7447da2f4410d6bbcc4e0eb25f6276830afc0fc533

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
59KB

MD5
8e2cfc03715e1d26470e32c24a3a06db

SHA1
8a62f46b579006bca9fd0aa65bff494b405b408e

SHA256
4da692a4a58dffdbbd0f45e02cef86e15c0656928b0fbab066cabc562a4146cb

SHA512
ea8a0ed7f5c9459b6c811925fbe1b54c9eabb0041c19cb5a0b7d2d0bde458e2f8aa493b889dea41a15a71c4b34d70cd3d52771341ecffc2f22de54ae6e7f63e2

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
60KB

MD5
89f3ec8d38067c986709bd90203e4ae1

SHA1
60468800540644d6ab4ad4096a3b0b3c499f6c59

SHA256
08455da864fef92a4ffa0f7af786e89ae7260cc5a1f8e1bf67fe72c49566d662

SHA512
f890e0f524fdce84fd90bb79d07d4d4d48d3c0c88beb45acc3bcaf50f68118cd5dc744c4c2e685e0db70c9a922a26d7818ffbbe89977ce63e47e3a9718643b70

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
61KB

MD5
ff94bf435ff36f5e97254ec9e616d7ec

SHA1
9082f196db13ceadfa43b9814357acf96b02dd1a

SHA256
4cd32a3f0c4483ac9787a0936323769997ec9e9e1da1f84d74ef46cd4b74e672

SHA512
ac8c1ea8280ce41c48e7d09cc8beca0d0f9077cc803c402d9763d7971977d4a4db0d613586a979accaf3a0dcb11a2a6b206a71f0b77e70c4fc6828208db3af14

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
53KB

MD5
7c29e1d93a5072a05da935236de112a0

SHA1
2bb77afd437ac81c3e9f6272f912b9b87131015d

SHA256
a0052e3ba7e3b0ba6637acb77fe0284cdcd8c54656bbd852104dd59895027d8c

SHA512
546147b55643c2a08ea5cc9afcdff9909f0c5bcc23dce4a5e7f6178e151938baf7fb93a255b81e24a229d80ff6041c4e9bafd11fdcf39919ffe01f2625c7085e

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
54KB

MD5
4bce3b817c1f515ccad12f07bb8e884d

SHA1
331244cb014ca450039f4e6451689048e3c11388

SHA256
93f6904137d26d5572d750a5ac2140e28a081f6d1582afbcb29300419ab5dcd3

SHA512
3ac656a4f631758ab5a0b6d74a9b87224724fde94d852a542b7fab3b7f2c866f8e919cea01f2aa0bf8b2d113fbd1b80266a2fa868d34076375485e2bb4db76ab

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
56KB

MD5
3b2f58fe4aab5acc8d1193ba4e2f3ca0

SHA1
70e08a60b70eef880d52745a2495d4733cea7419

SHA256
32dc44437c2100b728785c18eb96b93413b742ef3afe317c72729ab51309a638

SHA512
d2c4fd3f613ce0b7f23736b372477f7b92f1ba25fcdcdbc1ac8c7ef8bbc05bdf816219be05d96c53b59993bd7ff4b6ffe2b49d99372720289ad4bcf26ae3c8e3

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
65KB

MD5
38ec16e4b887ef750679312ec94eb38e

SHA1
a8966b599bfbcbe983b96bbfc7bd52053a5e9615

SHA256
2829ad22a63f235da1b9436d9f7cde35244a8e3e56a2192d598de18b751e852b

SHA512
f67c71e1e9a58e4989b11df87c37eb70f8240f8ea2255074e1c4e2cf8568d8a361ae45067046edd6711a363e74606a1ea72fcf4326db3ea8976b5f93d5cda03e

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
56KB

MD5
5fb9b1779ef17a03338686c45db0b1db

SHA1
8931bc4ffa15c40eb00e9bf93e5ce2512f8cb464

SHA256
9f3b1b672109d883059a2b5b0fb2402c8b1c38bfef27b993a8837a47e2b9b1d2

SHA512
84b71ad283cf8cce4c53080a17a96c2be6b46c521db90f4623e9ca4e1d757d55ce7d621d83c7d842aad7e8cc4196ee6c2e46c4c88768f4db491430f8476dbc80

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
48KB

MD5
d6e50a128a00601acfe10ff5a90cd220

SHA1
694c5f09fff7cf7c2ddd581ae537d1c9851f0770

SHA256
8610541b6a298435869379db49c105cd109720374f2842e9f80b45b04f2c6307

SHA512
3e5d4f52b8ccb66e29e19739b4e0b5be6d4f607cfe94321f5db2d340abc336081592f00b24c1e2d898aaba13b2ac40774ea1ed6908933c4e1d2ea34dcd19498c

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
50KB

MD5
29cae04a01d5aadbea8383d4e5a7bb22

SHA1
8975261684e3937779be881b524a039bd50dafca

SHA256
b7369dbf915a34d87b2db79e018e5b3257be9480cdac736f0e86c6bd3c9644d8

SHA512
a5210276edbf4c8b35c2856518305ef868826651f52306b3c7d42bd491e183755d1b57e9028915362b7d01356d9b52f891089f6e63e8f6e51b6d0f389c6f275e

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
56KB

MD5
24ac2296ef162ae74c0cff6c425b9650

SHA1
769ffbbf5ab386da78662331d9d000ef139e28fd

SHA256
c0ac6d8dcae0b3741407448a80886b6da49c07dfe23712fa5f199dd723e3a4d1

SHA512
dc5bbe1bd3d51d7be19b780af3dbef8e5886afbdb3437f117bf1fb094770f14063c8f33d33b7c1ee89542c2f403f18b9882732920c721ad2a18a15b8f0c871a2

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
61KB

MD5
3db16e6de23dde657a2351a697835854

SHA1
208e81bff432b13d3dc920df87864c4977cdc5bc

SHA256
cd8ed0640b00ce5f3a05e62d67a95edb488b12c250153ebb14efa3fb4ee208d1

SHA512
b2cb7f28fc236b04983367b3592d6dfdc0092e69488f92434f31a74a75f990c78b2ae287573563e11d1fbae636b924484e6357e7afedbc192850301e7395de97

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
57KB

MD5
5c54c893ee08b08f26ea10d1334f9d7d

SHA1
8c7d73d09a31a283e063fc6b6a733464516873a0

SHA256
87eccbb3145a406a6232d0e80bd0b1a71ca7e5ac3168d363fde0889184991213

SHA512
19d3a3d0993fcb89e8b78fafe97db9d19a778bb3afa00868604f4057d369c041a1d7bbb55720b2bf2ecaacea95cf1e064712111ea1bd72f20b9e13b55e517828

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
58KB

MD5
3eafd7db656badb836ef9a2d71b079c3

SHA1
637216ec7ab8f07fd7e3d98756c787eff88ae296

SHA256
47f5415b3c306d28cfd2b8e35cd39ea13deda7ad95f98fbacf1a4e43f7cca9e7

SHA512
1db88fe6e7a13c6d8172ea078f781a14efdb971fc38f6360a48e4a81bb05954d24c1d9ab8b99469d68e4596b1f72dc62eb9f356929d1553f71285c070036b6a5

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
44KB

MD5
ab6d464ad1fd3fe2fae8dfec1a7873af

SHA1
ce089b91c43804f0b09c1fbaf8adc6aa0a0913b6

SHA256
3abebbf2c3f4fdf283b4907e5281dc4b4c081b65ece3d916fbdcf44798c8b1ca

SHA512
2f4a4edf4696a3e87a209b815764408e8a9411a8a1673fb263ecab8e91bd048cb55b7f7587c93238386407ab167d3a17fd263a240f125965f0e66286960cfdb3

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
65KB

MD5
48b2a43611017e980d0f85acd52a4de3

SHA1
a9db66510487fd7b3f392d5e0784fc7813f544c2

SHA256
447d6893ef568b6cd1891620ea627353d58a5c381f26036c2086659af7e5bf5d

SHA512
f900d7c7227bf7583df5c10c29069551059c499602029244b8bc91317d60e55037bb97c21131cfaa90fd606fd467a0b85e2d28b69de6d28ff58463dc60cfb40a

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
65KB

MD5
ce18e460ca6d1706ddd7945d51c93ff3

SHA1
7925e2699faa9a06c26d9bbc599b8d3c92321a93

SHA256
98d243e0c2aa728c1860a788e93723549920791e4a02735ae35fd7d8785fd1dc

SHA512
c3559853a5609f10c207453f7dab641a3025439a02a9e1bdfd5fab0e224b773c3a9798adc4045fcd30d24c3bc6c1a18f3b1292dbbeecb71ff7ae86d2fcd6641b

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
58KB

MD5
f13685acaeab4766bdaa756e97fc5c5b

SHA1
f3e21a74acecd8b9b14384bd1a42f6b82591d827

SHA256
1546a0a4d0345136a5e3b7032e742530e38f47b10e0941ad4494897da0b3fd8d

SHA512
50c342f845e0c00dc64fd76c5b0fc4bd20dad135e4d472484580ec75cfe992f037214a024c2d8f146e1f03b955fa669a44cdc5f5458f5dfd22b33fce37ea0ab5

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
56KB

MD5
02081ffbf4573bd6587a495aa5cccd50

SHA1
77a8dc52802ecad8fd414564f7dfaca3fbe3c6cb

SHA256
ca5bdd28d54389f5e439b886637bf19dbba92525f814815a76a5d4d5760ff153

SHA512
cc757c7c500b5e7af08bb7ca48241a6562f7d0e69bbdf04952ace26ec8119279c0d6c62a414ab73bd7048b64f886e3eda08f31cde458203a149ce3f0d317a283

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
58KB

MD5
3b32828ddbcd497dea389a918944654b

SHA1
82f18f4ed99b491a732293c35dfe6451b7cb6f8f

SHA256
cbc480621dc34920a4ff5531b2719634adf3ebb20663450155ba5fb8607bb1a6

SHA512
08bbbb7cc6fc7315346debb786ddaa990289472d9c1b3bf7d524568b9e004bc9ccc7d89bb145bb09301ae994851bcd2e2ee70829a5ef3e5109c5bec6a810de00

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
57KB

MD5
791b576e047285ad8befa58acfc9df7f

SHA1
f05fef29e32e8a52ae615c6b87b51038561175d1

SHA256
3dcd85fc7a2a903c8d064c923f96648407e1d15a3cb2efe2281d89859d13ce01

SHA512
ef01a6bed4e092c72d37fc59c351ed1349ef194389b259dee7d8547c140f7668023a9129b6cc7cc935ebe52a0a9e7397d48a376df18823eb75e67a089b004e6e

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
58KB

MD5
b8122213b77047497a9a490bc56d94e8

SHA1
9fb226eee0e696a4b1474223262920348d841f26

SHA256
6ebab379e194881fd513773fa799a843601825baddf50f470d21e1b10758dce8

SHA512
0acecb74062b8330a2027713a6c6bf52a6848da2002f3f4e82eff1838896ffe5a80df61940b02904284c172cc56d89e6aa5ebbb5348616293d2f14c35fa53fc3

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
66KB

MD5
afa88ad981d1f3ea9984d367de36980a

SHA1
740b6febb884e0f99b1107b177e5d53294b62c62

SHA256
e2fe4aaafcabc0c64386af2c359fd20a57937c7ace4545fa88b19744886bbbdb

SHA512
aeab9ef538131b0584d1938d0bb1885b29ec93d50d902622a85105db6c1816819c930302ef22b4e3cfff14844d9c77ec51bfbaeb192e22136619d7b9187e9b5d

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
56KB

MD5
8a7c1fcd562e3dbe78e630816e5b5efb

SHA1
163ffff5e8f783a77dc591f5de74c0e45c1c7c63

SHA256
389dd1c6f66cb0b642a837126738982fa4ab07b1c877c195fd9f315d54fbb247

SHA512
3d4b331fca57c644a6caa9a9aa4f882d90aa4a8644e26702efe1cfb49362d9d9ce40fac6c6a05b857ade0fc5c6e4b1d1418d5936b8f5d45f183a259116cf9a01

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
49KB

MD5
09976f4f090c01c88f397388c0855b44

SHA1
1d26302af8a9984e6c39df3a5e6bc4fc384dddb6

SHA256
bea019929410e9c969957658532fab35d44cf8479466aa6b1b8a8ebd9312e262

SHA512
c185dfc2f7941c56f439a21e5c54767cb1ee1e1bb3eb2d0b08a3b335208096be6eb30bf65e63cf07fa6bc7d8a6d98a97108a90b654fb84c4376aaf09f8ca9ce6

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
56KB

MD5
8d476c8193bc4c74b62ac67e5b8c2342

SHA1
4961ecb0fc83c21ba11d756661da7eb577b9e5b0

SHA256
0fa452f88b4cb3bc007519fd0696297dc40e1a69a258560ce843fabc29834021

SHA512
f1ac1f21d5c69d24db6da35bfdd026b5b05439322b5b816b6493d52b6e4f07b6e6864d1112f5038f009ecd51e27a5b0ece5bd9742d8411e088c4729c9dfa9446

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
51KB

MD5
9b429e6b4c9b6220aef9581fb7ffb68e

SHA1
7b96d3bf8adee0fc4df1037c283a6c58eb3b6807

SHA256
cf11d60c0c20728a7b61695b172e1466fc445998eb3eeb740ae342678db105fb

SHA512
3e19d9237b22677305e806dac1d5fb8dcf80008bb764fbe35756f5adadd44ca5313507fe6891e320d75fbc499a15bc1ed59c059efde1645088776c530c22cab6

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
57KB

MD5
743b8367a6836fc8ea860d1f8803b67c

SHA1
4a84fbfbaab04192f19ed542a7f59a8ce0b0ec5e

SHA256
d5b5e9c58a54eb637143e57ebeeb8d3d4f562fea10e2e9cac7639e30347163e5

SHA512
63c9030870bead0fdfb74e25d0757cdcf2c666a3ca08b4f96619add2d4ff5fbcb71b836ea619cbe1c5f99768cdba3ffa4d6e8326ad7e5dade0139b39ea83cb3d

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
57KB

MD5
92a5976b9eec41edea85cded61c815fa

SHA1
72ff2c99602768ee757dcaef3c494e9fc970a57a

SHA256
93c93f3f5ad5b01a76690f56b0a7ceeef7f0dc059bfb1f6148599357791ff9df

SHA512
7e7148415c8fc9a1f70c36b860a909a6cd010d093a2f8595f4d9a4da10dd216421066a03bcd31926964bb97912a37195188597d6c4fad934d02c3c7e57ade3d3

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
56KB

MD5
aa1c726b5db3b5c4d8b099e2720f19d4

SHA1
15d2f4a86e0c4dddf2167460cdcf71d9f65c13a4

SHA256
f8c83acb51ed472edc1f5c8c25eadaf14b85a072903c255239a89a0c828a59d7

SHA512
664d15a8f8a15ab6bf9608d6a3544c1cf05f07ba63800bd61f4528bedecbdad3cc5df3b6ddf44b8bd2b609e67f4982bbb213216e3adeeecaae46f7181807aaf6

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
65KB

MD5
5a32024a63593ad7c67a542757b00450

SHA1
efcae9cb5f44319d1ef5cebb7a03753c9487e173

SHA256
d664a7fb77cd96273a01eb686138b1c1471f70aa24c12b20b7562fa9326aae69

SHA512
3d44d8d6dd3cd34ad5d96a637f17fcb93ea4de1f032f318cc28cda0fdb542e09abe4e0274f9414d62b14f8cce7ed37930c3af6b47b9c5c416f8df7cba3f286fb

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
59KB

MD5
69201409ccca1298e6cbf5e6c32b3aed

SHA1
aef4c5aa764a42d026504f2ce785f8b37298d860

SHA256
c631ad39fba1e13e1f932afd30197a19240a9eeef3b02a0f84f9bf3ca156f522

SHA512
7a417c8beb8b607fe1635ba5f2ce6113f4ae1835bd93bd9f9a92a623f3cf2e93584b323d68c6155a23eb0c731d7765b7c120b27b4c4c2bf04cc649086d06a8dc

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
49KB

MD5
e93a74b52f3579afeaea365e00e03b82

SHA1
1db83a28f59b0ffe4b7eefc8b718ef5b7473e2fa

SHA256
f5df9f3996f3fbe14a37f28b9c54f920d24f470f173f727049eae7363904a422

SHA512
bd0704d172002ab611855551ab0d203285980508380c24fadb174f8e18f9c8bc6d5c7ce8f042b033ed87d5daf383442fac2190fe2ee0f784a6d7b0d292735acd

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
48KB

MD5
861cd241b0bbe60e26cc84d7eeabaee8

SHA1
8e5bb55fb1e4d9504e36f27a1917beb21da2838f

SHA256
edaade02aef085b96e3e084c5a6f3484375e7a1f8a6d368d032528cc18fe344e

SHA512
afd2598f2e60701e4cb77b158ffa9feac4e774a7c031dd142bed0c4de707e67a8b8c856fac2c5d51250ac52763dc235eeea73536b0ee59ba2fa5b4509e6a3721

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
54KB

MD5
5f31ac65ea664d9fc9c647b0a02dd537

SHA1
297200189d346ef795d9556477b536c3a6ca6b71

SHA256
ab50246676b87650389a54f2e39efda0ef6681d93bdc18658e691e427d4e9997

SHA512
ddcaf1c903e6795a66ad70befec98d6e5b81ed2ce813a834d8dfdf1bf404221657050a80443504ad1f08baa16944435564bab3ea9830771c04c0c2ee259bae94

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
58KB

MD5
962ff76c320490902379bb9602900c39

SHA1
4c3b111df378b1ada6c066dfb63e8320739ab5d6

SHA256
63077d66ec46a6a00f4c998c4ccc82af01d70c5a61bc79df866299ba75ec759d

SHA512
fa76446d3751ae66ac6ca6fae2e5ec6cfb540c4875a53e438f13b0cf0d90f3c71d56b7b0fabb818e77c49fb65a5973bf45406cc4b0c2c468adebc6ec4ed8ad8d

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
56KB

MD5
b28bf817dad9a1090893420f3fcf6f71

SHA1
9a12779365f51fe5b3d685c111a7ab3c257278b7

SHA256
e857688ea85ad70a9957ae605130c531c758135df4529f1fc75886ff1bcc547c

SHA512
5e9f920296fe4b45b737cd7cf168ef1c143953a38194dae42f76a5933ea0418fd6fbe0413780e49c8bfeeae78aa9f3b240ce88cb1e1a9586d2c4384328fb420e

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
58KB

MD5
c970595bdb0f908128b13f7c9699028d

SHA1
ebbfa7334d53b6805b67f3844340f9d3c723b182

SHA256
5d7d14bf4d6cedc430a69cfbeca720bd5383c3d1687c8f37b04608a8b2390dee

SHA512
e62806d0f6db4157ab1723ba8205975ff41d9cc8a4284971bf168b52358027101d398c4c7b8adee22546277c9f640e2b53fd5651a8e8e87b58b95699bd100c10

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
63KB

MD5
126b2076d8cdfe414927b01838ce54ba

SHA1
eaec75603b4d3f3f2c83816bf364a7a0fca890d3

SHA256
e85ff408c020172f814e6d909ef80a179389cf5e43f218fecbef4658972ba4db

SHA512
df16632e5fbf193aa5c125ef3541bcb4dc2b0eb5f60609f4ddc107bef145e5363d12c0886c93c2072b14c3ed5aac8c94f7a30164afbc7c503ac4c2175b1b40d6

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
62KB

MD5
d59e2455583b81f9251ec9fde7e62126

SHA1
f3e6f4f4f49e33a6dfa6ba9c946d100051c63e9a

SHA256
c0e5cfbc2fff373169a3a4af061c4b6f18390121e17b4e10fa54163c76fdabcf

SHA512
f6e985453171a1a1edf8e6af655f27fd88455a4927a9f7e867ff87d4f4d2c5cfb370173fdaed278f5df042bb89089084f03ade15f36d787b6386a2ccf5f8a472

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
48KB

MD5
a4dcef0a38525c049e59400f664df6e8

SHA1
abdafdc7d6ce2666c5dcbbbeb0029df02ffa179c

SHA256
43fc2407b7b2c984cbd0f7b5ba1f7d63c25fe783ff2642e555259bcb494ecb08

SHA512
9c160074fb1dadda32842b879131c4f9668a0069adcd3439b4e3f25c8cbc97070a7243615b261e1a6311f60c4f042ccd747878be73e7e9fc1e601b56e86056c8

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
48KB

MD5
fb478fedb584cd9e24c5eb999a040d64

SHA1
948b440a6faecdd1fff2b7607c7b693ae1597861

SHA256
92dcdb44809ba00bf2357519b9ab7d92d4fdcf8d6a796a2bcc2e1a5e1b1366a6

SHA512
7f5bea2b1c027884eeca1ebf3405aeb471fbefccb07732731febb3d65df4fd1a68f2b4a15a704bff7b63cc5044f27fc9c70ef2b6ed48d995f827b4adbf015457

Download Submit
C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp

Filesize
54KB

MD5
cd4a487cbb19e09445876ebea767404f

SHA1
ff84cf48fe8a8557321af186648152cfc6dc1b57

SHA256
5ca88f0fb89698b8d86ec7b6a9d4ac5d5dc4d14fd6647cdb08cdd2941a00a07e

SHA512
e6f1f33903ad6f39995b16d198a8c92c5d3964887f29469fc7e92c21ae5d4a808bfa912e82380a99cd9648d213773248c17182fcc83caf270d1e82abd44530ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_customizations.xml.exe

Filesize
48KB

MD5
ea743a35aa7776af07ccb42b246bcd6a

SHA1
957a6c85072baf8afe74262770b39d08afb007a4

SHA256
01f2ef396a897d9700b7e1cdae6af4daabcc876194972be8c53db13c25f527bd

SHA512
2788d830c13aadc6f9f7121e75f8e37448683aaf2e367757edac2c26285beb2017a90d004cc28e825ef239cffec542094da70ef2b03158f6b3701059ae60d931

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
44KB

MD5
0ab2179baf07b66e949ddd74db1fb2bb

SHA1
0a9172c88137264ab43080dd8247107384b6a4b4

SHA256
c42b4ab4afa79ada4b049d83a392b37983d9d5f6c6167130fe14eeface76292b

SHA512
713ac0de8634fb47e0a62be9cbfc26c7f423ad010a5117e35ff91edc6718e62522db584fdaed7ab0ff64deb909b2a5154bf4efa702232c8447c8aa66d8776dd6

Download Submit