d4d75d5333bf23dbc07528c3a65717e914f058efc7d0a17e7885f30bf6a5ce27

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d4d75d5333bf23dbc07528c3a65717e914f058efc7d0a17e7885f30bf6a5ce27.exe
Size

183KB
MD5

2ecc5d8b0c0337fdc4c29f29c59ecc51
SHA1

20374d1602fccc86985f86c9b58587ebbba984ce
SHA256

d4d75d5333bf23dbc07528c3a65717e914f058efc7d0a17e7885f30bf6a5ce27
SHA512

79e62e127b03837d2f2ffd9de19c0e8c2d7b8e6092ca56be9999b568f1e235a5073f2eb1a6a7292d45a73448dda070b857af6a265956f4fef44f52f40f225e83
SSDEEP

3072:69WpQE0zxgMKNKnF3KNKnFb9WpQE0zxgE:nagMKNKnF3KNKnFQagE

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4902) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2696	Zombie.exe
2564	_desktop.ini.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	d4d75d5333bf23dbc07528c3a65717e914f058efc7d0a17e7885f30bf6a5ce27.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	d4d75d5333bf23dbc07528c3a65717e914f058efc7d0a17e7885f30bf6a5ce27.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.dub.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPRESOURCES.DLL.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\react-native-win32.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp	_desktop.ini.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-80.png.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.tmp	_desktop.ini.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4d75d5333bf23dbc07528c3a65717e914f058efc7d0a17e7885f30bf6a5ce27.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_desktop.ini.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2564	2388	d4d75d5333bf23dbc07528c3a65717e914f058efc7d0a17e7885f30bf6a5ce27.exe	87
PID 2388 wrote to memory of 2564	2388	d4d75d5333bf23dbc07528c3a65717e914f058efc7d0a17e7885f30bf6a5ce27.exe	87
PID 2388 wrote to memory of 2564	2388	d4d75d5333bf23dbc07528c3a65717e914f058efc7d0a17e7885f30bf6a5ce27.exe	87
PID 2388 wrote to memory of 2696	2388	d4d75d5333bf23dbc07528c3a65717e914f058efc7d0a17e7885f30bf6a5ce27.exe	86
PID 2388 wrote to memory of 2696	2388	d4d75d5333bf23dbc07528c3a65717e914f058efc7d0a17e7885f30bf6a5ce27.exe	86
PID 2388 wrote to memory of 2696	2388	d4d75d5333bf23dbc07528c3a65717e914f058efc7d0a17e7885f30bf6a5ce27.exe	86

C:\Users\Admin\AppData\Local\Temp\d4d75d5333bf23dbc07528c3a65717e914f058efc7d0a17e7885f30bf6a5ce27.exe
"C:\Users\Admin\AppData\Local\Temp\d4d75d5333bf23dbc07528c3a65717e914f058efc7d0a17e7885f30bf6a5ce27.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2696
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
95KB

MD5
62d407ba9dad199aa8b7144c54d0cbd0

SHA1
0fead18f300a2c1561b0df55b64076b06b451675

SHA256
91747fa8132b3d70e53f632498511f5f3c9d6a6f107c4f96d8afc13eac616765

SHA512
88342e4d37bb8f96ef679517c67b5bb89a8e11b23c9f78371afef14a9f13918a8e190851952dfb60382e17c13123d3bcc16a68d1f0c12bb38258641f018c83f4

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
207KB

MD5
a9e9b0cf342b4f8a72a6adc7a94a37ab

SHA1
9ec7d4b79a625a4b08f32622e451a1844e0ecc5a

SHA256
515724bbdc90e2b6786b2c60c1dd892a4d08cdb235a9ba55f2416d41b630220d

SHA512
95613601dfba1e0e38e43469957dd0807973ac17a1fa59265284aa57432c06555eb23b97695e0d3265cc83c2b15544ce34d2c2cb4aa44dfc569b7b0f030ea8ba

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
88KB

MD5
2146d35ce7875cbc1e630e6ffb09cbd5

SHA1
c6e8591e28476352c888bc6c15752461095692ed

SHA256
e56470a1e38a3fb0997a25ebc7ab1ca0d7fd0b62303a80dab041bb498b406ee7

SHA512
14626c38644be7acd571e2c8b3e0c2d79f1f67f926c1b286cde2056be1b5ce64be81970c9842bd1276816e48d00a048ada1ed3d6adbb39a72050073e988fb5a6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
194KB

MD5
b50ac8f57c3e6710892e6cd216e2067c

SHA1
34b736307730d7cc65422327162fb8d2fccacbb3

SHA256
c9e4da4f54abe1d330cce37544163bcdcd10fdd3911bb66c57d8a90668e103f7

SHA512
0399f4d1d620356b9cbca618c64cc5b921bde47d02df6130846a5ca099a6bb61c9f3925df1257a0cb8189826644b491330676113e2ccc009f4c315cc5f5c5980

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
e5d4c958db9c230a0e58172d926b60da

SHA1
c00994b932a8809b72d76d47014da223a1ee5fd4

SHA256
58e51730b2abdabcafdfe816812d898b3dda85099b0849badc756415994b7341

SHA512
c405f78c0d7231d6d8afb75b08ef34a40e5d882011369fa62dddf7211719acd5eb43b073a70020f6a4e2637ad04b4afc61c9c82828add9b91b7a0ae29c017a7e

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
639KB

MD5
cf698c4a1c3074be48878ce4e0b86ca6

SHA1
6d49f676842909b3132c9b5fd8ee22e8e712406d

SHA256
1f5b7c68b3d8b32e34206a0f34934154c407f6aa566ecf04635d89da598d808a

SHA512
0dddf4a4e82770180c42047dcc85664e1603d94620ed0efb695a3e2b95b8682bfc3ad07ad9281c4a81b66464bbbc2b8c40639badb13a51b43d2a0e0d646150c8

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
21ceea58a11a088968766bd276094ec2

SHA1
699418ec716ca4209ece48a6d9c16c6363304cab

SHA256
2b70026d1a7f6eb5b6bee4de42bfbc5d118f7e4a3cce436a279530903a8a15ec

SHA512
61048e9c623f58ac025a7fb3c18c77e141358928b5077f2e42119022979781189defdae8221c80d8ef7911f6335282ae334867dc5797bf6b75fd1d7a708dcca3

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
779KB

MD5
9057bc688c6b7dd65f1625fcbb774b5c

SHA1
b20a78b6285384ba1532c3452626d9196e08cd46

SHA256
637a75fd7d263ce3a782ef92afb6352ae96ae173fc58f3b9b917db712dfb62ac

SHA512
d532afd4b622f085fbafe2bf8400bdf4fb94dfcf8ce21e97996231e4a814dcf201320f4fbe26ea5096cc5f328e6d5825912542542d5b3da89f942a0bc0842862

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
104KB

MD5
a6569ae36d4a349df836a7b2e437b6c3

SHA1
6bee1a2a4e9dbb78eb548ebadde052b3029efb9f

SHA256
2c064c82fb7632b767fed9cf2ffc3b23b6904796d987ceec4fba3fffc5067d2d

SHA512
d54e1c7764190e423798fee9292768eb78b2ce576655d7eb1f0aed813ff00274609844968e84f52cdcb1603b3ba73ef9054957793ad2f9b3342ca1d0269f819f

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
95KB

MD5
e5d7603f9fb3bc875936cddf9efd9539

SHA1
4cee0cca6d15e5f257d76deb931e88dfd29e01b8

SHA256
68b58e57c0d454739cc76f0fd985127b1fc3e627b3d7aa3746c231beb27b26eb

SHA512
fb9ba3140952ce86a0ec015b9573f590c36dfd7b5a4a5c7f8d8e96cbb0504bcceed004857959cfc90562ba2ce9368232296a540f1ed37bd34da665fd3876afd6

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
100KB

MD5
c72064da26aac4013540c1666fdb760b

SHA1
7eba05907811df5c5c8028917d56ac364f160630

SHA256
38bf8a8aee40faa45f4b7a9946d3b28575da868059203adfa528822fe4418408

SHA512
46e2bad690537e97f13e2d21e771bb31a96280274792bdf74e8db8e4652f329f29196d22ea70fb1ab52a45866ce51b300de8fd001c0c7333b0faf83fd045943a

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
104KB

MD5
4d7da4acec5655115bf9d6127ae75135

SHA1
9ae663830b9c60a8aa2969ae0326419c8eb033cb

SHA256
8855cd9c96247806f88716310d3ad3519873f003b8dc92351a41f9a5085f6eb6

SHA512
6102dd3f37d4a59503f7b542c8adb4b9c843812060d93876bff09ad7af9e1184c3b60fbddc2820f5733b45bf218f6b75860e364fbd1dc226e646721a50ada089

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
104KB

MD5
e2282f0300997d60e6329b9600b3d7ee

SHA1
1841c29ec370b77cb74d88fc9b9bef808eadd9ca

SHA256
2746e6999c57dc335790145d6db49ade07d007b23840ff7503e18fb42699d209

SHA512
c026ff93b3b4bb80377115ffda7b4fa7a0f5e59ced8f33096fa3df229739a4f9d1b7d16dac573f66aa4df026f2c84587f6f5312bce852626c158ce71f343855b

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
93KB

MD5
fda383c71372c9b30a6d174c267d5c66

SHA1
e4872853a8921bde5db386bc4e1f9183615e4f19

SHA256
d190d34a3d374aaf7c9f88cebc83b8968a3519c2ac4012e003c15d9b32733519

SHA512
fdda5fda742513aac36aff1d60110868c0a4f34d1a680a5c3d1c381e9be2f37172315fe93f79f16be626c01d9b60c2b88845421b8badd46390c6a14b3a671875

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
97KB

MD5
955b9d6d1cc38854888bd7fc01a10de3

SHA1
9a6d48e1867fdcb378bce83ab05f4a469daea240

SHA256
7484f9dbf35bffd54d152ce7f60ed4f12a4674bcbe5a3de4614572e0a3f2ed61

SHA512
9085e6ea40177f9fc8bdda6554b649680eebf2f8677eed5dd27e66ef32657241567f77e71a97f09e3c9e0c54527913e9c7c293331fbe632f5197afaaee0e2eb6

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
104KB

MD5
5f23254085f547540322b0973e48cced

SHA1
9b114af595368ca48cbe5cb7abed04d7c36c7cac

SHA256
7d9a04e5a09c757ec8c26ff1cdd10038de66efacb8ef37a30c7054b546912d62

SHA512
c5c7f79f2b66b1e4cfd380769d0e1fc8d8eba307e2f4b1656990b29b0ee619dba9b4ed83486d706c3f181207e9963770c38a4365dc828b3532ff0230514d8e4a

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
102KB

MD5
82cb74fe5fe6a27a9723a673b47a25b6

SHA1
ca5e2d43b2cca93452b6a1c3963a10863ff2b7da

SHA256
ffbeaca90d14c180d8b66aab1e68dd91a8ec0e81485e89ec1a6d41ecec9b35fe

SHA512
eb7fbad1cd72bf192ebfca0b4faef6b01ec783d4279041daa4a00590c64b93423a450d58990fdad30bac2e5e374928d1fce03f2a2109396a2cf6a122e74adaf0

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
104KB

MD5
9374b72c4edc21dbffcf0a6ee36bbea9

SHA1
e7fe5cb8651ce8ba921809b140e967f9e0afd34e

SHA256
d989f1b57965d78652ce21f01abce84ae5cd2b57025e50b03eb358165066bb42

SHA512
d6471f6513cd58227c8f683e86c2861d2866ddf7b087f3b0eb3a905b74a98b599f7eea34dcf1b3d4cd9040d6b83aa9ff294de2abffa11dcdc4ae90d78b2972d5

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
80KB

MD5
c87edd8ae309f27c9da68d97d9895e24

SHA1
a8c840f2d5cbc6584d31f2dccfdf15cc3877187a

SHA256
7002f3e78bcdbb463227b64c511df740658b7c42defc9ad8d24cd5b8be57375d

SHA512
3d9f7589e1fada600da708573bfda91d40898b924014202fd70d20a62be99adef1f83389cbeecd65c7213bde69d8c275b3fea6408baf296ae489400ff86d3436

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
103KB

MD5
5a9b1861b7e98fdadcf39861d978dc7d

SHA1
10c8de316018bb019fd9dd0ed01154ce639906c4

SHA256
fcb3d2c3f5745f6785621efecd12e9ddf87d293ed5b3adf4c5eafed0c8e0319a

SHA512
c1e3df1fde0c51568f49661ef97c1ef3889aadf5109cca5ed377a6a36d83b3d9af2e5f9a28a36860600dd975f46c3431602ad2169ec85ef9ad1949d205f262e0

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
97KB

MD5
c200d2d04eee448d9ea746ec8e946d6c

SHA1
0259b5b9b00add8e5a641c2493b85e1c0cebfaa4

SHA256
10852d8881a9f48f5711d29d1cc61da2444bcc482cb63fbb77374ae780fafa95

SHA512
97062aa57c5bc4c6e3b820181f5c4d503ba68c71c4cf34e5e142ace21abd9897c9da68d23f68e49e27cea3152f3dc3151a2e5f271b7a19d189882f6d160d3789

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
95KB

MD5
1161fe92f111b5664ae541c1cab119d3

SHA1
1ffd38795abd31621bfbf9eddf495be33f676c3c

SHA256
9aace3c2474ef6fc64db86fa24230491a8209bb6c1852baaf27db42bbcbe5e8d

SHA512
ed3606a3fa04d9bdbfeb346108a8ab3f8a715e091b2aa58ad2a8ce0985fea40ae9395d2ad7a95aef2f840e0ef5d1f4311706c74e7d7547863b195dd6bc5ba3b7

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
96KB

MD5
95e7ff8fb463b58c989ca0e4f8b5e1bc

SHA1
927e97b0042fb4c6ffd81195c6f48f794c153e2e

SHA256
7cd052c7e9ec24a121bb3c00e2e9d3279f46104f815900b4d3d9154d370c9b41

SHA512
f2748acc397ceccd02699b47609c2fee6d6eefcd61dec6447c850fb488e397e48fb7abbacefd3e9fa8a1aa2ba0b9226a057008035b74a1cfeb41a7e25544d63e

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
105KB

MD5
ea2eeb7f22ca364651a2babdecbdc7b3

SHA1
498bed3b0da949b6518a3c0e598d093c74ab5998

SHA256
4df34a7e2221dba0d5e84fb6acf02cb80af3ce77380ae3db21a0843bd7024566

SHA512
8be34ae7134c4a44f972a4c04b5dd107f904385a74df5e6d3f2f3de53f3c274b4259b12b4753fdb88ba64c1fc85b12a4c2c0e35c3670128cf986325ac5d24fd5

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
99KB

MD5
18642fc758681c7a68e8e3f55eef325f

SHA1
ec776d900ab80da6a0f5fb5cb0258c79cc49fc21

SHA256
ba569cbc7cda21dd95e87226a6aa30bf622b8bcb3bc2ecc3257bcced5e5a6906

SHA512
276900858961a1a89d07b60ec6c30662a01dde1afcdbac0f3b9ea2dd82a0feaccbc549f80920c70165e11bc125d80d134c7b508b82ea5c5eecb81d57e6c876e1

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
105KB

MD5
1349f68658c87a1d565d80e82e0634d3

SHA1
7e76b62616abf31ea042f4c9626d2aa5fc5748a1

SHA256
3aad2e85c7d42a14b2214aa93dcf2d45a8632613d9a564a8fca5e4608f5abf32

SHA512
a39f05d0da77a1e2c6fc79d58557950b93dcb105b3ba8bdcf2cf39a981cbc34b87a4a0383d641c79f20d1d4c135dcf2a904917c0e41460acc28c546168666841

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
103KB

MD5
24ee7b09366b0bfd2ec5121a8b25e41f

SHA1
8f5aa53202e305fbc8fd9dd7af687c741b5f1360

SHA256
f19167cb8cc34964562de5f901745235f0bdf06faccb02c229ce458006904519

SHA512
db60a1cf9a5c282427700534b971d4dbc6e4e0a1d507df904694c283fd1d543c700fd28683d5f62c30808575253bc9af696513344101574cae7c04d63bf45e0a

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
52KB

MD5
b4691b1065df3dadbec1c86da5459974

SHA1
e8d4094f7eddfeab0d931fbd9e6c0b0be87ebf52

SHA256
7931c9d11235b5a736ae1f6259d15864fad18d7e44577c33c6f3ccce256c623f

SHA512
d15306c51ed0ba473d0ab45b428ee4c5253a3deb82a228fb40bed94696eaa10b02fb346207112100c8f7eb91e87392e060674d1d81494c9b8c73c32d3507fb98

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
95KB

MD5
10978b0a4d40508cc92288d878359105

SHA1
a7ddafb5bcc4028c6fa997667e3063cf99c14e9f

SHA256
720c84b0a0216ef23435159924ad5a48e2a777d704b9bb128077094cc42ca76e

SHA512
ab231b1749f18f5f916ae0c4d7273b57aab7766b26500747eaafe2be1d81a0340a6ddf77581033c831abd41c49025ac4aa5456ecca3215d6a9c60c943710a3ac

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
107KB

MD5
ae457a7e8518cf71d6489a8be558e748

SHA1
203892877f80220d739e0356e11efb2578555602

SHA256
c30e6d775b916106d9342fc17418bf257d61bc65efe955e72911a3d121677c33

SHA512
d8ba4d8064391e247c87200d83750161305b195c85453801666b90bfe93c55412d7d5aef66e95b0ff85cd424108949728cf4220b1768e41e8f4ce91369443224

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
112KB

MD5
6f274155ef47458babaca2634fd94824

SHA1
cbbcd1273e963d1bf2f267f58a6abda3dd2b68f4

SHA256
6fdc5d588e257751ca0399ba21a00b4b7c02ac88a434af392197bfdcff23fe7b

SHA512
afea299ee17ea37198b15239bb26e6d040e1d2543b38645c16ed341ab6696d2c053364671c552688f92faac33798804afe55eed5bb1737af8c077bc6e9c0b621

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
103KB

MD5
6fd87c5b33208a854b85e679bfae50de

SHA1
4436caf2cb7f22236cb3714da919292d138bbf99

SHA256
c00e38289db4150f234937c9275b6e1bf47631bc94d5eb60da6b9caf9d170edd

SHA512
9c0de99860b6056b41b2ec9a6d35f68e719e4cd326efa6bec017ca89303a59965ab362a9c458157c47c6bc3dfbd239fe6f33a0ccd64b0a3b6d59662a0e434873

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
105KB

MD5
a0a42146896b7a91ccd3af2e1d2d3e44

SHA1
43b60845a6d65789faeca2edbaa4758ee3e68348

SHA256
e1db947a8c8861b37b7179143be3ddc396e9bbcda22385873ce0e88f8733ba17

SHA512
882f7f403396147286ceae62aafc8bc436c9af34fd2a300c8b5385326e99b0e07d311e95a97030776a69766f2044b4cd2d6f377f134ed73d2b3fdb0414c7209d

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
105KB

MD5
f76923fe58ad8ddb12aaa0c847c98aea

SHA1
a2452824db504be703d5a89da795305249043bcf

SHA256
9943c002bc68ee56abdb810a40fe6ce2eec42bbcb68aa9f380e606e3bb7ef33d

SHA512
2384a20f0cd19ad4a774f6c4636933d8c5c79e3eb3c0890f7e0f840475b93caa21d40174f589ea7764361604988d6e0848856655c8fcec0a4e7ce48d15ce51a5

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
107KB

MD5
1806d2e6135374342aabacade52e2c82

SHA1
dee799254e8b1619d9ae94abeec4f014731f220f

SHA256
f8a65491b7ba241df53fe8f4206ec4df01ea48bcf9c0d6a82933da6d34106d09

SHA512
b52783ba0ef5b7329bdb1060478205190995e840b677c5d79a80ae1d519a6bc5d60dd5e13ef80199142914803cb2309e75702a04c31bff7e4b444b0398d9f690

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
95KB

MD5
e5610ad980dfbdadd3c446216ab4dee7

SHA1
b36b7a501de52bf95477e939783b646dc767d5da

SHA256
21166581e2914300cc3e32255a0433ecd373aaa8f0bfd64d8211bf1030425692

SHA512
3839aecdfb40b2debce3a2728470d824922b90d4ac447e29bf2c3cb31340f5be7ed1b7e57347764482b25c5c91b40fe8a62c157b99dac671b1860922e99af8b0

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
107KB

MD5
6ec684b1bf7214a0a987315e8603f8c9

SHA1
de74a32a93c2555e56611e0d58bd2ab29f3bc150

SHA256
63c4540ffe55d27116c9891e3e2581ce7dee801d611383fe405d0ca007962bfd

SHA512
1c08613f9ee13858a51bdb4d72c1beb3da53a4572ef36ba252f196d1e28032fc74c888fedeae822142aad28abd5b264d5fad7b152a7ab55f02d72be236774741

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
97KB

MD5
ee1b153d14ba73fad997a54030a20a86

SHA1
36ad4abd27c854785b8259116fb25fc14c4825e9

SHA256
394a2b9b54f787ca7ec068cc4dc12fe3ddadecb5f1fd454696f588bef4cc3125

SHA512
52481e67871a6298fa6e44273c6d050299c0dca41c5cf79121138294e509ecd42e6e9906a135a7c22325af3bc09cdf9308cc4ccdcc2dda12a64ffc501fc1bf27

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
96KB

MD5
cda50847922afdaadfa7b02fcf36ae26

SHA1
f55dbfc2244ca1197df4fdeb402a4265351ca5a2

SHA256
391067cbe3ddff6ff0ad2d4e4cf21c0aad879b27fbb01752a3710b0b9f601cac

SHA512
5a7ba9ea78377697cf4bdd5a73a02e090d1fd2ccb74a2fcfcc78c2c99dc84d8192a2a083bd8f1c8a4210fdfceef7e3f4799c316f3159f7a59bd3ffebaba6e9b0

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
96KB

MD5
e6cee000be227ecc709a05245146eedb

SHA1
73e45ec14e2320afab1433d72d8605bd2adea718

SHA256
57497ce672390f3b8a351b004bcac893fd4fc9579d769f25e093214d7f34f795

SHA512
9e07846be31ff2e77cc6896a4dede74b055ac3c5e181edb0d87a4d41feb11aff0933d42b01fe5908e21e287f5b9c283fa8992f14a5af88924b43a0ccb4cfbad5

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
109KB

MD5
9a27cd126ee739359b44519b5c005612

SHA1
6c6c23be75edd97dfa105a1d4ab946ecaab12140

SHA256
2b49773de6836ab943523e356821eb8d537a76caa268ea1d8135a1c299c5540b

SHA512
19a039c62f6a25ff049c78d24b52ed5860332084dc0bd025975e8f0522e7d8b67385482ff5c9b88e5f5c6df99854d1d419b6a8a2a5e2022d2073953454ca2045

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
98KB

MD5
5bcc9a2ed2c4cd495cd6834f9a566c9c

SHA1
dcb9219d08bd293eda5a20a5859b3d50297a3cff

SHA256
62294fe68207d1e8b37720ea971ebd1329a4f73dd610859770283b08fe676d93

SHA512
0ccabac3ca18333ed1c14cbe481ea45dc07b59eb860e0e4b8265a13d530d0e1c7f59b9a794a0288be3645f56446c6fda1da3dcff19a1eef86250a0bfb1b2ed78

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
95KB

MD5
64d4cd07de3d586bfd0923cfbff7fe07

SHA1
4a3a5fdfaa0e5806b883fcd915c2f0edc5f970a2

SHA256
27ad7516b79f913b3eabbc22f435a44f90a5cbea9f358d8d982aecb69b5f05df

SHA512
9f62676bcaebb381255c923c6616e2100558d66800e624e84ddb2cfb4e742799a9e067136b0d1c216801ddc8d37495ce4e7eaa0edd6afc9f8577eaf76ba8a400

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
101KB

MD5
1d3d19cf70be23179ca6a6587dfae4bc

SHA1
69e8cd5fd49a600456d98aab64ed5380224e5c41

SHA256
2589aba3cfebcf6ff95ae033101af32c80036162ca6c54b2a46168f114b54b1e

SHA512
925c78e3799114cd958ae328867c3f348ff544023a0f5a2e9d7777ab52f0a6aa9f3f993024d03b6ebdc102c95dce386b12d94d067f6afba9602eb0dee4282dab

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
104KB

MD5
7e2dbdd08218ac02753441ffdb313912

SHA1
3bec09d8fa3bb5fd989cc2494d57e68b3d5fa87e

SHA256
8d94eb55ef26a5507a4a23dfb9b2976cc88e5aca6c0b769ebf3bfd7466d75632

SHA512
40b5db5668bb5f6c0660c1f76828ba4fcd4945b4c95a608bd608f0c3cde65e3a336d86842ac2cd9406402f288bc15e0822f072e2b94fd8e368e5ec5ddfbf1dc1

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
100KB

MD5
1c77c9ee8c64caec25123a420c2cd193

SHA1
a7c1be695bb732bf4de1fe7179578bd81c887793

SHA256
bebd3d89a4ac77b76fc2c5a5b93ac6feb006c1b9b5c7a31ba8036d86a70d1cd5

SHA512
84210eba26089205ddb109a71629123ebfc62d9108dae13cea8b50a5e80ac67b3438d521647226315df0543720590fa44b77d3d8f18fd80791c25ecd2df1d10b

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
88KB

MD5
5b82451844211d5db5683f65902be9eb

SHA1
e33e594714f4386d40f2694f03ab8e89e27f000f

SHA256
9b761ad6515973f67cd858dd1c529d01b48c3d5e900b0cf3fd9d4361d7d5fe4b

SHA512
f587bdf219584bb4077cc4b5d7611be2be7aa71b85f0fc1fb4356f8e634e1758526f02826f84251f5c744efa04d1f44463c1a25e644ba4379a433061f1239232

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
44KB

MD5
4f1def9eee73fb2f44cbd1d88b21b2ce

SHA1
cdb6a8fda4cc5483aa6fdb472956c0d1fdb33549

SHA256
c0caa2ab71aefb0a4191e624015d36b494341bed3e94674b6d3ce02103c57b99

SHA512
fa9640eb9646042da9ef871c06ab09679ce00337ba07c1f21d591096a59b1f91d3b94019e7b8a0bf1a6359817fdba631875045c4e400c8bdb1ee18d037c29935

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
104KB

MD5
382e5037341f2658eb1b19919e1d1e97

SHA1
d3af1bca134addc4d23b97cc3987e78575e69fb5

SHA256
e040b625c0dab7a6692c767c76afd333c84a0995b85922d52a75bb230541190e

SHA512
1759d15ebf402be013885dc645cbf6f1186292146a701de71318a189b6596b7814249794d24bde0585fb738feb047aaef917c1f06cc9827fc45f88aa94acf9ea

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
96KB

MD5
af0f20d065a22685f0b1b526d3620737

SHA1
d23fcfeb8c20449823e6f5e223aa4e9465282b80

SHA256
03b2bd556b6f6162b72b29866c5cd46f6dc6cb278be866d7205126c09ed7a722

SHA512
4ee153e88c07dd4ac5a2c6f6a7fe07ead98ff10adf3450fbe90efdaf141a851d255e8a29157c18d1c3dd95dedbabe259514152b1ee7b2878e823958657bb6228

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
97KB

MD5
1fe0175e8b42eed08395bef71375ee41

SHA1
527a354a1b13efdb2a0413292845b7d3e691d2b4

SHA256
e634c912525d949a40ea6b8e136e659b51d1b7419fc315d802824f89d677387a

SHA512
82270def152903ae75a693d7cabdf22515f55101d3347e45a572107fb2476900e4d69446937de372f25f1d76c851870d63d3e24e95fc09c91506db1edba9bb58

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
113KB

MD5
7a0f63a79bc70765f5bd95b8867e4e48

SHA1
f9a3d862431978edd9b4dff0067cd10180e8736f

SHA256
e2d5ce1c4ca8eebec9c24cb6440ac0addd944310964a34a472511809433129ac

SHA512
05e599f4df4b71c81a1f553b309924ff65d4c963de791dcb265d8793358ce962337f8d27781f3c995d4084f6be3d104a5bd12c677f759040ab41cd61eb55edd9

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
104KB

MD5
851aec4a3acb53209e4a6ca8dfc3f51c

SHA1
f822c9f803458ca884f7e4452402a558b9ef9ec1

SHA256
b6cf6614088db0a1d7fa229969a34f1464588fbf955022ca092742869d517ab3

SHA512
dcb35d7d5c7d32f69a8b7db852a9091fd124ff909d1954f81b4e5ae42f48a0c1d7ffbd79df6b33287d891bb37ab8b5998a7aece220034c0246e64bcbb7dea2b1

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
100KB

MD5
6472ea4fa1549b04bbc3b28c4f76d818

SHA1
6ade60ec9e449914e2f823066a7b0ed603ab6b88

SHA256
c26882e366b4881ee54a8b5d76619883e266021cd11f0346d9f2599e8a93b604

SHA512
03a325a163ea0541daf6159f144b3dd598577d33bb45751a1785cbda7975364b4b264dc5c18f02c3de1176490cad74250f615a01cc15ec0c7244f3897db60b2a

Download Submit
C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

Filesize
102KB

MD5
ad0e8433c36655582b9ee2631ac25f18

SHA1
bb40380c99914784ff0f7b05fa390d4d56c1865f

SHA256
49877e43a95e1dbbca48a7ac2bf160b8a752e7365a4b8bb74498a4c7364e1c60

SHA512
ce7cbd3cbc316ca2e596673f1277bcad403df76637ce484beedb3801f230461073bdc0a09d1919146fe73d7d2bed9d237ed0e3c7b6b296dd25e245b3aeaf1e83

Download Submit
C:\Program Files\7-Zip\Lang\sv.txt.tmp

Filesize
104KB

MD5
a7cb90a9d225a002844aa094721bbcfe

SHA1
a69a1a0987c1305ed5952a466b5ab4bc6aba6d3a

SHA256
6852353bbf9c85f21df7eb0095a0f1072214c6adc612b49ee50fac3df400f27f

SHA512
d9fe6cd57081883d8bb878856134951751eeec53b455a9433f4e4858e6f1b8c38c7e5df154d665428d926e5cc5bc43569774f60b189fddddc950715cff96a323

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp

Filesize
99KB

MD5
7b2919288caeca11bb6d36c7366682ea

SHA1
8104073db5f5c606250ff281761d922ed9d6cc96

SHA256
75f566cc5c4e6875261bd88f693a955afbe950fab510e2f34524fae9085e3f68

SHA512
77e1c470fc9c664c854c5741dc4da3b4f8e6cba0a2f56548e5eb367a822b471f1567b53b35575c69f39ef784f281f629337749b69059fd9479e8b4a30f41fd36

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
88KB

MD5
827e901fbc04c7eb87bb3c0d0d7574d9

SHA1
e4a9fddde1fbc0a4a3701924e015fc3870390d0d

SHA256
e00abbef2ad425dcd8de7a12f63c0f8b21e2c4d50d1ddaba2cee1c06a1d3c592

SHA512
541ad54fb78cb1947db628a09f6c2869f334e105f24f38aab71b2bd1949165a9f8ea0400528e4d9edb6b1e2880ca837543d7036e029e2e3520f2a80c4863733d

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
95KB

MD5
5746e8903cc2bfeca0570c40c4b90cb5

SHA1
a04d580ce9d7d77a48965ed56163522a13426fc4

SHA256
70f8f4bcc4ca628a75b77f358693583095505b02f659c773ee40638d14100858

SHA512
24a6dd4bbd8509b9c0054e8b0838b8f765e81d9296c4a2826afb9680c3fc982bf8b21f17882c167fcd224dc340337e4ee9768c8b9fc66b1c8daf0df13739e33f

Download Submit