baae3bc6944bc54c1720104d8a82c7e6a7a2136c84a5eb164652357c627950c6

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0d809eeff6b19d579c93ef8cccb3d40N.exe
Size

162KB
MD5

f0d809eeff6b19d579c93ef8cccb3d40
SHA1

fe4b555eead8bd59481088e804065c5a94c00719
SHA256

baae3bc6944bc54c1720104d8a82c7e6a7a2136c84a5eb164652357c627950c6
SHA512

7591d44a946becfa367c797fc81f16d2048af1c5dc90c56c9f2acaa44a75e749a66881e6b4b3bbe9b8bf86967501e3bf3eb4f2c357873e244b0b85a31f47979e
SSDEEP

1536:W7ZNLpApCZrt8PWGoPWGANdN+hEwHwDvZvapBpYYpSZSEf07ZNLpApCZrt8PWGoN:6NLWpCZIzjwHwff0NLWpCZIzjwHwm

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4512) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2200	_desktop.ini.exe
4716	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	f0d809eeff6b19d579c93ef8cccb3d40N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	f0d809eeff6b19d579c93ef8cccb3d40N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.ProtectedData.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\vk_swiftshader.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Luna.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013.dotx.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pl.pak.tmp	_desktop.ini.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\ml.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0d809eeff6b19d579c93ef8cccb3d40N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_desktop.ini.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 4716	2888	f0d809eeff6b19d579c93ef8cccb3d40N.exe	84
PID 2888 wrote to memory of 4716	2888	f0d809eeff6b19d579c93ef8cccb3d40N.exe	84
PID 2888 wrote to memory of 4716	2888	f0d809eeff6b19d579c93ef8cccb3d40N.exe	84
PID 2888 wrote to memory of 2200	2888	f0d809eeff6b19d579c93ef8cccb3d40N.exe	83
PID 2888 wrote to memory of 2200	2888	f0d809eeff6b19d579c93ef8cccb3d40N.exe	83
PID 2888 wrote to memory of 2200	2888	f0d809eeff6b19d579c93ef8cccb3d40N.exe	83

C:\Users\Admin\AppData\Local\Temp\f0d809eeff6b19d579c93ef8cccb3d40N.exe
"C:\Users\Admin\AppData\Local\Temp\f0d809eeff6b19d579c93ef8cccb3d40N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2200
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.tmp

Filesize
80KB

MD5
9a2cf1cb8c76c034e0912717e05f7a30

SHA1
997602bf6d6935619d41601ad482c5d6717a4a19

SHA256
4edb954f344fd09f5aa8ed541d4a894d8601883f4bd3f8c9c2f803bc66604dc1

SHA512
0898aa951d9f069865d9f52ce09a75c7de38188162ac5ae0c5cfcfec16f873486f91b3ac5ace66ec3fc5db00b9c9ebf8b62087e010bde1f92a91cad47202aba0

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
192KB

MD5
8684e07a450e009b46c98bb2eeba0628

SHA1
827d07e99ac678b3634d381c65c5a6128f47f68b

SHA256
cde93c4265fc65be02ace908b6de57d6f148c92f3bf50e714d4b024912aadb4f

SHA512
44cb7fc9f0683f413f770f4c9098b9354d7b526de387bd3e4a389278641ceb4d7eb0b2fbb3aa3eb250cecdf4cbb568a71c27a77bd8c13162b022908ca3689326

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
d1bc87509b673771166efb8e7a4f0eb4

SHA1
a765ad9236401247867ee1c811021b75411507c3

SHA256
d07cc58dd86b06299ca2db38441ece30cdc57a6c1a82b054384fce473b30846d

SHA512
3c8430ea2578f9115a5459dfa04807e742d589bc5e89367df98cabaedeb1c63433b575a384084bf066d5a2ac58a1c31b58583a4a5e7042b7394de72b2674d455

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
146KB

MD5
ee93cc0acbd977245ee2c89736a52eba

SHA1
c0fa0e63205dc93c1eaa3b9fe052cacc575c3af5

SHA256
69de0af674a74dcfa4172875a62c533c43f67ba0c5a676a59b8f4ba9e0106d07

SHA512
18cc33ef92398d27cb7f5e5f3fb9a10017aee6ddddaef8512d4bb634f72bfd6784dda59699060e0b630da28810a94687d6b86825c0c237db854d52166b45832c

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
924KB

MD5
00a05deb2b3ea3e95d873bc7b7c4b799

SHA1
fad86c9ebbcbaa560b3c355cabe22d4799b31f72

SHA256
817b7236380bc63ae8f318413c7ce02f4d87181726a9f972845d6344534737b8

SHA512
60a30fe96fb9c4b15b189e4229554c3bf14a7c6f224b4934cc182d3171c518831c5457494b1e1c7d0cbfe9b05524b0e1d0718d2f231ad8935f0da64f2bce1db4

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
ec496cfb827c53480b8d8b2fcf0e6214

SHA1
c5e87c9c8634abfa838b8f76dba8bc5f7a06152f

SHA256
9d4077313c3d5dec2d1d01a311933ad8c8e37295bf3316fcc6432b68766ed23c

SHA512
278c2fa5461f0345b582d423c5fb66a978d443c3d5abea952dd49e4a8a5ea01e0d3b1348ab10b198da992c70145c11790094770dac1ef33898b4fe1ce8165c86

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
625KB

MD5
9e0bbbf455dab9507d8807992bf3ff69

SHA1
1f1b82e6c3c25f690b81abeae63fd0a414fb7eda

SHA256
a525d5fce624473f75a26f884980b81113147a054c36b876db1db14ad49049f8

SHA512
bc70a6c0dc4863ed69181a9a3666b66402a37879929f6d72abbbf53671f90c6e3cc8bef0eea534bbe3bca99ba6278f52b56fc40768ed1bfd1df752883b016213

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
291KB

MD5
4e7876d2c192cb44eed1d360378fa4c1

SHA1
6744db0aa176ee8a31a4f7cb0736ff614b9afe47

SHA256
a58c796043f7051a50d075956ef093fdb1f43a3531622610b3b287c1a94cc5e4

SHA512
2df421d788f1a616fac3a088016b665571823754ff712983b7ab1ec10f2e65a5b3c0d92894d36958f4398f6a4b17b983a269437d32b034a3425f68ca1413e8df

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
270KB

MD5
3407221735e6dbcb9eccae5099ff718c

SHA1
fd1a77ccee6b2b60e6083b0459d71d3331c68cb6

SHA256
0d71f642093cd21c4debef2c1dffe8511cb9fe7b29f952f6fbbf51473288076a

SHA512
00f7884f3d85228b9a902d8f6a254f7e5bf21b7664fba78467a21c3a3d11f2fd5c46e9bf17f7a8829d5ea0e6aefd778308933114dba125f8fa41d09ca4fa55bc

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1012KB

MD5
474ac62cbbb11c54de3136fbd9a2a154

SHA1
39acb948ba53f5a9d11e85b276329ef42b61e073

SHA256
3ba8b722c59c8fc6da427132cc149130dcbb17c4be4d10b072f5ac68ff5d139c

SHA512
465e69479ae9369e379c1b48345ba06926bca4fc7a905d0b3b3f8d914605784ed6e3487e5301a87f0bb7638a1b44d668ae4044be1fe72111c580d5589485314a

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
765KB

MD5
0b493a73f94f817df80e58d21b6eb630

SHA1
e0d412dfda4fc009dea3884ed0270c8e9cc10016

SHA256
6b05b1892be36c4ae4d662c98f737c4840e564c8985ef7f07ef4a0c078c7d0e7

SHA512
7a6bde7253ac14b01132abea7788b38ba0f5512b7564d2f2bea5f7f381dd30bcc705e4c8823f5f9da0473d9b5327400ba63fb93b1612fa0be9459df3350053ef

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
138KB

MD5
3241e292b3102dd3ea51f0f91e431c65

SHA1
3599651a483dc0a4d03316411d9e2dc9dfffada1

SHA256
f3483a144f7bd73d809b4dded4418cc5e215595ba112e45daa85fe771a07208f

SHA512
65a3bdc0af7340be5fad864f454a183b68a11c67e02c979836ff90af4a034bc090586fd8104e80f77bca8446b1eecbef8b523f32f58422c139c027029bd27407

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
91KB

MD5
53d8e9cfe9940db7a5ea9bf528a0189f

SHA1
cc33040bed285d91085e177ce3f6bbbb3013fafe

SHA256
56203551f56d50f43c9208c49bd6e4301bdc21518f5326797574b90db7f969f8

SHA512
9f20eb4897bbdc55afe7f021bd310e26c14d646542ae358f5aa6d917a96ed7c6da3f84f5ff0b141afc5978cefdfda9babce57bf8b785d3b9421c4e27dc9c46f2

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
80KB

MD5
ac6cda13adbd0296c722022f21e3b9c3

SHA1
aafe5bc5af4e84ad8398700af3391813c92b29e5

SHA256
c85e3ca9062d466bd1b63c9813dbbc87035c532b027b8fba31e05f5a0afcf1b4

SHA512
9f5408e8edb0ee494db6e65fb9d1c427c87629ed0011b17c26a7c8ed8b26d0c9f03050cf41852b572dd3418f5f873827efcb198225ecc836c141eb01bbf754ff

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
96KB

MD5
bdb52be87f739e294ced2f33375e5d81

SHA1
5a12a9598379ae43c15d6d86228fb2a5f2393fa3

SHA256
a1815eea8b41acac889af54c31091dff9bb1eb2c9691131e1f5406777d7bbd39

SHA512
3aed98305c9a65aeddb2117fb6eea0d3e0bf5bcb1d9bf0dd5eaab3ccee37e9c958d6231cd4f3103ef609de4c47b246571ebd65e02c378fd3e54d0da3416f014c

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
90KB

MD5
e98703456657a1ff9bc054a5abba7121

SHA1
356c02be3efbf9f3a3c2ffa8a588a76afe531958

SHA256
a1d84f80e60055082ef0dece4f0325ca49558d0310109a058096d92f2c239823

SHA512
4b43eab75ad25c4c373c7a296bdb4c64d41bb9abe37b5be77f86705e4bcaf5036de494f0501f4e3cf9617acaa16b8d98a4a6ec8d5302bc9689887f2c89626c44

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
92KB

MD5
038269799d79d4d84bc4ac2ac6b616ca

SHA1
2bf19c23b10fe76e84b0765957fccf94a9da0d9d

SHA256
c307ad856392c9cba962f7e7f00e3bb145aed6c9bf11f29afd8d504b058d70b9

SHA512
014b11e4e2a73c6a27fcb7a029daf5f96d1635a3ad6a8d057c77a76934618d4decd9c232065b33a1c55907cfc0656e7c45b0316ea54529b329b5171a3eaca025

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
90KB

MD5
0ab29588eab9141bee198a7513248223

SHA1
518eefe86fa72d8156f64ecc36c7293e1adf9d99

SHA256
5827a239bf752d16247fca37edfa1898d4e7a1316457235edf63bc5fe80ee88f

SHA512
93745769124a24a06bd2b602e2ba3c25db00329ae6e174ac199d7401bbe6d1f59d2d3b5de2f68fb57d375f6b4ebb05dbe98d5416212a230f974ec5c3ed12f7e6

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
89KB

MD5
73ae4e21eda9ec9c95862def79314ce1

SHA1
4e4c52ca5828fbfcb64f18aae6be0e6e85b68694

SHA256
5f1a64d789c90a7c576162948dea100614ae55cd6fa172e3e773ecedbd17dabd

SHA512
5f3876caca2d7fc68a6d842c8c6ab83764dfd41201cdc2d6efe92278d3db7062de2ec0c2772092fe53c28eaa4330e529661818fb7ce1afced7563a14bee7935d

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
98KB

MD5
74daa29e9670f04a12c4eed63bfcb3d1

SHA1
a7863a1bb1bd1effd23740215aa82ff8e011daa1

SHA256
adb6e1cd8e638b812757e4e04ba65dd7767f11d7ef444adbaf56e9bab1ee6359

SHA512
cedd3a205e6eeac1c2e924fb28f8f3b39265815a242fc8b20f0659965c3d95075a328d35f1a35da8b27f456902d88e894622f0fc3112812800d84ff464fab6f8

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
89KB

MD5
ebc9248cf8cf6165d06ba5a80e6719ac

SHA1
6c9335dd35195b08ef6c113d9ce9d6a9194bd45b

SHA256
86f45bab4ceaf0033f7990de80a75e4b60fa1ca13ff7d249b9e4962f460a62c3

SHA512
52199b8503610bcb453f5cdf52bfc07a53ff833c02f3ede272d4b7dbd1d72efc590ae8af40e8256aff5307efd169ed14035b7e527f5c66efa30af0579e6e178e

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
81KB

MD5
effeb0aa48e6b4c913de105388f9b5ca

SHA1
f42bace28ed3d5afba17633dbb20d6027e8aedd1

SHA256
26a5ae05cfce82cd83e8c185d0df41e09ef82964e791cc46332246986408d3b9

SHA512
50af845bfc39a5210b9e91740a89918720aa4c7326a9bd57de73d81d712d1c80ce768cec6115044bba4facbadfe46f615890254205d5c5282f02244b22414fda

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
90KB

MD5
8409f048492153cbf2975a842a558e42

SHA1
8ab87300cf709b788ac52701e745a6d09f288d53

SHA256
42c59bd7ff70d35c18653e926c7456a6c4dfe4ae7fd3e30809790762b9a653cd

SHA512
bb787ed37013c04e15e43674c8578477f290826dd92b726ebd2c6bd871b0ad47012354bf3a01e302ac9cf865272f4bfdaae09c4db3866ccc403cc011ba368a2b

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
88KB

MD5
e66ca45a414accf1c136ba939f448e2a

SHA1
43a0a14682dd1f579059ed72248312f9aaffbc87

SHA256
31d8a6e7db0eb4b95134036a585dd793bb90564f11fe83c3446bbb8d1f57d7e7

SHA512
f4bb3d56acfcc65c077b55ccb3e3d3ed62529d7104e6524fe116775b5c3038b302b8b0eb52d81570c77f5c1b05120ffcb9f5e0933830ebdf56031c42e8e4a660

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
90KB

MD5
b6b998922b3fb7e37af7b4b1df0b03c8

SHA1
c02f5733eeed6c8f5142519127e12df412b5ff2d

SHA256
2edf2d9cb965b116e31a24388cd448c642c530e45d8931cedbd0557b3ea34b19

SHA512
83b5eaae5583813b235f3d5f27aa901512a81c1c5f062536f8b7453d3d8bbbf267439a8c21d3fd271b7ccba7aaf2bf20cb0b913e1a9c1dde18009d887ee853f6

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
89KB

MD5
bf8ead5c839245613d3778bb2a613d3e

SHA1
dce511558c7ffd40adc0bd076e33bc681fcb6835

SHA256
86fb8d8c0ea6c45c9a17f64d38ece99bd07e05c406c5df19beeecc6b4d3dfa28

SHA512
1e8e408d034a3677a12d9178896cb90a9f291ee1984a2551cae49bf967106a42b73242e3d66339e780afbd02ec5c7ab058f28bd7e1a1a55072e6e3eadff010c2

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
89KB

MD5
38fb410748e7b8be5baac347a94134d9

SHA1
7cafb3ddf801d7bcce901ecc2dba87e7c3991f3d

SHA256
1bb08b6c5579109ce527e8c3ba01a11990ab39bb6b668cdac296204a83d2bcdb

SHA512
b94321eff3d7ed3afda92f209e3c352b7b999c081dcd4a3419bc5a35c5a39233e2634cd861b71f2e279fb7745d554f0ca584dc9725aa8fc970e87c8de167b48f

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
88KB

MD5
2a8b0d07f12cd9fdb5634d9e96b30761

SHA1
13a4bf9ee498f3ffd758a36fd2d29eb4c9ee1114

SHA256
ce504256296a8b4a1d85917deb6215aee5b2aba035808f03a9e65abaf242fa30

SHA512
f7e8b822c7bf695277e37bd8c2af8ffccc8fd14938bfd5288fd6bf35a4644c6287472744c3715f4caa5fbcba6dcc337ff477d371b799615649c3f6649d986c1d

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
90KB

MD5
05ba4d27f4fccde32787e9bcef1e108a

SHA1
766af997e4f0a427591ac6170f6be530bc829547

SHA256
6e91b1ff71a60761c2fe3ca305b1ab5744249460e7b396c6dfe90dedb571a930

SHA512
f129a2edc621e87ddc357868c0a96f2b86b1a4d6a27606a7aad790e1435bfada2fde9f7f9fbf579eaf567c476517bc48b3345c49815c166bd4537363396665ea

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
91KB

MD5
8f2096707febbd94949b18e3cbc81a50

SHA1
2cf54c5adc2658fe265a7c8ce44dc39bd3370d48

SHA256
f2de40cd6a09f57923132de6e4a72546c7144a7b367c0e8c0cd7dc0f79f9c6e3

SHA512
323da465ca523a874b5bd68794aaacb2b6922cdc39ba5a99b0978d0530f0890a2e104c69cebb5ae23a4a04f802fa702929e06af14fe9e9b5e640f9721aa9ccb6

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
91KB

MD5
00e06b7f2e2a7896129c4aa8a6ba7f92

SHA1
859717ced59cd87864820338435976b049aa8292

SHA256
0f1438b72ad29967b4eed501666b92931b83e60868fd15633476f7e01f02c570

SHA512
a9ba1d924488d75166a6e55baf2e8ca8cbb29912614caeb2679d5563df30974cc164040d3298569eb869a9d1ecd3e73124932c859829b250c0ec73a7e9b02472

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
97KB

MD5
3e4170a131db99cb4fbf196940e588ea

SHA1
3868542b8886e6b1e7e3afce8feeec7a2a81b18d

SHA256
f1d626b963943a01639fd37f4e64945e8de544d4a8f3069ce3f449e322d8defe

SHA512
6af7e2d78ea56dccf80c5b2dd06331dff6b7304e6efa2e7bbf954fae146a2eeaac268cea2cc7358f0b7f6a3a02672b4d4796352d67a66ee29e36c3f46832a6d3

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
88KB

MD5
b29c3c4b977415b355800877c13fbfd2

SHA1
8f2bb1879018609307c34f5636e2faf00609fc92

SHA256
a3857090ea7c3356f8c90280b32ee3314b58b308e5c09471565d566e57ed9cb4

SHA512
e446ec575d2d5c8e54d770f70fee1f6b1eaa3d83e21f48cfe7b630f83a692c667bffb54416097bd98bb99c6605f3d9073cd595338e75c52580627f321e30e813

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
90KB

MD5
a4037fec18c5182d3649d24fdecf2b30

SHA1
ea391ca5732249e4e2396b477a74c1dad76a99a8

SHA256
df1970f8209c6e4ef92acc31a4a0ed695203a0ce283644eb42865e3e16c93d44

SHA512
46b34e12604dc07e59c73cecdac3e2213e1f82917ccba416011c5bbb843e7a3864e813590b0e07af86125907c365484af3c9e2425d7231ec9884948a51953798

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
94KB

MD5
6dbcbb0b0946929c06f339356b7b382f

SHA1
901f2d114ce0da7b2abf80d7f0b72e4a8b5b20b8

SHA256
d6585aa64096566323e18ee8a4033e54f50b64c1996a826755f8c40924676ce9

SHA512
5d8a17d3ceadb3c7c99cedf296a9259faed9ca1487a2f80854dbd8dad1849e18c928ad72386a8868d2af5f9f8422135fe1b8f5a7fe8c0842c5a0613581088615

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
88KB

MD5
d022065b816803d12354adc1a866ab6f

SHA1
486635be94b2f7a6c8d572d45d73a5aa518cc6d3

SHA256
8cf85f39d5f908b5dd51819aa6d887cb473a5792b08c3c6d1569b67fd171a782

SHA512
f5a3ac7a181f7038e97d71bc45e84ba76adbc7a53aebc6f7777d9cba91bb6ab8b2f3f28c24bc338a69191560c594e0543d2414121a2ae28bce708d11a4a52467

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
90KB

MD5
d98c882bc9492c00d68235cab1dc7147

SHA1
1f22f48ab2e70879848fa58300c7d12b77e9438c

SHA256
f88125476b557ceda39770e7ee299716705de6fe4155c8038155b75b2511aeea

SHA512
62767bacac140ca33b06a61edf8ecc5e61295ddd7ec1eba39784dc7b6507d65ab7abf8cc6d632302e8a517828e7d0279f8407ff6c6859e09745275c60da42407

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
88KB

MD5
695b70eb4421c06b0132ea080e0f9f93

SHA1
22e98986c5a88e0fa8003221aa319f37e22b1721

SHA256
2b6090dc9307507921073d40ad681005fe649d171a38ac27cedd35fa8185461a

SHA512
d2592f15ffe72953cdbba3d0d652972c3340c295f714f2c559e996024336a458aad9f64c8f2e52f80563ddd3a8b6f5252104cb76ec988f5a5f3b6d04592b1983

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
80KB

MD5
fd49f2dde731045dc9c206774f7489c5

SHA1
570933ffdf623bb2058cf5b45713065c8249c901

SHA256
391b12a338bc8b28e580e9a6d9fb9b27117e45597eb87241920a87d8aa9e13ee

SHA512
cc1df29277de168e97bd02d9e1e5e79e67f4724ccca14e3127c6ff466736b7c2667d28d7b809b130dd1b341c04b31839ba0137a8baa9ef2784e799885d3abc43

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
92KB

MD5
742ba6fd9572bbbaf1fd7afc3c05b31a

SHA1
6ca3e50a0d2895d138f816f626f28c9e223fe164

SHA256
4ea819a9ead39498f90efd255cf0499ab393951fd9c538f2b763391fa2b1798b

SHA512
6a612c3f2d9b8c346302056d6b50fda4826ebcc084819fa3c7264d318e9b88aa03faad2fd417d0a97d245e115ea17b48e5bf12a5096b995cedf8c49542a77428

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
85KB

MD5
91c9b012027f3b7b2771d6642fbc6131

SHA1
449f6a7ba3c82a15172bef40cef1bc743fe0fcde

SHA256
fc2c673563f07ee1950a22753f2b064bb413a122ed7dc1036d2d2ad9cbc132d9

SHA512
882a510b812f87ac9d067b9cd07eb01de9dac7e30059a439a36db4fded7e04f85c75f1c88ff0beea61f45ed1754b3b9a3a676af9a765f8bb3bec89b7e5c8adb2

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
94KB

MD5
9af5dcf086117339ef6b9bbfeee2092f

SHA1
6cf4b36602a7c440f30ffba83d4a56fc605abc5c

SHA256
5f633079897f3c6fe4e5c045e3817f87f8f900ddca837bcd404ca5c8b53edbe3

SHA512
7d1e07d9ba341e5ca08fd259520d1006da92a7e53f35d06e03dac74edc3668ab7f46f067f3286258957ca39c34ea9caa22f8d2c2beb36564e1149aa0efc7fa6a

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
89KB

MD5
95057b015bb55dbc3b4c0c3ea966de6d

SHA1
3172d68f39d50c76dd9f3e9ebe577a876faeb850

SHA256
506b0d731b7280e2b9a2f4de1f41f8d1f1743d6607704858c586dafdea2dc10f

SHA512
9e207e271b037d3f1e4188808d93bfe5c486ae575cd5e1c7308f32d9622bcf4de8e673faec3882837377b68bc44b3c58f96865c806020f8d6931fb3c16d1bfdd

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
91KB

MD5
f883b47f1196b607df48c755766d50d1

SHA1
c9a73737e9736c958105fef2a4bab1bb14a75de7

SHA256
91948a3bfca470201d253cbed17d0e91099df2782b82ddf503c9ddeabe923008

SHA512
32089f8dc1b6bd5082fdc0295f7405fe3863f277006b6a2e4dd1f4f2706c64b51268a4fd66cd050616cc61030e1aa53e5462fbf89bf349de1c6d82288933cde2

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
80KB

MD5
329fa6c55daef3b8162f815f327454d3

SHA1
f67118bd1f5247350d7e53898c094ab072540e28

SHA256
119262e22069e8aec1d93f8d84bb55cb8b8f28e293bfd7d116f0d11e10be171e

SHA512
57d3529e4d70e006e755ab5e3b23eaeacd95b379e4f859d5f64aee81aeac564253190a86aa22a04de2d2ceebfec9be4c9e39d7d32cc6fe4d5fc43099e3e233d1

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
90KB

MD5
0012f55d51e5c1f54c8d9204a25fdb33

SHA1
a1c78c832bc105917549bb9ed6569d6be3e2cb81

SHA256
51aa222f871e095ae4e42c567915c47acc9f15e70fa4ee3ac4cd8721a1ea1b56

SHA512
bb1c36ba4ae69adba899b0064148b56aa1f75e5d91f8f35cb91a7cdc88f8bd6a9bae971fb79c7057c351aaf719c1e3eefe41d3fba1a5ec6ad734094db19a4a26

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
101KB

MD5
f8c6e6dc6a43f679258d5a618eb0e734

SHA1
77798e7c1e1335ff20aadedeff80202b5734b6a0

SHA256
f70e3421dc5299878592adecd32615b16a8b0ba9e3078faf033483ed82e53726

SHA512
adcf4f8fc462187739ca05f7094f32f8906757b71af55237237321f34d3c2cd8a03a86d5389bb6d7603a7197b65d0e4305b98ab7bd70e63b8e05c7fefa63fe7c

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
102KB

MD5
02f1eafca2fa921d4443730e26a63ec3

SHA1
a2d5c834ead3c5e0fcf1e20d71f050a7db3d2312

SHA256
5dc92ec40172b7b9aad16e1d1feb4cf957fb486cbc9fe32036d241512d9ccc58

SHA512
e2371cf7e63cc377ed305bf9813b9cf7ab90f4ec292e21a0bdef2e940df6540ae7366bceb3e34e58cf5dd94c298c0b3b8ca460f1d0f61a32e7908e555aeea4c9

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
92KB

MD5
e0d4a3fd1beefbc7cac58a242e5112c4

SHA1
335cc9d0e6b7b3ed33e368d2a1514ea6e399c250

SHA256
2c07076cc1698a0056ee48c037e177f3aa9ef94f861cf79076814de294676ba5

SHA512
9a1982f4ee0f4caca950ca0c1029280865bdca0a66ecd2abdf287878e327e2d3d2dca7f199864cf0dacb81d5ff93aa4d2c043b23800a7b7656fc52a7962914d7

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
80KB

MD5
b0c07ccf724d6bd1da771f1d7da84949

SHA1
cf0fde4601af6ef874a1103aed91ff5ab85f2a6c

SHA256
304c142e8097b679e146478545793702cc6b911c73fa3e55593faa250f82ec1a

SHA512
25a9b037a1201dbcc241e844aa2769e810760e995e923e03eb4a5bc06ae135e54e3fe529b695bc83b9d393d55679c56bc1571cf48115a77fd2914ed6d1d8b28e

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
91KB

MD5
452f4365e6e1eff5450cba3d719ac950

SHA1
1713b18ede6a73e27972f64076b536fff0b865aa

SHA256
db5dae07bb2d32cdb0edc2205faad07f75fa4a5bad376bba64a95c22da9dcd67

SHA512
67f3d4606d5dda0b68cd70ddbf8c0cdd1270554c7a9382acf427c043cb392076c5f39ced60c45a647ea6ec53bcf8f9b156e98235b67b2c40eed838607819c705

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
87KB

MD5
836050e2bd10a4bddf3c10a3af251719

SHA1
2705c4682428382d18590ad4643ba6122408c1dc

SHA256
6fd061b71dd0581eee5602b6ff3a844d2ac23fccb0abcbd55ea264de2e213846

SHA512
375b4ea35657f8776cb8c3d9bc0e6af8ad0eec9f6f831141a258dba1ca34e3a28da603dd8524b6717ac85ba6397d680db6a12aeb2cc76d9307c3d9b35a5f1f08

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms.tmp

Filesize
91KB

MD5
1329585055e9d8538874af40304ba09a

SHA1
a44af2243cd36dcecf9ed19651ec42af604f42b6

SHA256
2b00df2f742eee48b883b1214c415beddcecd98faa276ed6e5af9edd7ba463b0

SHA512
665317eaa03f7ede3f78ba3d399ff7d457c3347a6eedc4e225bfb4ed5f3393c0bfe62d251427b27c9983b5d965dba15b2db975227c007e93b1945abdb04f5b10

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
80KB

MD5
891a05261f0db4680fed9d8fc6845e21

SHA1
6167c05dccf70d85b741cb31eba71f364b7b7f9f

SHA256
9a537fe308fcf6f02c348ce7f61c46e1c066b1eb64af835f96d78057c943e37a

SHA512
aba1b00b9aaeeee63c1bab7dcfb45a8bd6b444ece652955709b0acc44181d1990afdf4e92aa3a4556a475c5189b64f4d5c86468071925c3246e1a9fffd082e40

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
81KB

MD5
f2cfe85a05bdb9e5e3779f50f56bed78

SHA1
bd5328c8fa562c19fe968b4b530e28b839766241

SHA256
9cacadb1f3335f9d8d5b11c2f5c6fb4e859180bc4664c3c35e261ea180f82cf2

SHA512
2267658bd255f3df6923a38ff24f4c1a14a428448bab3e8a98a6953f6564087827f2da1eb667b3e4a1f197701619d8408246a663be49d8f7cc88e3b8d5162548

Download Submit