d2bbe699b44b98908b2d31518df9380ecdf3c1833cb47b5221abfe1d3635642e

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a71d36d41f76e008767b9b119cfa8450N.exe
Size

197KB
MD5

a71d36d41f76e008767b9b119cfa8450
SHA1

e3b6b175da45e10d853d65e3d78739a6a5fe56b3
SHA256

d2bbe699b44b98908b2d31518df9380ecdf3c1833cb47b5221abfe1d3635642e
SHA512

430f2ab157626300c94c660a11d5b3a0256692b7471bddb0d0c1a2e84b3957ac820d667e7d260018f0e226ac0e0b79c66eb03c274a0e53277ff0b839cef1339f
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBD:PqFF2Ie+eFuqFF2Ie+eFr

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4386) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
5100	_services.lnk.exe
4652	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	a71d36d41f76e008767b9b119cfa8450N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	a71d36d41f76e008767b9b119cfa8450N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp	_services.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms.tmp	_services.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	_services.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp	_services.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp	_services.lnk.exe
File created	C:\Program Files\dotnet\LICENSE.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp	_services.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	_services.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Numerics.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\resources.pak.tmp	_services.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp	_services.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Buffers.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp	_services.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	_services.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp	_services.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	Zombie.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp	_services.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp	_services.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	_services.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	_services.lnk.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	_services.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.resources.dll.tmp	_services.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	_services.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	_services.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	_services.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp	_services.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp	_services.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp	_services.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.RegularExpressions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp	_services.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp	_services.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a71d36d41f76e008767b9b119cfa8450N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_services.lnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4652	2472	a71d36d41f76e008767b9b119cfa8450N.exe	83
PID 2472 wrote to memory of 4652	2472	a71d36d41f76e008767b9b119cfa8450N.exe	83
PID 2472 wrote to memory of 4652	2472	a71d36d41f76e008767b9b119cfa8450N.exe	83
PID 2472 wrote to memory of 5100	2472	a71d36d41f76e008767b9b119cfa8450N.exe	84
PID 2472 wrote to memory of 5100	2472	a71d36d41f76e008767b9b119cfa8450N.exe	84
PID 2472 wrote to memory of 5100	2472	a71d36d41f76e008767b9b119cfa8450N.exe	84

C:\Users\Admin\AppData\Local\Temp\a71d36d41f76e008767b9b119cfa8450N.exe
"C:\Users\Admin\AppData\Local\Temp\a71d36d41f76e008767b9b119cfa8450N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4652
- C:\Users\Admin\AppData\Local\Temp\_services.lnk.exe
  "_services.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.exe

Filesize
100KB

MD5
5e188a3803bfb3f78463c563faadd757

SHA1
2783462d8e730bc203bcd19bdff3586b55c12a1b

SHA256
abb234130c54956a7d1986156e50290ce53e2fa286f61ee8fc9868a84c1bd3c0

SHA512
fdc00c5e8dfed5928ecd7433e48bc519a06b95ed93df4bcb99519fd742f17ebccf640bb4813a0b573acfd068cbebbcffe69a6bb5a56d990e5359ce2f9f09b225

Download Submit
C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.exe.tmp

Filesize
197KB

MD5
d1c0b0ddfae974ffa1ac4adf9e216f69

SHA1
b270acfcc92a4540c101e1d35f615007c36a58e3

SHA256
84c4bb9565fe95c6892743d1f495a9b2160ec05c24cfd465fcc366fa2cc1ab12

SHA512
93a72286de76632caffa2252e2416141e2682e50f902c015687d4c7fabd01c4dc03e793b9a83372dd9891b79de782ca9a0b469cca702833a6b218d404a57fecf

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
212KB

MD5
5064ef53e88e239ae3addc5bbc60fa7e

SHA1
c988405eb31c3dba9ece163b37aa855269b2ed18

SHA256
6407a7da72c6bbd28fe64568d5ab4d8613efa72266f3eb44c845b0770bdbe0dc

SHA512
36d0d7adeb0d4fa708ffe1f9ff66479a80901d60f5b88553f9a57bea9908aac1c1b69623cc90cbf5d4b3a8ef2a14b57398ce3b28a8b222e34a3ea62a66302f30

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
164KB

MD5
f5b276c3d7355842cbd530651625079a

SHA1
5c4df89f6cc8ba736296c0bc130eb36bd9049774

SHA256
7e04dc5b0f2ecc4f8ceafa2cee379e7ceca3fa782ff1d253a1c34344b39f1156

SHA512
bd77ace142bea3e8952b74e56976c3380c9baf2d511a38f4e4651286370fb34aacd2244d52c83a93083c89d3dac6b97f9a73185a462a435b0ae2b606f8f81fa5

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
fd0bb4195177166ca44d9c40fa4d4686

SHA1
04260faa48ae8f220405ee9f637dec8a186094a7

SHA256
f2785738e094f24d3d92d2f48a8a6d8d6a2255e1d97be9e637cb063a9cedf2e6

SHA512
87ec5ffd0165331bcdd44a90695c9aa3b8be7bcd83d2989cf4d26eb08dfe7db8086411b88715f0ace8cc55bac25b1dccf66328ac058527db204637be31a22208

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
fccbf9bc2d7ba212f965dda0586d053a

SHA1
b9caf7ff06287304cf11f33ed39ddf8c8b71c1e6

SHA256
b68dca89f88a2be9ae629ba8a9c1c84a0af60a586db9135d8e8f0f8b0b1eeeff

SHA512
e43928c7b523486e3a1773455c310731d1119acdb5f2e811d28bee03171903b19c6a1ec52cf12a8b4fd4fa41bf595fed44e1303c56e0a719bd2c945c857a3408

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
643KB

MD5
9f0a5532bbb6e43d3819d522911fcb98

SHA1
f87c0910eac37d8df7ae1831f5019510099a4b6f

SHA256
b792c25c6029b878df369725ff56224ba231f56f4346b5abf6af6ab5ed853a34

SHA512
ae01c6f1306553af4ff91ea59844a5f0653f3e3ff342adfbc29ad4d834015c332f2442839b468afb004cf6866c124df728a647a320ffe9fa30bc1736edf562dd

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
309KB

MD5
511a810dceb5457871df10ec78d427cf

SHA1
e55dc38dcd2b392a275f4e878410f29499bcdeac

SHA256
21ee68af67e5e6c51e709d289f3a8c10895077a0b7aa33e48c43fee62dc3079b

SHA512
7742d1ca0df117421ad0d3dc34dfe36983ce21af280dd6d20d017d631b138f81a92577d55e5f32e91888387f7d09d6f3ef674c27b7c9e21790574fbc63b2ae3b

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
288KB

MD5
bef153d57ac21a3822944514e2e650c4

SHA1
3cfbbaa4de828bed2f31a95935ab08169920dae5

SHA256
8a89a4d2544d8f08d7c566c60483581c46d3a1859fe83cbed22b80c770c7cc2b

SHA512
16dd3f0c12cb738afa8862e7034ef15d974ad8dec698790b74591d4b98c2975be7176ea7d5784c309da08dac4a1fd8ef07e7e749c50ac25903c24e9ccc85be3b

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
cc28749eac0be8c44e777e3a14eb3439

SHA1
d39a3e456b80e576be452deb9e987823e4afcfd4

SHA256
e0b3a0d4f26bb53a7373ad27b80c9be7b92046de560e48c1befd593fc946fe79

SHA512
110407ef4ec2adab728434b37cdad04d97543397202b455783aaa8c94b40f674242c1e458456b7980f1a20f2e4665c04422ada2975ae999c3bea845edf0b51a5

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
16KB

MD5
6e812ce6bca23bb73ef79b732852a9c4

SHA1
c6d1648b7036e52325d7dc22f042255cb8758169

SHA256
17fd7214063cca63636d4ade8c3f1d2a41e90afefdbec661ba437ecd92cd5c8d

SHA512
aec5ac5bac9026ab893ed45d23c0f6d70de57383ccee181ee7987725ae82abe7cc83d71f36dfefeb1cdca472a04d37b7f31903be6a3b22e5c657bc97b1ffc8dd

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
109KB

MD5
51562f1374a766c19c11c1309b0ce8e9

SHA1
62461f4a9a179dcf913da98341ab2658f0f68820

SHA256
8b295f5013789bf258093bcdf02384081f725cf695f38dcd72d732c1f3441e5c

SHA512
92ae703c9c3a0bf7c25f233ebe928fb88f7607d59bbefda6b8fb7f4d8d47b67f68e159c3c59ff91e7d032be62961aec7c5a409d2c039e9c8be737d61b5b18945

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
107KB

MD5
7327bbacff5b6ffa22e0aa7c395ea580

SHA1
2d85b2b2912d296c9ea56d33adcfa93f59a6804c

SHA256
2a93d74a61484e743e508c8d43498ac459c5c7e69563132770963e3c6c2a3a49

SHA512
23185215ae5bbd108bf7f465a856db4c06b478ef276a1d82429725c781b27273c4f3503edc5090c9ed3c0a6a4fa22cc9fd14c2dbb8a7c56650233838985a2120

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
112KB

MD5
055ca03f9f01e8582a07f080e66d3299

SHA1
515f12087cbc73c6d4599e3cc09f15ea99fc34c6

SHA256
59a83a222d6f990387e7ac392c13b54c1b73398febd66f7f02e9c3fa3e68a105

SHA512
090568bab1dd850e109523e21dfeb22b2bac8e624c419514bbfdf3b53f0163f09c9e31f798d813a30f7b21233be67d662d0f9065dde7e436ad18e4e4764fb0b7

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
105KB

MD5
b3ac20f475a9aa77f6f15148a13639de

SHA1
fb7cd5efddaeb1309ac56f3df25c05f3ed4155e3

SHA256
c5158e22ab8d893672afb6021deaa433b77daf6b3528867c05cad8668385f3dd

SHA512
f98923e909110d6eee93295fd9edbc4259346ce0058589551e58f5df79706806acb725e47e8ea2741019103b19a117d6496dc958abd1ed64efdc21aabf19af9c

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
109KB

MD5
a146e91542e9dc81369df851052b8077

SHA1
13ebf7b935b2a91f446292a87b99dac68f9110dc

SHA256
ee71ad03982f0e2c709fd9364a9478210953fb91e4e49d670bf750dd561c00ab

SHA512
662196ee1e69fdeb68f2acc8b71bdcd5ae7fdf398ef4760455cf54b0124233087c6ebeab5dc4261b8d476272851d27610c1a7db9c0cf3b4bc383a96c93711369

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
110KB

MD5
f77e8007e90af9e24276e2e342547b02

SHA1
e126463f785d62abdfab8100c5257a7936d48738

SHA256
536c09a86ef1201b18296aebcfb8f8e40dc490476df43f091cde154faf546ce4

SHA512
f64826886e56a77e8cd83c9aa3db50b1829dd5b42f7e8146aa2bee484d21f81c5bbb24ebf713ea25efc4e7ee1e1c2c44327477622acf77a2ce9bc387085e301a

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
111KB

MD5
870bf5d91168df7f2cd6ef8f5b0fd9cd

SHA1
f77c697d6b33f11c3c2fd17838a5cd3ad792ac62

SHA256
f606781a66a97acd6096d369a68a6cc3f2b954943078ab593fb8b34eafd8321c

SHA512
aaa2a6d1498beabf8bf2a0f29a491e31f9effcf4fcd5619907576cec99ceae4f6989f8c0066ae8356dbb3f15d159e52b422757e42a3b99cca1d0ba05d0f8559e

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
104KB

MD5
fecb1d12a850b5036edde06d1cea0a66

SHA1
092aeab86e659b85adcf521df11bc396eabe30b4

SHA256
7ecfb58a6210df530b10ead7d0a642aef3b53429cec37b49489bb1f1bf47cd6c

SHA512
a568b41b3e38b5c391902ad23a0eac9300c3b7475c767019f81ce652fd649e7e6eef17dbf0b0f69a3bbbd4cc20e9f45f7c0c107cdea3d126d3575606981c1323

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
107KB

MD5
fe0a510d099947c0b369aae5ec7c025c

SHA1
981a66acc291d921cff20707a9adf035fb9f233d

SHA256
3ff84e25438a2c4ea56af7194e1646b9a93d94cd20e181c3eb2a77a9dccacdd7

SHA512
6e074340e973322af5be5ed610b1133edf955575523cf9f1a9ba2c7abcdf88c5ad6e316428d3895c268b91e20d8498597ba1ec3cae82a2e8b077dace4e5574ac

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
109KB

MD5
e72bb1edeb276968c2c5cabf57102e3a

SHA1
27b7e565fc7deaeebac34f033d9f711213201ddb

SHA256
48b018e417bdc02b7bbdbfe66bd01a749cd3f16ced258644309f4081c24a1ea2

SHA512
184a219571331c74b2b1a9c8be13873a5ff20f227084d5dfc2c0ef2aada96149ef2f0075b0659b0253991168135f799a9709029e7ba461fb60f4b11a436c5001

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
116KB

MD5
d0dbc6a841296bea9ec170a2335fafee

SHA1
8d1aab9fdd52ef9ac7e052fdcbbf0e16a8ff5111

SHA256
4485622b688ed62c37cd63f4b9d9c69525df12d25eccaba612da7df6d7eaebfb

SHA512
f3f4f9fe91a78efdc7195e942ee1561035c81c96efd4c5e2a95e6b08a6902c6012d3197e2e6594b93b83ed4c29cd1b524b66633f1a8ed33f9689fd017dcb8ba7

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
107KB

MD5
8d8020fb3e0c2e280df226a36c263ffc

SHA1
318f48954dec372d9a70f70dd180852eff9e8637

SHA256
0ec52b6793349fe8021bb6187304209260faed11af0315454338ad455c918226

SHA512
b3794ede7c9d6f8e3667a9263f7e7e3e32614889cd52ca00ee71d0e4a363e96cb4cc0395b6dfb0addfcc0db76cb61e3d445076dde7af99c4b156cef40d1cad30

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
104KB

MD5
14c43419552329d54dc06ad99d11aa6f

SHA1
6673239c391a62a42e4a1f60db964f5f8e488c1c

SHA256
0f4913e0cdbf5adbc6a2482395d9917895d0aea907d372908eee7b44f74dcde8

SHA512
61335016fc75099ae7adec43e069978932cd8330253a50e832dcc4e577644e5e73efa74d71ccf003b2f7462ada665abf26bb464f0d2459192118a073aa4f1f86

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
107KB

MD5
f5204d80c13c18d59e58a1dae1a9f51e

SHA1
01c9f0fd1cf8a13f9bcf507d4a09c9d715e35809

SHA256
fc678b4953c4792715b972e6764028f5c060d21b5b3b194567563ddfc21fc3d9

SHA512
1a0a354a1d331ad84170bf05210cc26a49548fa77485ded5fe3e7a6f75780a8510bd426e26f80ef0ef2647db52dde240f5b91f8c3b0bad691b8a99b7a01f84c3

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
106KB

MD5
8bfab5717a7698d7955199751b3a3f02

SHA1
1c456bb090dbd9a1376e1dd52cd1d90fe79188bc

SHA256
7f9edd7a47780ad03356b369fd38800158b7e1fbdd9183df70a8b6eba81ba0df

SHA512
4a2bb496c9895b056194ccae14eb971e0539b34cfef012a1a1e39cf9b883648dd2436025750f195c4288c7dd19aed5f21d549fc921fe97ce6648f4b5b38e2c48

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
113KB

MD5
a95403fe0fdfb9a2bd241a51d2dd7e00

SHA1
e15ec229a839a3b11573ad43dd57ec0ad0a3529b

SHA256
fc81a707291d2d46fe665d551ecd7f6a90c07ab88fd0a148c2657305b5f8e588

SHA512
1abf23bcb8f734c4de580b2f34188b0e458d1ce14cb386fe96c69e366d00f5aa988e478c211dd7f9a9590121c1c322e885725be8c22d8348cf1b7ff92af95f39

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
106KB

MD5
6072fd1b1ca9510ffd09ac2e0f3c4d41

SHA1
3eb1e634f258125d3292f5637627647ac732321b

SHA256
e7fbca2bddb83b1b6b86c97a1df4b9afb134eb9dde7ded32351c9e0d9304cbdd

SHA512
57e042e0867be473ece888d1d1065ee5e42150d5b4aa5bbeb0ca45c2beab40e0eedcb4d913240ed6fb787846d17d9eb48069f890f433fd95411d645ab05a7eef

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
109KB

MD5
eadbc803e1eb63944ffe05e80ed9c2f0

SHA1
12ca51b0c237ae6b0ad7498fbf6d94d4ca9eab07

SHA256
1eed585d400fe76bea8c20f5f652eedeb539709dd262ccb6421c97bd66c3e1f9

SHA512
13c86f8ab4280cb4e061749196a2d1a4e0b90680f661bd476cc8e277b853105e935bc723336f4545fd83418777b0342a114595a60eca006648b4cf9635463cd7

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
104KB

MD5
84ccdd8b5b6b529fab30714bb339d803

SHA1
d9cc5afd5b24cd3d536910920c0270f2a0cc8011

SHA256
9f2ac1ada0809db82af21329b127546bdcaa152aa3344c1ba5456cebd6bc0ba0

SHA512
4795ea3119a00d2f357bd0c27f0557644b65e6842514f4e867c83fbf1530b484dcfc00c317bfaaccd46735a9d0679fbc992cd1d6881e319469313a9bdf47b1d7

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
109KB

MD5
ef323196c3cff71d31a73ee695e4607e

SHA1
ee9d5e829d074a1241b84cdcde56f35ad2596c83

SHA256
68350aa29068f9d64f7d1900d79de4c1f4d3fd09fdd02bd2dd5cbfe6c5f43657

SHA512
f32772771671cd73b8f16f601070fadbf1aa9ad894af486ced49b0a7353b19c3e331eb78b77749daf1bb1e655c79a8e94b60c95c5513ad1f2d69196c03d407ea

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
117KB

MD5
1892cc8c9fb22e26a4de29eb37529583

SHA1
132f90ec55f1e02568ac5903de476cf17da7d380

SHA256
35a9531274233582e0ecd412f91211451a382557fd92514b2213febc2d14c495

SHA512
83dfa550af3c8e72c9c04b5b3563442ff47112c3de501f25f072f0c517e5268112614b0dc5323f51216553f428fa9e3c052fa25455cec5db8bb755e92dc451bf

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
110KB

MD5
e93383315fbd8dd97497cffd9e4c26e7

SHA1
f1e216d9957713275381ea494a0eb07b751ee20e

SHA256
0758ca742741106a113ae877de55252e2a7b9ae4cb62c354a4c7b4c71a87dac3

SHA512
0207a04947b271144da61f0673cbd2413e4641abe029d6bea511095600bcf94e081db2438fd6cefbc6dc09ccf14d9c184cd12aeac469c28a6ba457a8bd814065

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
117KB

MD5
ef774bfc0d90259873dded281fc24c4e

SHA1
71d6d7904fc5ac3a67fbe6da460f083769d5f1bd

SHA256
d9834e1c37e73617f8c0812d27fd5e1f27d6fce31670fb77764d952febdeeab2

SHA512
1ef161d743979a82c8ee7bd08d3f9c4611cb0dff6bc3b381d610fd9aa97caffb529a61536d2e9726b489f83f7b1e7f8feee888637a36e65709d4981d608fd0df

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
108KB

MD5
e3a07d8a7728765e4a34a9d8a2ea62f6

SHA1
926e7140e248a4ccac9755fd8ccd9c5e226c1077

SHA256
510a07da7061be653481281ab857b93dcb242632d3187f157132ca40c6fff76e

SHA512
01d2d7a2c4ef3a2b9b43da87a160c53f79ec884d15db1dfab8c3963099df60793a60ad7f435fa0153cc3aa1c24c1a64e3367ffc9ed82af33419bece59eeea0da

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
113KB

MD5
1dfe5f4310f07531799f4e1751f314c3

SHA1
cf540c9debcff7511f55382d6d7780b1fb152cb4

SHA256
100d4bbf55853084e01310c71ab071fd11d13e12f1c6dbb6f4547672cb80c359

SHA512
67d5a92edca191c48b4b11cd78a6afa587299fb0f49a71728496ba15bd404a634a1db9455dd34cc75f8e2ba10bc993ae2a8476d59008600d788cb7e2b851c6e5

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
109KB

MD5
9af670c0dac102c8daa660bc30d519e0

SHA1
df18a2023e97943e1a71fbe6cca3ea9138850d47

SHA256
a414510cf95b01978cce1c352ecc205485bb120ab8295892f12d57e76a9e263a

SHA512
68f853c2a6009ac9f920a2a7670cb4048049b251383bf9c2c8a730bea1f548a198d224aa3179eeecd3ad33eb4f517772a94a2739cb44b6ed00512bd93379eff7

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
108KB

MD5
18d043f5af1c2e3d84db7191538ff721

SHA1
ae2473518b561461fe437cb665a71481bedef4c6

SHA256
2b869106f3cd8580ca8e378d0c167128a0b7c3513c5a3d4bd8f0c4a761343e54

SHA512
322da271bbca7d58a96e2a6d3173106799fd412e72a414ce56f11d1c3929618ca4600b0196996fad75f5846b80d8afa70c4e9fee6c074b6c8531178e8eee8a59

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
106KB

MD5
c5c6fe0daac490d32889e5d7e6a7a6bf

SHA1
37b90b40536d08f14a6f37427464726d508bf143

SHA256
8367aefaf5b57a5b7053979f0932d3dabae2afff83c46ca648b72a79d0f31c9f

SHA512
dd44359eeeb7a4c8ef194329514613fa8a42ac3eca3a9e4ac9c3ff3b070a4b29ed82ea43f45667525f0b7e5722379e6c28f9558fe873e832e7d22c984b03bd9f

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
117KB

MD5
0745d8aaf8a81568e4de20a7a8bb90c6

SHA1
a083b6ed81b0cda599bc03f74799f79ec6f9e121

SHA256
025ac0ebb902592fadc64831f8b56fbc543bae93d2a6bcf1e825b5f873921274

SHA512
b43c6e2298e950550ef579bc935196b78abc21ca1fd48eba2ae6d169c4e3bee0ccefaa9c3d9a7be1f22c5525ad8e081dd428d0528c3f7ddd01d50352ff549999

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
107KB

MD5
09f1d39d0ab74838d6f4ccf9629b7e61

SHA1
25177443bb980be78c48c178eee4d7546d9c095e

SHA256
92dd910aa2464fcfada3d91277ae4a9f325950e24d5f207a914dfb89fe8e3b1f

SHA512
8859b174f26af9ef3132fdc05b811e7df043e965cb6b48db2656f50ea688915695dfdac0b417efc7289c0d54800ba18173bcea63383ea6446493c606a21c0b5d

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
108KB

MD5
d5a75ce8bceb1c886e78f5f8d2b2055a

SHA1
fde1939242ee223ff0c72e2a30717ad89a9b1044

SHA256
c8909d131e5874d412233addf5d461d481bf944424d3a43a5a8bc0e46a254720

SHA512
844ea8269eb9b1603f5c87723d92791180f05dff6baa75e8a429e0257dedb8941d4be9bd387edc7a095da4ead5edd74971d48f013ff4b7411bc8af717f57a3d7

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
110KB

MD5
88ffb24c08b5c0cb6116b18dc2f2bd8c

SHA1
a3c3dbd4da387291d02335c942899d0c7da84e82

SHA256
71846da0bbb86de7abea2ebcf54a1862f892f109c3f995a25087101b4f9f29b8

SHA512
fcdc8d1177dd7b33ac6b25bbf4e5e9b0f0307b1a5238b32b8938b7ed67a1105b5205b2485ad6be20c40c602832fe6d772c92a8c5a32d2c43dd0bf3f5ab7278b7

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
111KB

MD5
5c7737d729fa764681d0a9b50c703836

SHA1
94ccefddea7f1e442d3681a5b60b2520456e07c0

SHA256
c97903dbf0daccda84e389e13fb662ff5cb6384fea3e7cde4d5d0236124653de

SHA512
ea827d4f6e526c66f92a52f2a2be6bde6f8d41402f7b7ebd78b6949719f649a88e6b0a877745d00086db086f841e6964e8a62a6cc21176d4c25dc49aad25bbc8

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
105KB

MD5
70ea572abe720adcce9a39f73b538f27

SHA1
5715ba03bf04b46af01c00c3fb10b7321179d212

SHA256
4b8b494eb9ea2c2ae6d159881b11a6eac30abc904edc1df8120098524d2ed23a

SHA512
8e928ac6e9a5fd21baeb008578f45ad95ddc62e59b53c790a549ff5f34ecf2f604ab023b069b61930b7e32d47fb59adb58e40d3e51f11ce82e493696290c7721

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
111KB

MD5
8bea7d5c21aa4498cb13860fde16bd10

SHA1
0166755dbb6860c5c159396ecfe9cfc2da8b2501

SHA256
a11baba89f7cabc4c7458841a80163634944d05ebba9ab78ac8aa9e05a4f9cce

SHA512
9a588525f0ddad13c4d0ffc8af012b1ef4b7f5d3412eabb4f3651de00eb358e646b8c54eb6b94c73d5b733d41cbe2f44f3c0f953183e470755f4fb9a0b0b19a2

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
107KB

MD5
7bc6b99480390056a7ebc28e722705ac

SHA1
1b2d806354f6b23cb14c0bdfe3900174c685b878

SHA256
e578ee90e79b3a8e674b373915d2ad494aff293d764fd4b6ed24932814140c92

SHA512
0c2a00e98b671c465a90b97d61d1ad409d5e2c5ab9c5c3bf3cbf9b5ba7fd22e54635b101ca9ffffe392d066dff4f42cc7b927c96cc4535fddfa25ef6c6ff9146

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
109KB

MD5
0938cc0f7eb427e4a4a513e7e307544b

SHA1
6cc34ba88ae5be3b237153d2d035c7d45a819375

SHA256
597972c6ea19da78ae84d9edfecc2b29dbfe67cad32ab6934691965fada8d618

SHA512
6668fec289925842a8078a47c52d19bcd5b12a41a040b6dd9d6519a835aed77882593ad8f50cf8ea3224aa082cbc971c6ecc03fadfbc8cf0b88194a24cc424ac

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
105KB

MD5
979f8baa73c39429f4881e45d72be19d

SHA1
d1e2a662a5eee9815ed642aa5fd4813dfcb0dcd6

SHA256
5e23a9aed5324fe1849c9acfe78e6e15d0c198149f333e0f5b9e8ed83649c2c1

SHA512
a30f9ab83ebe78ff27d4a7d36d6b5c51b07d4c2459b29a295b9ec09baa23b163017b56e527348bfe4c8f6e38170231046903f9c81e44c7889e24d92b5d31b12a

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
108KB

MD5
da69b45bfca3ea83fee6ef2ab30cc63c

SHA1
63e6c52b573eaff62906df1c77fe3a66599ce1c5

SHA256
5cf8f84efd4f6a39f3dd5f5ed2440bd6879c2a62dd87c89d2c8ebb6ea9dd55f6

SHA512
ae29db88966442679291d2f94303b8300e9daa9172c1b6710a58b89d1221feb5174a1318bdd32cfc6a6eb46d9c5a07249ed2a7ee4be0807a2fbeaeb2700e6c97

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
108KB

MD5
8fe604f00ab6c5a5895b99de03609a48

SHA1
061fdd24000d413786ef88dd4c2526e29f549b1c

SHA256
98ada1ec52f1338830d3100a389587e4e06abf499762ef5ecb7acb80bcac9954

SHA512
4d57517885136d921a7d4b01add7be14170f88a91029da8c101863e64ba84df1da7b6df62a9e9b0007c468cf86313aeb8ce4cdc1e205d525d8dd7fee9869265d

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
100KB

MD5
f28511b40bfeaf440cca52de212ad0c9

SHA1
a6d0a1873928c4302aa766dab83b617c228a1521

SHA256
a4931d31e4423651d3838a78e38b52fc7d7864c712af87c0e4f260250c05bd14

SHA512
ef22049bc014cadead3f2a1c40571d9d66f62f1569b1b419ea2e22ff7b41476cc05688da389cddb4cdab2c3d712c3e07fa3c53d4b0df1293f0075e5ecc29a6b7

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.tmp

Filesize
107KB

MD5
1bcfbb870ab658a7f4fecc5e66101883

SHA1
d9d08e8273a233104ae069f417271e2734b60378

SHA256
59a3fc7f71755fb7c1bd1a99590611ea839d064c5e3cc75edda8b945123ec46e

SHA512
2ce40a4efa8c7bb174c94a349a03916ffc1906f2687876f50512131d194812f80cbbc2a33b869ff987fe265419e707ad2041ecc8e2ded7be4d28e2a8fde98293

Download Submit
C:\Users\Admin\AppData\Local\Temp\_services.lnk.exe

Filesize
99KB

MD5
18aed92c430b321ae495ea2d8a4da0ec

SHA1
3a006485b4d0aca5ea3731351b7507b449a3fa9b

SHA256
efb55d204cc27a73750e76b06ebc057b1d5b1b6b0d079f29faecbeb0dfb75372

SHA512
8de65be9ea36b6b09f88ab6c67f5ff1e819a755a60d4a371c45ea98493cb0eb761663807b075704eeeeea44f4562b1826ba0c27df02ecc164afec088deca92af

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
97KB

MD5
ab9218a0830bc2ec22be53588c7c8c47

SHA1
e3f8abddb91a640fb83ac9834b587acf11d20165

SHA256
34cd1ffdc174c95b2949eac94351c7f8b72f596b0f0f6f477c1bafb9295bb40b

SHA512
0c70c63cc2d9df171c3dab94699638e7f138bb0343dfb188a2d9cad928e728d9eed804abf7cf707697309b050d4ee24fe0152c94283a1087544993a952593d12

Download Submit