86a55ff90a6fa49f1f95857a0675daca9385bf9bea1dde06bfa25021249754f3

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86a55ff90a6fa49f1f95857a0675daca9385bf9bea1dde06bfa25021249754f3N.exe
Size

69KB
MD5

90523974b87f3c7cb41b8c6962b31b90
SHA1

ebf0e66543f2886e120f97102b34f9bf0bf1d855
SHA256

86a55ff90a6fa49f1f95857a0675daca9385bf9bea1dde06bfa25021249754f3
SHA512

86aebd1a76fed673a9d098d9e57ff8e6b0f6410d03f2d45276a65ce2e9de5f14a9fcb5bbb3532f87d855553832cceaeebc131fd784abab9f93e5e7b7614ad33e
SSDEEP

1536:W7ZhA7pApM21LOA1LOl6Ap7ZhA7pApM21LOA1LOl6A5WB:6e7WpMgLOiLO7e7WpMgLOiLOU

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4701) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2800	_Visit Java.com.url.exe
4668	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	86a55ff90a6fa49f1f95857a0675daca9385bf9bea1dde06bfa25021249754f3N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	86a55ff90a6fa49f1f95857a0675daca9385bf9bea1dde06bfa25021249754f3N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp	_Visit Java.com.url.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll.tmp	_Visit Java.com.url.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationUI.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp	_Visit Java.com.url.exe
File opened for modification	C:\Program Files\DenyOptimize.wav.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\th.pak.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp	_Visit Java.com.url.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	_Visit Java.com.url.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	_Visit Java.com.url.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	_Visit Java.com.url.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	_Visit Java.com.url.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.ThreadPool.dll.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp	_Visit Java.com.url.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.tmp	_Visit Java.com.url.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp	_Visit Java.com.url.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86a55ff90a6fa49f1f95857a0675daca9385bf9bea1dde06bfa25021249754f3N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_Visit Java.com.url.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2800	1136	86a55ff90a6fa49f1f95857a0675daca9385bf9bea1dde06bfa25021249754f3N.exe	83
PID 1136 wrote to memory of 2800	1136	86a55ff90a6fa49f1f95857a0675daca9385bf9bea1dde06bfa25021249754f3N.exe	83
PID 1136 wrote to memory of 2800	1136	86a55ff90a6fa49f1f95857a0675daca9385bf9bea1dde06bfa25021249754f3N.exe	83
PID 1136 wrote to memory of 4668	1136	86a55ff90a6fa49f1f95857a0675daca9385bf9bea1dde06bfa25021249754f3N.exe	82
PID 1136 wrote to memory of 4668	1136	86a55ff90a6fa49f1f95857a0675daca9385bf9bea1dde06bfa25021249754f3N.exe	82
PID 1136 wrote to memory of 4668	1136	86a55ff90a6fa49f1f95857a0675daca9385bf9bea1dde06bfa25021249754f3N.exe	82

C:\Users\Admin\AppData\Local\Temp\86a55ff90a6fa49f1f95857a0675daca9385bf9bea1dde06bfa25021249754f3N.exe
"C:\Users\Admin\AppData\Local\Temp\86a55ff90a6fa49f1f95857a0675daca9385bf9bea1dde06bfa25021249754f3N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4668
- C:\Users\Admin\AppData\Local\Temp\_Visit Java.com.url.exe
  "_Visit Java.com.url.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.exe.tmp

Filesize
69KB

MD5
c7162dbcf146d0c6bf6d83b9d645ed20

SHA1
e5462cb1edde0a2cd6edc7decdf777354fd74f4b

SHA256
895a970b294edda39cca7a68b13413c1bee72dc1ffa942c51477f2772c4d458e

SHA512
99c4fc6c0f393f36b9f75751d4294c97023a37d7c226963069db222fe460e75c0f081f5cda0bbd4d475a390719e71ab69a89f6c276501cf4a42bc37b129802ca

Download Submit
C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

Filesize
35KB

MD5
71932dca0f00daca88d1ad31aea68bb4

SHA1
cf5fd1705198f6e02d737e02ff9e6b425b34e4d9

SHA256
7ec138dd5a479b17f89d19610d8d9649f7bee31dfd447598a57f50697b76b548

SHA512
bff3ee43a061a260193c35f447f33a350818bdeb0be9c41e219e3d7ce9dd404cc6fc3ef29f7acda1410a22c35844a638b052ad784b8a8dd0c83ce7c5bcf1723b

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
147KB

MD5
68cf401ee1dffb22af0d1612776997d7

SHA1
7ded93e79bcb241a9e5166326655807b0e9dff32

SHA256
0c5cd314368af63e9d8bb7f4bca59395e7b0d5ea0ea373aeb5d1dda388e5d01b

SHA512
8070aea94c2d15993a5527a8902c8064cc5083b29311929ecf2230bbb592effd90d7947ccdd35d899324bb64110aa381d4cb5e9c63ade4eab12f75474c00655f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
133KB

MD5
d5dc7a5949c372456f59dc4a8f1b020a

SHA1
2f3e543a260251043d3dfccb337b1d752b5d266e

SHA256
066d2b22c94de5fc32643d96f974f14d78245593877be4793ad09211c81ab5fc

SHA512
58d214d3a4ff2b8c411a1175dc516f822b15f56c448b2e2e2678229e4873bd9a67d7bc014122e4cea3c9cc3e0ec3510e4f2514d9c5beb0cea84a808c23d5b7a7

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
781ad764b9bce48ffdf5e830154f7a34

SHA1
f18dbab6c3edf4ff3119f9ebbffe90c2b20c72e6

SHA256
d39d2462d8d5e3305c98d0c6ddf4ffdb4c2d07b5fa1311a4278a82285370fb80

SHA512
379c2bebfea9b5fa8bc658a3afd583cdc9b6a9f4cab32b628e8b086f56d35f80a43b447b493e59108266689af4e452733d71e008a0aa7fce6932393d9b2f6f81

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
578KB

MD5
7bf05217db6d728ff27b243be1f211c9

SHA1
e2ad580efc301a6fff2d5eaeb5090214016c5ba5

SHA256
882751d33920ab0087b0127fa3180634f7710b19ecfeed0531437ff096f66acd

SHA512
3fccba5323f9fc53cd5a37605cc8121c2f3dc0bee00b622e2c91b4b3412b41659fba68e9ca614f277b4c720a3c6eae6c76ac9fd2fc136660c13cd6964df42526

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
244KB

MD5
5aa5be20b47c0be79d814ca2575332f9

SHA1
161a6927c66c7ef5d962a8bee0bf437f67d3260c

SHA256
eea37b2a34512423276bb38186a53f33dff365c0e02ba49e04b2ea5e9db21cc9

SHA512
d1e5c9803fcdcaba4368c3a91e2e778a31378747908a0720b78a77a7a8d3717b0f443c254e91de3bfd20209188ce83b340e73c617d64e61f2354627d751986ff

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
965KB

MD5
9d67b4cf5e4471b1be13212e73a1c59f

SHA1
d8d10721b6f37e7efb263c9f094339d6f9dc4dec

SHA256
c1056248b186b3e215b46e7f5e0598a19b125a55bbb3dc8a9c7fd2a262edb559

SHA512
ee94df8c58663ecb36b72df0468d093cf39f95fd6a7b92a581ae00b975bae1f34a7aca680e7fedc0d3d4ae1abcaf48d84649dd37db3d8c53dd6db49604484ed1

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
718KB

MD5
6df378c168d40bdb0c2525bc8dc28fe1

SHA1
7be884253c83cce062ffd93bc4b025efcdaf498d

SHA256
558f72c3519261949caece708c117078ddf78713ced1b24c42a9eda147474f19

SHA512
a889b13235c977cf7b950fd5b128baea5770566a4eb875be6149b27f9cdcbda898c9bcc536f860c1572e60fe526063d192b1bec61150603f5c8d285f510f368b

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
44KB

MD5
d3426c3c4066020f9e329ccca1349d69

SHA1
33a5f59cd77c8ff7842e188f4a1a459d4798276a

SHA256
4d1cea241b4672e42d0d26785be3aaf90b4d7365d9e7ea0d8d70b8bfe5a6bf4a

SHA512
c3d3030177cbcae4d27d4b70b2450f9ab87f33b4a3543adc53e661559a33ffbcaa68c61a9c38948913ddeb42ae3af1214b17d2aea0127acfe31624924bc78052

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
42KB

MD5
b2c376cb47d290941a25e23c61f36286

SHA1
2ad2a4f75f0c55291df80257dd4ec009599f7d40

SHA256
2844b99c1dfd80713139cb4bc98196a5eecba4ccb30c85d750a62fc123e688ca

SHA512
aa29fca9c7c8c17e8a89d96aaa018672593a00b91408fced50d4c71724301d209d1553110758a4719ab7df2ef27b0a4c23f62b84bfbe1c61bd6eb9bb292c65ca

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
47KB

MD5
1c14e98dc4ce99de3febc468484ad5b1

SHA1
fdea0f3bdc34052b883f0dbb6e7af0d7d0a693e8

SHA256
8114dfda55d16e8adcb25c723b23410e43daede49bb9dee37c8a26228f27d978

SHA512
73129eae140cff886ff0c07d1f98b940ca00cbb4b33faa88f1ef1193c4bbf268c2405a3ef57a1500b79c761a6b322372baa1c00372bc0d0caf134fc6ee32c601

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
44KB

MD5
3f9de6822e82869534bf61e9fa7b8fbc

SHA1
ff15eb81882a628dc19400d5353c6f71dce2a6e6

SHA256
92ad0d62a84fc2846f796daf1c292c9c4ce9221c56ac7dd7ecb70f264b30aecc

SHA512
cbda42dad6877333768ce4763929957a06130e56212893b47de829f31306ebc56501327ebe070406ca97a118c519f9796b1b42bd17ba80d18389009cc86d5ffc

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
45KB

MD5
2d2f9f4143b7006d7d0a83970f450460

SHA1
41f9628c5cc54b17e8bbdc95f351e36211db1b27

SHA256
5baf79efef7f04f0cf2a4e0765a2668926a89e9d9ba69575972af50dc76ee2b3

SHA512
62c47e3f7daa0507496f11c3240519a3c976ee8b93dc3b683698fdcb70fad0c8b15bd2dd72a71bfab443a9a22a34855b704f9dd50f88c06c2b24921e7b34aaa8

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
46KB

MD5
52d18ac34474d325acd8ffed745afda2

SHA1
32fda66f4b3e1126c19f88f6e4b33d0c666c2ac6

SHA256
8baa761316dc55ad9496ad78f1e313d3f153c866d9b72d35fd3684063e0aef8c

SHA512
96bcef036814876063a3a340d6a5db4f69883457d35ccad6c7037309e25950d3e38c55f661e2eba324d675f2c3ce7291a50fa82df34b685fb99f2969470345b9

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
32KB

MD5
e447cb8b7eb91e6e869a6be579742118

SHA1
600f5a63c897ae484984510fb3ade84fdc8ed511

SHA256
ab04cff3037aac3a54ad18abf787d449e92075167ed3f5a0cfe638db030ec86d

SHA512
d4070c56b747cb4693daf4ad1050be4698753714f72f8920f6fb39ddd1dbf8e4d6754951fe49067982f2699ccf14c64db5f19b6b2834ff85656a90989c378f9b

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
49KB

MD5
dc59661085a7b9174c0441f3c7113f38

SHA1
b3f298220a8f504be773bf42e606ba3dda0828b5

SHA256
c63c6c66020a96cb651ef964cefb7ca7ba48102bf1cd220be54af1801f6e001c

SHA512
cc4ee41c2f6e3961dfb33553fd766005fe3f1216ab93839876cdfa6ca61008bc4491b2bb49c458a6cfd6b6cf85b1f716f2e22f072a45ce47b3c770e04716e135

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
40KB

MD5
5be16f623ceb841eaf3614fb7cabb595

SHA1
d428b79360895a2bb4bdfeb5ab5024fa6c4d0b55

SHA256
1c88c455416215c5c1900d6067c46cb8979bf4c1cb5804a00cb48313366c8914

SHA512
85fe5b0d87abb13ffd8961e554519597885dc3d9b5875ac0b28aef6e2a80c18e7114a631aaad0edd0c3863550727b7ebf2650879cba32e6723bd6e93fd590597

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
44KB

MD5
05c9a15865b267b9f347cee758985edc

SHA1
9b554fefdf149c30b3ad8784295d0884ea660532

SHA256
15fa95b587f56e048d2bcb011df1b64c4e67cc39c839e60147612d0780994da9

SHA512
afe4ccb027253b17c7b804b65e6fbcc8ec1063129edf8b307c5f8f4be3633b0ef584b8acc709db8a28062e1635fea1ade6e22abe90442870080c3a7ece7f6bff

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
45KB

MD5
76fa68e8686188e7b2a9e4c3dadd4c40

SHA1
4141bb5b5225f8a0e5be77b390d9e1386384164c

SHA256
9686f014bea94de6a83faa01e8dcfb519002b3acce90d35cbb8d44f49e75b557

SHA512
8eb861b2c7f703df933ee591db34c8ff0a66de58ab4999d91d299b5a40784d11d9ce8e969a02c4e63de87c03cd8f32138d442f71087c08f8b6885993111261c9

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
51KB

MD5
52d3d8f1564f967cbeec377d3cadfde0

SHA1
d895d0a5473d39eb5c7927f7f6be4003abd80d8e

SHA256
80c71ccb899c4dd551101f0a7af45af1ecdcc99b072f84e1167eb5b17d29e9b9

SHA512
883d06161a70ef63da0716050179ce0147def0289c23d2f721dda891809db5a02a9b4f0086fc15d6ef40e952f4a73cd1e04475a64b8a647e61efe95b316e755a

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
40KB

MD5
aef7e8c6e12e1883a19fcc8e104d0532

SHA1
fa4f30924b759375798d21c7b04a769c2f81171d

SHA256
ccb23fa42dd097118cc79eb721f6e8a628f6022696ef6378be9d4cc9d3d085c9

SHA512
dac2b215d5617d2670b8e204a1bff1606fdd6e39043e8f67ebaa6586271d37126d789e6bc31a6d31dfc7ab2aa0a506e73c5004901581873f642287111ce21f3b

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
44KB

MD5
71c41877c8d0fdae717775da2d6086e2

SHA1
7437048509cc661bc807f3e072e0bd450bd5c3f7

SHA256
713ad2ad75ca22e339314fd853176a4bf750e8beaf7c9ffb277051518f525e25

SHA512
0d486834806b8c04c5c01b18c1ce93849b0646fd9f929d9b650260aa47331541b91cf7a1767cde58b7af5fc1919037c5bdb3ef240c34d00973e2e01a8bea6e20

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
41KB

MD5
6e63151f246771d40efba01d3ff533ff

SHA1
40819feb1b50e644f131f559f8780374bfa35886

SHA256
efd3d3be73211cf9ae894bd1bdc40da7af7ec2c0fd3fe524a2165e38c3097d2f

SHA512
18f1275af8af9c856b3bbd95d2331153ea6cbfca3d9c5b04b17727aad5c20b3bd66895ed5c423ff20ed85c64ced935d3a232d8596e2fdbac6b7e9c4630e55e22

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
43KB

MD5
b3fb8a586cc5aafe4c7ca8c1b24fea0d

SHA1
72b42ecca6cf4e1afefa2404841373bb6828cd17

SHA256
4456f14db34dc032412232d366d933468c6076da982c59286fb2982f687384e3

SHA512
a7f2f6be06125341ac87872d863765ffd6ccd0b9c2cf0375c082492484e897d8f8402e790b8288329dad52cf84345e6d03a0a59211646fdac5caa61ee05948e7

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
44KB

MD5
8ffa60b2adc1c9677169663169ace91f

SHA1
3afc3e9e59a9f89fc26cb7fc7bac5213ec31cc35

SHA256
d96ed93d292e3cf84ec65a08169eb9e3b5d680c8212f4d9830e3c37ea3bb10c1

SHA512
4459cd9c686cf6a68da8beb4fca57b3e3887f7cada7b33603da4270ed0fea60103b855b56366948b53c45b65f6e44b7e59a9ccb1d7d56b59334cd2d04777bd66

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
42KB

MD5
7a9e971e99e3c6f1380e2b13263e514e

SHA1
e5bc417751fd5ec90d90af3817848a29cdde2f92

SHA256
097c7cf1f8b1263ec374c5dc14cc2a3a5b3fa9ca5289a7d96a910c1e518eac31

SHA512
408291fc5594aae1f2108649271f997944159012fe8ff28cfff1629ecf7908410fda4b61da506c10864a84ec16cc0c0a416a808b84bc023a8a32ed105996feb2

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
40KB

MD5
140eb778e7d083c3b8eabf07db9146cb

SHA1
a99d0ab2443ec8781d08a0e6719368f721c27871

SHA256
a31e5802e262a562880793a39f3ae96fd936fcd9c9b7b10729e0d28a797b516a

SHA512
0c4f299df8ad14e3438b24e17ae0ab1098ccf2a78dc281a1acfb5357a861f90ca8648627857048e63d70b839d49dd9f9fbefd59ae0ebe96fe48ef05febd57aab

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
44KB

MD5
0b51995e6d9bfaa5f6f1bb8f5b894e06

SHA1
cd8db347dc89d97f6326b50a42970add9282ec5c

SHA256
576f4c8b182866e102088143f9ed27fae64fe144d20258467b6987f78de461b1

SHA512
87ea51898c89f8bba14740e451a12c0e649271fe31e57d0618204ba7c9b310e8dfe30c31b5d1e0f913907608422710fbb831e99f9d45288fd67d09021a6a5c98

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
52KB

MD5
82b4836b25fe91101028bfb3b805c178

SHA1
8de751c8634b707beec04ada5bd0043afc1b4b8d

SHA256
761c824534a2b5029895f94bf83dc32caf2c8b81fb7a5949420f58a63c8fbfd4

SHA512
18f27ffa2c24ef9be14c4d1a7e67d43bfccf22539f883542b1ec49366fa6672eb03a0ac888bfc68577da2188c1c13e49a9db0985e36170012976e9a65f826267

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
46KB

MD5
c218b409ba4b691b92e718c93a433c89

SHA1
094205ae6246602a3092ca5da3104acbb39c1d61

SHA256
86dbdfae74fce7ea2182ce96339e04f1bb29980f9fb62cc89384c8803898c17c

SHA512
e82744e001f0b2073efd00661796aebfe0408d18e539b2e53f42a465aca5fa3a846154eb2a6198e4832f736d108fffcb02fbd63e7f32309573eaa5174cc0bfb7

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
52KB

MD5
6cae48d3389445fca7bd8d07af457854

SHA1
8c3551cf7d48be38c878fbb4fc59b0f1981c4568

SHA256
3317e83f2df0ccfe1ecdcd2b80ef23d0b5290027c362f64c70792bd043e68e3b

SHA512
3affb867f92718076d55f4eafd9438a3660d0e98b8e08a3203a234e73e74d117561803da5df32462460956fce366dcf5ae09eec80b0a72c5f2e8505ea43be415

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
43KB

MD5
60daaf48c5ab9548c8814673208d2b51

SHA1
0120cf2ae77f366f571b703685ee971b860beced

SHA256
aca28c5f1f9dd741f05cd6f62fbe18ef374ea44cbe58e17ee35a53fbe232d620

SHA512
40ce213e8a6bd0c6816f6cfb9acf9b85b19edd05e9d67bcf59022661cc6a8bd9c56310f33ec61b0a09178c29925cc2b1284aeebd2e1b5c59045cbd5d3d27a1e2

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
44KB

MD5
92bfbc5707010a52df1710a101bafe31

SHA1
a0e15d391616a11137c74a9849893dd12543de92

SHA256
a5cdf6dd001c0ef381263dcede564a13f32573beef25bcc8f7928309f8b126c1

SHA512
7d601885f010113c1356275a4e9f60500644acfeb541177b3e12fce597640ae47a607564ff18777b75ca4fc8b28f5880a49341425a0059c5ed5dd7f857aaf5b1

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
43KB

MD5
1aab40fac36fc44fc2bcec5c25938df7

SHA1
79694fa6a0b4886b67539f1929a8e9de4f8a16a8

SHA256
ee7d611dc38ff6ea37b7a550033011dcd3268656666589835a8f2dae1e1d8c7e

SHA512
162b25ac21a6b81311cf82fb472c57fd39a735dba8bf608fd990acd44787bc9078ddcfb17590c78ba3bd5db1c71d393535ffe63adceb93fb0d1a4aa073a42452

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
44KB

MD5
0684230efc80f27af7791290c8c9478c

SHA1
231f02c05b424da628d95a60d5fd9849ddee9a98

SHA256
3b33e56129ec3dab05e8eefb37e0fd6dca603a7c28c5a9c94465b1d72855e1e9

SHA512
cbcb46229e00a745d872510184f9ec8a261e924aaaae25cbb573d86c667a05710d07244841246d88d7c03f52c2e98dd5f9954c1aad2a8c279d2276750d1b46cf

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
43KB

MD5
22e4af09fbb25a74e8f40cb253f989e0

SHA1
1905d35caaf4b35eb0c18e4a59149bd754f5a256

SHA256
998beb2783108156a629b3d9e42a2523d2b22e542064d26af78f183ce79cfa70

SHA512
bb02f46e61ac07f468c63dbe9db85c94e979bbcc7df8f84de6f609ab4c742f302914bf086f3c7292963bc235af979d5950394d79b2b840995af45d8e997c21dc

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
44KB

MD5
44bfbd7fa3766bd86593d53d96a8b007

SHA1
7f30ecd94dedf3988775605374fd4a843519c0af

SHA256
5437748d51ce5ba1bc983dc2dcb54ccfc03bbc2991a6138615b2765509fd130f

SHA512
d164b22229cc8d300f39cab872fb5a93aa9a9dffb25acc2ea83cb6a8020728079a3a5c46acdb89fcb213be737b3869040f20cde79a0f37b22db061e7aac03d3d

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
32KB

MD5
11ca9031725b9cbdf644469d698c5ada

SHA1
764dc0c669d866b9e140ff42c0fa93e1f813c843

SHA256
0b621d753f227f03037c858093fcdb301bfdd29c12d29dac05da8a47f73e69c1

SHA512
7cce8676d7b0c6beb9ba7c308af56e2044b50b4141be4bf750aa45424c6846cbbf44fe91d906614fc978003acd5e1dc409d0b21a6f68eca6c1fd042a58d162d2

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
42KB

MD5
49c82a85ca344aad3bdf4030853cb9ae

SHA1
3e35352b123bc615865eb31d61e14e2f8a2d2e89

SHA256
3c25438f073cdf602fa35ef5e92e85e567be01b9ae359fabbb8ca5b76433ec53

SHA512
2b868c4ee6a9ba551e05fdf93ef74b9fabdc261d96b97b3957e603d058fa6c7a7db32493efc56fc0b9e04a10c051de1f3063cb1c09872d5046d049ca4557dbc1

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
43KB

MD5
af867ca36b2baac4660765c96b797b5d

SHA1
d5dcff1ca566bad7f27bcfe9b0d570eb39f2416d

SHA256
f8069b70aa2ba00b26a7f4e9fbb2ddc072ffb901e1449b383c47be76f348f126

SHA512
4bc1e244a9942cf5d47856b9a50ab14535741456dda921f96056f09a304c94d7fcc0f7ace76b622e175e6935bc231c3ca389ca0573a00fc69255bfaa106fd649

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
45KB

MD5
ab362147e197eca546ac48f317d87a25

SHA1
e53eb59777a2d499c1a41eefdc72e85960e54a4c

SHA256
6cd85d4d14680c7948d4930e104916767ab3f8bb08ff332cb53baa9c1a9f8085

SHA512
75bec3aad43f51fa24d731d991510a8249c36e612087ef79c00887a6b973b8e287d09b706b895f13f66280bacd3e497c2a356f22076f758221536dddd4fdca5b

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
44KB

MD5
99dcf9799af2ebf57d1d83741288583c

SHA1
7920aac2f544d5615bbeb5d960b33f15b113aab2

SHA256
c2df6bdad495abaf2ffcf572bd0b70e14f618f257d28ac915e8d0893af8e68eb

SHA512
b470a98e1b2f3b331e4f93c7cc0699a0addc3c1321fe990656ac67bb1b2e0466f2c597866fe4d87e6d68a4576f9535a9334f7cea6ee6a6e96c7e6b89515187f7

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
46KB

MD5
6ba65e40f6611cc51b7d2d6ba7a493fb

SHA1
8475dc2ad41749d6ff85342578511b4573d7a2e5

SHA256
11611dfa2c2fd2531e42af4a41874e95d0da19186736e37411e01af771b8a220

SHA512
e75363c839197ceca1346e65cb309ebcaf6395501864e3cd38cbebe84c950c8687536b397634e9d92ceaa4262abd748f6222a338a8ef363a847a24ff44c89a88

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
40KB

MD5
6d94a8f7341235b69bbf39df4b590b80

SHA1
3dfba1518b910caafec77801b24a3906ec91d1e1

SHA256
2cc8efd4bc7dbd523d357a739c111ef06b430041ae658f5ecf470a2fa45fb756

SHA512
068450daeae3028b073289c1296b7250de52ed9e4ac7e295515ce329ac7e3b67673a3955cd2f42a7ea70f1a21713d414ffcf5a02e82ecbf7487ac00b34cfe76f

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
46KB

MD5
9791efb265f3134abd324025a4bddec3

SHA1
0ee571496d1b18ec2b974e18edc2297cad208308

SHA256
9191b11ad9fa58b867e44a9d9b592bc12924ef049ebb055f528cf8ee0467f02e

SHA512
c481efd1d54b58f08fef352cb3111249469043798f07769f0d029c0dd218429cd6f5b4c104545fc6eab72996fe8f35569ae611054460fcf28e984d7ad22e5b7e

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
42KB

MD5
ec6b8f4acc32112823c6814ce3a77454

SHA1
21426bcf7e60bd4162973d4d7d82be45cfb6efe9

SHA256
8e2f21f68f1f13740ef5cce59a1a2838aca645533fef8e53195701b3462df5b9

SHA512
8183961ed22661808f8ed83c82f219514aeaf8a994e5d7fb547f44b918e906d31c903d26a7b6394f148671214c177794f5e1988252cab78d1edefcd029770c10

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
40KB

MD5
ec3158277a6a468eb4cd2c070ccc237f

SHA1
c133297101afadba383d87a38cad59cbc6f85e25

SHA256
97a0652337b53b1d1ea377db2c02b53d50b965d1f2b71f7861926490b85e8d53

SHA512
076eda5f8afe9f9e55d869c7c7e8790e7518445a803a627874d801e7a56d67b9bea83326e683304543fd81a256ec68850c82143d50a1171d06408b237f121687

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
43KB

MD5
a919b6b762c0666637d2d45fd9e0f5bf

SHA1
897dc6665a9d308aa44e5f461b3c5d424e8ca4c5

SHA256
e3d886c9f81ee9bc0568d2cb843884aa2269eb14d4a8a2d6f2a35a18d4f6339c

SHA512
a009c30db0fcb3bd0abd60760cceeeb994d47deb4080a90a58d7ca6d7efaa95daa7a5eca0b8752ddab8ca6ca1eecaf9296f09d6a1cc32ec035fa6aaf4dcfd47d

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
45KB

MD5
ecf6f71184d5c1ca890f8dbc9c388f1a

SHA1
ad4a313e5816e65e48652c28b16fda1648846861

SHA256
6232043d042283033c085c8481b3d20244541c26084656b8248a5a67ff763529

SHA512
d873172e3f2257eb25003cd5b1948ec1b0dedb2f270c62a2e54ce294c8d73fdb413861e521a3390ae32c8cd1f49401310eb06e67df78e43e5ba12633a22cd123

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
34KB

MD5
e081fa9676b5a9c759209fc8e19ec408

SHA1
07071d8ba6252b03f180dc7dc0b065bb2965360e

SHA256
fd302c6de7032777a0bf20650444026bc4c60370093c4c226fb5d0d99297d0eb

SHA512
2f8dc1f682efd29fc3fea6aae5576cf683c819c593838b1c30a3c5be9e79a8c30c38ac5d2b2ae5c92d50b84202a290becc1b3ff69e51a3ee3ef248db2e98d1ec

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
43KB

MD5
857214337bcf4e5660ff49c20f9133d0

SHA1
0e80f00aab65debe1c98e22ff3849942d9eb60c4

SHA256
e8cd26a7d575a4e72ba0e7b4a2388b10f052bace4bd896c928a84b66b29b7992

SHA512
6febe1736c0d74b05c2b8c48b7024ad204a38d6142b25331c7e7df48b1c39666d406e574dbeaceff517406a051c72058fcd4ad6d9ef4765a736d04c3889ce9a2

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
40KB

MD5
b3700ea92b27ffdacfeeb6d3979508df

SHA1
1f2ec0f74457c298fbcfae1d58b84e6037b07cfc

SHA256
90942c7e14a263bff79f8266f8ccfd33414da44ba64f5a1de6407705396a540a

SHA512
f3d25e27376c1abe6ab9f8b1c3f48d3b9169340637626ed7a587383843a3ec72314e714001e9d9d396ca67e60069bc40aaa9e28eec6f611ea81a0d46f8cd2dbf

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
48KB

MD5
2b42691ba0420c33f85fd40f8d174719

SHA1
b625ef4e1e29e7fcc3d2bea4dfa788290f2aeddb

SHA256
d38ac70b1ab11ef7173c37dc06dcc11d2ec7f39ca629e611ebf21fc603329ea4

SHA512
9abb7a99e093e1c96df84e8354192e222d999616aa31a5fdf5434342832454300559b0347e60cfcc37a4fddb9849f21c7bb5aacfe62044eacb942ea40f2b51c8

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
44KB

MD5
1260d87e24ea9cb41e65cfa46f9a6e51

SHA1
21161650455de44e1c7c5fcfb978358c666e36c4

SHA256
b813fc8e7e9606254386c8ae381565674a7af4a79071cd12dc95a5b5b3fdd671

SHA512
6665149afb02ba321c3c97df69253858988f9003e7eef57ab6ad28b377c9df015f9627ad748ea49945264a0fa6b81b284d1f48262f5b50f6f378efd336f547f2

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp

Filesize
50KB

MD5
e5fff86edf603095fa7000381a906876

SHA1
da0293910eadc18f737c544fb1fca9ac31f2c3cb

SHA256
4bedd454f6ac857caa10bfb18c1029a25970243aa25772d1cfc9d6e23547f8b8

SHA512
2f00d253241a6e6984fa521125d498a2632bbf95afaa9e931ad3d3230a8c1dcdb4a403c6cbecc621bf1a6f391bd29c1dc9271cf8e31856ed3935af5127c55ad7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Visit Java.com.url.exe

Filesize
34KB

MD5
da99012bb2772c6e3aec3a0f8a8820fb

SHA1
f699ee92f2cc20512bd14037bbd879eae13bd8f7

SHA256
c879d95e46cc37f0e84d2c7c8b61d8722a98ec545276d6647c47382111c0ab14

SHA512
762e844dc270dba859f5c0d9906e19b52583dadd7da6f04aeb32c1e635e460f2d5ce04a5d51bbc5b473f0f65dcfcaad7ea078471523c0f30e82acae3143f932d

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
34KB

MD5
a6c09bb1376a2466ab1195c6c551bccd

SHA1
ddd510954910648ca1bdac93a29043cfc17307f7

SHA256
ffe4ee49454bd6c135b2dc3cab6a97e0076936f4e07721ef60ff741276ec15ca

SHA512
d065d43287fb18cbab6afd777a17fa1be123ea393dbfae7ab6e2ddc591d11759999d04d350ab783b808937d086034df87d5e0a16673d3571a9c844485a6e23aa

Download Submit