cab0145f5a70516b85f0d2df1b273bb5d5526da0a1ca5213a76f60aecb711e0d

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cab0145f5a70516b85f0d2df1b273bb5d5526da0a1ca5213a76f60aecb711e0d.exe
Size

206KB
MD5

139c060a61e54a7a9443195185b4fff1
SHA1

868d61c720a3f8e471519f6ea2dd17020f92f1e8
SHA256

cab0145f5a70516b85f0d2df1b273bb5d5526da0a1ca5213a76f60aecb711e0d
SHA512

7a60f1036654ec2c5adc4950180748c724e7d0c8df9e0d86a33b70c10ac0418c9e689cac53de45c8bc7dcbd922f44d8f4432585c030bb7541b7f642a949ec6d7
SSDEEP

6144:RqKvb0CYJ973e+eKZOf7f3qKvb0CYJ973e+eKZOf7ff:vvbxYX7ZWvbxYX7ZY

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5008) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
808	Zombie.exe
1940	_desktop.ini.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	cab0145f5a70516b85f0d2df1b273bb5d5526da0a1ca5213a76f60aecb711e0d.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	cab0145f5a70516b85f0d2df1b273bb5d5526da0a1ca5213a76f60aecb711e0d.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsFormsIntegration.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Requests.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Common.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.XDocument.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp	_desktop.ini.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\123.0.6312.123.manifest.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\mfc140u.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8ES.LEX.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cab0145f5a70516b85f0d2df1b273bb5d5526da0a1ca5213a76f60aecb711e0d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_desktop.ini.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 808	2316	cab0145f5a70516b85f0d2df1b273bb5d5526da0a1ca5213a76f60aecb711e0d.exe	84
PID 2316 wrote to memory of 808	2316	cab0145f5a70516b85f0d2df1b273bb5d5526da0a1ca5213a76f60aecb711e0d.exe	84
PID 2316 wrote to memory of 808	2316	cab0145f5a70516b85f0d2df1b273bb5d5526da0a1ca5213a76f60aecb711e0d.exe	84
PID 2316 wrote to memory of 1940	2316	cab0145f5a70516b85f0d2df1b273bb5d5526da0a1ca5213a76f60aecb711e0d.exe	85
PID 2316 wrote to memory of 1940	2316	cab0145f5a70516b85f0d2df1b273bb5d5526da0a1ca5213a76f60aecb711e0d.exe	85
PID 2316 wrote to memory of 1940	2316	cab0145f5a70516b85f0d2df1b273bb5d5526da0a1ca5213a76f60aecb711e0d.exe	85

C:\Users\Admin\AppData\Local\Temp\cab0145f5a70516b85f0d2df1b273bb5d5526da0a1ca5213a76f60aecb711e0d.exe
"C:\Users\Admin\AppData\Local\Temp\cab0145f5a70516b85f0d2df1b273bb5d5526da0a1ca5213a76f60aecb711e0d.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:808
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.exe.tmp

Filesize
206KB

MD5
5ff8fdb58a9c55c8cc298fa9733c7c5a

SHA1
27166ff77e44043875f79899957333d7bdbec999

SHA256
a30d8f9c177273791d31d9b595e2ec17fc39178b385b5a17eb36ff6de9ed2c54

SHA512
1471771de62b20a679d0c60fe49380e8179a8be49d06d6e10e5a86945303895af81fb1e86947112166c8810477aa91bfc383daaa31254b895bbaf84b7a9c3578

Download Submit
C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
102KB

MD5
fa9dbf3b581b6c401688988a0fd0da26

SHA1
a26e581c1add550a2332e234ae838c15868225e8

SHA256
5ca6b43d2d1bc5f305317544866998aa0716a00142d9125641e6f526a58c0eb0

SHA512
7c81f3a30fdaf378cda659fb02531ad4e6d7b70eb59858141d47e215696cc56db561576fb9407e35f727290f3395a58d3bf997c07bc0c324c5195a809b11806f

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
215KB

MD5
387404ed089f479ed252b2d4d31496c5

SHA1
d914701eec6eb7789983307e5cebcf75cdbbadce

SHA256
32598805d0f1e0bd370ff15ef93a3409f819a27f3ee05f49c9cf5d01cb790bf0

SHA512
c16346c61359c9e64dc58da19cbe1352bacfda6bf130d5f8806b58642f3d89f59f4e8ed8522134fa62fefaf9ce73c411912bfc3d312cabf91a3ed07b2bdc00a3

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
168KB

MD5
876ec197626f7ee60806a8e1e4129845

SHA1
1db19eae34f90692c0503f3c51d95b44018574a5

SHA256
b57862c9d869bfa8a76e501bddca4e7206bc546419dbb00c5ebc08e81bfdcd2e

SHA512
a7f55d7f8b93d8b4affe1da686d89922e9e0ce5aafe444ef6c242393efbe8c19f3b78fe77d5fd870928540a25863c03e40fcd9cb12190cefd9433830f9022aef

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
647KB

MD5
f47a234810893bf6430ab9ddc5f8fa1e

SHA1
102534bf88ab639ab45bf1c08b52b8bf6db924fc

SHA256
61549e5757ddf2f1cc698ffdc24eb7d64952368d384fe2e8ffc011e4c623de80

SHA512
2bbd893501c65e0324319c6929112f5e1e5518021b456bca18b4596deb76a38a66c4d210fb6c77ef6c6b85ef5c0c3677eb42c2cebad6b6285482af61a432a922

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
313KB

MD5
4174f8395a8e2050ec3ece9ca4038d5d

SHA1
816ee153a5796d7cf2c075d59c2afe24b5f0077f

SHA256
181baaa81c8221a9e3fca8a5ff535c0cb0159d094fb9a65343425d252085f29f

SHA512
a311d4b912f5923f3777e49b8755d7e3e22797c63c313a017a145551512c78dc4a2e9528ee0343a21bb3a49122945c6a34491a1b8cff2a0a128871aa7710cf8d

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
787KB

MD5
83ec2317aa4f35655a2e9989a5264915

SHA1
d7cf44ef609c1b69560a9b605b45e21278b9d120

SHA256
3f1b5da70388fbbcb3357edf42f280bfd0d06257f02567358753c51ae80c7582

SHA512
1ec6ca5debc75f3290607854f868291cbfd39e14d3873ccb14c27b6fcf35ba9f2b5042e6bd526966c25c85119cb4e389505c02d7a7156ec99dd890c071646cd3

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
113KB

MD5
b710a7b18a34caef5e06618153deb3b4

SHA1
abae02b261897bdad04a0c8230b9c867f57d0c50

SHA256
da3d1a1aad5a1fdb6ae5119f52ae315dcc315dbf7f0a9956505cf75db61122d2

SHA512
38ce76c0e8f97895072fa22e14e36c471595ebab04b027c3078983549b611db25382e9e8bdbad66a130208dd1d3d3881c1733e89b3eb27a3c866e750b6885bab

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
111KB

MD5
66d3fec0be8057f53751b87ab3393f23

SHA1
320d49852b4e2880d812865b89a8395740d36d17

SHA256
a37e4e3e2765c70728933cc6976b956ef12fae973caa907c1a5bce9c1a7b9dea

SHA512
ab2feb332bebba21fef2c1544f2bd6139a43a7dd6e791945aaaa00d58233c4c2e9678eeba9fa4090b6df76bf71409fee90e8c68f8f00cdc6154f73c3260a3162

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
116KB

MD5
6179028c2eeed13884b689b3c42f820c

SHA1
b0ff8b783fa312f26ac9c1fce3c4b67bd078b097

SHA256
09032184f937f2a5671bb1666799a9e451ca7aedda20b4b3e60f881fec8613f0

SHA512
ab44b28ab2f1b207cbc75a40972d787176192da9c7194c393b029284644eaac08b851b99950fc34eed8eb29a155e3140f5e93fde5361925a47a860723616fd4d

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
107KB

MD5
a50b31eca4624ac3e6bc1f601987a26d

SHA1
48eb48fb4b6cbbdc4d1faa29662913ec95d36df5

SHA256
859d1a5f1e59891acdc3563f63e01cf5bbd2eacf2315d3fd98961ba13e2752c7

SHA512
ed8e70bb8164ab75c4beeb93689dec0a9041b3aa3976a1044674ed73e63bf816f3e6e632f051fd11bd4024ffddd25d8c8018b37ed6d03ef3d4a7217b29685905

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
111KB

MD5
fa7d07fc7df9eed137f233722325e611

SHA1
c7654741e7c6e122aee1151fa993196a827c72d1

SHA256
1bdc33526d8021ee8f9b9633fa94f3fbb61d49ec96e6a669fb8724c95156c9cd

SHA512
30ca0dda003b4a7c7fdda762e8beaeed5150cab3916a56860721fab5864720a34302ad8c373e225f0cb312a95d4d479552695988d0747bd9d878cd1b38bb7619

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
113KB

MD5
d11768446f41f068ba7a7693dd636dc6

SHA1
6e46c8ebf9363d6a949ac29a72c67d3de9b9f513

SHA256
b7f38b6ac96c8000a2778b7e1f76624e68bd71b9d2e63c161a1c4e5a2af86352

SHA512
75b248651b28de71fa1e3a1e9bb760674bd09413da06725b46bbaeca605b6d0a6b188d36abe0d9a204100b1f98926d8d2bf5454ee0ff3dfc424546d6ab4c053b

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
115KB

MD5
11864cf09f0a3d89a2f647527989466f

SHA1
56c9e74664db832c3da141c2e82594578b96b234

SHA256
6f4b6216859024c693cf93f48e955cb48bdf68cd9241d00753993953c695f19f

SHA512
937e638da19646c99975b7d67abeb4197e3df42c9e44cc5f5341eac87a17e11dddf2a135d98c0ef8443b809820cd5846aa008fca188b228e5b850a3a9803f1be

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
118KB

MD5
f3ca0a7af8cb6111e96dea3788a57aed

SHA1
b0bb7e1bbf8c7693b3dd591fa1c1984e9f019336

SHA256
4df6c590cd391b82fcc89523b85806e8d0c2dafe98777d17d60f6e404ee759b7

SHA512
3f6aee4e566d00d6b13487782b6f2a62207305d2dda0b24c0ad55a724796060aef28b96e8f0849c592ff9e80231163fcf29958e38077978e943d434216befd8d

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
108KB

MD5
abf9216d96279e7ac608d205d4e98674

SHA1
a87974af15fffb41c08ef70c7e08959dcd8d9692

SHA256
f40f9855851d75293a474264cb6b89d111905d842822e4f8d802e4ed42189655

SHA512
f7e84879fd2b5d9f5e2d86c8bbb73a02ca4145e3c518edff75fda09bddb6972e8c67c5a69dfdd7333eb7735bc1141d4139b57b3923540d738466852eea9c9824

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
112KB

MD5
5b06eb408274fb5d53e849ce3b1c5f22

SHA1
d276acf166b267664fc217253fcb19142b19c726

SHA256
db950f24315d32787303df6a3cad7e5a58cfeaf55d1dc119bba1553e0e2a2ab3

SHA512
061dbdaa065d6cbcc114f40e5403f88febfa29ca03ac976710c711e51a2d942907f91bd5ea530155e360e266b44e982b581d2a2e599db07f2cd17b6da3c703ab

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
114KB

MD5
2ff78bf5014b5765fb84b20735c7a602

SHA1
b5b5b4bdf5959f5566b7d58ee5e73d6bf197a918

SHA256
25f955a7de388ecbcca8ea883a90c27cba7e1875a648e46576328d51fd8ce8bd

SHA512
7c18041da0df7a50bf6eca2216859c0608895b9150adec26f75e59bceabf6e2d56ea7e93eadc9264dc276499b9cccdcbe10b3d99c793167535e9220981dcdefd

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
112KB

MD5
2e88dbe68838e3abdb21b4e0d8228f95

SHA1
7087911f1978b36468ba7badc2765624c1d48403

SHA256
e48c3e971f26871034ebe81a889b6a5d90c1449c7f7dd6018bdc5deddfd0d2ad

SHA512
1751f141ed2efc620f11174694801b550244ace6920bcded1f65030fde1e17cf755b1a3914fb2d7168bdfd75eb5cee9ab72f931725198bf814b17ea60bde3ad5

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
107KB

MD5
8eda77df8cb144f791054dd1cac92934

SHA1
a73fd868939874ed0c077b789e27b524261ec0b8

SHA256
c5c48d06b18607f9640b1a225312ba3ebb1d32202435df8ecea55a659eb3c62f

SHA512
9b53371abc1429601dfaa55a26be1856d880ceb8d9907f1983e08871cbd47a82c6e2942e09eecefc718041e0b4abc9ae9659712f09ca22213dd856a18c064f5d

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
111KB

MD5
0bf4b862d2914e5b945299d340e10c9f

SHA1
fae365d81f18fd70cbc3aeafb3b6b54b19d0d6d0

SHA256
cdee1a7e4185af43c7693c3c3cd41cdd78a64acf238b70aa0e94744352d74a79

SHA512
b2b0b1990623595270a3bcacd76a9046f2d6d09a62f50e656345790cd24fa4a53cabdcf48a96169e114fc70935baa87afe99b3c1bde3eea67ec37a57e27fa369

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
112KB

MD5
0d01f5e83d59000fe34cc36920c90cc7

SHA1
8d05df25a8bd647855e5905f6e9a7374e182ef80

SHA256
2e9c61a705d206ec0a2e750e1ca83b60ce5e57704892cbcec3ddf6029b4024a7

SHA512
0e965ec825a3fac293be5452de8de77690cfc0edb1a5d453b4a9042c9a8145e2a02da51e35a939b6e57c298b15c9b75a8b69792d3a38bc762af8ed9b30d8f5cc

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
113KB

MD5
774c9d2cf120a3471e51ad3150eedcc0

SHA1
c7cff42b88338727cf24030cddf413ac938bbd0b

SHA256
faa6d5d8f5c3464b90bf2c2a28dff3fea97232c382fb3a060cf648ba645dcabc

SHA512
9a315234b587c665cdd5569ef809f43de57f76514c9bcbaaeda04172b390ec59be582cb1d3e1c5e387da5ff65d8bdc899c9b207b5f6773235b6a5acc56e3ee94

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
110KB

MD5
368e9d9936ed6d9917b4efc300f38015

SHA1
79d2584bcea8f16bb00e5de00c0c711fe2ecdd4b

SHA256
15545f3aa924dc475fd4a1a770fd00e9fa8741e1ac79f0892dc7d6e883842318

SHA512
6137f13a3ced2e251b67243cc82cde13d13ead72fa862333720e089540fe4099ca7dfdefb6656cb90904d2350f93460f76242a0da8fe80a76cdc3933f67d5dc3

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
112KB

MD5
f1b812656348a87ea5743ffa3912783d

SHA1
c8de79ed3e0dfbe0b7397bfc6f6af1486518f457

SHA256
dabcba92123211d27d0005e24a138e87a953fec1d573fc68737871530991d61b

SHA512
c5f54b3e02ece973f4ce74cc7f8ce5fab7582105477ae876a3031e4cd963862432acceb2df7796d9f911f9f9b7faaad9ae9930e78c8010085d8bc55a9c41b794

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
111KB

MD5
8a96a74a6dc024fe37ecfceffca22341

SHA1
210d84a10adddc1771a5e0ead2b7adeed91c7edb

SHA256
83d7e5f7f3e3074a257a9cc09e29b882f1da289e90eab4cf540b0ada5a25153a

SHA512
741108ed687eddb3b5dca5abb53b13f9b0cad953a7b12438b78d4cc76217d13d35ce70c670d0c3e24ac239590bacc946a3059b6fe88c3174aab9a3b13f682f6a

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
117KB

MD5
d3991efcb8038a9a777e0b0680a3c3fa

SHA1
17b6af173c97a8c2e085a3b1b02d2f95e5ce1679

SHA256
2994e8f0dbbbf1ce7ac85878c001857ba047bc4ff599faefd6b3d87a8ec6e3f4

SHA512
c13dc4f727acb0d58f387a5addf2ae27ce9f8beaa3470a2c26a07c9292d0741a9fb27cc0b4fd6a753f72f638b893d782746518ab241285faac720bdbbfb450f1

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
113KB

MD5
b8fc96d8e616e58bfefe0410b60853d5

SHA1
b0f297d08dfd6a579a9fed6feb17d2c1b9c9d809

SHA256
71f00e8009f437ca818e007e2f8ce795d444cf237814f79d751ea69f4ce6179e

SHA512
17fc182637d51760ec9927b0200f61377d589fb645e9968afc9bc456cd59ac762d2ac5678b22867c9e123ec4c1789fa4026cb9ee576a093d250b87dd75b8db9a

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
110KB

MD5
ce670e8912cf9c0f219c4783eb5be45a

SHA1
94366c4f34c88e3d1a87fe91c27ed1ec6cc0481e

SHA256
974b7ab0bce1a6f5593bf3b97ba395299a6f4a1896e217a054b0e9e1af9ea8b8

SHA512
c72ec10ebdc549c6cbf4f93add78e5f2fcafc5c5d18decff4987da919b632c438906cf2e5e1fe50776decc193470062d9d045b62a4a251e517fc036a7ff974ea

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
109KB

MD5
01a4320ec401a399880427e17984fcee

SHA1
9afa615ef151f0174bf195ef3d1b11f3e8ddcd68

SHA256
4c2f0860268c0aa4b39f361c4f93af56a48f666e3c3153d0a76d6b99c4c04b0b

SHA512
45fa19a10a1fb6717145ae07c4b8be6361916dbd885000975656ebf8f0e7129db2702c859d0e9fa3f3c552cfee78f4934c59e3c6bf3b9f9c989de5bec548a234

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
113KB

MD5
108a95ba77b5929d84fa017cc88fd9ff

SHA1
d680443cf10f097318c05a470f9914ae0788c26e

SHA256
a35a08551697017401b3f7f7ae93f58098681fb0cc1d20f0e7cdbbf860cc5a1e

SHA512
7752c7a7f78049b274054e24182f5f054488d23e6aeecc64c80b3c0c65f578808d256f56e90e4f749fc907dab72018b27066ea636e3d01edf0060d1623dbaf8b

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
120KB

MD5
7185f99ec02cf556d96d614209baab5c

SHA1
ebf924d814e847d9755030d1af1fada0cedf6ccf

SHA256
d3dcd67562c2472af5c54458a945274aa27e8f277eaf81cfeafe65e4295f8dca

SHA512
0de9c598e738493cb5f2c875c69a18dd0877c1cd1dedaead6b1a77660375383067fa5e1932442dab07eb0c6119414c364a8a3ecce5d2437fa9272309bd44ef2f

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
114KB

MD5
bb695e9d5a5b53b0503ae93b91426193

SHA1
25682f52db301d347129770ab75eee580467f7bc

SHA256
1b18b7fdc530a5a96129fb8798b7a7d81b55990697e9a88dd271034ce576c47d

SHA512
45b3a6425805aa4b3768af8e8d42e54da27ce3b5a1dbfdca56f340d259ed3702b04809a501d7aabdb0d2da1de38b07e3837c1f042c284ee6702fb632cf05ce62

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
119KB

MD5
36f8d5a4a46217fda797a8fc467b5d91

SHA1
cde747bc079f821f1db42d0fedb573e675ae1dbf

SHA256
e2da810e6cb9d257112b2ecf89306b13183cfbe1c9fc5e0d6e2bb00bcf13dbaa

SHA512
8eed2ce66dde828512664b5ab0e96f36678cd7fc9e804041de4e856a67450f8061f69d00986a5049340d47f828a204fb620bce7765353ba3acae9b8c698016b6

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
110KB

MD5
c3415d9aac57d366cf400f71450f4cdd

SHA1
f6f76eaf94bc050f0337c283bb250a8622efe816

SHA256
e45f56908f3ffdd1875acf72e48511c1a61255fb57ae20aafec8afc57ce393fa

SHA512
22b19d952a4ae5f3207ddb7861f04cdc92cb1c2845e9e0d8861e97285b8758e8ccbe2dd590a1229b15caed68457208815a30a87f33a57fa3a9c2c97addf76564

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
112KB

MD5
c93087ddbeee9d5ad14a282228ce84cc

SHA1
ccd33912f1691031d0937fd4e6453b698450b478

SHA256
12a6aca4714b39384652e6037f67b7d779b7b090eab9d4b37c3b5a510075f613

SHA512
84c3c698d1e896abf2080bfc1ba160e3be7fdd01db9be4f8999554d9b76e5f111e6f2a753f5055b13a6a7f0151da6147202f71a7f02830e9cbd1f69100625d84

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
44KB

MD5
d454b3ecb21a326284760540865a6a8a

SHA1
05ed99961c846a37a08c4674c5992b99988b4863

SHA256
d51fcde5d5ae09cbea8ba132552184d42c50a5780349f5227d6226876136fdce

SHA512
8b32df46e9f4e2b31be72a39dabd044f47c039b719cf4154e4d122fe378eafce475d3a72cf333ec2792fc8b851a945f215e416baba3e700ca5fad21c05c905ac

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
112KB

MD5
8e192cbdbeb3b1cf880c27b6b7e8543e

SHA1
4c0d30a29fde1b6983e3e2acb7e37a63da08b9fb

SHA256
53dbd6bf18a5da2dc5874a1cb343cec1359b63f72b962d4a9c0ebf735dc8fe78

SHA512
a06aba4eae30b3453088e5e7f6cb4befb2a367d8760cb14f15598658408a1bb248d16a1d8659b5974ef2ef5001cdbb037a3cc8a88787fb5ba26de4cad1115e24

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
114KB

MD5
9d86a4b1c19014cbb3c29749630eb9aa

SHA1
4c735005ebf6fd8316f73f1c574b4fd186f9045e

SHA256
1cfbdd8059dd1dfc08083ae6c913d464ef6a92bfa3604e7270d6c9a12facf7d1

SHA512
90839fce7f0a53cfb8ef64618cf950d0981d991476c373d607513e4af24c6fd3d4221389cc763f353349ce51539fcc717d37f235e19b6fa4a3a0cf4a8c699abc

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
120KB

MD5
889a8b3bc5601fb1b5af58035c7b63c8

SHA1
b1ff567626e18ddbe37ce1f97a614d520cf7147c

SHA256
30e1527dd2b6cfccdf4feb5ddbe11938fc0fb852dd24f547f73f4963f04d7f6c

SHA512
8ef03acc12a400f581eb25679e4981e412a88cc59929cae6953b5f01667db9493abf69e9ec965b299d31559f6721fe83810afd32bdff0644f45171c7d943fed2

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
110KB

MD5
2ec7ece1422a06bc422d29fed679e86b

SHA1
f6cf0270e975e3b99dc6b8f50fe24e4389b62122

SHA256
58825f302190c1a49d74efe95613ad4f45ebc4c871a2d980de89fbd2d4d6d842

SHA512
09f210eaefd377fd5ab4cb9d4c9f512785ecd64fdbecee59671779392220953ec20cbd7dd4fa08a2a53250e41f929a1bd73b51e83428edb775b284ff7e615839

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
112KB

MD5
2a36712886fc334d9118895a8bfd0f67

SHA1
2cadda57808a23b94cc8a19fd092eb1bc572e523

SHA256
0a3a4e596675d88375b331c30419df985ff80ae9e74d4d7a96dc69d52ebdc565

SHA512
ce01eca2aa0de05dae29ce08bf488f180e4fbb5c7c7956ce69cbe00eecfedc26872bdedef0263bad59320df29de1b1b1600e9c75dcc306cd06292b7786c39964

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
115KB

MD5
6db1d58190b4075d58f404de9eaaad37

SHA1
011bf3a40dba7001ada48cda247ca496a04b1526

SHA256
e9580c3bcadbfacf2de0b81dde838d78bb08e0308f10cdbd9493579b9d5e5e79

SHA512
7864aae6dbf033beba881ce26a65a719962fa18bf65179eb0bc99a2e2eb2b94c07eb01ec65a521b52ce324a1a5408ba46d41dc4ea7bd8d780811e1539c1841fd

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
108KB

MD5
53c19b150a2dd01bfc889385ff83d13b

SHA1
c1e188e98c9e59cf765d45f7d0907ea054a4750d

SHA256
6cbeb5b7477fd973ba0bf33feae0c1d893222da08372e9beee7592c07e40a8c2

SHA512
dfdf6ade33f503d2600986efad8747149711483f414f4ef017fde19aa7e250130518941a6d3ee3ac8d271d2e5c6d9717bcf48c86c00e5ff63b2506e256bbf642

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
109KB

MD5
2ffb7cec56b0129d2de0faedbeffa65e

SHA1
0f2adcb524e224abaaa62e578dbb7135d09059f0

SHA256
de860abcd8923b8a8aa89b83c8119436127e6d6e1d27767f9141a5ed74eb42bd

SHA512
37888d00d7d02de5fc9afb1d61df2db354f0fdfc9537b4bfbdc78a1a6b6d7e6397f1b63fb6bd609c70f98012b48045992609765b79d59346f222a962913ce4b1

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
114KB

MD5
a4dae00bbaffa7d7939f91eb16ced1f8

SHA1
addd106c5ff878014ec0cb9c774f12283d294e4d

SHA256
15adbe6de4cea737b0bd3655b12f86d511df3f87ac7463135172e955400693d7

SHA512
da301127af515be04c95b7923fa035629741951af7b50a108063606f7e50c5c58d74d07a36bcff1930e69a63eeb66b31fc97fc4cf48719805fc2d100e5fc63b9

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
111KB

MD5
8f1f100940df02ec496f765e90077bcf

SHA1
fbb9365587bafe129ae723dbca52b67e54d235bc

SHA256
525b324a78105cc780f7f3681b3c195856fc1154104ec4a76db95542b0ebdd6b

SHA512
f9cad5a2b767e62a7058b948e40c5dfec901ce865464c686de44c5283d01543d73413c2aa645c13d6ddca726768f6bb4731967d129603cc42988f297df640abe

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
107KB

MD5
197099559c75e17945e2cf77b9e8dc2c

SHA1
23ebc83cb4972fa320ccf417862b5d44691f88e2

SHA256
a8f73267bec6c4459a6c7ee928d31e7a88f0b0dbda8a628aa654c83bb4486f5d

SHA512
9c53eb9ee362182164137264263f9cce19c8aec0a529653b3961366786d445cf157a7d3221d262ba45fa59501b54f0f78350bcbdf71cad5fc89aa71fe9e3b162

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
110KB

MD5
bb21ee193e75c57e0793ecf253fdecd1

SHA1
194433042247cc22b0cc219859d8dee5ef7d5d87

SHA256
0744bee31797d8e2cdd34b36ce86e18bd045ff7b540be0b8c42660652bd224d8

SHA512
0296655da27be2029a7e51295a2bb314fbe240cb444afb6d1e5ae1ea764a32650645a556c2a6dead3b33f8e1af7114ee00c0cb5fc2926fd34ce5a13ca325259b

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
111KB

MD5
b45b20df544cd4e9907f801a2779977d

SHA1
d1d748fb33df717485388a8b2ce075448871dccc

SHA256
e6faea664d6c73aa37551ecd575dbf50b699f0f5755f15dcabc1cf9ff936e0d2

SHA512
21088029d99c64011d9471484113493135f5c5e60b0ca503502ab1af1c4ac713bd2b3fc0a385be73fab94d54831a1d467a293ff30e23c2fd4cf4e18c0c6eee11

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
122KB

MD5
c85b436c7e5c5cbf448ed264fe2c95d2

SHA1
7defbf1a3340574c0f31a0d388a8f1282dbc8c65

SHA256
d8eb30e2c2bdb9b6da24138b2edc5a372d46a58a3d0fdb7b7b199890200bca77

SHA512
a20126d568efa01cb4ae0857483b43c6b1d309d7ae06c49c82db526ade6073dc1f67a5279580ee384671617dcc12e35e22237f9a75464069b4fea3395c73d77c

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
123KB

MD5
b36bda4fc877762dd24100d175799623

SHA1
7edbd4ddd43fa366a101c11ffb08a9c7d8955a66

SHA256
652c53827b1edfa7d94d4d04f6ab9e1e53f1669d002789c10c8524e75bf99401

SHA512
368a75a80d38d902cf686ba284a786fb0dd4f82cbd4ad659da44515939f4721d6006a4832346e27e3602d334bd1c63cd473a7ac4246c703e4a8e545fdc2bad0f

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp

Filesize
115KB

MD5
65e1402ff4855aaa5e668c02d2fe8a52

SHA1
e4c64ec2d760e808227139fcfcfc885ad0961b02

SHA256
ce00225fe04c8a7b0e866b02b785ca8658e02830a7e3ad5d21d183eb9046e1a1

SHA512
53eb1049e805da340f9f27789fa2eb307a987b5cbb8bc8b560bf858d3752e303dbb10440054898d88b8adaa3e7396d854e6c9cd99a2454478c64d72a9dfcc741

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
103KB

MD5
642970e6f9e67d04258d8f4103112dbc

SHA1
37eef24e575cf2bedba8b012e11fd113d055c064

SHA256
c8fd9ef3d907121d6a627538484cceac9b395e27a80dd1345291779be8c5663f

SHA512
4bdf1dc8c41786c09a686900ec674dda14a303b6439431843b90875ea0b27a0769e996939f30ce5202fa60a217e06d77e80f6cbae11d97664f1b9a23cac33af5

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
102KB

MD5
60cb42868b426aff734dabcdca71b513

SHA1
37f0116129d35f4dd7d4b4e544044fa69fe8b539

SHA256
55d256793499fa5c119b4b205063697bad10ffcc57969f35413c5433503f77c1

SHA512
b29853accef294f2c98307eff907c83e0d4711028a412d5ea1550d4c0a6de4b14e51f4617523c7f7d29fa899b6f5796a6812cf814d78d7cd7663fb1891fd601d

Download Submit