fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb.exe
Size

142KB
MD5

64ba02bec137e708106752707b8e2876
SHA1

d282b42d9c410816ac2c4feea9166d5c532e65ee
SHA256

fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb
SHA512

eb86452c8ef95e376ec5ca58a999d5efc47d776414a4251e2d3bb4d34138d53c4c64f3dd4aeb1342832a00842c4e979e25198e2dd79a684bf6289607e147fa38
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZVe7WpMaxeb0CYJ97lEYNR73e+eKZw:RqKvb0CYJ973e+eKZQqKvb0CYJ973e+2

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5053) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Executes dropped EXE 2 IoCs

Processes:

Zombie.exe_MS.EXCEL.12.1033.hxn.exe

pid process

2556 Zombie.exe
3144 _MS.EXCEL.12.1033.hxn.exe

pid	process
2556	Zombie.exe
3144	_MS.EXCEL.12.1033.hxn.exe

Drops file in System32 directory 2 IoCs

Processes:

fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Zombie.exe	fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb.exe

Drops file in Program Files directory 64 IoCs

Processes:

_MS.EXCEL.12.1033.hxn.exeZombie.exe

description	ioc	process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.exe.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable-dark.png.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationUI.resources.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\sspi_bridge.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\assets_picker-account-addPerson-48.png.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\DATATRANSFORMERWRAPPER.DLL.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ur.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\CloseUnlock.001.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fi.pak.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp	_MS.EXCEL.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp	_MS.EXCEL.12.1033.hxn.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb.exe

description	pid	process	target process
PID 3712 wrote to memory of 2556	3712	fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb.exe	Zombie.exe
PID 3712 wrote to memory of 2556	3712	fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb.exe	Zombie.exe
PID 3712 wrote to memory of 2556	3712	fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb.exe	Zombie.exe
PID 3712 wrote to memory of 3144	3712	fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb.exe	_MS.EXCEL.12.1033.hxn.exe
PID 3712 wrote to memory of 3144	3712	fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb.exe	_MS.EXCEL.12.1033.hxn.exe
PID 3712 wrote to memory of 3144	3712	fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb.exe	_MS.EXCEL.12.1033.hxn.exe

C:\Users\Admin\AppData\Local\Temp\fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb.exe
"C:\Users\Admin\AppData\Local\Temp\fff1c83e4f805bf78fb9fcd8e2171db63ea0bb264364c8d910c7722fc527badb.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3712

C:\Windows\SysWOW64\Zombie.exe
"C:\Windows\system32\Zombie.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2556

C:\Users\Admin\AppData\Local\Temp\_MS.EXCEL.12.1033.hxn.exe
"_MS.EXCEL.12.1033.hxn.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2288054676-1871194608-3559553667-1000\desktop.ini.exe.tmp
Filesize
142KB

MD5
de12cbc393cd63a86bcdb8715e2370ea

SHA1
114c4b95634d954393a8e83d96268903dca62ab0

SHA256
eb1e57b93b5299e811d409b86a8a05ace77714ec594b6fab11340cbee73ac4bf

SHA512
d1683b6ca360a05739d42a3fb1513fc73c4ba06a5e4e2037af78fa33abb1dda0bec264cae41a8604878d0723990f72bb0463e931871edb55794ce7b321b91088

Download Submit
C:\$Recycle.Bin\S-1-5-21-2288054676-1871194608-3559553667-1000\desktop.ini.tmp
Filesize
71KB

MD5
65a67dd42e111963fa23b094500366df

SHA1
9e9ec7b921d3846b2ffca9dba5b8ad3f3c43b0f9

SHA256
34c75f602cc64238e00b8b4675e41b970c6c06b89f9a60e8686c0fd38aa93629

SHA512
0f2e92f62778072089941bd1d733757d96212e30f4a6b5b43ec405d14d65148a57bacc4472b5aee94692b6c52a6d859f8379dbffc0703b1988489adbf6ba2726

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe
Filesize
183KB

MD5
6e2502560c48155377ad941dbc217389

SHA1
de044d0b6021d8f1dd7fca04ad3d7bfb0364a431

SHA256
23c2cbb96087679dd20d2792afce87c63e6585ab5d27815c98677c41c4c80d9b

SHA512
815c98b7c5ee27e2e5f3a29395abad5f5211a7eb41d8755ca38175ee73b10b04f4ff024d48da68fb1e4c19bd747731519afa7ebc6badaff33e47494466c485e3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe
Filesize
169KB

MD5
c11ff26114cc556a29702bf2c213d798

SHA1
1884620fc7a4b0123c41c297097676717b14a685

SHA256
074685a017cd1f0a6559064faacdf8df8c12ff4af3b53f77641b65873eac1b65

SHA512
5859376d4dbfc291dea062ec96c910a15b1f15dab1444d0d7db609d8fe65484797a3eaba3c56bde0644d2aa015d70802a384636bd587a111d01453370d8dfd46

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.exe
Filesize
135KB

MD5
61ac9142d1da5ddac0c22794442ba571

SHA1
6ce205626e5d8db503bb76eb7d63fdcd17b8acce

SHA256
3332582dcf0282d8677956e5573240533e27a8b2d92db4ea20bcec2768efc67c

SHA512
38c4b25203c71f3b1265afa862d74cb6cc7e1d51d9961b60eec25fbfda08f8611840d117b1191e8120cfaaaef3db9e5ea9a659e93baa99662629a5328815a4f2

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp
Filesize
1.8MB

MD5
c49697a4299fde7cab5f617819b50789

SHA1
91e647c46f702ff50e670258e947e1272997d464

SHA256
63b3d2d91a3223f699a7a83192230039e4455f1a20882a43bac03668b6e8867a

SHA512
f7bd582143f6abcd1508d96b292d27d16e84578b706361afa96258d1eda19efb44d1ac783bbc506b5220bde0c69d5f6817b28a8789ffb1a823e7ccd680a183aa

Download Submit
C:\Program Files\7-Zip\7z.exe
Filesize
614KB

MD5
f484d6420bc7920c97d7ccc43e4c4c25

SHA1
d8b26347398e7f0d5a59dcbd8a98d5f403e0abc3

SHA256
1830030a4a6eee51d2eca77ea0f5978a8060a08867267c125325a29224dbb89d

SHA512
09369e6267e89b906b941a3f4c0b7990e0d107a3ed3e2afb30bc8b494e31596c2cccfc9a2c9e69e31c8381b2f982c1a706668f1148bed191d7747741430f833f

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp
Filesize
1002KB

MD5
84a497c347b8633f927cf403ea1df50f

SHA1
183ceee68d3ec14e6dbda60e25d2873e3a5b35cb

SHA256
3cda9e063eccce664f606d325e5e2941f9765d3cc3d325c703bf24971c453c54

SHA512
4159198ddfac9177bd85f5db920577d0ad87a409a4b4526d65516517594e6396e00a6d1b9a148aa5597b31cf53ed962a4495f18d014d57b21fb066f6a794fa21

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp
Filesize
1002KB

MD5
8d3b64da4e3eb20ee49c4ce755b50bca

SHA1
043eada1cec9dcf4236f3be7f85b4d577f30e231

SHA256
c36909869524a5db595ab80efa890c4e31a76fc33c864f3fc9ef973463f1070b

SHA512
a22bd6cae8a330ce9770e684a984116b06c6e4e682e7e2b489d79bdd6b029c8557c396e21405732587709655e93ee69556981d63b1778738f999e1c768b37c5b

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp
Filesize
755KB

MD5
d760cfbe36968388e2f7099aeb6f20ec

SHA1
f0375270d3f020f39dfdbc01b491845f99a66412

SHA256
198feda07d4a74adc21f4542e7d8d5ab6f2ae8ae351acc69e0973577b54e3619

SHA512
0df6504954f9cde24ecb2c8ad7ca83eccb7b2225d5b7605035b63effd4991f4d2868e2e65991cbdad06f21ea4d898c06f59e121eafc62ce7d5f71bfe2d115cf3

Download Submit
C:\Program Files\7-Zip\History.txt.tmp
Filesize
128KB

MD5
d28c003828971b8b145435c255acf634

SHA1
b60d8446b41dbf72dbf7577bbd91002bd2de8900

SHA256
462b5e5e7c4496c1fbd76941ab3387f791a468d495e8696652182d6ba1639e94

SHA512
6a83e994221dd342ec9303d7287beea400dc3a75ad5654c938a88bae20c5146f2d8abeb87d515be95981228cdb921d5623a4e72bf03a6b2827aebe110b5b8037

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp
Filesize
81KB

MD5
35fc0eb2a2a0d770ad1ba357d96bcf18

SHA1
b8fea137becfb018ba0d67b8c41bd17cf5ed37ea

SHA256
5fee522a406889cb4fe1a2e4dd5cf08eab2df68de5b8b72071c8544b6352314c

SHA512
d45b6cc1e0cf0f9de1be2942dcdc3307dc94e88c025523e063edb921986f944ede921ad18f097743048713b28fc8567a7e3b270eaa39c172fd85b15a741d3d1b

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp
Filesize
76KB

MD5
6ce357c44910edcc26b3da4943f9997a

SHA1
cbe83e752a1b55a72eee7c28ffe0ce897d30ea1e

SHA256
73f5b3fc266cfc104d9a8273819f5c8894335f83e65ccfd8f729ad782e0fd902

SHA512
ab4384237619a9d484e99b9c583e877873e12fa9030847ae62556bbf22c0a9d21327c9da3534590740b7d70085cf5132762ea0389fe8c8d0e386634a245f96d9

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp
Filesize
82KB

MD5
cf825f7e0b85ef3c752c557b802721b9

SHA1
42a007bc4da721a75f8231d23277f651bda269be

SHA256
24051990f5f9f8768e8a99c7f7b03c2ac16d161e39b61fcfa695a30fb20fff84

SHA512
3d4a15d80d2a684155343635846027770003a96a060a1dff31e6fac802ed733bbab63ec554569638ebdb86d7039aae7702c4ad5d765f5a3d175899aa83671902

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp
Filesize
83KB

MD5
e95805fa9e9994a0f99968009072eac3

SHA1
802869c1414f37e6f1cc78532e2ee16f2657dafb

SHA256
54a7d1b396151020a9d589f14b84a964ede96860dde3b53d6aed5fe8b37e6bbc

SHA512
42ec9df5db09d5765409532d2b1392d297e61f6247409de3ec0a5f252209fc65d609d21eb9694cbc90d3e7800fe9856100d25020f4b27cf4d469b820cecd66e3

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp
Filesize
82KB

MD5
3b20176259c947c1bbf5d70e0245d1bc

SHA1
4a44556189a8e3a77494241b89bd3eafb7b67267

SHA256
98750facebad8ca3e1ac6ee35ae039bc4661313c9a7b2bf0309e3445bbdf3ad3

SHA512
ff9bb9f5c0922d5a3cfd0e2a6d6b8cb16647fb01d3617c0a74529fc6c5255d5da06889c6c9d8962a4cce9d2f68d115c06b8ef73352189c73775340afb8111f67

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp
Filesize
76KB

MD5
e91d3f9695a6f0262ae4e61b98443578

SHA1
e61823d53a7cb4b24d63eca29e2d51c5990bafe4

SHA256
d5a6784fb5ea6403bdb554b12306948df68c8100d5c9502c975d49a565d5c8f3

SHA512
8505e22b8a6854a58abee080a078fd6016a97870732f14aba17c03556928ae45008286ffc36e9ffb3e750d94a586f476ae35c95a10bfbc3f56b6e71eb2ac5bb9

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp
Filesize
79KB

MD5
0edada56211526e91444fae2e590d0a9

SHA1
fb1ab645ae304e71d42c23fda7053887e7b8fd81

SHA256
1fc6a82856a49fddd1d5dec5304891d5f1377d4e090e2079159c1401108d6d71

SHA512
864d01c45797c3aad8aaf9800f2f898d70954537229282054a3d9e6c2b0ac746f6e6a3892d3f944ad759aa3586b435f067ce8d4249e4abe4b9269d4d6ad0e87b

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp
Filesize
87KB

MD5
27cc2bbc8ecac82b39b70661663104f2

SHA1
bc82434c9029bbad7f56282fe73ee37e266aca74

SHA256
3f017f81032d73c2ed42330f960920f8c773fadf0f1e7c06ca279c452353b1ee

SHA512
3d5a253b5e86ec74c70a9bc81d6493d52db142c64444128b3b982bb879bb40195181c0cb9266c18e9dc296ac15b46467398288c391baf2c5b109a95e610078fa

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp
Filesize
79KB

MD5
99d9ae2299e824c5fc7e966275c12635

SHA1
43a420b9250b9d131b2c6731e0d14fecab003f2e

SHA256
dd2cb8ae2f66fcf02a8ebf72c90f2b219358ce5b0fada6699840b6f253604101

SHA512
b1c32352c2f627756e0443ba4a56e72ca7c2ce0ea1abdfc2877fb6472f25a83d613a8eba3a03070af72438277d419317f4ff2b272dcd8bdc84c7d08e2cde2a8e

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp
Filesize
76KB

MD5
0500101468a175900f699ae930f55671

SHA1
f0666a690a75cb65353f7b175ddb8436acb8707e

SHA256
e68e098b1a219e8d45cb4b5de36fd897821466b210745b062e58fcd261d1785e

SHA512
1a2519b02d671d6a3fdcdbd9286ac8693ced6d7f734067b5f0c30a3bc18e080d7de3968bb2cfb5111e8ccbdeaad3e83e49448d791864b2e71d4cafc0ef0c3321

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp
Filesize
78KB

MD5
263348707ef6482e5dd5d47004f070de

SHA1
cd2ac734344a6fb858f597ece41fbe59ba312289

SHA256
4a405ee095ba2fa3f8bcfbd18d8cb3c65383cac99b782f543e15c72ef482732b

SHA512
40ceb75a55621bb473a003ac43f3de3a74a15904c97de6a3e66295fcbba18b5caeab3cc3ce2b1c454c032212d6996183ae40eee95cdc7d0cd8c3fef38faff93e

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp
Filesize
80KB

MD5
1a31fd645b1a22d25096b08e33bb14f0

SHA1
0ecbb794eb9b0ad42cd442f193bd4929469e3bf7

SHA256
48e96046088c84ade33e1b0dfcecdd602f9ec9dd910f99383d74cc926f4f4eaf

SHA512
6f6a82096dd5b35b85398ecc196d55e1ebafea842bb4c93e23f6186aa3005786b32350bd6a772cbf1c73a8534387f97516ca0cd87838015d474605d15968a312

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp
Filesize
78KB

MD5
ab16f533652ad56856f9838cb9b40a3c

SHA1
ef667d45c2130df9f6c19419666cb89a6902b47e

SHA256
95d5852a9aaf9b7a0b76362d56f5c79a0aa480bd6efea0f95129650cb776a6ea

SHA512
01f71452819594586622941aec25c67fca91b6c6ff28afd8e02c9bd84bc8f73cfac6d1248b3692599a1708c7afc2a325d9b4a7dfe41f6edee80fb4f7d353deae

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp
Filesize
79KB

MD5
c597c86c2b3c25ff013649234697ea32

SHA1
3a18212e43f28be0a1ceb831233ff3f8f28bb1f7

SHA256
ea5cc39c1b57f5bacc781e696884a4ee964afa14cc0fce5d719fa1134b967df3

SHA512
7dab188760eaa230a9c810d407a98587008de965c0423fe809b4594c2218154194904a92cd37922a97b9da96aea71ced8b6d53e9df48e8d4b876a81fb8c127e2

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp
Filesize
77KB

MD5
7b51f161e214ad9398f42e98f7bf8b07

SHA1
273b6f1011e47fa6b05989dfdd0f513f5d2d838b

SHA256
b1fc52ceb67267cff17077606a7e098bffddb845e509620687d160b1aae079e8

SHA512
76352c4a027ec51d53794d8b700a91b21ed9ae43fb2f602a24c7191cb3ddf3f83c7143bb8afd1318e477356669e0d166349a3260d7d1cbe53250b3a22e306396

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp
Filesize
78KB

MD5
d603f634545f77c712697b678d2e1eeb

SHA1
f910250b7bbc8b24ba342219a8a87c2f26ddc2c0

SHA256
b40598abc69036c05d870b854d03d498bf5fde12ab6e801661392498e91d0701

SHA512
bab36db627832c4bf5b4e41ad49bc03655709a09c4338c5de6f7d92b0df35b28653af9078a5a2d68684621fadf4e7e56ec416d64cb6fe1067107236e299d00fa

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp
Filesize
80KB

MD5
bdfb454e2ed275edbb6b253b33215e1c

SHA1
f07195fcec58289acd0d48aa2b97fb1c0b25d424

SHA256
519a49031a026eb1dd4783cf385332a69205420982b7cbbbdb41685b809f4910

SHA512
9f5f673dce997d99de302525f1a17eded3d82cff77480e090d25819987fda0191744ca5a99b9c754349d8e44db3600489f2627df2e0263e2a877325a9d65d14c

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp
Filesize
82KB

MD5
3ee1f379d5ea356329f80fc6371b525a

SHA1
f985208b652973c95523d63e2e74b0b2fb0884ef

SHA256
6b85cf1d5f19621bf059bcb2b4c270929821d471faffb459df21431d197e55fd

SHA512
a1bdfa8e6cc3d310b2139ef78ec8bf3fd2d2629f9012a910b44fb1bccbc6f0ce009b1df7d20fbdbf70709a4381b9d9c8e47fbdfa9cd00061a4a0177825238bce

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp
Filesize
89KB

MD5
141731281f456b6653495c7cd406f888

SHA1
f5893c16a4a8a2be6ddfefd72bd47c51ca04924b

SHA256
e4fc9eeaccdbcf3c2afb264f1ca9b458d59ca2f9a4157f2f07c2a6798e460bf1

SHA512
9c995ed36e87e5e269d0d3d89bd4b79b4253bdf0ce0b77755cc4a6f0469f026450cc5f890038ec7a1a321cfd3c6e59c641d5a0d4cd7a13b802ab5d8ca5d54458

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp
Filesize
80KB

MD5
f6dd50e0d050290379286fd3fa49173e

SHA1
e73dfbaf13c2ffad0855bb90cd6b1b018d236818

SHA256
086081897c69d66fc263c084ba0ab4f7e6722dd52112841345eb26efe67678a0

SHA512
9c32d93485f7056b8240309d03fb38615812a78b4fcdc6e571db7109f18d31f212a345ae4d45b7e9895c71ebf7915ea01efa49e6115d78447ac937bb83b56e9d

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp
Filesize
81KB

MD5
72eedfb4c7cfdeaf3640f84b0933c312

SHA1
3950a5b35a9cf95f40389cd7eb38fe1b8a9aefef

SHA256
64edd4ddff04a39ceee6a4a018f4a71712fc126e1c62b9e4ebea000e6a595ab7

SHA512
785a2ca9b19ca709bd7d0f7375d6462fdaf9c69093c887f902fc728789962c36d6b79fe46afaaa1b5a8b615248628cf47a07dde331748410df76c0321920376f

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp
Filesize
80KB

MD5
017702891e1515b35383c67759e4976b

SHA1
ddc2e41aa334fd6f71da24d2baef3d1800d72ef7

SHA256
f143357f293f1151cc2577bd21c40d5496cfbcc1f5abaeaaf17b8c0a461a8eda

SHA512
f3f344537a5307b874983638dd908ab135e472f28752dae66d9ce89d6af32602823243b0665c3a96bb8e41cbf1ca122ac83110aac0a21eca43e20a8ca3b715d9

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp
Filesize
79KB

MD5
1864646c5972549111c7298ff30aeb40

SHA1
ff984f329f7c78127245a6041e79073aa9b6ac43

SHA256
5263af507519d15c15a62f28a57aa8bdc5b6f070b74004c89a8ec864445892a4

SHA512
b66d009be2793f9821a0bd7263df29dcb7c67f69f497fd3642ec6ff4fa189aeba1fb15e4b27ab677fd3d4c323451308d8ba0fb0f913bf532858f14c863a1559c

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp
Filesize
82KB

MD5
74274ebba56567a6d5717a23ef8b909f

SHA1
344407449b2b585a23ad72ec36adf7da727ef644

SHA256
49aa264e9f60b25f427aabefed2df28c00f3f41e056538fbca3e137185b41414

SHA512
1a62c3122737e1f024d35bb1ceea23fd5d85e8d53e67458c8a1175c76e88fedbb6019e1e5c5185d8dd05a141424c7e73db0f38f07d26e5429985a63018670e3a

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp
Filesize
79KB

MD5
7be8c5fdf2719d59c6be02da8064226b

SHA1
e110f824b0a274f2a139656afa8cc0c954134894

SHA256
132710c55262643a3ad5195e590b49959eab20c0ff889a339d278645b2c22232

SHA512
66cf958223c33029e9c41925653e45b583c4549c4ae6b3a9818f5748389792775bffde0100ccc982a713be132fbe090e18959742cff89337b0cd1b853b2c312b

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp
Filesize
79KB

MD5
bc56d8a6daa4f488a12ef3c5895bb73a

SHA1
9dacae024d4b546020e66bcfb6b9ddd9f6f60c9c

SHA256
de4e9ee513e1ce4b2fcdc91e5414155d592cc5469b1c098b5a8935b2c15ac822

SHA512
4c1e15acb519565a062c2a5dc70488446a48931b4ec93ec74e6b4f26cf529c18b65a08528982d52807835f14e715b4781b497f49edde91136f0e26d531bc0ff2

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp
Filesize
76KB

MD5
0c905038c7e29f869948939bec6a6722

SHA1
7a80f438a523d4aa8e3314509005ed47640a6fb0

SHA256
ab44973ee0053ff64fa475f13df46386683d75f0049b8cbba43d76ff2c385c77

SHA512
5885b3c2c4997654df38ba1f09daebbbbc4f493223e6573b994deee9b22740dbc1f9a06641e6f78eb0df5ab61774d7af0e5db2df7cfdbb442c61cbffffdfa0de

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp
Filesize
78KB

MD5
40c52c7a7cbec7717f2ab2dec4948ad1

SHA1
8940402fe6435b1973d8f74865b58f55df6bb0a1

SHA256
2d046c4e808d5933f07d335a718310086875251b9a401679f043a4fb9a578764

SHA512
6fd5e67dd76f934cd916f830caf7b07604405d3c83e33d016226579e8d617abfd76c777e358051ce6cdad6774dab939378d67b03165886eb27b1a0ec70376632

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp
Filesize
80KB

MD5
a82335fcaff549f969cbc32a6043e3d6

SHA1
74fb25346bc72b885abe9251468966dd86746a86

SHA256
3138d5f8eceba8993ea39a43d939f2527ce05c2121b964676aedd5d8030d0f07

SHA512
76c32cc9fa63b009c25d29d24de950614816bbcc8fe93e9de51e84adf8f2f236276c6e4f2fa558985c4da5bfe9c3c37d0b0e3ef345e8fbc9fe9811e19a3b354d

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp
Filesize
79KB

MD5
d6bfa3b3388e0eccea10a079b3994e01

SHA1
01879231b6f9ddc490c6677309eaef8805e3df23

SHA256
674ad181716b8a285d314761657e4af0ed2582091850b7a56950374ad0ee6e0c

SHA512
2ef91551b44872f7c8e9136415b6246a66d1949f0bdd0b068a39d52b40c70359a2b9a1ba8c0e1b7ddd920e477e2e836be7a7f69f4bfa71cca62a8df2379f371e

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp
Filesize
91KB

MD5
5025d59894aa1671cae79178f30f3038

SHA1
c4e3ffb46327d761e6dffcceef2794c32f607c17

SHA256
7febe707041b84479774c55f71134da590f69f2ba813ecefbaae8ed36a730814

SHA512
98ce549ffcb6dbfdadf072bacf8d43f4b4ce24248bc52594619eec6d8cddb053848160409bb4be560450b98e8e8171f3e921b8fbbb58950f3021eefb9b9b4947

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp
Filesize
76KB

MD5
520fd5f72bd9b75b2c09345f5496e9f3

SHA1
8eaa398690fa23fd7ebc36e2ed741e011c860444

SHA256
2ad1d646bc70a717920854e051d06dae778fd5102da3caad99e79d68588115d1

SHA512
665bdb0bb0c78fa27d7a91040b7cbe3ec1a447e8747a8a25e3341346feaee6e2ff0278f5e6a8625332638872d3608606af52ae65ad0ec4c904380607fa061722

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp
Filesize
71KB

MD5
a3143a48651e88cb9465c35213c926b8

SHA1
cb874d25a9bd0ab4e32001301ad6aab7f6342a63

SHA256
821ae063989d0981aa07c8d948405a4637639ed2b2f1477076e56e59015cccd1

SHA512
f62be361feea23723e456738a1dd4215bf9155681295cb72d31646d5fe75542cf635994e9cc7163462cfdec79f66fda7570e4eedced94bc2c347ff2d6ad281a6

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp
Filesize
83KB

MD5
c1e5d3bcb3fb6f95052e497a7bda53e4

SHA1
5619235d9e7be94045cca03d77a459697338238c

SHA256
bdd331b0c4a69607d5193b06696490dc5c8217b31a1b5fed8fd9e502cd7c72e3

SHA512
6360a1ea08955d844c8887741681564caf47449ce744f4c9d48d88bf39872f8fd3445fdcfb5ef7c5509b97799dcf8ed65c0db1b89059daca5a574bf79e3f9b45

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp
Filesize
71KB

MD5
60e86627eb6d966009210ab7a61648ba

SHA1
bdd7399c36f4f925bca189ff0b59c57c31cf6668

SHA256
adf5d05426ba0458fad47b94de3d05f348dba7f53bec20237c2537e6412f4757

SHA512
c3c25b85b6be8cc426a51d3c9a09e670897161d8c42199665d3558601ec474baf1dcf49451425bbcaa4a7e345e8512f0495406788eed0be0c663dc5ccb2e973d

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp
Filesize
85KB

MD5
aeb6d69a7fa34db9878213a19a49542d

SHA1
f22be4bd32121080cdde664ca2714be1dcfebfa4

SHA256
277f9393b851297c8f89cfefbc267e93f9fd7a83204c0f4bc3d2b5091d3265e3

SHA512
22105506adbd1ce4a841bdfe9bd813950a3dd5ebaf57080d515fd97c3a5bee177c8194d066a8d7ac51bb1bc9e317dd77aca3fad9464bd4e233744c41b168f868

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp
Filesize
81KB

MD5
2dfdfeec314404c70a8464ccd1ec0137

SHA1
5ce32b76fa7b6f0bd64d4061dc1c6c133e20d96a

SHA256
714c64b87bbb19513a69ca88c1c22f0afdd5596c0f06436dea9c72d0fe01db27

SHA512
b07924dd5dfa790076f5cc3097a92f4b366400a74c2ffe53c12d93d22e6bfbd8a51d048ca2cebae316842d4260f3ac744d558c77504bb8a090bc19cb1fff22b9

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp
Filesize
71KB

MD5
727e78c08b462c4aeb6fcb38cf252de0

SHA1
a1da33e87e78bf65bced02cae7b1f66820f660d6

SHA256
86f8e5682319d398195235de51b6c50353988a1cb2679f599908cbeed9442f72

SHA512
a5a2b17bc0dfd97e2152532f4a951e70c43e75615508b8f9bd5dc211e878dd0ccc2122066908db83f762b293a7c58fc7be17761f81a4f638e1b9071f0b52a20a

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp
Filesize
80KB

MD5
2c6f5855bf161c77538a75556da276e2

SHA1
a1d5537d259f0390d1233c590dcab223a3509208

SHA256
175b47b2c1d6ac0856a3490d0d64d1ed555515b2a5ad1a4d99d8f76999268792

SHA512
2bba6c167a93260c5c709d09c90509b8c12d63e561f4699b7ed245ab5be4569b94f9cc07dd4044d9330304058a31182cec812a1cf986c2fe5be2f6994cad7ba1

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp
Filesize
90KB

MD5
38a8c8fbbe7616741f2c933ce44b1143

SHA1
8c7c337db92b8e271b7a2e0766fa1bb62811e8f0

SHA256
90b84871c7d463cc2cd23bc75d11245184b6c6da3cdd9212c7ae42690bb2e865

SHA512
9c8f166f8ca5427b1a4dfdbef9bd3c59fef596e114c88ad8f0e4453f01cf6dd63ef1ca9e301612cac55105a8597607491a234f6a6b2362bec1e9a49d549223b2

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp
Filesize
80KB

MD5
2bbbb99a5fd198971764304fea195b66

SHA1
3587f7031a62d4c132d514c842097ec6f45d7e11

SHA256
12b09591202ad5e38b2a0fdc5ab80b6b111001a8f9bf1d7abe46d2c9dffa9f8e

SHA512
b054058d43a9cc9637ed33a9a28d3ef1a5645b7d930217f096ce90fb72a7e466204e479a27cc942125c48e55fe0eae8d56e505f0e2a26ca63f9c3fc7144e85c0

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp
Filesize
83KB

MD5
9f00811b42f5f56367520255e1b41422

SHA1
d4ed0ccbbef0acb48b69cc499104aedf439e278e

SHA256
4a70d14533d217a76e2248e47b09b58286b987a6517dfbb7bbe693fc65c7a92b

SHA512
32f6c78f9ea4e4e94b1b4db30e126553308d6f4552ef4baf045af02deced76a1a051bd301bbbb619122a5d47293a5ae895841ee9034dc5264d7f827700b192e0

Download Submit
C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp
Filesize
78KB

MD5
00d1934abfa5bc166b6f819d57d8cb32

SHA1
2a8bd7dd2cc37dddd60f3ae537124ad880f1072a

SHA256
04e566ebf448c8b3d28b5de7280a04a8e2191cb4ee9f35d35e4ebe391234e9f9

SHA512
2e46921fcf23c5e3eabeca7b13d1f99e0c3704c2efda3932a328fea1b459901e1cd200c319d00f5985a2928c5cec7e50644d752afba02619d8290835cfbe79dd

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp
Filesize
89KB

MD5
298b23ec64903160312e5a97e466d2cb

SHA1
4e251456365eb55483581956f912854eb7601266

SHA256
6ad782cc54017ea490efe11e75d4a0bbfde643c41d7b499da36996568f099289

SHA512
d9200804abeda2c550777b552a02e9162876eba6bd219690bda63d56f109ad9e39522ae5132bbe5ec5176b45ee65e038fade570b8ceeb31cffabfe9ab275ccd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MS.EXCEL.12.1033.hxn.exe
Filesize
71KB

MD5
7c8de2fa67dc498676551a419e0be1b9

SHA1
18c3205410867e24be022990bc166915e476d5e6

SHA256
3471b26b01a24027640f6db1276412dc91e0889f251820eff9db6c7d6627eea6

SHA512
f2795991235af994898189caeb4eefc2adaea2febfae8c8e5cfb30fb27630bfcbd74964970da86a185024e3ad3717835009490f4d70626b158481b45880b37f8

Download Submit
C:\Windows\SysWOW64\Zombie.exe
Filesize
70KB

MD5
c1c9195c7712c03a3f57e86d14809845

SHA1
c07ad625c0c6620ad571d4acbcf0b1ccb6562b16

SHA256
909449af816a4cff3900e479d0e66251c19933ed9074156bb243287164b047e1

SHA512
42113cdefa98b3b4458cb2edab48ef3aa88323382bc8a57e9579069b27549bb083b6d674b8555a6d6bba02afce079a02c71ad1deff3fa03cb686c2e2f70c6c08

Download Submit