67d07082bdcadfcdb6f580d039bbe182df5d4dd32332289f78a45b7d4d63b1ba

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b809e5b5e802ea8c3ac9e2006dadc2a0N.exe
Size

588KB
MD5

b809e5b5e802ea8c3ac9e2006dadc2a0
SHA1

42b51b5b5688953ef6a7fab24ad7bd3c960ec320
SHA256

67d07082bdcadfcdb6f580d039bbe182df5d4dd32332289f78a45b7d4d63b1ba
SHA512

8695f316f410ea8d389756c1623c8c9fd48a281a5ef78f453d6842e65173e0bf65d562d75b32fdba8c74fb04cd549944c9f24301dd0f1165e41d720ed2cb9cb7
SSDEEP

1536:W7ZhA7pApaX0aX09rDVMFDwU5LenTpnDr5LenTpnDRSfuYa3bztYtzZrZotYtz1s:6e7WpGlCK1I1ye7WpGlCK1I1d

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3423) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
208	_MS.SKYPEFB.16.1033.hxn.exe
708	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	b809e5b5e802ea8c3ac9e2006dadc2a0N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	b809e5b5e802ea8c3ac9e2006dadc2a0N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.resources.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Internet Explorer\es-ES\iexplore.exe.mui.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\release.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\nio.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File created	C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NetworkInformation.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	_MS.SKYPEFB.16.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b809e5b5e802ea8c3ac9e2006dadc2a0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_MS.SKYPEFB.16.1033.hxn.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 208	4880	b809e5b5e802ea8c3ac9e2006dadc2a0N.exe	83
PID 4880 wrote to memory of 208	4880	b809e5b5e802ea8c3ac9e2006dadc2a0N.exe	83
PID 4880 wrote to memory of 208	4880	b809e5b5e802ea8c3ac9e2006dadc2a0N.exe	83
PID 4880 wrote to memory of 708	4880	b809e5b5e802ea8c3ac9e2006dadc2a0N.exe	84
PID 4880 wrote to memory of 708	4880	b809e5b5e802ea8c3ac9e2006dadc2a0N.exe	84
PID 4880 wrote to memory of 708	4880	b809e5b5e802ea8c3ac9e2006dadc2a0N.exe	84

C:\Users\Admin\AppData\Local\Temp\b809e5b5e802ea8c3ac9e2006dadc2a0N.exe
"C:\Users\Admin\AppData\Local\Temp\b809e5b5e802ea8c3ac9e2006dadc2a0N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\_MS.SKYPEFB.16.1033.hxn.exe
  "_MS.SKYPEFB.16.1033.hxn.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:208
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.exe.tmp

Filesize
589KB

MD5
f33648b4d5354c28932324f47863f4b5

SHA1
725578e4015e8a10441bedea7f762a79d8936984

SHA256
8f7119c6044ff4241546b975151729859dd5d93b1c0238a89a750ef1995e9fbd

SHA512
da8b1193f04a1e662c8775a8225a3e466a37e156d258f1aec7dcb84e7beb6ea9593a4bec378f86c5160c0c908cb8101be21a8df10eda68f273007b71bcdd7ece

Download Submit
C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.tmp

Filesize
294KB

MD5
bfe13b16654e47437b75e3bbd16d22ad

SHA1
1f37c8664e27e548071d444e712e9fe6b25c38d6

SHA256
34e28cdc82fb3eba6674257edb9b5f69a18683a0e5713fb91cc9e843c3b2b61c

SHA512
101173237f767100e11292411cce75558ae97bcaa140cb813f889b4b37fe71d453118c7a596e5d7f477dad782e682b6fcfa77435de9d0ca2e8b7f1ba56d8290c

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
406KB

MD5
130aa448b938a3d10b6f12817e9c5310

SHA1
e7e6db4f803527719c46167e2dbc9f8b132f05ab

SHA256
d6b3534b16afefa0fd39b48204d567bdd66fe6657e8748ebb3d7af671021b624

SHA512
5c97a952ec2bd89fe5b538ba70fc35f1b4e49369bb516032f5e44cb1d8cd415732d5de697b393dbbb535138d01a55cf30541d92e824e9162427877549e5688d1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
393KB

MD5
b34f6a7641a225e48115374ad664df5a

SHA1
16b61671396b81ed4a9c6d18583179729c1dfa72

SHA256
5573758913162bc0ea31d949b190e9e7e33827e9e9eafe9169c5ce29a4f86a3e

SHA512
79ca32c1082b0ec9da0db0be05958493a4a800e75987329f320676a2e64f13e27b1297ad92f5fc8a0da60a049ad27524d1d65028849cd4af691a479b66df86aa

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
2.0MB

MD5
68bec651548046a4b68823423bdb091f

SHA1
58ddfd057528a934d9eab014b482da58c6194ec3

SHA256
c43dd2502423bc73e0d571b0e0b88b80621e607ffc9525e9ca1b97ef3f7cb2f8

SHA512
247f9c0845af9032c6ebcb8737409b767be1e307d0339225ba6dfc78501583a1086abe256296d69aace5543a45dedf76956cbc1014a91f5eb1c30ad0bd84daad

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
838KB

MD5
70fd66bec9ad5404f6f73b8906aeba04

SHA1
a2e81802c9492661d692bd3c2011d99db82b0502

SHA256
b05a01f72bfa89e2e81edccbb5955691e2f9aa78cf764e484814ea316f573a1c

SHA512
3bf3b18c8e5fce8c6e6ce3e5d0393a5905c040b5d2105cce2f45d9b076787012b5c3491eed198e59d0971e568317be7a58e70350371f1b17afcf848cbb4dc994

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
503KB

MD5
254346e2fa77d74b65ed3299290c2e4c

SHA1
747b031a517bb0dfbb2d4aadefe7450d789faca1

SHA256
220a17d22f1f4bd937d0eb5a5b6d9f17812ad52b672c7487183781206e49e12f

SHA512
1e863f99b85c5cfe37d18294d22fde8c2c8c1f7efe936074346f1c33508d2b3b3b20d00c00b5fb8f30b4e1b08960dadc31274a7cc4109abf58cfd9eca2eff4d6

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
483KB

MD5
81baa3b46c8cbb9dd6cfa81291772761

SHA1
de7978cb955705f36cd59c850c9930d1bec30294

SHA256
a8092dbfb7cbd0685686abf0823ea6f871bf363ed71ee371be818e413c990bf8

SHA512
a8a99f0d961745c85574195e84ed7573f82dde6da3644ce720b123e59d16039bb212c010146498f15e0db168f9b9b93753a4352d1478f37debcfc91594b8190f

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
483KB

MD5
de11d077cad936d1ff8f98ee508cc0ca

SHA1
59cfa6d817ad41b1b917099115fd0f1d22b2da3a

SHA256
d774e6cc8dcdcd1c17139532b924d6edc773604a2da8706e1c3a93ecec550232

SHA512
8dd340426ea56b2e4ec024012953e15d6f5336baaee039110cf1d7ce7864615770c8d298d40c9596ec8e4b087b36f4e154f61d4ebb4a94a57ce8bad0108b2d36

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.2MB

MD5
a8739c0b59e485ce9a64aae43c7640db

SHA1
a465d02329af328cf7e4c1a808a1788ea9f4c029

SHA256
fcae959ae96b03c39b05367a977fe0abb299243370c4ac776f576c002157e7e3

SHA512
4cffb98abfd5c4cdf4903ec02ee56f137951802e8f7dbfdc4bc8f54bd93ebe523e4ac67bc9d40ba1fd826f7130b92666adcdbafa41995560e07bcf88e10ee80d

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
978KB

MD5
60cf671931743c6e444c266471c11b02

SHA1
6e565800deb604c604a782685e2f0fe1fe78e840

SHA256
ed01eae3fda337ef6fb30464442a772aa14a83ea5d694707422eb036c92ff424

SHA512
0177f54954aba137fac0b467332eda3fa2e297e220bdfaf228eb4b074285a633c4d1ad41abcc1f4900ec00354ad7b3d9020a74ee5e526c9b6ad3666cd507cd6b

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
304KB

MD5
66872edef3145c0a317beaa43ee715cd

SHA1
49bcf27bd04344312c23abd5fe8048dbfeff0c71

SHA256
5273b29be60de789da61749d88ab83968f3203b731735f3f014765d0ab7104d5

SHA512
0dca286fde4ef1683a8fad4f4a1b132444ee15b56099758244cde2eea43839fe7a11feebc3f765109497c369ff68d5be315535e0b6e3167378f52691cff0965f

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
302KB

MD5
dab30e4d23ae72f8cb8e580c25612bf1

SHA1
c218b08261139614369c89a36a2bc1058cd758c6

SHA256
60818c55355f2bd365be47ee274e112d66e0e1c3a1959520d4d67b9734b01a09

SHA512
f3b1ac5c10d000fba08f43601f5acc82a09fa962d17bf170ead28b619d3f77bf84e2980cd011691cf526d2dfae4d5666b41f7a4b0bda212b53b53ac5b9e80db5

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
307KB

MD5
45901100ae95f1a850cfdb5549085c48

SHA1
0591e6e23ad0d0c4af4ad8ef4669c0fd202a51ef

SHA256
c8bb32e6b89d95aaea3d9984e186538875baa1c9f9e2889c9a71e0c50a947277

SHA512
754df0e1ddf208cffe84b2a58e340706cf10050c10decbd7644c8e2a7f4c290ed2dad2530abd0c097a33b850d4d8a4655e5d68ed600d9db1a551dde85acf29c1

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
300KB

MD5
13e06140b31d3f7f808440dbfbc0a110

SHA1
8ad802dc374a49aafb13547caa31320a229106c0

SHA256
e37e7046ca0bcd5d8e4a5ae58a282f88ff682e81ee258c4ebd5a668e060cbe94

SHA512
7465e062b6da4fcf2a521f7f0946278249ce1f6ec12fc09540463029eceb8475d2eb922f4cd8d1bbfd6bfd1a0403182434421b8fd3c39ea6968d9bcdd55701cc

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
305KB

MD5
645dce682e6cdff10e36ff41f5c3f9c2

SHA1
66f3a252cacb13d794d09bdf5786d1a86542a0f1

SHA256
63d9385370da5ed2531f65488dd50b377d61af6c1bb4786e613b889281ab921b

SHA512
30adc807ad6da833646f8deef1b3dcde4e629f3ce45d52e32efd95c7abb60f84127043438cdcbc5658bd898ae8b17d77c468aa500ca4a7284952bc747d8f3d23

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
56KB

MD5
569b232573b3d463b48115eba2ea4a6c

SHA1
44fe379117463c81ae0c9d44ddd9368eb9f4f908

SHA256
c4c354bf147ab01ddcd62e38b7ffd33c26aa4deb4bea301fdef8183bb88dcbc2

SHA512
f50342eca478bbd68365943bdebe78ba2fc14032fff337ff0a20b5ab5bcca6de83d3d3db7958eaa4c81ed8fafb3890e2cee9a55a0469fbe7519759f875c68a46

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
309KB

MD5
d6f6c5c45fb0e294931b7f70cc0762ff

SHA1
293e6c1b806c1c853b5938914ea3321c0e511c15

SHA256
f8f968abf49a31ad6e26aa4ecde3e166a6c371a1ef905cc724fc764d973f9ff4

SHA512
903db2e49e5917b1e9835e1249e357906a3ef0b6e3d7323256d3297afe2488838f220734c58b272fda00bd1687e84d2f87c0fdc6a89bed17a77eda62957afe3b

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
304KB

MD5
acc28c5bd91ee55851755c7bf2d86a1d

SHA1
e627478e614a08d21b8cd3b40d74dac9bf2124c0

SHA256
a10502392354e6a212db9573a69dd7d94181b14f6cd5a112ec58045123f319d3

SHA512
f1ae59c5e2bbed16cd05660cb467ac95bebb441a10e6d80955ea3bad83a4ad35523799473904752a365184ae54a445c03e175c75b58b02cc645b659dd511b81c

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
303KB

MD5
2ede4f0a8e85d04a59777044b51fadc1

SHA1
7311ccf2e4273b70419bbbde0f08f03ebef24c40

SHA256
32d5e0295e3f22ab156eb608f8c245d903b9b8b0379bd1230c2bd698788c0e2b

SHA512
2e2a4d1fda7e2a70fbc8f5c4a0042232a01d8abfeb384aeea1b7ec9f3e24d3c94aa34b3de5d81601e325a77c8ea71424fe31af03d060ef8c458074e7777015dc

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
299KB

MD5
f674ded785e1e0f8e40ae20048677972

SHA1
65400e659e5a9b1d8cb3f52897144103d4d1e9c6

SHA256
37ebc92a962f6fa8093bea7d0a3c14302e82c5075f97c2ff2bb29d3f5f82678e

SHA512
42b2fbc651ca0e2486e5bef016efed23450d4a4c0d5561687483049858043c3a935606544938be39a075cd5df5480325c009de3589aa13a85a30cad9d98ed005

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
310KB

MD5
bfdf8977970939b5f4316c1ca4532ed6

SHA1
f159c08d6a7d024ee302ce4748bb2c78e4275845

SHA256
2ffaf269d44debb6d6a12767b272ead2e04e2ed32feda6f553a111ee9c107f5c

SHA512
b47e428cadaf3cdd2a9c61eb66ff297b3106e7684918007b92fe4b8ac95be66578e850cf6aa76b355a5c98ff079deaedd516e7ebeb62e96e0150013c9ec17fc9

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
294KB

MD5
da121b55eeee5cc4f9e0bc7b4b09bcde

SHA1
72e55097ce4b3f6b9e8ae0f3c1c2a6f1ebf96221

SHA256
f519d8ab2fd5a2469859e521ea676b6d124ad47eec05d36700a67a4b9cacd62e

SHA512
46a64a9cb7743fe8f0b37fa1c3523c5d69212aa470c284f37e478eb17a124ed9d0dcedcf0d8554617c9cc77312f1920065f1b3383fe83affc22d711565b09f6a

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
303KB

MD5
00e289a0beb36bdbca14f67d33542e5a

SHA1
d95eefcde6c826378a49f74bec90eeffbf69f8eb

SHA256
1c4a5454bfe800e0217849acf14efbfd47d2e23c669537083d52943e6eb95857

SHA512
941a90e3798ff75f4a8097e8c8378e7d21e2654f8b056a6a4dcad2bac71fe89d091b15b686e3096a5631a032f30d01a1fa6fe46b1a0b3f5af2a1efb852e65cd0

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
300KB

MD5
989cacb3a975a3dfe023d3f9eaccfe0b

SHA1
f137d5f48a6430e630dd576da8bb89d5a76b1e0d

SHA256
830805df0acf472ea74bc56f7fa81300e7911d5d6211ea0d936eb3f67ed22bb6

SHA512
7185656fc92cf5ac304313f25ca64ff564fef15cbc663e7572bb403e2230858652a7101e86774bf477bb2389cf5e3195ad72c335bf0f63f99acfeaed80f90332

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
302KB

MD5
ac2e536c622bc4ae772f99f2bc5aa41b

SHA1
b2aeb9b9cd4e1e0c349180cb87bd49973c0f4570

SHA256
106e20d2cb0ddb58b5a18917bbc42cb57d507ed5f416724d8bf381ae9f0820cf

SHA512
9c1128dfb13671767a0b9d6cf647d8431bb4baef0eff46c8e0fc1c37f571a3dbabfccb850cdafe2c98aee861f848280c435c71c2a504f5729ba8a3d44eecd74d

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
308KB

MD5
b7db7c3a2a48201f5405e91f533c5219

SHA1
658fb6a864f6fadfdc8ac8312e20bc6768dcf5c5

SHA256
db780b1dcee501236d483c162b2a9ae1dd3ccaab25b7ac644b6a88876a6ccbd1

SHA512
4f63a8dd199632953e52f6b3294587ebf5bc1677a8196d96467449ffc11f34ff4486c92abe23b65e76458d96ccc0ee220cdd1b18120ae646078d8f35b6b6f87b

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
303KB

MD5
e18b1364d5e896e1ddcce1072e07a4ba

SHA1
5231082e022cb7ae2dfe4c64a30c005e6e94d366

SHA256
8929941a135a24cfe33aa471a93d76611fee991a3c7f101e95d05b2a96a82f0f

SHA512
0e959f621024312193dbb42797112601d4b88a33cec086b6cb5c251750b849303ab1278089be4a05456445d838e3ef7ffc035e539fc77f49b4cbed0a6cdcc90a

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
304KB

MD5
662974c044fe1acd3547d4a746fdb7a4

SHA1
8b34132a1ef55c853be5a1905f902f2b188307f5

SHA256
777a149d85aa3bcf5a4f993f33329151b66b9fa0f975bfe81adaee3cf29e816e

SHA512
aa85edbd695d4aa7220247c8b5773d6b00d3b40352b0fae4b44822fcdb7bdb94e71db9e2a81c86c472fb192aa883d42c826d07c6280cbbf9a95c69a246456c7c

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
302KB

MD5
b5624db58b45343f55dfcb82d840b51f

SHA1
fb17ef9a90115852d96acd6f00ca74a59ceede7a

SHA256
729328b556e00fc7795090c1e618ecea4498648d08208588bbefe50979d75c6f

SHA512
6750a8e2c28ddc77396fabd78160c3a65bfb9e93c9b01445c7d097b29724d3a973653f75ea85240a0fc68e6b2847876c4b8dfe0ff1920c197ce761c46408c220

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
292KB

MD5
6d8af8a368bd90fcc1c5c653c5a33f52

SHA1
285f539874b08191c340b7d009b6923f05c08280

SHA256
69c053d063752b3a8b34f8f19561b6c794c0b96267df5dadbbc285510ef1880d

SHA512
461061424e61568588812c39c08e36e6fa7edc8240447750f0aad11afd6a724622055e6ff127c1793aa60a23662587c89877b8bd260e86f5ea010e947b1f3983

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
302KB

MD5
80e4fc0ff7ac7711c8618e93c46fd1ed

SHA1
962f58b827943567446850ba55252d583f0ade88

SHA256
1db3f6649dbf6bf2581cb252f6d2cc8add25acba4636eebccda0b5aabe905783

SHA512
3302f48404bc590f0b2483df3eb4861432d70dca4d605040bb5af7a05d5bf7a46ff88fa35070c3dbb6581cefddf9137f1bf8fd1fc15d79d2920770dce0ead3d0

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
304KB

MD5
66d39ae15ea6ca017106bc64341f4564

SHA1
4fa55fc2422247dd395d9a71883947476d8c9581

SHA256
95268f1932a5138599aaba7eb422534ebd4a2021469fc83d696d0d055844a913

SHA512
8dd437bfcb662f702cdcef5f7662de5751d33e949ee2dbeba7b81bc142ff0d3a1d903a07f87816014a1aa82fc97a2428380914f9d55d06bcba14397cbc770c7d

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
312KB

MD5
dc695e91db47a3577bb8dc5c73830267

SHA1
bb2a12ba0819b28671bfc51ebde27dbe2a52cbb7

SHA256
2967db7716c1b87ffd80d9a72cf3d0ba00c05df855d6fb05fd6696152adefed1

SHA512
d277364754c4326072a3557c1b88d6a8d0e018f32acff991a936d758d760febe835852246c3b50ec932264be0aba78371ae7641e4afa302dd84249c77c136a08

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
305KB

MD5
57d103c0ecb7447cade21e3a1c97c0fd

SHA1
4d9a8fb0bcb1e19ed17fed6ba9466d98d9a3da9f

SHA256
e57524542a74714aeca576df39df576fddbfe1dec476837263375f319f094e08

SHA512
78f661459a116fd915cb77a55fc3c6cfd9ea0adef31571ff9c087809704e21ff9dd4768aab41446c4e835bcfdee0375ef66ae60e8a2308c113e49dc9b9c85451

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
312KB

MD5
83686c8a05a396837afedc3d3b490f4b

SHA1
e9cc81b5df263519492743af79202ce1a3c72fec

SHA256
edf11f7961fcc06684ee675220b460350f0b4dccba9c6abbe44c6131438bb2e9

SHA512
08cc99778ee6d2a92fefc6016a05b727717c09edb96a900f1163744de8e8ea8f516c97fa74aab6f1984a8f61a7077be5ebe75569a14f831a0762b743018320af

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
307KB

MD5
caddb67b5356a70ad44ab9fbe88e1b62

SHA1
249fcc61261ab153cbfd398397e68f6fd2190316

SHA256
60a4e830a3e492932c0a646dd47c04a0170cef1096f5dc39209eac9527a6e0df

SHA512
e014e1f16eb01d90c24c45b6626267de879125e65990268061d1e4801208e5842613f3ee3236c17313625cda7e9a5662575104f83af45af7a5429bf8ecb97f87

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
303KB

MD5
abe52d7b83834ee189c501df602931d2

SHA1
6a9e678a5a8582e2ecb55d643cfc69ce19c5292d

SHA256
0e683e08d5df7dd3302394db43c250f25e3710a84f1cff7e09cca45d4b4883f2

SHA512
3cc74070a516d218e067b49399c5efc346d9010ef02c1669139d76a915a3d656fbc046d2f06b04e91b699038ddfebd4029c40f4d92c88c2db7ba0f6e7318f291

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
303KB

MD5
5c4e73eddf6d28d508860f36ee037296

SHA1
b6f7fcf1652ff9ed921c4f1818ea4756cae5c059

SHA256
4ac8ca5401a7c29365945e165766f8f9260d72de2529bf4dde8a0d512c526a03

SHA512
52972d0184a4fcb25d6dd192abe25206baf8e3b76ceb69097869aaeeb4fb52f73e219da9c2891f6740e9a53b2a56a63f9f9c784c7b1bee9be8b0d5fe3c9f5a83

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
302KB

MD5
5b251fd9f12fe65a3b2d6a4219d9db57

SHA1
dd3781b30256c0cb5b82b7fc3b4738dd90ed7ceb

SHA256
3899f59c5c28fb03f64cd87ea31133636223f30b6156e0131c18464afc94c024

SHA512
d8966ebe367611fc96b14c27bfea91207f95e307bb4f6043c49280eabfb99d5ca4d761e2af568a0b930a58d8350f7afee135d19de43968c579bcf8009fb37584

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
303KB

MD5
f609a258fbd42c122d624f599a4adff0

SHA1
075c34a21f4fd4e38d4b03fa877cb656222ed97b

SHA256
a75d2f207fe03fc64ea6f96b2c0f1b33e1a541f32734147de2e1d82dadfb7cd9

SHA512
49785321a51002268bf3a7f19db30627f28ff4be97d5b95b3c854a7950de247365ee8db8ed9a591f516c8d344430ab3eb75f20a543551f80d19f24a899e49ed4

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
311KB

MD5
bd78484d977ec5e167f75deea00affc3

SHA1
b707d06870604842bb79ff3418ffe2e3e7927989

SHA256
a54330fa38f1b95714835e53c4939d479895019272943a1a2b9f6516b0b6f6fc

SHA512
50dac6b845e0a5ab5641d5d2fe366dd6e68ba72aad7fe8fb902ba41831b3f0eb51accba3744228fee1ee6c4f2962552e6e2e3254007636b879992ec92d12a764

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
116KB

MD5
37cf7140adb4cc49563bfc97bf80fb27

SHA1
8cc22d27c3b6964cc27131a42ea1285db2d0499f

SHA256
87f360662886dde7cc4395885ebd4e216306f480e22552fe6b58647693598377

SHA512
4a190b063eb7130f24a3bd0d8c4d496a60bf8af3122aaba219eb25208c9cdf0fe63d17fc4adc525c8c26828b03d830df30110f3386c54e538ade7c9293bcb530

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
294KB

MD5
d7cf33a0a267556ffb50d6e7dace47c9

SHA1
ed75e3edff7f97b2e7bf89b1cf74f928154efc27

SHA256
9d07221d2cf6b75bed37e5a87955f1944b801421353e7b7504ad4922017c4115

SHA512
3aea2115cb3fb801e440f775728978b888e8dee46cf38eb1fa4c703fee4246bf44f822ed4150f7018dff013ab65ac713cdfce4bd0c2456717547f019f8e790be

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
304KB

MD5
467aab53a9908cc2fead5dd00455be15

SHA1
42fbef7a5fc7fd89b6209d689564190d476c1468

SHA256
134a735f87fd93c804034387f3aa18552da3f82f636f1d4c8f9275d443ff9095

SHA512
020965fea5d3343333d68a092bda2c5003158c12eb0f2b83d204cde2e41e2da2911b41c98e69e09b68e128b9c8730603984b062ced343d4b06fd868d6d370b00

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
306KB

MD5
dae854996866a4d285178c92034c7f89

SHA1
38a7c4447e63dbe45f135da8d99b36e6a686370a

SHA256
673ae8c0d04c19fe87f0e0be7ee799bc8f03316c5e05f7687e1e13bfa569e61b

SHA512
1da57bb4cd2b21521bb5aa475f7ba5bd136b9007701099a3f528ab4c4c38afac762d962a29040b2f4e2473bf8de7f57304b671a863418c38a2c28955e958a916

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
300KB

MD5
4fd4c05405ac351ec6eccf8260238b0b

SHA1
4c765c78f46db79a905735a010700d389b74ea64

SHA256
b53098f42992b1780aebc935b9b272a6f2111c6286dc714e341c0419a8dd536a

SHA512
e9578017362cbcbcc6237347ce09c1fe80a8d3d3cc7843088b672375289127ae288cccaac34c37d74c8d6532fa502821d8099afff2aab9b6f1ae77cc02fb69a0

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
302KB

MD5
214f6f7437af8456de6bd98661a4fd25

SHA1
cddfe5f202ec2ab9ecceecff369b50c127fbec18

SHA256
00db1a7306691f92a61e481335cc6f4e2b6c82f493921304b84b560406986e31

SHA512
d76ae9019e1db8df31daadafa5c9c71a42164d85ca6f91a591f61007933cd9c276209df7ed30e9d5a0b3d835d781e5af9d8ac124504806e15056c2c1d1c26e1f

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
304KB

MD5
fe83fa0dac630b1fc4e9604a5ebffc0c

SHA1
ae3de805d0028500a3872be8b7c1dcccea6d6302

SHA256
28bf6c9fc7339a5b756b0fde268dce7a65656c2f6de81fed3c6d9cd39f9cfe35

SHA512
b86c03c8a646769181ff3f113c390207a2bf32c9ecb7d3192dde6e76d9ad9da9269ce59c920acfa12475c5f484dc2ff577704257716efbbed6172ace3e374b3d

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
300KB

MD5
5a73cb3fd8df41374698c518f9248fc6

SHA1
fda4aaa299e3665e1c62a0976f5d8afc3539a6ba

SHA256
5c43651a85f9057c8e5ce2731909150dd23ae3d7c321085587b011724303e2da

SHA512
03ca34526a51067efae6785332e957c6517302a5d417f875cf19c69232f4ae7d5dbc718a9e73692729bc51e1a16ca774cdd6d0a09e7634d1745cc8895651da74

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
303KB

MD5
c5d11fb0b438fad349e812050d4d678e

SHA1
b3b90a7085093e0326d7407f37314c650c0b2b18

SHA256
c5ca335e4fada7b9fcd6b74b445e6a87bed3e251798c04fce9d7518476bb6135

SHA512
f448d2f4dd704c3aaacc05d72b025cf79b6de0bca541de73ad5057fb1b28228f4af80db440254486fcde57af094d6edea3eaf17c6a56299b8bf75eb1718bd514

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
302KB

MD5
649c1e73a5347caadc98d45adc0b2ec2

SHA1
e3b5b8955f9e5e28399ccae8805fb2373b9c0940

SHA256
82ef30cf03791aa4633807ac8dcdc2a28e7c8c0842d95d7da4f474c8eb597ca1

SHA512
aadf8d103c93e6527e21192531bbc48656b3d069c4f8930ab3f7a73e4bb7037349d4d05698b654e4e87faa3fccb1638e6719814d8b74c38f543473b876a818c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MS.SKYPEFB.16.1033.hxn.exe

Filesize
294KB

MD5
ae75c667f9d6d5966a86359922ceaae0

SHA1
90267a47b5b954ca6415004d8918a836ac19f6d0

SHA256
821b91001f31a54ac7cea6753ff6e3009b425fcfd4e1c631f66ccf8b2e63e2e8

SHA512
aec49f07c343af797065f2ed3b6f005d3164ec6f2e4658cf90cabdb6d4bba1c9bc370f4770857b497e922a9b8f11c11bd70c44b82c132178531f5732820cb72b

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
294KB

MD5
6db1ca00d48dfb750e899f29d9b910c6

SHA1
0de64df02319e1029be6765db9208a78cb39c47f

SHA256
ea6dcdd740c554537fa7ef60f413b6cb0282d7f9eece14adb44619d1856b1df0

SHA512
f7e33d18efbe2ea5f7accf5c18b34886689b83b92bb530f8a3ec2af33d5ebe25541c5d8356644c5abe5acc37de0e1c792ee80ef83ad4c9c253e1a11743538041

Download Submit