64f116aeffdd662369b5bb3fc08c7254b9e6073a1fb504b469b5d582a83ebd51

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4024ae7fdf1df62f2143e7f8b702f890N.exe
Size

179KB
MD5

4024ae7fdf1df62f2143e7f8b702f890
SHA1

942e9de4f350a1a7629f75e1d9b097de1b8814c2
SHA256

64f116aeffdd662369b5bb3fc08c7254b9e6073a1fb504b469b5d582a83ebd51
SHA512

81f67f2a03e3d0bc71e107ae6e648641eb5bd360dc9d811c9d0c046cb010407fa09ea777a5d2c15974482d28dd29770b810fdc1b5c534bdf6b24d429656eb570
SSDEEP

3072:62ssWpcU7lK1lKgkh02ssWpcU7lK1lKgkhZ:MVyU7lK1lKYVyU7lK1lKH

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4640) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1984	_MS.LYNC.16.1033.hxn.exe
4256	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	4024ae7fdf1df62f2143e7f8b702f890N.exe
File created	C:\Windows\SysWOW64\Zombie.exe	4024ae7fdf1df62f2143e7f8b702f890N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ppd.xrm-ms.tmp	_MS.LYNC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp	_MS.LYNC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	_MS.LYNC.16.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebProxy.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp	_MS.LYNC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL.tmp	_MS.LYNC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA.tmp	_MS.LYNC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Design.resources.dll.tmp	_MS.LYNC.16.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp	_MS.LYNC.16.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp	_MS.LYNC.16.1033.hxn.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_MS.LYNC.16.1033.hxn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4024ae7fdf1df62f2143e7f8b702f890N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 4256	1668	4024ae7fdf1df62f2143e7f8b702f890N.exe	84
PID 1668 wrote to memory of 4256	1668	4024ae7fdf1df62f2143e7f8b702f890N.exe	84
PID 1668 wrote to memory of 4256	1668	4024ae7fdf1df62f2143e7f8b702f890N.exe	84
PID 1668 wrote to memory of 1984	1668	4024ae7fdf1df62f2143e7f8b702f890N.exe	83
PID 1668 wrote to memory of 1984	1668	4024ae7fdf1df62f2143e7f8b702f890N.exe	83
PID 1668 wrote to memory of 1984	1668	4024ae7fdf1df62f2143e7f8b702f890N.exe	83

C:\Users\Admin\AppData\Local\Temp\4024ae7fdf1df62f2143e7f8b702f890N.exe
"C:\Users\Admin\AppData\Local\Temp\4024ae7fdf1df62f2143e7f8b702f890N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\_MS.LYNC.16.1033.hxn.exe
  "_MS.LYNC.16.1033.hxn.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1984
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.exe.tmp

Filesize
180KB

MD5
6f8f722a1bd8cf00009123374d9c41d3

SHA1
2a0a7e6992038760133f89e99d2d4dc4cc9d815c

SHA256
8484e80df41de044cd8e54df63ef962f03e8ff0a04012ed817ff365667b548c3

SHA512
bd7806f8ed19ebd6b5f157f57fd4d45a1ab7c9324cda6acc65a600914a437a48e61ad2b0aaebd817de49043d78106c108d402743204cf5963cd1f7f152b4ccdb

Download Submit
C:\$Recycle.Bin\S-1-5-21-656926755-4116854191-210765258-1000\desktop.ini.tmp

Filesize
89KB

MD5
f161a7bead64a0555bb29cd258f7f3d1

SHA1
3af4eed3b233e79f332afe4746a8b37ea7187b5d

SHA256
080b50d25a63eb2dd38196d13cf37827624e31830e34051600d9bfe3587b3364

SHA512
6d75d154207c206eb2bef38dcb7bd1ccce4d514acceceeadbfca2fc306a698c38d452bba805b4270a8eec51e5252c6eb13e82d22e131475bb97f4768d216c1b1

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
202KB

MD5
f4655ffa17546f0b776a873db25958bb

SHA1
ea07a8ac92ad856a5039c06ecb3702085410c506

SHA256
2077fc5a01f9a82d0a362b69becae25ad0acfc69d682c2db972c0d5d0b37a28b

SHA512
937be674678785517bf987df06b57cf3a9b6455f04470e290dcc7979cfbd370978fc0d609eec73280b42d578683d9f0c41d3c0b9359445101623dafc371ceecc

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
189KB

MD5
0acc986b3ea0d1c1ca01073282a0848c

SHA1
d96d05f92c2c818d267dd0000a88d2084e7876b5

SHA256
a9c132529f05650eff8474a50b260aa94e27add4728ba60fc38d3467f63c2085

SHA512
9ad827ae127b0a1268040bd0c4e4e752f7f408024ce112d1b0e6d69cd5c63cf69cbeebaded1c7f19ae06828b49267ef279f527affe01ae7866bfe68cb7a717c3

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
155KB

MD5
9269c4fb9a638141a638ebce054d2709

SHA1
29dedffb5b02f9935855bb0bbefd724fc1e0b6b7

SHA256
a0456a8fac73581f0ddec17e3691e3d326adc0d05478889cb29139d54c154bbe

SHA512
e0e2c3caea0e40d99933cd6529125b2f0b90119b7d7117bf441c0689d5a9827754102cec6c1fe0afb1c1f94b8e72ec1c58b34c58895a0bd5112ea656bb601c77

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
29583faf51ad2d5ab332f1f3d1d55b0c

SHA1
2c32dbbb0f6195a71d8c84805690b7cdb89cf951

SHA256
dbb6fa3b18de22c4af51672aaa12adbf4e3ead64802bc2f01e7244c1d1f17455

SHA512
334b0fb481801c4d668e990556f350f10a592bd89c1e5bb199bc85188a098f738241572abef20868fb393191bbc68242513c3559168400a22d1a4439c0b23948

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
634KB

MD5
f6e4af381e3b069c68560803f4510680

SHA1
2ae2dcd8617970cf02e2fc269d825f1df144b3d0

SHA256
39440a7fcda41f0207d9e11780b4e57c0ba7464beb0abce697efa20473b7adc1

SHA512
6e6fef39a68cca5f9b57f59f9a32abc3d1ec13955c46ff0e606babaef91915435b45a7480c2df964868fc622386d5d62096aa6c2d8fc46000dcab24b30d7d58e

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
299KB

MD5
12bb641cb675780772f492c1b04ae869

SHA1
3493be869bf8c2ae8762aeb401b8d412e3aaec84

SHA256
72a72e11602e031f92bd03f37c1c993ede5515790a4d837cd1532ebc5f5ff56c

SHA512
109f323b600a4ab5bcf66af29b7b9590b8d51cfc4c8e4bf4d3f07902d28400a3159f69a3d28cf13fe7264f894aa96fcb2fe4bf045397b51ddc3b6012ae757b3b

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
278KB

MD5
35573ad6848249d115cf4bcb4f15e6cf

SHA1
7c2845b9d7bfa03f535ea632268c2cd2801cb89e

SHA256
e741be6312d8720abaac9177a754236c73e1017c5b73ec07fda275c9eead7504

SHA512
c13b0052f4d864cf9f1c0c6babbf8d2c29c29cf627bc48d3ec21c7950b4ce52031efd44df06dd4fb9933474a4ee5f04611ebe3f0034fbba0dd68ea0c1cfce265

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1020KB

MD5
b9c9fd52c8534dd3fc8cd52dc3cd3ea2

SHA1
a95876677b24888dbd708cc8019318b75e843484

SHA256
52b298492d94c388d73712927c3e927a12ae48f03c2a740551552bb374d0d00f

SHA512
2753714d325b62cbfe8522dffcf20d7a1bb7191b278792494705c47933b1733ba956f93fb3d3322263593c0776ba388af5718862c176feca13cffd621add47b9

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
774KB

MD5
e5e09296d2b9e08c9d1b6be359b83eae

SHA1
22121158abfb6eb2495d5c37f5e5f3b58a2670e6

SHA256
59d623d8b664b97b8371d7671c741954aa69c4913307f8d3e7dfe6632492c24e

SHA512
b1c5c3504c0bfd6660ffb2e39f308b59d7bfd1d552bdb6919bc17f31d418a720ff6c542e12cf85f84a4af29e4fd35fae66152215381316181c121610f6aa563e

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
99KB

MD5
97ccdaad67938256d8f7e97a4bdbb20b

SHA1
996805e5e57a3ad302370adbd10b75a22a03422b

SHA256
915ddb459204e3b6fc4526812924f638f6f5d690be4aad612fbb3c22eb3f69be

SHA512
1938e5c596f1c5b11ff1dd996a89b37941660b3aac498b883164dcb36cd1cd14ea42dc39d309bfd82ad8564c9ceb05f679653663f84ceabbb1ac2f0071f2c18d

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
97KB

MD5
7c79a109ca033fd88ea7aad7025cd5de

SHA1
b511e8b59ed6738b6d93433f829a0bce6f8ae378

SHA256
0ff157a71700ebcdcae80f55455b74b4b994f48fdddf03f3074d1fe71e40409d

SHA512
35d6b6a8d4cf61276c26e0fe3eab37fdf496b8ff70aba38488dce2ca07460edf7339149880252e2c29636363faefc1aab4aaee0afb10ad29f08bf2cf89214e3d

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
94KB

MD5
f645b566650abcdc96af7cee486284ca

SHA1
373ad1e190203750c2257afb6085ca519d45f2b2

SHA256
5c98e5b9a1fc1940bb301cc5bf9565d47034792eafbb1b9b6489693961ca23cb

SHA512
794316c8cd9faa92a983370c97f75237f93b9699a0af8aa806542dd32f84cc63253339f5084f8c122a0b4d535dc2b43d99c36b5efb74385aaa3550d84b558758

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
101KB

MD5
224962e8003e5e17ad0c2d57a3119ff4

SHA1
70bcac97a8ead7eaf17c97904d9e9487c04ac0bd

SHA256
c1d5e1fa68dd684ff7e4b8007d8aa6bd92e88e9ab9fc9e23fc3c3c7ae1298aa6

SHA512
f57ed0f011d7af9bb1759033b9190b9139afaceac36333e027a266d174f39c619b0779b96dc4449cc1f6b0d39ef16ea3326b8cffeb73d6829eb00ea24a177ed3

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
99KB

MD5
ef6ba7bb12c5e0b925b9684234feb3dc

SHA1
65ee16b7fc6a6b97601dd8929338dfd9ec493dc9

SHA256
71825fe353aa708ce734a3f41c3bfe3836ce841ae7d38f3fbf7629863cab3f5b

SHA512
bbf6b02eafc975ca82d8b46a6ce200fd2d967cb851797bcc38e0bc1317d8c981cb371ac43c56c63f6a4ca4238b27def2bb1f7ebd81d2bb9a8bb86e3b330fb480

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
95KB

MD5
aa4bd180e3341f88e69570f3bb30027a

SHA1
d2c8fcf019611398cd59337429dc6982ae884369

SHA256
18331f8952e2a5b8c79e61ab1e5453f79ccebcd13b8ed26b218834b4e2d81107

SHA512
e74f18571b1eece7aed4ed24ec6d9e2752e490304a4b39aee1134bec45899d21335f78a9a2d5c1b5e9b69af0633ed71dc4f820807c5f2fb7cee575f90fd40442

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
106KB

MD5
75e34712cde4e5f716865494d577775f

SHA1
d231814e061c42abc2051e8923af39ac12b423cb

SHA256
ec61a4367e5932a541e35defe5b4aaf777980141984c279faf917bdb5651eca1

SHA512
14e4f2a8a49cd789e6e692431a9cbd48c73e0319555a46a23889a8127a34ca0ca8e56bcee2fa94a3a03e404ee56e793ed008f0bd0df9b5eb8d754c6f6c446d83

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
89KB

MD5
df68fa8e17ce04f1d2b94752f0df18a5

SHA1
87f7439b4100255dd7bbf9d84c5b0363ae4f60ab

SHA256
72ed220e30e607a37339db8b36149e084afd35a83c4faac60adc65d9f332d770

SHA512
9ae550f947317e00deb2644c33dae58fb66db429afa855b78a123bd6c1647bd500501de018b5c0c2fbe080af003d94e028d2948fad7e8c43c9d1dccb458e06e7

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
96KB

MD5
149731eed2854b7848a20a4dae8ffda8

SHA1
b4ff539184588d91b70522518f5925ccb6d8ed8d

SHA256
63f87de1313cfd557b925aa178fe528442f0773e502fae1ea40c7d1890f1aa89

SHA512
82acd9ef6849aa86d770afc8724ccb8f5d347022131254c984843fcdfef908debdac36cc7a5e3a626b4e97a770085d34b48a1ff040b34137ac34f916345f771a

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
98KB

MD5
eb8c20848d22fd9b4c37b42d00fe4f1e

SHA1
9b9ebf58e2df8e88d85123e79452ddd870925887

SHA256
6a0262fb0860209b3daaaa404b96febc90dcb58a7c7e3633979d9852afdf46c0

SHA512
2399b344486cf70560b40bdac08cbec6350b99697b33f31966c1c92925b7a8fc5054657f71ded11b175b57a4771aab68f48075cbaf6a4362645e8243f7ca9158

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
103KB

MD5
9cafc75d62485d8861331cec8421acf6

SHA1
db738e3f8d7269cab78ca2546d12d39964ba828a

SHA256
683e5acc4c059084cab601232f83738e09bad1f00609363cda0d807a0ddc339b

SHA512
afeea9980d5b1310bf479f9c4887bba424fe3284305dae5fc5aa31c5506c1f14997616e0a3544c60a7c9a330eb38f02c08f6c88a885f479ea8cd7ac7a771b91b

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
103KB

MD5
f0725a228f0f784caf360a1195ef93dd

SHA1
908c53eee66e319ecb43b1c5e29464569713bacc

SHA256
fbb88c5d58eb3ad938f82e893418bec1ca4b1638bd9ebdf1f08854c1f3caf541

SHA512
7b6b533383c6a97c5c65b563a41b8d17d998b96f064da2c8a6be01554e00a3d1595cc0fa52dfedb1e2922cc92383b5e4d017fe0846a54ebc011f16f30b814c58

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
99KB

MD5
2d559b6a6db0b625495cbf07c0363ca4

SHA1
a2d7cb6a4ba2ccc3ca2cfdcd65ab9d3a3c363463

SHA256
9613a81b4a19a7d1f70712b32432d157f16438b05e7ee6fc9b25ef0593308bbd

SHA512
8df45c925442e4fda2ba9b439c08473b9bed227b417eff409288f146c13ae7338ae644c8eba914f09ffebc2471a4836291912d5668f155e6d4cd5e0f4e9417a5

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
96KB

MD5
ca8d1a78cfbc206fe5ac4ca2621759e1

SHA1
309d4cb7c6c04e33fdf69ce5f5d290f0a63a8e04

SHA256
3ee86aa70f85fe05ae6227187d76f0274fc1036af0d04da0abc90e22a1ded910

SHA512
6f07d534b0a43e93b0f12db542d66813182628f5a8e5d3fca3200820863e45de28bf900eeb4afba656a49311260ead52bc482775635cef30c1daaf8480fcc646

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
98KB

MD5
629c022df3c5b909e12edbf43d9bf06a

SHA1
edaef5e8e7a2def7792f9f6056f0647d3556e14b

SHA256
510194e69b6292225f431e3f824330d424ebd25fa38b4bc4b382c761c4857991

SHA512
ebf21d7458bd7c16c2f9a0a9c8bf585554d42eb82862228840b1ac0fdba9f13adf6ce07efe47732dd264d7c22a7ee2e2899b455ada5dc7dde1faee76da0c4a63

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
99KB

MD5
b8a061782acd715fe2d2b41237cc6f71

SHA1
970e1483aa86ae065438053aa4c5c4057fffdbbf

SHA256
58d24b6b393032f4bb863694a681e4f80baa1e666d2857b303b2b00f20dc6085

SHA512
e672189762d30448e30285709b2a7e42ec4ad9d5fbd107c6fdf5be9ddca2907790a5eb0b9258b4d0839cd331db3bf4ccf7bd8991e442ffa36382280fc8419a76

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
106KB

MD5
7f1dde6705071739eedd63475a4e3a96

SHA1
bb2daef55790d37f9e1e9784aa785a8cbec2b249

SHA256
486c578114199a3bb27fcea5b2844057412926a5d8bf72f4dbd7777d074601b5

SHA512
37ff9f2f10ea17e3f88109569aa40e0f555f37432d4d5c2ce895a1fca4e16c7048a4b4451f77760ff2eb18b7c9d78dc5707220b19d1552fac7d6b7fd86219998

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
100KB

MD5
1c606840fbe433d1db91d425be817512

SHA1
9466f64eeaac7b627f9c1ec00bcfa38456008b47

SHA256
2e13e9c840e0c1d9ad5e5f2b31b602d10f1ff1ba86a53368f96268dde0e25811

SHA512
77eb6299d441f7789713029d1dfa3eaa13c5d77d0eafba138b9d9e0fde98262c26ff9eda62205e278e41663f0cb903ae28d12ee2675cd0128b9753249dab80fd

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
107KB

MD5
58adc9c0ae218f6fa2b096908f5728df

SHA1
40a3e3d54a4e6807f368ae7e6db7a83860178ce7

SHA256
cf4ffbb7e206fbdfa3c26f2f08e7832b5488d20f5e8f81fa331387ffe8baf95c

SHA512
79cad53b53b3f7de65d87a81fd5235a20c1731d701d377cd1b9f1028c6a071fd92a5ffa2bfe418e9c0f7503e5b852a253e3ec8c5225a213b5831f33a03fa4223

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
104KB

MD5
7ab95f812e8bd1bbd2c9dc33fa03c4d7

SHA1
1722f57f13f01a1e393fea70d9d2916c72158396

SHA256
ebb9b959d844fb0d59955a8e20d070e36904012d75c65414d5d00f673229417c

SHA512
7352ca21b688f0ba086d9a9a8914391ad3c2c5e34cec34e57b4f9796e0e92308ef3b52818169e2fc03310be9dd0b853d950c2341f20424ccc0e3e90ddda1461d

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
100KB

MD5
6cff5aece2079e8f58fbd3a5c0a65f3b

SHA1
d368add12aab020ccfbf77f7579d6afed3d57100

SHA256
b45b88acd49a5ac2513009998d0aa155230e0093eafc75232a30b525747c4a47

SHA512
ef6dabf9566a870f4cfc40b86d5fb52acc0c1bb785dc25543238706a32cb3cd5596a9f67a185c537e8381e834be77473da949e1bec94c09e5bd62825ff809ae0

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
98KB

MD5
bde070b0a67f8f8959cacc1a2e9c543c

SHA1
4f4aa18e43bdab8a401a810176f146741165bded

SHA256
25dd7b2c6f8935ca24b2f197b495eda738bf0a42f116c0cb02076e738c137c54

SHA512
5fe352b0a7dedeaa2f3db7ce59a7a6d638c80abcffade930113c660ae6166523d68545ba66b47619870320c9dc13dc937536590d3de13f1e382ee99f8126e266

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
99KB

MD5
c68d8bbc8d87acb7a00e5c7b8c357c78

SHA1
abf391a67acf44b772af16bb8a1f5e9b900705f2

SHA256
dc1018f222dcf7280a5e08b5868c0512f936e552e764cb9deb471f127f5e7856

SHA512
7a9f3ce293e8f6e4a806e3446205ee1dbfb99544b0b046b985560c41deb798a5e1f4a66de1602ef134e26926e69b9b6d1d9185d245b31292240a719135f5b34b

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
102KB

MD5
c7f5a4f68172c51fdefd48432c9cf6df

SHA1
86e3c579fde26066031bde4dbb708f4c2ff16e50

SHA256
528c72b8e2ca238b21f85aa2e661fb8d94bd4d6346c48a22c69977d2bc3d26a0

SHA512
7ddf3f50c0a1e35c3836309110fa86d334611fc6cbcdde607a3cc9f041678178a0e374ed0b4f6f5be29c1abd511d5c903d908111a2c251b0dd52a1252c7dbe41

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
108KB

MD5
4e8cdf2b8307be38aa084768f8c071e9

SHA1
deb738f7f43552e7008abd76518bc583b4393646

SHA256
53f0a7d519519d4b1078f209b299206a83c02abfa61da6e5ad336c65452b9f31

SHA512
82186c80e4d0bb8848d8fcf54505bda30c14723c6e9f051bf99a9db680f453a59d3a72dd69a53a4b5cc54207b1703ae2b1600f91483b64c62345e2d121e24a20

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
98KB

MD5
85907fec0c9b4596e7433dbe1de1d7c5

SHA1
2d306e5c34b8255f49ab1f2004589681ef4bbef4

SHA256
2fc427a92196b0320ced0fd1c31c559e0052e28f9881f2efcb817f47fee53874

SHA512
e6710d0f764148cdfa2b08e1113693b1b4e2f307c4e81f09683e76d34f36add2f01763be41a722502aef88814f2032735552c5589aec2daf6662d7c66ee608e1

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
100KB

MD5
5d1c79a16651cc4538d2496e56b9dd1e

SHA1
59d9e03689f278020f575fd2c81e76af8266f3b9

SHA256
fe17f53dbcab19a530a49f4eb40ba6590882f64944a775af7ef4bf4b4eed753c

SHA512
3546c3b3121ddee85a4b834b55132fb887cbc8ff22a58762c97a94313a507a36dd4a8f6b4c08bd6cdd09637120769042d5a5ee9d9a93c517cf470ce4a5f08334

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
99KB

MD5
109cb219477bc77977e8f44fad389f5a

SHA1
96d77f49a02357e2b872ed82822a356f6df392d8

SHA256
7bac513b0bb408b0e278792a152ba34b870ca395d7ae61037102fd2608ca0e98

SHA512
a3cf9309dc1d1ada3a86e0f434a7f5ef258ba4cef16dfd0b424d6270154c21c94e6921510370c15cef338958b0ba7bc121796d03c913554c917f3bd87ce21d5b

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
95KB

MD5
f87d5a2bc59855da919a48dc32b0d585

SHA1
96b4e442faa8651b409f0c894bb8384a02611967

SHA256
1de962952153b0666931ebc58588298c56366e0628da6a2120cc8715583a0247

SHA512
850716505f09c3317d2eb8a74470052b316ab78593cfcbb92c10cc55aa702b38a30adb30961a13930ed1d0254fe45fa66556afdff46435700a5cb7631c137429

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
90KB

MD5
b56402a80be172fb4faa35a084c4f711

SHA1
9efcf487ce89fd5ce4dfc64e529504aa807f0737

SHA256
08d9d71c43d030e8f7f5a2b4ff67fe6545c35e738f1ec0a7a29c517b5af8af88

SHA512
206e55822a5a6c0ea74aa9a97c3da4af2299ba9a82c49167d31d437388676caae7d60d2d8bb3eea534ca9158b9e3cea1136b4893bce66049e4f691aba22d7f80

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
95KB

MD5
4f5755d671d8685f93ab15dac1172b57

SHA1
c5070486290da68d9ab8e64cfbbafacb6ded1f2a

SHA256
712953b4758398b1939b916825c7aa456de4dd4b1d627215860d9f4fdee693b9

SHA512
27154d9e51ab1b899b3906dde8fff69775defcf7a1f0aa5fa9622f750438cad81fee05a79fb92c75cc8a1562e89495f3f51d24fefa5056948949445da31c7911

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
98KB

MD5
bfb4ce58db4761c5b0d910031c18d1d0

SHA1
21cf361a4c862042f83c0a591a2016bbeb588252

SHA256
c99c80440eb6c69b9fac35bb71a2b897d642b68d8161606bac9552dd82d33752

SHA512
d9137db304b242a0fc8b03ebf53b211d591f726b9e3ba1efe865ebccbf58b948712fe92998c4571e00309e6f36b9ac8bcd4b153d5cac02cd6bbc04066a34f7ff

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
97KB

MD5
48b7fab113dde9767c9d26f1a5308879

SHA1
0b611849d59f0aee860facdb0eb356a213183e92

SHA256
dc3f70aece7fe681420c7c2699faf9b776273962c63169044d62dae6c1e9b864

SHA512
dd5ec70214e8d9bb6c00b69526e962260cd812173d71cc4b02406684b30b570fa21042b3caded68fb7bdb0f9b03d594bbea87625ffa510fd091505b873610831

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
109KB

MD5
242829ae7afb441d8805133f2c49a26d

SHA1
710a2446ff3054e80a84a3be51d8af54e82911c0

SHA256
68cc70341c4226e6721a145d1dc117be9655922ed7349982925eb7fbc5cc002d

SHA512
70283ed9e95d8c26f94dd20d0d78538d7fdf2779ad67365530fe3e0cf1cd40885bd3c7c03a86aaf0a632ee490cff47658990729e0496c79964edbed1d7a2de4c

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
110KB

MD5
3e2f75fe43228cbcb020cbd6bf65003a

SHA1
0caa248b384737689c75ae5630f573e3e5e77313

SHA256
0a58a3790e8d4291f8c3093c95b77c8098765a495ee157e325323664f5ab4cb3

SHA512
1148d4e50cf1f481ed6869593d2004db9721b57d68419e5eaf66494c048a7a7d703864747d22d3affa9dd30963fa4870ba66759a3a0fce3e099cce07738b24f7

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
100KB

MD5
81453a27af94256d400149a44798e748

SHA1
d68d2167c412b8737bf6ef3a5f3c934075eb80e9

SHA256
235ff1fb52afc11776606a0575007b02144b18f7bdc730812bb25d722c53c28c

SHA512
277f755bff486d2d5033cf112df58c0bf19264cfe3a5efbf5b32dde803b1ed3004597a3f1b544af86715c4371ee5e8e87733863f385dd3f4e0e252a93a06f689

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
95KB

MD5
76676e4c2357a3978a04bf01dba945f1

SHA1
45963129caa6ec2430787949604c2435bb95ce0f

SHA256
0c5bc04f87e71f36a54944a24cec35575f0ce49f57e9dae742fdc5b390feec64

SHA512
46713b0aa64062caee2ce92e105b76f9408781060bf405b8ff88acda8dda3d51a101e2ecbf0e5694e3bdbdbe35c6ce15e1c98c0e314c1cd21d717c097d45c054

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
95KB

MD5
6a1850d528225fce8dfbf6f1016a9ccd

SHA1
8708b58cc0a3ec48d65a4e145f35f5915f61a7e2

SHA256
d0e52b05f9b7c87ae6a780ea8b53b0ba76544c760be367abd9a38b3317238511

SHA512
94ddc82e2f54a1b10538dc862aa787d09542a5da9d11e1c5ee8fb428d29369c80a4b2e162a1ab0b7584115a3f374040b7581e37c57a192f70f78263256fb8bc1

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
98KB

MD5
9920e6ab52c20fcd35149883c584e4c0

SHA1
da0bcb0e1d6e3dfd53031aead9074ac94f41ebb8

SHA256
6e685261a89804edf750b8a0f8bb76ee5e84d1a452894fbb7947de06a7aec640

SHA512
0861605602452149fdbe3b535ffce45e0f5865ba67aa4b688962a4577b2a1859a8075a9bb83792ec37af4fd73ca8eee48cc81f969670ce392105d015b8da79e6

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
95KB

MD5
776f90afbf14d7215aba0743ee628ccc

SHA1
9004d60bac1718dfd1adb8c779510b44b280b5d4

SHA256
d5316fd78326270e6c30c167ea0a908cd87eac865ed2cc3b4ed535b30e527378

SHA512
d17f98fed26c682e22745ced784a29c7692b2d912a8d8ef3c28c2ed8b1b60c3ecda7765df10a8f4f5ac96faa82a2ace9f7631dcd3f5dc8bb31cc17987279de2b

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
104KB

MD5
8b0c0a5c8d33dcf953545c38e56eb14e

SHA1
14f9358cf22f99673246fd6c90268ecbb8bd4545

SHA256
58e5e9ffc4392085f7a27eb6b241ecbc356958af546169222db6565b1817c271

SHA512
8d6b2f5d567ec0ced7a57cc84c01e531fadbef036907ab34651d6a79c21495e8acc42f039125a0e79c1a05b77f42c4e78dd1f9797b53b1b0a128edde21b115c3

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
88KB

MD5
b692156aee6805534c3a16022fef0150

SHA1
ff7bf069dff638199164cf8ce791cb53799cd5e1

SHA256
52f420d4a65ea6a1cd42a0980d392455264c07843aa6c354ccc9d555592900a5

SHA512
260afada474c058c98fc892334d56c97089b97d4e826220a9650e263b7683b59e19bee4a8a04b45c770a9497b6dbe81ef4021727a4631a217b58201106f4bada

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
99KB

MD5
e6e76e554a7e85ea9c30573ca45c4b7e

SHA1
67eaeb0783e81851522a9c6e566bc96ff63b36f1

SHA256
839fd94b22701d7913e65ae068f0b76cb80176ba16c2e44519d1a2a6af1e1ae5

SHA512
d1436456c06318eea6351f98e9e1248ae04e03ee60244e927cecbb5fed012e85d6dd1c3ff69e828745c2d5c99d3cf0330f9c1e333cfecf38e3daa9561f497fed

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
99KB

MD5
b13245b75d9b595d515ca985937bdfde

SHA1
07985b44b4e7a150c001f10f332ece3bd6ae1773

SHA256
6c38727da128f42e2db51ac8f3baac28c371f43dd7fb7bf3906485d9b4fe7050

SHA512
6a1871614b5492beb5f94e23fc5d3d7dfd2f7dc0caa36a12a8e56677891fe92a73bd0b51d6b6b0e6389be533eac2e1119048cb503012e895348eda58f3feec59

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp

Filesize
95KB

MD5
3a67fe69f9304a0fb138607e062ebd7b

SHA1
5082b0e689e64d3225d8ca89c27df90c03fdc52b

SHA256
72ed207b6e60e203fd38454798ae61a599767ccf1fd17b21cf4aae9074bd03c0

SHA512
4b2ab16f430b7edb2cdddd7b73fe47eb33b1af8ed51ba41b9809f09ff8eb5f74bf3c92aaccd6a7824bc3791d87ab727c15e46cb72a37b981e4c711bf25d74ec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MS.LYNC.16.1033.hxn.exe

Filesize
90KB

MD5
e37ef3541b461cdf7f1bf0531c4d8e89

SHA1
f9d9116c3041996139fc999d38a37dbdd075e7b6

SHA256
6f9168a9b4efd1cf53076d1ee46aaf8084cdbf4a6be88a0c9086ee557504dd92

SHA512
7f038dea6f06fab527dc9b81f22cd4e2f8a6e0d9008fa51c0d08e266e65c257d6dd71bca3ca2529fb9960458862f21668ee8408369ec41e316264320f896d9db

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
89KB

MD5
f162d0c1b58d224e4f16368a3d3a8336

SHA1
4e9708e16b17ece6287d1af4a5ad7a2c0de22fb0

SHA256
5e664311947080158536f0fb2fea1d5b2f0d4fa2d3ab47c4b9d5cf439d58043b

SHA512
a7f951ed6a4e3860549b7b5293f404fc419755b71cc8039452e7869ca08ce2a3844adff0ea8d25bb79298fc1489cd2556a1a7b33b987803fc19c9403ee1f9081

Download Submit