8a9e982f0bc91c51d56b2b8682a3fb649db3e6deb2d4d83b4d903bb94903ec6f

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a9e982f0bc91c51d56b2b8682a3fb649db3e6deb2d4d83b4d903bb94903ec6fN.exe
Size

90KB
MD5

9ab69028d7b2264ad06ae4d993c36060
SHA1

dc8064c87ace984a90afdda2a8a499305b00cc85
SHA256

8a9e982f0bc91c51d56b2b8682a3fb649db3e6deb2d4d83b4d903bb94903ec6f
SHA512

f91cab5d1f04a07b4675a524f1237c6da1bace1e355f71705ec48fd52d5bc8558d73a987c4ce6f47a11c3bbfe0024752dee7533ad6c55e54a3a4d3cee355735b
SSDEEP

1536:W7ZhA7pApM21LOA1LO87ZhA7pApM21LOA1LOu5:6e7WpMgLOiLO8e7WpMgLOiLOs

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4713) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3380	_MicrosoftLync2010.xml.exe
3704	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	8a9e982f0bc91c51d56b2b8682a3fb649db3e6deb2d4d83b4d903bb94903ec6fN.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	8a9e982f0bc91c51d56b2b8682a3fb649db3e6deb2d4d83b4d903bb94903ec6fN.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	_MicrosoftLync2010.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	_MicrosoftLync2010.xml.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp	_MicrosoftLync2010.xml.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp	_MicrosoftLync2010.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp	_MicrosoftLync2010.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	_MicrosoftLync2010.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ppd.xrm-ms.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp	_MicrosoftLync2010.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp	_MicrosoftLync2010.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll.tmp	_MicrosoftLync2010.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Design.resources.dll.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	_MicrosoftLync2010.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp	_MicrosoftLync2010.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	_MicrosoftLync2010.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp	_MicrosoftLync2010.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	_MicrosoftLync2010.xml.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8a9e982f0bc91c51d56b2b8682a3fb649db3e6deb2d4d83b4d903bb94903ec6fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_MicrosoftLync2010.xml.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 3380	4928	8a9e982f0bc91c51d56b2b8682a3fb649db3e6deb2d4d83b4d903bb94903ec6fN.exe	82
PID 4928 wrote to memory of 3380	4928	8a9e982f0bc91c51d56b2b8682a3fb649db3e6deb2d4d83b4d903bb94903ec6fN.exe	82
PID 4928 wrote to memory of 3380	4928	8a9e982f0bc91c51d56b2b8682a3fb649db3e6deb2d4d83b4d903bb94903ec6fN.exe	82
PID 4928 wrote to memory of 3704	4928	8a9e982f0bc91c51d56b2b8682a3fb649db3e6deb2d4d83b4d903bb94903ec6fN.exe	83
PID 4928 wrote to memory of 3704	4928	8a9e982f0bc91c51d56b2b8682a3fb649db3e6deb2d4d83b4d903bb94903ec6fN.exe	83
PID 4928 wrote to memory of 3704	4928	8a9e982f0bc91c51d56b2b8682a3fb649db3e6deb2d4d83b4d903bb94903ec6fN.exe	83

C:\Users\Admin\AppData\Local\Temp\8a9e982f0bc91c51d56b2b8682a3fb649db3e6deb2d4d83b4d903bb94903ec6fN.exe
"C:\Users\Admin\AppData\Local\Temp\8a9e982f0bc91c51d56b2b8682a3fb649db3e6deb2d4d83b4d903bb94903ec6fN.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Local\Temp\_MicrosoftLync2010.xml.exe
  "_MicrosoftLync2010.xml.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3380
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.exe.tmp

Filesize
91KB

MD5
5490c96d1f550bc93063b3362e906ee2

SHA1
2d80d519aa2094cd756e473ac70ea19a4e2af833

SHA256
7fe43eb2c3282efa5720c5e69ff556b6b561e05c5c7fc2c6e053a89ab71b51be

SHA512
24f3527361edc72e64264db0a4f80ad93143aede815320ce67f83b85fe5d795e917f9d98726375b6cadf2d2f5b28df0f1e3794b05dfbb04131f175fcb79e085c

Download Submit
C:\$Recycle.Bin\S-1-5-21-523280732-2327480845-3730041215-1000\desktop.ini.tmp

Filesize
41KB

MD5
f0e5c7de89688c71192c7da64b5342ce

SHA1
c333387d00f504646e4ddb934ac60bea8050511d

SHA256
ba6b5fed692bc9a2cc534fb52fd83f3772361a61f9374dec464b610b4b0f0482

SHA512
b7af54c9479676c58b1c75a545349d21a280af3d49897bcb5529c3a96df5b45e24ab71184fa6970cb6ac86708affdd18bf6a56239158e1efb51dc2198fa3ee8f

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
154KB

MD5
d69a49c3c660e6855fe62ca1cfefcef8

SHA1
3d2b548469c9992b372094c5800ee5bdcf6eccbd

SHA256
f2cdccf305806d6037b4ea968a6c6caf818340c34a1b34e3c3b3f06488f15de8

SHA512
44571273c54c02dfe8949df3cf05b5512dc32584f6941a9b154164f841a5c08915e267b21365f56ae3ecef1cf28553acd7dbadbfdd756bdea092203e760276e2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
148KB

MD5
db1d2fd03a886b5fef7de7069f036c15

SHA1
354dadece31cf63bb0d2ec6ecd74f851f25f9f7f

SHA256
ea596454e80f0d9264a8e8b9ddc18a4ef4359d1c307dcfb9755ec98a98085f20

SHA512
b3608f10b7256a9f3863c3284a6c7aa5708f812f3b9d961f0e16eb72ce95b7b0250dd581fc63d6d599ae9d10e33f8abb7e530c16637794be47da4020ff931619

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
52KB

MD5
a590e9ab420649634f0facfa39ac7a11

SHA1
d3d7ae5f794e083752b0207e4189f0a541ddb003

SHA256
e9e34c48193a4354f07ba24d5f080702b1fe84bcb995cc55fe788639c1b9bd5d

SHA512
d2a313ab177859aaa3e50c82ed46b70d31faf8b6c40779df852e2035a85075556081c8f4d711be164fbcd0c06004bb0c6deb61b6a1221825cd939b39d1061706

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
593KB

MD5
d24cc1e5dfe170c94ef94cc744d011bd

SHA1
9f67f9e0d9d01a52be20d36ace6835f020a86dba

SHA256
e2a0f0905cd091f806c919fb1a99ec5b27fb8e9809baa90f11c3d0261fb06f46

SHA512
b791238c1a49d582e45e46aef0d7e6532f31b211c62600ad4528fc4e060fae125ec64e46fea6f9f4837854171a69e6db1ce34d8b01b5fa143052e3122474ecd7

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
258KB

MD5
dce18d3ff851ae2898bbcc638a8e99c9

SHA1
85b4d463037a757c1ad0cd113e2696c1b77cea8c

SHA256
68a6947a0d0c9674cbb14b77d4b2685aafc0d0b0a9ba42a729a030269b1c1c9d

SHA512
17ae037b1d493092ef41e4b97ec02e4566ce90b38b6cde3c8d0b5264bd7305fd683f09deb84a24e246d081cbe30c9b716f6296ae28acc3f50c865f012815722b

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
237KB

MD5
e4005f3ff63124a1bb2daf6681e02cf7

SHA1
1ac9aa2eca57354e21ceeb02d43cb4d2535dbdbe

SHA256
cd81b3a004420fa7eed35785e301988214794706e34a04439492d839e338b588

SHA512
3afeaff717d385635581a3bdf8eaed06f386a8d4e78785bbd5eda3df64fe0bd3b0bdd3ac4f3b778ec3fa31d1e3e417e3c359452a1e48eef33335b3129feacfc4

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
979KB

MD5
490283713aae62dbe2605608459f28ca

SHA1
f1213533a929ca5d6a55e94b2771749f58adc274

SHA256
8d1f6c57a60ee04ceb389636a31972a1acf5e5c5cd66a7aa7c329353b85bef54

SHA512
7c49b5ea1281373ee29ce635370ab7e9b0e3fe11b6950b0cc711da65d99c8b6879926bbe5c6e7f512d785033a4c3936f0ffbfb07bd98b6c8bb2d6eb81546b2cd

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
979KB

MD5
e58604abc49837e3d71d8858e9cea7da

SHA1
b150b98933cfa0083916258bfa2c53439c4e6f30

SHA256
6b43723c67aa3a7e2f7498eb01c6e40f9fa3401eefe341d0c45a86eef964a84c

SHA512
226b0cff8be22efdc4c1591f510626a825107cb8159982e6561c81586bb3456b410ee44cc64518cd3289688df7230afd020f515ffaacf980e05015c3a219c912

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
733KB

MD5
1a12313459b5ef5b30ede1e71ca97d26

SHA1
9d4a0e18f99fd49cf04cb9924eff9504149e938e

SHA256
60d31f76230639248f41aaad4e934238c94f3a8dabd4d0078f3079baf7784b75

SHA512
06a83da6e20a287e11604cc2b3979c131767104be1c0bf9bbcc83223103d1692062fe64425576c537e825d5e8df49e2f08a473bb39c772958f626da8d56a997a

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
59KB

MD5
803f6e859a95a43d5eda44c7569e72e3

SHA1
990d8e108fdb9ccd1fc9f6c201923737ac0285c1

SHA256
e74bb9b72ef68bb4756d91db9271aaf2e511dbca379f0bfe660436ff500cd96a

SHA512
ec02259525652bbe6c22716913343aa17d720937e62ae0279d54c8e7fec089a7925924673b54fc6cd5d561d6b76d692340f4a0daed41c39e192483cea6b8294b

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
56KB

MD5
9e9f54aada482037d8be1ca95c995ee7

SHA1
dbbcf42f9418ce65515a647141759114217607e1

SHA256
f311f0d27c1dc2e4d950001637bf1ee9865932216929b69ea881bd0e3fc29569

SHA512
744bf4f63ca383d831c80f7b4c62da51c91ad1fe6617962c3ebd34a02e7f4250844b4770cb35a3b0c9e2b7020a1d5fd2c15cbe5a4fc79c22a6f8846168341951

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
61KB

MD5
3e8e3f7badbf4a9a22d432cd8c1da257

SHA1
c41163dcbde1acb23540730ba80e81cb8ca0aa14

SHA256
d0ed6fb0635accd9b68c572c5480fe567de31fd055402110eff338a309ed172c

SHA512
cca18360a39485912d1893757bb68242bf6f69d4932b216d0bdb0521bb2122a5e96d8350ee4064c6eb3f38bc8000d1564d61e2b81fc1f6cff1e9658204b9a90b

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
64KB

MD5
8bc54ea9d4c3a781e7f7ecb1ee813ff6

SHA1
2da8af3db38081a742502f26a8114bbf6fc0f62c

SHA256
7364d360e3083ba43ff13f08989778b73ab6759e0fcc254bc92758ff5b622086

SHA512
4e920fcb53f03bea78a2dbb01e0ed7c60e5780f20e77d3bfc08c865368483cb7f17cbeec4a1272a75ee34ce424061ca3772e42db546a81518d6bf8e5c532f71c

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
58KB

MD5
f547dd42b51d7552f3b475559c1fa3af

SHA1
55d7e7431ebd49ae254746c84f9fdf87def6d642

SHA256
c914b1d17bc54aeb2379744c63da48e208ec5d87b28e9614068e1ec8a8d8ab56

SHA512
4b3d6be68338db98539b6435eb3cf78fbb787a6b24f12d53a497db60572ba59f972a3d1dc112a794190f2db115690a449e9599d7ea06c9d8a11105ca8653b63d

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
52KB

MD5
1b2f928b25c5e27a04d544cba7f6f529

SHA1
a9732a607140512a98a7f2e55712fb30c4da0a6a

SHA256
5fdbe280a8e06da8c1126ec1141d71e1a53aa0be092cd7f9f6064ed6a7e87410

SHA512
6cfffa91ca9757e6888a133c1e67379dc2166fc596a82b8d70806cd8d139fc3e4bd7f601ca267adc3a32fa108be54449adf79526291052ad52c6142dab93fb5f

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
49KB

MD5
85b349eb4fe32fad48e3aa77377e8a65

SHA1
f53f3f5d199d63909186853313190be73e7933a9

SHA256
6dee75a13e9009765bf60f7177aaa5e954630f91bfef93c255e7490dc614b1c9

SHA512
c83e0d7e567a94bc421607af0cc9fb84f3ee416e7d1200f1d18af6f56d595b4623d90b5b4892e2ad8b5636120125e6d20341da0cb059a7fcf2fc6d11ce2d45ae

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
49KB

MD5
108f24378fcb6bba2a979622edc73017

SHA1
d742cdf592a860b2326eb15135be1d56282c28b6

SHA256
35d7c1808334c2a64fdc8ad6d50ab87f24fde509a081b21aac062d8980477663

SHA512
bdf60c2a4cc17662bb4d94699817ac5b5b64417a3cc9d448277abfc6b27d2044f2a5f0516788dc104924fc5273d13dfd9b136dae42854962f77b1b3fc77f472c

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
49KB

MD5
833bcdfacd8ec852760c122332236d67

SHA1
466f86c13c678f54b0c6da201f1fceab2af7b7bc

SHA256
46a52a40ff5c89b643e6dacc3515220b40e16f2c499ab35ccecd73b3e30ec1f0

SHA512
5fb46ad30c766e651d1a01bcc9ebe3b51ed9e281135cc1c1cf1da0ffda8f7f934bdf2d291582509c65c038c4e71e65ab3fec8f64b8f0f5a295c3eed419734082

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
40KB

MD5
5495fcea8c8e2f73b0c70b29822ba154

SHA1
23451e3525f7f7b68deba0cdd205134b8b0c082b

SHA256
4415476bb8f00019a7184535c18a9220f2ac7e9856f09123738ace1779b9fa62

SHA512
e349a3306e28883b86bd0504f3241701c01796ef9e800c7124fc1c4e06e4fcc4cb90c519472e51ae190beb8d1d567914ea493803eafb75a5e83b128db026ca1b

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
51KB

MD5
fbc6c45a9ef3d04e1a7ed925c1eaefda

SHA1
cd32073c3f2e5b3bb2c8e4d1ce69d4119fbf2ba3

SHA256
f66091908e6f4595377ef1c24f901a7a5db808a60d74f5f75cef1e88d734c4a8

SHA512
b3e4085d2a4cf330370c9d3d2a8c89555d74162d39e24de0959b9311869d9629a41d4e038941f50ccfef4b5d61461e69d1e5222442369e199b83f5252cf1d3c4

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
56KB

MD5
c9bf94ba732d7dc6097994ac232a45c5

SHA1
0057993b058f95a17523373b61929a224d37de1b

SHA256
6e449d7fcbde8eee34c5cab82e0e9a3c61d919eb8749b9ba362d858afc358ffc

SHA512
ced4df0fbca2593b0ec087e7814d30e4b960872e385ba7bb4bfafbde5d8da60af4085c0b6fd2ac11a2cf6fb271a0451a27ce8514d6285f7bd434d15e0c1d8c8e

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
50KB

MD5
b28d2ebc2f46cac03cda9c021494cebb

SHA1
94952930a6960c7f9dc843f9161898061a0c1680

SHA256
3720ef4d4aa54a4c1948c23ff3ba167155b5bebd6504e2036edbdd7440c89765

SHA512
3fc6c29c80d5df2b5c083702919bff14220f889c21104e0328bda9396283d32e1594385919a2b60ff40cdf14380e8b9d30f5bf9c23acd446413797d6e6b9d73b

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
59KB

MD5
78023e6fd0e800ba173047dd39ec81cf

SHA1
40faa2f434cce5a4fac87382c4da9527442541ec

SHA256
0953f59ede075a5ae2935e243711a4dc867a8af8e509943bd22c6cabcc6d630a

SHA512
649e3407de113861a364e7002f3289e2f8a4cd216894b75a2349f8380825a4497aaab97dfab2544c46fa973c6b099300f05fdc24cf503f96c0658f93a9323e1b

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
56KB

MD5
353f1885fc7aaab913ce8d9d34914e07

SHA1
3ad72dedbedde1c21819ef696616d0db6fd2ecbd

SHA256
19476786c90c9c5035529179402459768d0ff62e805cc903a139999bc5fbc93c

SHA512
b9dae4da0fd180ff7cc4f3ed8cf8e407016665211cb49d1ec8eca8667efc88ad2a2d8b4252f3e2c035c08c60fe7c85ab6ef64c58dedb71f1bddd707dd59c1450

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
49KB

MD5
a590c8b02d01da82e2b0cfad1ef690d9

SHA1
2060caee9dfcb6d3bb0b52582da3eb4488b8ebec

SHA256
c07d249e7055a1c9538bff12a037b998bfaa99d18ec07fc0603396f0972f3b21

SHA512
da5bcd0ebbe87e481a822ce3553961a70dcb4442bb8a9caf2f40143420e7afb2be179d304f9f500db6e8ca3d420e285f270153615550e3c8a696a02b4a0062b8

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
58KB

MD5
cd3f882b90863b410ad23222eee79d26

SHA1
1189019336cdd71b08675b6a0a372e2dc2c63b8a

SHA256
313d570e272c7f79605fa5a430161b43eb588823ecfdec6963a64b675aac3201

SHA512
12950a9341c8a93b0b8cc991b2d6f5b4aa263eed5c58e4548664a0187ce8efc7a5d0051da0fa9f544c00f03d3ef8d6ba1e4a94ad9793be6a357590181c7cd6c0

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
58KB

MD5
873cd41fd4affac5204e6081a31484d3

SHA1
70a63b5de109806656a897bde7cd36df6cc069a4

SHA256
fb356a407b462e870088dc5aaff565668e0ca210c0a30f1a7b7b2792960f02fc

SHA512
50c078b8a075860119ff42053346d6eca2290dacf6f4c5ab336da25fbab9c8d539f4cf6ea31a69e94fa27d595961525aac12adeeb8dcc970c4e4e88de1eeef49

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
8KB

MD5
b70d64abed5a12100dcba4fead027392

SHA1
0db41829607b74bdeff914507fd6c1434f7f8455

SHA256
8273304bbffe3122f8b2b81ec8b93112057f7b0a0ea47684a7c850a9cb119b43

SHA512
cee26943b379eadfa3d00651c8721d4ea0998060377a6fe9ac277c2630e9c4054e97af0071ed498c178751046c49515e3dd6ecacd4e8dcb371e824b45494692a

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
55KB

MD5
137f8a97420f3f777e8e20bffa50f0c8

SHA1
aa7aae81db3128fda231b70d7c20eaafc121724d

SHA256
355c87b840b02c365e0180c2d3e80b0e1d9b5345a75b982533073b597dc92850

SHA512
08583e983c898575f04b43057ad2cb6ae4727c810378b1798e5ac2bf222b9c21312d90a772373ffeecde7b91afce2c4da07d3b32c02960356ef530b51b96c28a

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
57KB

MD5
131d4940a6f5657532050a74420231f0

SHA1
5cae8ba365eabca689213d8c9b30419620260bc5

SHA256
e43e0caa4b7fc1fcddf2d00b8da160b54fc0c18a3958b5242ac18431ccc32740

SHA512
2a98faa770bb867737380ea816b77ed956eb5aa3d2b17d7e679166506fb16b16b649b00b057414687a320847131fa647af37cc8c9639e714fdc62b71bdfc8414

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
51KB

MD5
2b58dfa8e5fac292b2ec7d11e624afb1

SHA1
347d6912479b8f290c7af8939468e9e73dede383

SHA256
23711c90eb420036ac54eb8708e3d258fd5665ae0e468e00b91d6d2e6d48058a

SHA512
9a0f70bc32df274c39332b8dec2550835a09bb826f792144b64c4989278501a2ba3197b6c1bd697ef805ce34a291c6823783bf64643e2459490243802dcf772c

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
51KB

MD5
251a697d6c06f51399982000a5ef174b

SHA1
ae74489371ff5cea83645494b7147a412145ab6a

SHA256
30c57663710db1b64a4437424634f986943101906d3d01e188f2b661bab05c36

SHA512
4a1f5dab3c7aaf9c6f88c4c67d2799cf0ead68e92002719286540d0c94bee7ff1645400a4d0b5f780182feaa3eb16ab2abb474ec30c7e39a40f1e23778b8e26e

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
50KB

MD5
128eadadbcf5d939421c95f86df4041e

SHA1
1b9751eeeeca84c675cf29ef27013ac18bc03b73

SHA256
373dd5c7a65088f16c60ecb0ce083599b4cd12812ea08d254c4e3a401d323906

SHA512
9a0c5ebbc46a13c1b260e9e52f2829e5d48120024ee9febae5612376d6576a87625a30d2ad790b4359373d98ea5edc93d8f9bb6556bf2cbb6bc01ef2641fb61c

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
53KB

MD5
d2b118ddc7686005ef123c406074ef48

SHA1
deb962c582c81f61addd598deb82ce445c154265

SHA256
13f0c72c4604ab1842ad9ffa550cbe01ba97581f1d61d919042699a808fdff80

SHA512
29732c17eedfa546bd306918e58175714d98f2af1abefe6d3a8613fec9c91fead6813fce2659e7f34470642157f1847dcfb5aae1d353dcef65ba7da6f26d1618

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
49KB

MD5
caf8e4f70b45d84a475219ebe51bae31

SHA1
0c43e9647a32bc71f5acf20d31ec0d7f76bbf526

SHA256
c9fb29b46fd9f142fe0b40ccd324489b8e7f273c39050c21abde305848c46c8d

SHA512
1f9a642024b1fccd320d0043d9cfdb71c81c246e88d509a84e1d5f08b548b0ecf1b67b0482e6adebbfc7ea9a9cae4e2ce3a9e662bb416ef67a4581a3993e5eaa

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
49KB

MD5
4214eab2f22be52d68b2eb0a315aa2e1

SHA1
f3779ad6dcc79773be220196fa097b99b1ae1db3

SHA256
7f9520f4f6b7187bf5488f2deb946f7670baa7822e223ecde536a9332b46312e

SHA512
82507c06d39b78e2adba85f11b96f1ff540d220faecaeb196da53df2320fdaaf614536000c087855a4e4f78f81e63d4056c520628e561e1ce7c421527a0fc03f

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
48KB

MD5
2d9b34d7c830b4c5000210cf54910e19

SHA1
5ceb19249b63af4063f2ee1a3bf716314610000a

SHA256
e489dcef292da34536abde1d4afdd2461df93265972bfb501b3a0876c04fcfe4

SHA512
964d2be83ece52a86b3fba6b519be3d0b825709b23458f88cd95d512beead1a6824263d0019c2d73288c0160d0105186e9c0e28220599d4e776cde44b929eb37

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
59KB

MD5
ee743c0657c38c64e085dc713d46932d

SHA1
46e4f4d4ccbbd1947a350ea6ffb24c9fe77030a6

SHA256
93f73680642e1494b9414cb64570189dc1a225ff702434512057075c14a55f28

SHA512
e1f90b9f6af96be2f8927bfa672ae8b6660f5d4c9190be25e6a20082cf0004a9eb674f2409d96c115695cade8009afb8fefb485a4c4817f9b890691715b0391c

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
61KB

MD5
0cbf1798fe5a13c56f3667e603c64c44

SHA1
8a698e6a7de4fb62682f20b4d5c9e1fcb9e003f3

SHA256
c25e0e39e1cafe811e466cf40f85efacbeb33252a0462939e08a979a21f4f517

SHA512
cdb1928dbdb8f16e1532132192a9d441ce8b4136eb7c8afa5e318e5b3923210cca67adcd03010c7b30e4f3c29a5a3bdf623ab5676db290c7631a5fc77066c8eb

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
57KB

MD5
a866e3dc60fdc06fd45c6e2d4df6926b

SHA1
1b66ba36d07e2f4e94e5f8c44b8e4ae340012778

SHA256
e387ed57c12d68a524be47ec41e782f5b515b2b1700e974eb93c7a43a863f6ae

SHA512
500515679fd8e8502cfccd1675db19d14981dcec808e628bf5e2e2717a2779b3cb4b652d3d7e8329dcbb576190aea4210cdde9d1d33ed257b9ea33ab240d3f76

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
57KB

MD5
26877a54876616d461e8eb5a778a1d43

SHA1
01f0c14d633162b9dc2262fb9f1a11654a95122a

SHA256
b521960215021108747fe15b6f9172d31711a83c053e9fed6cd522cef698145c

SHA512
cdb9d59bfd38c6344bde39334b741447ecc0781dd38658b22877d8908f5fdcd13545905cd168d63a68c1e451db13e5fd28d7e9d220bc349e2bfcdaa3a2b180ed

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
57KB

MD5
e0cfe272fec859a0b14e722676962908

SHA1
69dd9202bc5461aee34dd1229f6600758b235e77

SHA256
5f08f1fb711b5f7262d500ed0979ca67818888731637a45a6b252e1028638828

SHA512
127c8cd2dc257d8b87735742324485873f599a914b772bb720c6850d97c7817408a9fff263de4cc8c4833ce82df5257852f2395c60bb4ff223cce9ab31e8abb7

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
69KB

MD5
1df064b3a458e16e942dad1422d6b1af

SHA1
63405d602c751f9f4b38a1dd48bc685683b3b49a

SHA256
0c3b478177e607a1dcc6d16dbc212502542c7f3f747a9f19c44fd50c0db9157b

SHA512
873327762a42fddde76e3bedde591bce1925b15e786fefdb1bad4ab274c80501d122fbe1297eaca30103d9c0265252d8131d51b6c183e43ff4b5247d3bec568d

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
70KB

MD5
a8ee462dce763ecb0cba01c221a6b930

SHA1
d69a894cd22ea84522cb1e894ed4f453104a5ce0

SHA256
6cee321c155e3bf7fa56f01e66d7d789033f7d5c31dd6b2fb81318b37f89fc1f

SHA512
b818ba338660e6008f86f7ecee41a0d33f5253a7349091c7f2c52b83b10e739aefd5b8f44ce93db20fc393d2913ab1571184f21de2850345b5148abb41692abb

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
59KB

MD5
f639e5aca42b408a77a69eb20fb9f54b

SHA1
4c2aef07866b67f0a172e392da0c0f1cf763b410

SHA256
808f53b886e6bddefbcef1428e6b5f6608cb0309ac529c9ce403424ac9672643

SHA512
883fc5e76d3d18354ac2b987e60f3dd50ccbaad6d846f5e8b09dc3a1ac21e4f223da2df119488f3040f8071777177a61d870100ca74d19455a78b1ffed765909

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
55KB

MD5
278bf2100e9461d18d6c322066677db4

SHA1
2a8543a010b164387da95135ddf9e36432d16880

SHA256
03b452a01f15cc06b43eedaa8ba22567fe01a584838b51d6251b742da66662b6

SHA512
95a7b3aa49ae8b36b88753c0b027b53f9b3487e58a31543bc134b4a2a9792156b2e452c126a2aee9c3322c62fa54e7bffd1ef53489504ca23189263311333ecb

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
58KB

MD5
782abde4144a1479ff960a369da2df48

SHA1
19aee6d6e120899edaf8183ccd2d897777d5cbed

SHA256
bb413bd5e429f8a8f4121237b3493af8c5155191a2827430e3743921a30abfda

SHA512
3068eb594a961c6f69cb1f7b116e3882b45c95e807b744d1337737bb350d117747b074a3bcfb4235c2f7cbfb221107140d83e8490c12e8abb184424506a08723

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
63KB

MD5
24d89e5b326ccee12c31acf0aaa547d2

SHA1
13272c0ddae4b579060881c9a1f34b8fcf3986b4

SHA256
9a0ee2e2cdefafbe5ec0052eaef0229c49696c1d465d5c3d52fbca93d7de7424

SHA512
760938e1b1307334d3046fc33cce75c8501fb99079b3dc3359606d1f76811c69a0b2d462994cb69feecdc62001207e4e671ef8c150362881a35829e08460bff3

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
41KB

MD5
4a1cb12286a3c1f06416241f06a484e1

SHA1
a62e9062bb1e0a7188f7d564b661dd41f1909124

SHA256
50f99227206f842aa946348e5af28e217547ff5a39f406688f3f18a7a92582ea

SHA512
7031011b3b9254577e27eac886f7a6db581fc3a13303b3e333b16138724e59fbcf7545ad88ff88b200412ad555e3a323e0c0cfea4da571cc3f94382e589ffccc

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
57KB

MD5
1b73f7a899aef26b16c56e6aa82c8308

SHA1
167548a43c2b8949be5ee9ff18888c8fff865ac2

SHA256
fccd3f053142ef49b1c15a387e0963a0f3fca4c5f4ec1fbf53bb970fa75a761a

SHA512
587d325cd81adc373a1cb9043c2493542f08179de36e661a9cd923645ed78754e0fe54698fb1cfd367af495227338a6e6eca572e53c1cdbecaa39c43700c955d

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
51KB

MD5
1d7516474ced55cdef4010909d4f652e

SHA1
de2c9bbe88738805602ce926372f142dfe0eb099

SHA256
148b3247b87b56d8b1905aabd27b775e809fa28235e99ddd17b1d72be3ddb6a2

SHA512
c7af01398a257cf285e27e68e730caf0f6f175af8e1ed4297bb31223c4e189a5ab7f667446a0e6c545de9cc5cc7fd6459b8a7a3abc47234ec3a65ec52c61e572

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
49KB

MD5
83f13ddeabe5ff138b4669d1b42bc045

SHA1
68ba1393ad65fc6f174ffb27db483ac4692bef0f

SHA256
642d3fb15faab78821058f267aaacffbfa92ff33e0bf4a1e6b692b2cacb65ad6

SHA512
23b528b6e446a1b805fff1e9cb3e6ac88372a5567bcf1585246162dd1d7cf68d21a10daf249873e83df59f7b8a7a6df94c3de8e386158d95076ae19bac1de0ff

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
68KB

MD5
b3b9be2abd2c55fc706b104c83c37732

SHA1
6a352fc83599bd22154c82ef26f15736d993b8ee

SHA256
cb65dbdb0ec4efe9f8cb1f5de48ffdffa6577181159cb3bd86dde8b6b589dfb7

SHA512
702f3dc30b45da8e85595c437c4787a75f355e75ebfa1396e167eb9a49a1e990efc67ebc7d10ce32d1e7d8af489f1a41814c8ebd44842c66d14806af949d4355

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp

Filesize
59KB

MD5
7ce77f8dfe4b7bdd64ab117757809f25

SHA1
82ee690eb7cbea42be22962e313868323b4fb553

SHA256
807b4eefe64e5602295d31da3037a3241f7cd199dea879af93fee8b1b5be7984

SHA512
1022a2d79e0aceb6ee1c364945629723d7b7dc93bc3d6d3e69ac4c3a0daa86f2c6dfc15ea13a8b8b9965eab69f70be2af79219151886ecf93fc3b91e67acde6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MicrosoftLync2010.xml.exe

Filesize
49KB

MD5
48cfb7d21dde1f002b3ea54eaaa66c78

SHA1
50f4827897a322ff59f3e00965a86b7395c06e55

SHA256
855cde313fc2be06c5a437e0082207a3354d941bf5cc4c8430a0789659b8e2dc

SHA512
c62e58294261f4ae3dd67a5a115a3b5e9e6900e64fe5d757983e2f31ac13e1d3397ea6b37c819c64e1d924f6557ba3bb8266c9dd03fbebb41b0fc5e5541fa4f1

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
41KB

MD5
9754728ce8fe514f4af7aa58871db2c9

SHA1
89f646e80afe597dd83d39c65924f2b3edf9877f

SHA256
a815c706ae023da9e3a06582abb7baede27dbca07569bf45bed5d7aa9be7984c

SHA512
66865fb1146bb824de6d1de200a19ea645adb041fc6fa04ed349991a8e88540e5ee0c7c9708af771f3557672acb95fd12a69888c29765a6900699d010683b8b5

Download Submit