90caf076287a65fa20cf1f6944155b40d1cdc00add12500765cda339fefdcff2

Analysis

max time kernel
120s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

72a55eb3903dc00f7cb81957e424e390N.exe
Size

139KB
MD5

72a55eb3903dc00f7cb81957e424e390
SHA1

4640a6cbf359d00f1a6a73e0422a2802f06f2448
SHA256

90caf076287a65fa20cf1f6944155b40d1cdc00add12500765cda339fefdcff2
SHA512

23d17e5b2eaa1880bfb1f1a9174c0391a4dfff414db1b492971e6119d2ca9fda910de07b496ac5c6783c197489e6ab0e6f8731437fcef4449a6e84b018e08057
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR7kzlSHe7WpMaxeb0CYJ97lEYNR7kzlSl:RqKvb0CYJ976qKvb0CYJ975

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (4655) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1912	Zombie.exe
3572	_SketchPadTestSchema.xml.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	72a55eb3903dc00f7cb81957e424e390N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	72a55eb3903dc00f7cb81957e424e390N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Permissions.dll.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.exe.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\APPLAUSE.WAV.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\pt-PT.pak.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\v8_context_snapshot.bin.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Java\jre-1.8\release.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_SketchPadTestSchema.xml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72a55eb3903dc00f7cb81957e424e390N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 1912	3372	72a55eb3903dc00f7cb81957e424e390N.exe	83
PID 3372 wrote to memory of 1912	3372	72a55eb3903dc00f7cb81957e424e390N.exe	83
PID 3372 wrote to memory of 1912	3372	72a55eb3903dc00f7cb81957e424e390N.exe	83
PID 3372 wrote to memory of 3572	3372	72a55eb3903dc00f7cb81957e424e390N.exe	84
PID 3372 wrote to memory of 3572	3372	72a55eb3903dc00f7cb81957e424e390N.exe	84
PID 3372 wrote to memory of 3572	3372	72a55eb3903dc00f7cb81957e424e390N.exe	84

C:\Users\Admin\AppData\Local\Temp\72a55eb3903dc00f7cb81957e424e390N.exe
"C:\Users\Admin\AppData\Local\Temp\72a55eb3903dc00f7cb81957e424e390N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\_SketchPadTestSchema.xml.exe
  "_SketchPadTestSchema.xml.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.exe

Filesize
70KB

MD5
5832c36d467b774a2b8d15fe8e07446c

SHA1
8c767a59f26becb370f6e830d4da7d63287f0ccc

SHA256
87ce3dd3340f1a69c3388ffa0e78685f34bc1d3f67c55bc4f4e378d48c42b1d6

SHA512
42dd796a853c711c8f8771dd39beae094991f68f06b1e8ee13df66fd19b1faa63b351d59b9621545d08ac2e0d55aaab6614532f4db40811b11b0168b944ac192

Download Submit
C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.exe.tmp

Filesize
140KB

MD5
aa115fb2ac770a60dc4d63eedec317b8

SHA1
b188e53da96b838f07d634ead13d9ac608d5f7cb

SHA256
46b35e6186134730f7620e337a74af83bcf5c6d4f035e2e4c0d11810f2f915fa

SHA512
b82d4dda372e729711ec5c30a2f6cd24c5d3b14488e9add5b9023903feb7ea6ab723021d209fb8ee165ee3ed6fd9f850d49997216a9869695806f2ccc0de2ca5

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
182KB

MD5
bf2a313a854ea9e4d466ada6347aff6e

SHA1
21c8f2d609e2270f6930b9a1d64792aed38ba72b

SHA256
b0d4feefba0f4381a7464b1c3ff2f5e26563e43affe157a8f3269e797376918c

SHA512
72d3cea50a5d2dbdaa690427a26e4f66bda3809d1e3d944c9c363ac3b43fab2c8b4fe7f6b2cc6080a48eb39f5cf441f025cc4d8bda67c028904678ddd0101936

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
169KB

MD5
6a9c9759aba9854f44726f3d3f7c099b

SHA1
7e1e70d3e6712bb2679d4ad61b8038132faf6c40

SHA256
7b87cd9c286c62a3a7233a702601abbfa75251cc15a54c2ea939e711614e400e

SHA512
f0c25625c869c56b7780072a0e0884e1fe96c26232c54d0c0f7771caf552e6e44618bd69f86ad7414a14b7c202a8deebbef4fb222ca0d96011c68b66513dd022

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
135KB

MD5
f8f1e8de46109581cf14cf27208c3cea

SHA1
be4dde9b8f08e9c6c4cbbd50edb8a98c2ac4ff76

SHA256
fda1ff9959b0c1d9ade638b2401480dc9907e145dffb2ea7a160888f7641b3c4

SHA512
b3fb2adbc8ff8e935b8243e330625e8fbcde3bb0b8291563f1dbd1e5e5c372bdfdc2f66c128364ab14a522647c788bbe570687dd525f3359ddb457648f1ea8f9

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
8ee59a1be7311336f18a791ee10677b3

SHA1
d539c32ac19dce6517a2a3b94b6bcb6dde2cde87

SHA256
e05337de93c74b0ca86744b22c2e7272a9707ce8a15fdf3429e16b0a6f3e0664

SHA512
27e039ee4a83eaf249e0b05b34e1c7ba557e4dbbdfe67306782b2b9e523c53df6b3c69b031129c6a78d939831c91faf487547ff60dddd5d4b655de0dd305d4d5

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
614KB

MD5
f96bebe39c18ed6e22b6e72049703f3e

SHA1
afb12887ce1ceaff0bf4f0fb6fcc6d2093163c1c

SHA256
62a9e8b0c8fa4ef52c47b59a1175bf4fff03fb24baf2ce7808c52a19823c64cc

SHA512
707d4f771b6101695517563594f12e5b9e288e868df0db9f64df83dd0b7f167593cf628f24db9588b29f2d9fe79d0440a6153c8cee6612dfbb3617ac26a2196e

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
279KB

MD5
df7aa858588b6d2a7c676fb95e67bb04

SHA1
336fc233198789b34446948e5e8636b0f98c13ec

SHA256
df435d9839d3e793e7a400e4702f3ae280db6e0114514b720847bcabfd455b30

SHA512
00dd9fd7c5511b9a7c7ab99f7a11248686ea1168372d634673dc9487da60cbf3a49d73cb99044d0976a2b359bc88981d788fd750d15fb7b6cd8d975252d460e7

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1000KB

MD5
53519414f244aad03fa6bd571b08a23c

SHA1
205c03986802c4f451a460627c857c19eb70bc55

SHA256
db3e158249a3ee74c5ee99144a0f8449c38d86d218fba8e9a4166e6c8cac238b

SHA512
fc4dac8a619069345f3f368fbabd14c0f434260090c6bf1a2cc4f6b60b8260b4f91735e39e75a1c7060df860df4fd278ba6bba830b89b781dbae54dfb18cc009

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
754KB

MD5
feb5f7f08e354264a4cb12f4dcd67d2c

SHA1
46b5b24d6c624fc154572e9c6021234a10d426b7

SHA256
e556bfe91f8cce86f72eda8b3194a160d47b9b08d509f930befffd92c730dfc6

SHA512
fa830a9a33b4ef594ad20f851aef807b51033c7b5a834ebc625a40e468844a3ba60a65e1a114b88edd79914599209a8d980ad889df75881146179e6fa332bb37

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
126KB

MD5
7cb51142981f9b032e25142875da9f66

SHA1
3a09cecd96a60e8e0a2881988bb85bedc2e5c000

SHA256
58a7e3be94c460937d42ce1f33582f73e00cef7647d2958df3e12e7465a2d91f

SHA512
31bbeaf3342288f8eacfbd3d56e29587bbd7bfe99cdf945d29750c2913773a9aa7903f79adbbe149290926ab79d359bae1d1cc7833756db3f0a2459b1224f1e8

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
79KB

MD5
7eef246d56b1acc4f96250f105ffbf05

SHA1
20e6dff64c5ada0bec0e0e99094255cefeabce36

SHA256
ae7d994d7d8f04da8b291f258538858275cf81d7cfd66edc7037e1167665dad3

SHA512
0305077bb068137a1336ad14221c5466522a4e7f5d544d7070339a307977e87426a0dcca4b72b35bd338c8b2827cfc689a63ba16afebd5a5c0e23d5c04379bcd

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
77KB

MD5
1243018e08e3b9b35688df1a59bbb8a5

SHA1
dbe7cd0676eecd138a477f73df77fea89939a5cd

SHA256
25660b72b6561d5db94e63cccb7a67570352da013fa13130fab0550606773ae8

SHA512
52345a9b0f392d6de5c9f6ef3136ccaf1c480aa90827ec900e7ba56e124ea9495fbf176579113f2b32baa931e7cead3d3b0b6264812158467ebaf70ce82bf88e

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
82KB

MD5
20186d05b6f1f8237bd8ec253793d591

SHA1
d4ead48d4e19be5899b90fec5704a45e37b10ed3

SHA256
97259c6be5e2c506d1c0801bd8d07063b8649e1ebe98f5181776581f997d269c

SHA512
94edd0622de46ffafcb3f24ada621a30a5356b32545c4954b93cc611425dfbb2292a0c6b38cb7cab311c6eeb3c7a2a952021e107aef3788483a6ced39ba1bf53

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
75KB

MD5
937c7a33f30a7a537bee3f394d6848c2

SHA1
e0ea676887f5d55ae43a3b6dad6c7e020adbd866

SHA256
06a807d481dcbcf021ba6651c8da32a83acb91d259045e11084d86226d265344

SHA512
d9f49391da3ff027496a0d783a083de969ee1ce02d0119dcc3e49750023b863320b0f74bf3a539a89b543d6641a3b2cb5b45228ad263cbb5db26499015571c1b

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
79KB

MD5
c799938065b8aab7cfb04b5e41f3fdbc

SHA1
8698a7a8ee17b90ea8c8993b6e99fca51279f3db

SHA256
1d74210770c2a70904cde0f34f95007b5b1f2ea75a10b5ef46711bad2eccc700

SHA512
07de5c7e14391ca41b99ddb3de00f59e2081fcedb61353f2580d71bb1b4fdf4b69cfccdbb377c76f74e36d775c9539b32f1751013c2d9abc9dccd2f07d2a80d7

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
82KB

MD5
1bacc3af95ae33d030abdcf980cc27a3

SHA1
3d116361b1473e991a5ca806cbf7cb768594eeb2

SHA256
d94df8061ec6c55e0b33e0d567909d2a0201342195c479f0fa9154f982ee6c8d

SHA512
baa116cdf87ed80700d8998f65724a9317dae30aed115409c7f001007186105e19b736c6eca15785ac473ad000337268a29e5fb705121ce6d92082eedfa2f4eb

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
84KB

MD5
1091c7cbcba0ff1dfa56c53296c929e0

SHA1
c149341e40d41a5d2c27c082e57dfbeb20018509

SHA256
24e57db3511224d817c687a8da0aa03af1c62d77064fa0f2a6d752adcf23f0ef

SHA512
5cdfeba6ec7bf33421347f4584004c124344b201a621ecba0172820ae23867622c12a4c0e2988896a02fa99aaf9f56d9b993c83e6ebdba9d14af9c2c3a4df9cd

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
80KB

MD5
ef1f144a63edf8cf8d2a1b4f4cec9024

SHA1
edafa6fd55f34be807eceff5afc19103d6808fb5

SHA256
8e801b5af73a8da0470153650c5c26a3d77712a001aab2e887952306faea4694

SHA512
9b6e16ea829442c1e1e2c4b3146b4dd5d429630c9af06fc9f2730a56971ed1d7f74215b17ddc13ad5c7aad6195c8cdb40792c9e7b417ec1d78eca9af4b054cb1

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
78KB

MD5
e010fbbf76a6fa27172014a8b7048144

SHA1
4c50728208e5b0e569e3a2b809a5c0a0f619c617

SHA256
66cb6222f079441dc17610ff15910c73f6d3d4bcb1a44b9c9ccb9a7355d8b1ba

SHA512
31ae5932728a7368ff06943d51ac5f55935f51f3f0b8068d8b683291f85d35b8fc47fc01ca725161a4194ecea12d4d4931207ab169c5685f24e188fbf50b8630

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
77KB

MD5
8e04814fcb7945fd92af6527c467c019

SHA1
3f5e8803122a8bf6fd5c79b76a7c5b776ee1d576

SHA256
a3c6162819917c68a2c4513dd59b079fa3debe985be5e56ee8a6c253c643f695

SHA512
cfada36eab6ccd5e6894fffed1a38f4798719df513b3a924c6749c91a046ddd671fa3f519289028524e01e39d7cf7c5e91acfe7f31d4bc1efb0a54226c937917

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
86KB

MD5
7dfaebc2b643a087249c22ed22501ed4

SHA1
446f54a60b864cf08dce7b5c3744d2fbcb000115

SHA256
2d8082cba7a3010e95b3c811f8241289f0f0bfe5a48cd9cf01c493af40abef08

SHA512
aa5373a69abba065731ed88ae5ba1806aa11b72bf623b793e05d6f6464b30267d030b51588a789df7a0df18a0614d77dff1ef5f29003dccfc2356904b726d623

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
77KB

MD5
c96517fac699810455ff01d82346478f

SHA1
588a2fc98ef242b8c35ae8ed5fe9ab9eacc3542a

SHA256
716d695d476d7bfbf77760d277074e2cd740c35a066f9cf17e67d3c177122da0

SHA512
97105bb59d40ca1f85f221a915a5b4d33cff8d3475f8e206aa1a5e5daff679a0e6cbba14b1a7c825e45d598e5678ca0595f0f02a64e3d45eb2685957bc65153c

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
75KB

MD5
9ee66316641e6932daf4cba1d6b534c1

SHA1
4a62127753ea53fa67eff03929bf90739777db65

SHA256
67ac1978ee353ee04e2a986f3e6ca84b5833417bea9f0f99e2ca73e2b0385389

SHA512
9d3e0fed3cffc55db559bf9eb348467edc49822b05555083207a66e5d0a50632bf4c72ee96bbb07131ac6ab63218c1ddcc02711ba4c353d1e23becebbb2de7f4

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
79KB

MD5
8301464fd716956d649814322d560b60

SHA1
4e2328c6ab81bccd72a730527af99da8888cc347

SHA256
c7e793f6236180a374d1d5a0b29a38913d90f746e4df30836b3f6a2b9dc0f905

SHA512
a8d81e18fd644f4f6c7e293a812f38d2e7ac932b710afa9594155071aba55518de308ad10f8be7de1bf87bb0f5f26128cb6b74c212bb4d3a05321ebd179348cc

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
77KB

MD5
349d506046cdb2b16dd0151d5d2d2d0f

SHA1
2240a473e06a1ab6f340ec27fe7b47173042f601

SHA256
85d37c13a106fb3d59b1fae1223bdf54baa2daa058ff65e9cd67bdfdd56aa1c7

SHA512
3adfeb16ff35763e4ff682a46a3b678ef8c8e76eded656c331a8dbed0a9f5db790d018997b2d216a165255c64941e13f4c3d6b89fdde8ff851f1e48c912d10d5

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
78KB

MD5
7a3b7575964c37c92bd24b8137ad3347

SHA1
e7ada75c0679325c4c1cd7d4f2eb2faffd8e66b8

SHA256
c3e7a67463da3fb9661db60c20d671c9889bd756a55e6d5537ca72d67a9096b9

SHA512
aa77c11127cc681aee149f8ee3cce5aa12395ef0b9eb6bb80901c64054dc7cd8e576e1026bde4fb576b5d9406acf3471d34201e2c35103245a309cc8429e9948

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
79KB

MD5
671a6b8a537d0e96dba4f64b03453890

SHA1
39871287f61f457f581a1288eb5b987243cc9810

SHA256
31d5769f39b20818016b469ac228a0fb1db8c88c754dc988494593a464e83c88

SHA512
5b2b75061c0efbe74b821ae477307fc87d7c99c8fdf5b71db3ddb9c63c34d7ab096085b228810730fc8eb4f7ec8186939c8d0f5f0a8817a12e841abf7cc6acfb

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
76KB

MD5
8a03990ee1e543e4f2dbf483a5d1f635

SHA1
adb984e3079c90ac7ba6d384f522fc730d7d901f

SHA256
d590a8f6e612fb991a73fafc02d5e3514e90bfafc273d40d39916c4cbfb7cd77

SHA512
7b92521298d68407d6fbb1e739a475ccdd946e888edecdf96002aab64ba5474197b88a5591ff3f0a793d7d1e21f6d14db25286e2e7feaa2bae6b9b48f8342a69

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
70KB

MD5
50c0877d41633d379782afc9ad223698

SHA1
e4abdc3723ab96d9bb7ec036f430fe4da6544c7c

SHA256
30c03310931a653ac31dbfe84c1093f709d750b6609f5e1dd286a58ceffda6ac

SHA512
deea1af616e76e642f8eecb4ec8513cc9741dbbdbaba2b57f278dcd672e7b79e46da84bdb7f2a8aec0991afbb1c68373eb2020175cc1aacaa02531c1b4571e53

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
79KB

MD5
072ef0bb2da6e989d53bdbd5b32e51ac

SHA1
a8f08cc19e4bec0ca09518ae53f5eb976f83ce00

SHA256
531f980ac334bf6990d8c66435ff1a32e40948a4333a450a20276ff5566239e8

SHA512
6d4df50568e03cd0a3038b179e61ca4d19df20f78c7ff56a98f03bdb7830c7ffd0d7fab1069a734400e9efcd28aa9dc49a57b777456c34ff8e1286f3f8bf80c3

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
79KB

MD5
a8146dd4791a457517c1b7bde581c362

SHA1
d0ce9d7a31d22eb9dc7314780307174e7ba17f7b

SHA256
0c1944a99ce6f9fbf33d59bbd036ce316a3c815657a1adb507a2723331ccd347

SHA512
18b07a37c6866702d2893a2e63857967a11fbb9c43ab20c59b9faa8ec250a2709ebbd9183d25eeaa1a8b25c982391f2c39743988f93093f974b2cbf64c04999d

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
87KB

MD5
51c4f33616dc3e90197223f6ba16049e

SHA1
dcbffbbbe7449153d1289ba032e2cb1595f70cde

SHA256
c3525700774774c17bffe39ba3da401f5291dc92029dc2f818afebe54cb0757b

SHA512
9145c7bc9528105e2c63b235ab8e9e215df95b9f4906f70e839765d9cc63fb3e97b6ce44f4cdfa9a7467258b0f819aed5c3971fe8f73ddeae827d8351d24c878

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
81KB

MD5
35a24613df86d282ddcb5f5e41a7d5f6

SHA1
5123c49cc4ae8b42d1b1f540cd7a1b5ce08dbaf6

SHA256
b9600f2a6d2a2c4b8e7e33ba1ec9e7e38d7881ef4b3082c2a1c93ec04eb20d25

SHA512
7c6c5542c12dd3970106f3511c92d10e37d400e3205584e3e37bb4b3bb3504a5a6156e997e0ae2566f3cec7dbdc868832e39c47753a525bad10b61fae4e9a200

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
87KB

MD5
facae0135739544b761e11a30a822f44

SHA1
4c632f48f4e63366ce7b474b86b6dae35bf85804

SHA256
6e7dad5ea4d62004876de6d2f74d51897154d97b6146e0de7671cff2c5d0eaa9

SHA512
d12acce54b33f3837c3c10e9b9437de199cadfc3a35590daae44d6de0d1f2edab49ce4d2583261e96fc148bb464537dea2a3d126e9db225d77f5e091709ed001

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
78KB

MD5
1723ee88cdadb6110d96ed0d81088ff3

SHA1
e6e3491d7d88db4ec9b217199da91f440028e68b

SHA256
8e9e7fc771eb282f12fb6a78971d82c7a61d4a76961eeb4d2bd625b187e32476

SHA512
e48d4d8703071adbfaf8b2ffb261cadc4e3c8da795ef3d40265fceb84094e41feb20ec3d5b201e1405d0bd154bee38788ef1d0200640f2def9a34c16b9344451

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
79KB

MD5
e7186fbfc0ae815445c26155c40dea41

SHA1
dbf96c3b685528b898a602cfef6129c50746b759

SHA256
b314569789d74afcb260ccf6c665562aae1ff06ab8576c18b8979cd6cd190ed8

SHA512
bbf177b1bb61f3e18c43d38e6431e995ad6726ed210a6b4cbd2c0d5ff40f82a9ac6489292fd8a242c5f2ef3892541c4ef086d4eddb24264ff03383a92a05e6da

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
83KB

MD5
c340fa7f4c9685f922db7eb154f3f76a

SHA1
08eac71125ef2457f3f3a2bbe37e658a84e5b2ba

SHA256
803513414bc027a2c3d56e5703c11901af5cdb40fc3ca318bc3688d9da2e8ca5

SHA512
30331d6381f5378942347b0167c82fb00e49236db03f4bfe1c3a3999a333e235668041942d3bebd2bb60ce480e9cffbce46f6b59147fedf4d8864cd6216192fd

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
79KB

MD5
65cbde27c0ca993872999eaa858edba2

SHA1
17166f66d6bbee463f88262f17919d9653189f63

SHA256
58732725e9aa83947802b17a92b63dfc697644470321ab9fe8c358df317e377c

SHA512
7584dbdb08358ca38ac162bde2dc29d0e5b6772eec98c224e4bda64b07894ce14e63abbf486281f03fbf30ade42a5430079598dfea52bbf78155b9d47a01d0b6

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
78KB

MD5
da1cd6257cb03edae62b0e83b25f58d9

SHA1
25c0e58648b670ce8c0157a318956c7f742ccd79

SHA256
91239332ee8cd1324fb9b14ded6764be9bc508c6f7001a67ac3cf62e45b60876

SHA512
98677795fa2e33f08c23904a6a1102bc054505b3e0818a365fae6fe1d83bde3478300171f3fd5424c4423f6b7a7843a52ef937b2e7e7df6fac7d971dfcbe9157

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
79KB

MD5
1670e5a19ff0aed756a49c0a661d4783

SHA1
f6891e7b4b1909fbbf152e6de4c67e8b9d71e613

SHA256
3093ea577992211e26fa28987b38acaaecd244ff4123b25b2fc2efc94aea7142

SHA512
f2260ea6ebaf7faeceec15a2682fcaaf159af725fe0c7a5c6d4cd9807b3fb543d2556fe3f6bffa7bae29ca13588f053cfaa0f4faab9268044f621f7c6b1fcee4

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
81KB

MD5
a62403894c0abf633133d5b19cedd291

SHA1
6b9769bf55a1f89cfa2029648cd5be6b9536a9c0

SHA256
438b88af0b0e6edfd3835b654b59054bc1b12a48968fa67293f07d6bd26ab250

SHA512
183570e0336b1ef8b6a46a8954f04c1bf0df0071199f47096c875f6746af1460c53ee86305a88d3dcb111967efbf01a5de8b8206fa1159045ad02fa802d8905d

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
87KB

MD5
cec0ce4cde41d5344198c8b1a02d0e4c

SHA1
71e97c4cfb84a6ca49bb755f0c7eb95cb5430755

SHA256
d9dca2478b1c4cf18b1ec67de69ec41e91090738a57e2a560b448d98bcb92c73

SHA512
3ac461ee79f692bccadbc1e58df1b09ea075495f0ac56fcebf1ed43892af5df6b7d70188542f17b2bcc85ce937319423aedcaf8e57a8d95ab6ccf00451b05572

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
80KB

MD5
4fc168449e5fdfdec24b10e41213ef76

SHA1
9585e26ab579511a6e5d169f5e2686df0cb85b6d

SHA256
e4450eb68add743c0aa8e52472994c1c9a8be0e5ee66acf59105dc338021423c

SHA512
149b2fe0fad1a94f18c292e79d54bb385e7f85a41a3490065a5a050c26c9be75497d4337ec6f55d7107814d1041a1a602260df4d98ba29519b39aedda94a75e3

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
79KB

MD5
b0a472fd6a62b929e541d3cc7da0d708

SHA1
122390079a99e0d1f3b7bf677a7f2554d20627bf

SHA256
5027474648a5c63002193b1ac48a96226643e82602cff62b19ba0fc0f254536b

SHA512
6b823e93565a664ee6fc6d942a603a7450d598822fad3f7053b531d466fdfcdc462778dbd66bc009bed6fc7383646abcf99931c921aeae0e0af1ba47063cd81a

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
82KB

MD5
b404c5e5a04e0a0feb6bdfcd40e3c6bf

SHA1
3b34355562949ea2e48136bed1823792a4f271d2

SHA256
d860785951b4a9a8bf2b159a92542137a276f86e0f9a99f73e544b12a2898d5c

SHA512
9f2afba3ebbab4727fd24f7f5496651370bdec2d716fa4e0981bf0a64617ab8c522d02ce52769a1cf038ca789ffb6ba3f961e7a1ae97e9483725ef33bbfc0af1

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
75KB

MD5
69754d99b1879e3ac5b2f896fa1e9d5b

SHA1
0f144f82340312ff67794b22b95df7480702a243

SHA256
ebc71aa002a851d58d8aeb21eeeae71f09dbcc2fde3be7945b44552f8b33c6fc

SHA512
e7ce0348fa52febfeb4b2a5e2914e5f05ef1bb2d49de4c1bea5606a675a4cffde98af71b0a98ac312b1c52be9cd299bc30e2e7f67b22961f7152a7b18a4f58d4

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
82KB

MD5
f92ae3d01044fcac90303442520d19e4

SHA1
7c6e9071daa0b8dc3f207c401586f4a592c10c45

SHA256
e439cda222ede59eecf7b80c665b3dc9d8160e076780708c5991f955effe8dbd

SHA512
294e2225e3337d5da86d5878dab9587ca82fa81ec98b1faf8540b7ca666f2488e82484bc46269d6c6fad261ebfc0de51d704428d80eddc513d8ebde00cace3c6

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
79KB

MD5
ff69ec69b09a30cbf4b8cfb10c67429a

SHA1
759c989e8f667e2273ca7d57b9b6386fd60fd209

SHA256
ce8df64496abffee27e6d447a1fc001d03888b25b041dd8e7bfdf734a720284a

SHA512
7d3c28580ffab1a54a2ed4b1d0d610563b7f2661ddde4820677256a3677ae31644f4c369504c1657705ab03df884a8144db61257e77457ef34062312e7833ce2

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
68KB

MD5
3e12b15976a96e1db973187d46e404d7

SHA1
ca1803ea35d95a6f926d6a864210f542e80df837

SHA256
1c3576244ef5f9f1da49ddf66c13647646018ce66318803bd716c36ac309be97

SHA512
70466d4d454ebcba4de19080dd257902c801e231576fe1f7471c8df21393f76cc9aad2f2619f977a88e9219c31201333b93dbb6cb4686b1fa0026f8e2fa4dfa7

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
75KB

MD5
9eb3d33c8bf8464e1070ed8c31e001b7

SHA1
f6c768a5007ac3afab2148262a73e7ecffcc2163

SHA256
df5c358c3e62b0434119e8c430061cdbf3cd8e4d7b78f6cc3e5a4935a5c5b8a3

SHA512
e45994b4e0e7bdf2a1e67e4743f6eca16fed2a6f6deb4227e9ddf944e0a87b73312350258900f1e2d29eb1f716585a2ce4f1e54865a8644682067b3072804434

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
78KB

MD5
5173de73b9e1de4f820c004bff1be4af

SHA1
2a322099d016cbf8fc9dd11150d7a0dd75cbef70

SHA256
dbf98493883e5fb1494f2b3a28c494aea5dc54f0a10f8521b5f32028381635d7

SHA512
fd0b0380672a7a6877b419575e065a6da1fc0bd961a294626203bb4bc6d72ae13377df2ee2020a82e6c6b3d36fe3eaa5eb58387d343548079e1ccd6ee6838541

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
78KB

MD5
abed988b9af90d9754aaafb24d9db6ec

SHA1
024eb6d2bc081645ead306ef96c1a6d2619633fa

SHA256
227ac9b507617e2cb6c6f3ed3e6a25a757e851703595ad80ec6aa22e3b6d6a0e

SHA512
728339d6419bf3628a5e1b4bc5fcb26db828f7cf1dad22fc74de546368fd84e6eaa62c4b2e717daee2b913d2fdc69e0ad4c1b261c2884671c9d38538fc8baaf7

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
70KB

MD5
1165254689b96fde02950da68d726da2

SHA1
315c5aa11cfe8661cf21cd3a34651274a7a41bb9

SHA256
99d06f87dd5278243de2d335d774b17ce4a885ca0759fba5976980bc49ac894a

SHA512
19dcc214358d9364a1caca83ff82de6c9ec71cfa55e4c4198430d2bcc9450049a6d18d4b83e8b4929391c02036dec80981f719d1d5df2cd69732f04a94b5bcda

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp

Filesize
82KB

MD5
c60b648be12eab042da4ff72db60eeb5

SHA1
39fe021eacba540df466061976942ed13b4c5dde

SHA256
c82f82eaa7f145edbca4a9e03c6471ec914ed5fd1cb7f85a0714cf3ef9d99941

SHA512
07ec107d88939addc86fbaf0d0ff7a5250c9861e4364891d87deba6513f42b1dc3916916a7f856d98a4421378779e2598779daa9b51f342cc6914a517384287e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_SketchPadTestSchema.xml.exe

Filesize
69KB

MD5
04ec4f75641d4e7d031ad2b24ec624af

SHA1
3e06d20a887f7e096016a6b66d57f0df1a4e197f

SHA256
27e13b78fbfc9d702b1b82c34cd637850e8d9d7bd09dfb3265909653208d1979

SHA512
80e8e216ad821fe255a2f4038729f6bcc318226eba8c40e3ffc9d51cd4d2419ef3302692d036f62bbbe60db63f777c8ca9380e45d1f3d7c72f5aa3f2f3bd8729

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
69KB

MD5
ca54c82b9cafddf9d31ab38e52542640

SHA1
078cf1c7242b568c946eb29dfb6c9d1876ee2da3

SHA256
07fa203eb2e7adf723bb64d47df3fa0b868840d9d02e0ff8c9bfa74e6e26aba2

SHA512
b6e56c5024cd55ad52bb29d01d93f2b404f429d7429cb86037fc9b9981806ba132715a192bceab01b82a7e608897831d5ec27a403b60ff7a27ca9fea19a9878b

Download Submit