3c63bcbfaaf8c63725fc4235ca549f9af3c13ffd0c75161cf709a2aea9536e57

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c63bcbfaaf8c63725fc4235ca549f9af3c13ffd0c75161cf709a2aea9536e57.exe
Size

81KB
MD5

3f961c85b433981bd57050c20f8fdd1a
SHA1

4dbff12a4e0a73c6342d0aa920ea9f20add031a6
SHA256

3c63bcbfaaf8c63725fc4235ca549f9af3c13ffd0c75161cf709a2aea9536e57
SHA512

8f275b266e86817f4b31c6614457503dffd80ec7d25bd22d8c0b095ee096f5182a1713f496f97ca7d99b2daf5d0547ec3b3a9d9655f84bbb632d8c08dc823c18
SSDEEP

1536:W7ZhA7pApw03vR03vuhP7ZhA7pApw03vR03vuhS:6e7WpwYRYee7WpwYRYN

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5276) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2476	Zombie.exe
1460	_MicrosoftWordpad.xml.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	3c63bcbfaaf8c63725fc4235ca549f9af3c13ffd0c75161cf709a2aea9536e57.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	3c63bcbfaaf8c63725fc4235ca549f9af3c13ffd0c75161cf709a2aea9536e57.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp	_MicrosoftWordpad.xml.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\d3dcompiler_47.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-heap-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.ResourceManager.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp	_MicrosoftWordpad.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp	_MicrosoftWordpad.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	_MicrosoftWordpad.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ContemporaryPhotoAlbum.potx.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	_MicrosoftWordpad.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp	_MicrosoftWordpad.xml.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	_MicrosoftWordpad.xml.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Java\jre-1.8\bin\glass.dll.tmp	_MicrosoftWordpad.xml.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Common.dll.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\MySite.ico.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp	_MicrosoftWordpad.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp	_MicrosoftWordpad.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_MicrosoftWordpad.xml.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c63bcbfaaf8c63725fc4235ca549f9af3c13ffd0c75161cf709a2aea9536e57.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 2476	3684	3c63bcbfaaf8c63725fc4235ca549f9af3c13ffd0c75161cf709a2aea9536e57.exe	84
PID 3684 wrote to memory of 2476	3684	3c63bcbfaaf8c63725fc4235ca549f9af3c13ffd0c75161cf709a2aea9536e57.exe	84
PID 3684 wrote to memory of 2476	3684	3c63bcbfaaf8c63725fc4235ca549f9af3c13ffd0c75161cf709a2aea9536e57.exe	84
PID 3684 wrote to memory of 1460	3684	3c63bcbfaaf8c63725fc4235ca549f9af3c13ffd0c75161cf709a2aea9536e57.exe	85
PID 3684 wrote to memory of 1460	3684	3c63bcbfaaf8c63725fc4235ca549f9af3c13ffd0c75161cf709a2aea9536e57.exe	85
PID 3684 wrote to memory of 1460	3684	3c63bcbfaaf8c63725fc4235ca549f9af3c13ffd0c75161cf709a2aea9536e57.exe	85

C:\Users\Admin\AppData\Local\Temp\3c63bcbfaaf8c63725fc4235ca549f9af3c13ffd0c75161cf709a2aea9536e57.exe
"C:\Users\Admin\AppData\Local\Temp\3c63bcbfaaf8c63725fc4235ca549f9af3c13ffd0c75161cf709a2aea9536e57.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2476
- C:\Users\Admin\AppData\Local\Temp\_MicrosoftWordpad.xml.exe
  "_MicrosoftWordpad.xml.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.exe.tmp

Filesize
81KB

MD5
5aa5353fe230d8d19c0819b24a88ccf8

SHA1
d6f0d3ed556acf9ee2adb42d2a87802caf107566

SHA256
3a58a79aec46eb23e6a4eae0b10fd633bdf368ed30136cafc459e3de37c2d0d0

SHA512
3e0d81a06d112a64465521dc6b4189e3de8aa4a0680aee999b35e3961180e3176d00190f7c5b52a4f284011712b1ab360d36ab1ace6ef139c55475ef38b6bfc8

Download Submit
C:\$Recycle.Bin\S-1-5-21-2718105630-359604950-2820636825-1000\desktop.ini.tmp

Filesize
39KB

MD5
fc2df834e186c29ab9e427c4edb52667

SHA1
cfb0dc6358a7e70b7c2e259a4b1846122b86401f

SHA256
34a5a0b5c9347e7548bec4af90eb757a3384e9eb4d85dd3786ae1a388e13ca91

SHA512
d0b163a03601c8e89ec0df9b0ade22d9a3e81f3ad2815e0e79b7c75bc5a7b45c2c6c2f9f82dd9a461d4cc9365259e91829259e1b1069cc7df637f7f1ec1dbe88

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
152KB

MD5
3c67533e14fa2bce4dac9d831dcb05ba

SHA1
e3ef35ed39585f66cc0262398a92830f8cb3a452

SHA256
c9cc16e69b6eebab527cb149d1c8b31eaf1f773edd3eca71a18cbb4cfc926b2c

SHA512
971a9e11e8a3027317a756947f190da2d2a220294fd431518ae499448028e230f8376ce2b6bf38f626171d2fcbf2cc96a7285714de2d65297927f5e579f41d3c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
140KB

MD5
312280f91ea3e3a2525e937d38598077

SHA1
51cf74f0c68bb3087e5c39313497b18c2a1eb50a

SHA256
8a45a09039d2dd3377467e20b235d7d9f6e4f76a71ff329b46bb70a0686b1c6a

SHA512
3491dc6c1507eb975b85f98894e02c7fbc74f7e2a82b077d312cd4b41c950732ea604fdbac526907739d0cb8afc6ab8b3acb342637945d1c281d55eec07d96ad

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
106KB

MD5
b8006da562ec365b79a16e70e948c58b

SHA1
c9eeecb85518a266e98a744e90899e6446ade6ac

SHA256
087af819b47f4b0437ab6f55b42dd5dae2735503fd237b5ddf0335cf64b5e397

SHA512
3788fcdbd48c3923793ce18028221c5d94af19ef0fb2c52428e6501b771609f18980e71228f042fc872fb7ad83e8c09dcff44de79c6ebdd724c1a6f08d8a0694

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
856KB

MD5
7de9bb14216e4649817e1bd51b555fdb

SHA1
c6f969532e00b72d0f546496403fd1f02334cf22

SHA256
866f5352f401547c1085df770c5b4155e281988044c0e17e866cc4f69d63a281

SHA512
b57e4f79cb4c11631e6ac6cecebef6dbf578322db4e03f26241ee3d0a71c2f739073f0a954f6f4240d5dbb1ef703a6522c5c7c63515f3ad4f62c9701945647aa

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
ce976ac416283c2ceee157941a396957

SHA1
70b4bc459f1d346e4843ab89ae011ac0efb4f0e8

SHA256
92e6defc77265a62adab3ae191f85424695972db51133c972257158d7ec13cde

SHA512
69868ef6e8cb030f53b48187272a01cead3e24cd2d3e46ffcd439d762e4e033b8942d9423bf5b5e782f4774c4526c0385cc2383eb70554cbb1e81e99e026c4f8

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
585KB

MD5
feb72ed7ab5a305e36863f67fa448942

SHA1
320b84e7b5f3306f25cb5c282d8a9186ac0d8df4

SHA256
ad2ccce0785d933f59fbc007191af72a33a9598c0de6d380a2869af048d64efa

SHA512
8f7ccb4f6aab06f0487f00d4b29d375ccdd8afb4c99c2370c8912178e14df5b932f732b67f99d853416aea07d49ed977c27e667249cd483098da25b089bed426

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
251KB

MD5
e3533605d3b7d53b2d5040f622cbe2a5

SHA1
851fcaa3e12d848f3e7bed9478c526a115356d1f

SHA256
532faf81a944fb6a55a6fed0a6c9ebaab1b7e4d571218290c3b43c9451713ede

SHA512
be4a74b0d8754d574d419d21b9536ff293318aa9e7a8802df6bbea0e229f4f8dee6f7092ee811462fb3c4914eb8eec8bfceba15c2dde249c6c4e8a363a1f9a9f

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
230KB

MD5
5113d7ac58f7c66b8b5d0502b6730e75

SHA1
ffe79997a2514a5be5857dd9e9523c004e04eacc

SHA256
6af42fcdb2d1162b4908d2f58bd17805af79dc62af09b6c13ad78a5069a918db

SHA512
fa3957628f03f5b50faac1fd70b669e47e220b2a5dd5ded21d9353700baa183ce20a9ca513542583028d8c5d6b8e7108629d701cc6346397dcbdfed710336172

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
972KB

MD5
1768eb420b075c2f66b0f0823d8a2810

SHA1
a138f2354024c037739ceb7b74aa9206403cac7b

SHA256
885f1959c6c26547bb5a2d2c5ab88ac65ed02ea1fb2ad8a50a164e1756b60e18

SHA512
444343d6571b46e4a3a7d8029d2a301963cabef758d320c094d2c3eaa49e062b39172a4621d983438179a86da4360a1941a9b4dce06c1f2bad2c192078ce1fea

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
725KB

MD5
dfe5ebcb59e13ca5f8d9f40ec0cc187d

SHA1
4c471840df9c4ea99e661bddb4c1f23fdff18a65

SHA256
146d7233c04671cc9e751ab37c4226ed362ae3fc0ebf4027cdcff5087f491107

SHA512
8ce87684bd99c2be3ca8b001a3dcda4d672ed4b52d960a05cd01ed8fbbb67c9d6e090be32a515430048e5c9252ce345c72bd32c3c18cd89cc78ee96dd78797a2

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
49KB

MD5
a7e8bdde856c0f4c7931b530420fb789

SHA1
7c7108b3309b7d71abc08a88800d0cdbe85d99a0

SHA256
13e51276ca04816f3f07a7465ca90a92a32ca122555ff94cc9479715cdf8d822

SHA512
c82c6a895a04608a276ca2f3e7c0a488343de5aa9c5518726ccafbb95b1f5210db0e56703510b21b1b1fec62ca546c482febdeec081497c1b554134c155f7fe3

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
54KB

MD5
b1a70e6965e6b960d6169910c20508c8

SHA1
ea13f68411cbbaea5af85d86a8827733b68cf4ec

SHA256
69830c61e69385b837eb1e6e06a0ef5bf09aa650894547d51e563fe1cf64f259

SHA512
7a2c6bad77f3c031e760af5cdca3a60673a95f1ee49b97877c877cd1123b7705800d8cff35017d4ef0507606a3576db31703edd0f21d0b4cdc5585c34b009d10

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
46KB

MD5
860e954c6daf5cb67d75a0c39f0ff7eb

SHA1
eb35c7e4f2c77b5817a2c088b9bde2c2a0e582c6

SHA256
3b44888ac144d28cb8a06cd642a720271663312520381259f7b001d0b3b97835

SHA512
1260d8eed4a8895755ee2b7e427787cb7da833e195ec8d06c82f9f2da30792a94332597487f4ecf5582387842c0d372d7e0841d8ac794714a87eda5e124bb32d

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
51KB

MD5
2b38b0233e04c8a6cec7685d88ae1731

SHA1
15fa4cbd2e6aa3e63fa179f0f977a8309c0c52d7

SHA256
e270004029d1df1191f3bebb39b90d3409255a1568b95a6e30b43b0ae30633ad

SHA512
4ade5f2ea7620209042ac1e7cae0bd5af6bd1b8ec849c591e210cd22a94cd31ce754abdd8c35cd674db0e1c77816b265f7458dc883c82b516ff3c519ae043d1e

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
52KB

MD5
53477aaea2179a8abbc027c388216938

SHA1
439e1f12f01be824ca8e4303ed85308624c02fce

SHA256
1aa84e1a14d9d7ea73021e2921b7521c13c56a465183316cd563cd2048a11221

SHA512
a44b11e0600ad698a92684bcc1f86add8838d53b0ef44f49e4d852608d655618bc44d0b711059b4b07a60ac9ef2d0b91d329b4146f9730915501e93077dba1c9

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
53KB

MD5
f1b1e0835d57c92d0e8603ac1dddf819

SHA1
9f18c8cf417e1ddd9ba57806031da4c11eb3047e

SHA256
20abe6fd07b9a15519da075ab9dd5d63bfc6904a654dd2dbbcf07fdc744065fd

SHA512
c62bddf8b1241286bf493b3be32c7b9e3e6760b115391d303eaabd171ede0e3f6f655e60b5a4a758345e8e1db4020610c5c796203a457912175f3188de82c8de

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
56KB

MD5
49fd9c1044325f8196b7e4a4dc429a7a

SHA1
b24062f4a7741564e48333b7e4a25d9602e5149b

SHA256
d85ea4b2bcde41c9b9c368ba52c9b2fa2de30f205487fa272023cfb58bfd5a9d

SHA512
6efc0c6d41b5a95a21fa1a5fb466e1bb3e7738d70bddeef1795492400b6a450e8793fc68e35bf8b0873546a9d99b7b7f817ad9b3e5077c393903bb5c68a88bc4

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
50KB

MD5
a38a668a6787406d367e44324070d11c

SHA1
ac126ebe800f1cc1150b425ffcb27c4b6614c986

SHA256
77eaf62c2d94d38d4c42609ad11d2069195d3dbf4444de34cf0a83c80d697c7c

SHA512
6f752a8b9cc3d057db43e73782c11878dea1d43191c86bd2ce2e9d13c203ce0c80e0d52d1e99ca572de991f9cde37dec45170e81339965c760611d5f71c11001

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
50KB

MD5
b82ccd586bbf1f85a42852eb1363e37b

SHA1
f8df59b4c1e1edafa859e9451b4283c6e076a903

SHA256
c695f0907d3ac95a19deca8a04ef0677b1fe4854a3a29d89607936ca81683886

SHA512
34e88f546f710e89a0cab9fe005fa9f8e0e7e9a5109274bcacd997cd1be7a656e8e74f0a722125b7d9208d30a3bdb3950c4ce17c6e147612519bff2ff08eee5b

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
47KB

MD5
92d7e0e9efa2414e645b753073d776fb

SHA1
02fe33965549b0188b7a9d66dda6a63f2be76e9f

SHA256
a80becfe9550d1db0381398d191c6b6b6d92e8a871c53890fec443bbfc6d1b63

SHA512
54c24195e11114a7494bac210c348e9e7f7b61c49c8937100e8a9429e0212f1c420f0f95c45d822e3b86c9a32fc5eddfdc7377f373506d999f304ebdd9ed9f12

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
56KB

MD5
f6ff1fbd6e7bc128a8f18f609c8530ad

SHA1
a15a18001880c3e71cf1493a7a560d58ce94dcf2

SHA256
668f891c858e40be3f9e21c7a723ca2cb7e174b120588c507f55f3a03a25aef1

SHA512
27c0f5f09e67d99096a8ef66bdef18795b7dc9dce8368fb1dd664e5ac2c95882cee42c2065bc460960862308a898d1d6316cd4e1d81700ae8bb867885ca7e934

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
44KB

MD5
c293d22da23c11a9c8eaac911c0afb1b

SHA1
7c257049f300221cbd3421c1c118661f47409bc7

SHA256
a3ad89c8c6532bef7abe42f2f92ea5f2f0038fdd9221ccc95550aff9f96040c3

SHA512
3ab4c19e061e507bd787a1d7c76259140b04848a5f0c773ba39c4a3420fd0f9b399642a1ab8f693438d79e718e4b4a8c89924bed593216e35de835d2ba04185f

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
49KB

MD5
5217a763b6320fd0a75fca33c19b2d48

SHA1
b65fe011ba543b388da4f61a6a2e9138cba58f66

SHA256
63cc77ad402839012aa473f6cd73efab5224ee94760a786dcbfdc1839fa7acee

SHA512
dbdaaa9de0a42c16d87562ee6b2430c914b4e013d6579ea8e6dc0939285acf350d4b3d0af745fb8f67c6af7cf7588f43b50fab88e814911eeae993bf0af7a3ce

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
49KB

MD5
3e963b97edf93889be1123087a2bd258

SHA1
0b6aaae93d89ffcb74b91914befb1b3c89dc17a9

SHA256
45bd29004dade3680c8deb46a29734302790ccb14c127cecd6ce8e331132068e

SHA512
eac99c4b9ef8e61cec5dc347482ab0ee6a5a24eea10c28fad45d32761c071aebda708eabade138dc9aaa7c1ddae0ef96f26e0483059fac97f0e219aa431b5850

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
55KB

MD5
3912e7ca5cdf5e69e30af2dfbcc783cd

SHA1
ce0675258daedb54d868815e5e8947ff06e8a30d

SHA256
f1f01c89bb4efaf648857ffb9f5e6e5908e01cf5ae7f762793fb265b2706478f

SHA512
c112d9acc7cf5f3bd26a3f9668dee9b5c62460d8d165b9f2ff95800e00a68268ddcb0c154ca69b655f1e6a73eeb4fd4ef2d048a69c7d904cf254cda82f66c4e8

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
50KB

MD5
b2dd7da403ec301015788435df2d5212

SHA1
e36b13cf9249d1f19fd92591bf719b02994077ea

SHA256
03d9e5b6856351a4034c7064b83aace8ae8ed37bbdb3b0b8d56d3083219b10f1

SHA512
1ed34fff73b3ec47566d1d3e29450515f1ac01224507b70a5ae67a5dcab4f8b4fb35745e84d1e465a1a6e8a5d37f1074d06a8b97b2220a8dc99813a473789348

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
48KB

MD5
7bf65c473ac3bf8b2b316f91706854f9

SHA1
37c2a677483d0db66c4f1f9a95b4f07fd8eba016

SHA256
652f2fa0726e92794b63cd2ad03793de99b1127460eeb325172ec0107b6ed01a

SHA512
a377dc6761a8d1084ce0279b6d50374070373ff657678e23775c74f0adcde1f5006ec203512caccfbc704e9eed4dc9586cfd9028d4b2fca97a4097db027b4f0f

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
46KB

MD5
e16f3dc82c919173cebfd20ff811fdaa

SHA1
e8c7fe38e31103a129d150f41eb8e45547e7dae5

SHA256
1527f90a5e8381ba783e2482e76750edececfa95a9ff979da4c4d0c9b8c8d555

SHA512
21b123d1141975b7eb48ae20aba9550b31a0c2d26f7b962b23a489112f3d6e13e9099a387ad60c02e17bba5e3b8911ed49fa5320da87dd8e687192343847ac56

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
45KB

MD5
83936f813c22369b62aad9e62e3c640c

SHA1
4c8b38e7a006f2ed467e7af6ba00461151ff2562

SHA256
0c2e3e2d9c5f3e82cb8ecf82d78023382bef351d8e0bd8aa11f89ce60a99b56e

SHA512
b6308f6a0accb94a783ca5e0864b4e7e192b3925cfbdc673dae0d177fb6113f27c40e68e6e5a7082daffcd723478ea9734b53410021c93c10cee248874734946

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
49KB

MD5
6de29df8968b8584464c617d3759c3c7

SHA1
638d66259d8e8b14e07d307935d886a52f52c062

SHA256
8ffc0655a5d737a609330602a8c8929a92b44bf9b9dc334a3f87e3fbb20b3ed3

SHA512
af52545142806a13874ee4983decd2370b901d7a933629d79a2ae714be131c1d49791e539c8cec8031ce43868fe5791ab9ff939753aaf30d58e5956e612144c7

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
49KB

MD5
6466e65240eeda9484b82b472a8f3df5

SHA1
d91ce7590d22076d92007429e5adcbdf603b8c0e

SHA256
7bc3b257b5c4506af8d670d3306afa260816411984ebe1b628188caad1f948b2

SHA512
94234b6d7cc9ea0ff00ed78e5b7eff670b86ea25ac3259bf8a1d3c835f18a13aaed08a45da75b514d68fa308ac3d435b4595d7a1ee8799ad550cc27518f783b2

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
56KB

MD5
c79f86ccfa9efbacd4919e37190c5af4

SHA1
67afa687eff0a761ca1ec7368e0d9fb61ab62437

SHA256
647a70b8b49ec154ecedf6cb89e1341fb277945b66772770975f53e19141abd9

SHA512
dd709c8552bfdaeea2bd2f9375edd0a6341ddb2389d2618d0317aea1fb3a718a908831d661b8bf40bab8805108e097f6fa400cbd8d3053986a8b09b7e77dad9e

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
50KB

MD5
8b7bcc6cdc416c0ebe390ef99981cd0f

SHA1
532bd7e7961526db9ff628d8ad806d1e0ab9fd22

SHA256
cfb4ca5272525941803f54fc51bd99205ce24848ebf1e51772f7832224a244cf

SHA512
740609e0560377edfabeac0280f507813f9805eaecda9100e55938609a6b637524f13307e9955f9e4885f9d0a276050c216c2d0dd738590c10462de66a292fd8

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
50KB

MD5
043c123a54b1607bb5220b3a2f616433

SHA1
d0b92011a2598897c5768df1c3bea856c6dcf999

SHA256
1ce01aa368112d150b636be076946375419391946db9938bd1655100995d2993

SHA512
975e07f748aa817220e0995011dbeafea3bca0eb1ef52f383b24778fe1572f05c6e3a2e13153688a145ced550dc58e053152aecb9ba9b1a7254b096072324ace

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
49KB

MD5
a46c65e3b0a05f5eb586224c88be649c

SHA1
7b7675a434f6aa6f7af91fd7ad87d24dd88dc977

SHA256
83d94c7e34340f189d3112068ce7eaeda46b420b92709a5c4cf9ad7bc6cbf171

SHA512
df6bfcc311fb5a0164b889dcc73321516b23811fc29bde1ca248a16c93d3aaef6b5bdb597a096411ba4d7fb954fbd05a4a15d828018e05cfe0d65d0259b234c1

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
50KB

MD5
ea86c788240dc1cf4a9b62137375d60c

SHA1
6db73a324b6f4869078152042e54e163c5a07594

SHA256
700cd6959e866d251e361b81b36f36753b8f34dcbddad3aa9f8bcb0ea2489073

SHA512
dc9fbf649641c79ac5841cffab8213070ac7c611ba0b3fbba9a585cd0102b9986c5ed079fd626e7fbc374972bac0653a3a2b5b35a173d0822c3ed3c41c640215

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
49KB

MD5
2e704af28df5730d3b107495baf9154f

SHA1
c840a2e496e6d6637aa1e9c6ee68a6804b20f0ae

SHA256
493d6f2228a372fdf9a47c18b2f473b6891367537deafb9a8d019d399a8642fc

SHA512
aa8a8209a8d8455bea89b70cc1263da482ae71375c6f5cec9a8d67a47681e0e0c6fc5caaeeda6f1baecca62df7d746d5e0b26e4a626bb15a717c0e264fdfea01

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
51KB

MD5
53ba702c52a1fac032fbf8c55d28fd2b

SHA1
32e7a96b4084d31982418b66a35b635c80aa542b

SHA256
98708f132cd6ffdb780a180ddd8d595fac4c85f0208bfbcb5fbea151186b7302

SHA512
0383175cb91d6c09b11a07fbdfc950daf12dc6b9745120df536682e219cfaf0f1dcb55a291a5e95c20ccc95360542adc673658844bb3e76e4d017143b21b22bc

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
57KB

MD5
fa4ba5d08c09cb629265bbab0ed77737

SHA1
d3d3a1af4141d0115921e400f66079d43981acaf

SHA256
4b2a76d4d2908f06d5d29772279d54f124221eba97c3ef8d4520fb219c8d55dd

SHA512
e302c0a41a0f14831d32784417ea92fdd4b6dd23fc1d41f4fa4211976d896441c785b587b3f74cdcaa29de9f60926ab928a7526096dfce35d92ac1c4396a4856

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
47KB

MD5
007fb32ac12cbf525696bf3def4b9d00

SHA1
ce123cf4343becc960a18c8b4b280fc7a8dbdef1

SHA256
dd12c30da1a124f528b00afef5d2f6b319b3d0d49f4d09e3874fd208ec383334

SHA512
73e723628cdd6a811018491bec6b62398d831658d5a47ea086caf4ef68d7c9807aa41de80234d50381856ba32802a4da7340f7564a09c3b494d06380512ab797

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
48KB

MD5
0c69affddcbc338a2923f55eca76bb4b

SHA1
d5e74c8b94281d0fe790eb8ebd0ede8acf664e9c

SHA256
26c77a6c9f3bd9260344c6611b2160511361749f92deda88d6f363f545f22fce

SHA512
17e7f34bf3facc745769f417ced78ea5d2a6f83d9c0546f2c320e1bf38618c5739a85d302edee0bfd6eb862fc28923a1cfac4d26f17b9cbfde077f89e83a86f3

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
50KB

MD5
e261ec4dd1d3fc6d80b8edeb44417afa

SHA1
43f4b75a447de1ac554df47c8d209306c12ef84a

SHA256
f5ec31ce19bfee84c47eb83a6dfce2d93ec16eb7844d8285ef327b522441db5b

SHA512
9ac700aa3e1763409b8a4a720fa91c0ac14da3a5cc4441c9865d6126e9c4539fb7e37e7e6eaf5b76b3d3a0955e2ce361b90cf2f6d8497f388ead84d20b4ead82

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
51KB

MD5
7ea1a8848fa8add600429df85a66c126

SHA1
27f815803e40c114c7eddebcc4c08b51e2324614

SHA256
0841ca96d798d553f72e0cda5bb31d4fc544fe66177b28079818f7f4c28b59fb

SHA512
2b4e9b6d900eef5e40170da2cd410b1509ef11c51bf8ead832ebed36ab3848ee5a3dfdc3304233e0bcbe4da01a2ff40d4252b0ffe13666e757879d44a1d957eb

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
53KB

MD5
f027b97ccff415b9991c8363a3c71c18

SHA1
491333c5d8d3f50e3ecc9cb8ff9c8adb8d1cd6a1

SHA256
5cebed1b78e4b5b5508338a96d2cac9ab692739768d518a263eb5af5d92adf9c

SHA512
cd712b51c9c7aac768c7aa54f4e20c4dd308716058626ea2b03ed30ca122e4e65c4049ef9d9fdecc5476690d5f23c727138f11f063afc08ae891c72aaaeb1fcb

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
47KB

MD5
82f7598ff7a68332ac07007a2a93922d

SHA1
fe8ca19f3f2e51a64be7196e0ebf0a5f393ccf0e

SHA256
b2540a634c33519185e4fbf214db3eb46b4de825c49be61c543651b93f902094

SHA512
60adef03dc2ad114e706f1a0d90e1ecd99196c72cdf3ea3c336f65608262defc1d67778c1fae21ad149b1bc7d0c4a285e656baa8b5d9e5bacb1ef504e6578c8e

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
53KB

MD5
536cb7d6ac7bca2b0cc66810f1935f41

SHA1
ee2a6adbe1d3851c735429697d07a17a356eb3e6

SHA256
bf48ef1b0a9997865c159534e94c67a6c1600230be1a8f9488c54fb137e5bf47

SHA512
e2530cb77c7cbc50ed691e6eb64bf00c23877efe463068aff8c3d5c4c17eac3fb749a65c8a4dd720f1a936b9842640effc56183fa1dbaa008fc4d890d0e6c97e

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
47KB

MD5
7b416c4e9f830d7ef296cea0332a9c92

SHA1
5413e705616bb37ae375cedad7723bf249806de8

SHA256
fa2d4144c9a69381fc60b6529069f5f707432fdda1c409ad9bb42ea4be9807b9

SHA512
a899edb8a18957586d9dd7dc4ec61f7eeec9bbf46c60115b49ae91672ee263efc323dffc23d01597809edc5cf61d081d2de2037d365f2e679d8213f75243959d

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
46KB

MD5
6d6c2f07dee150e5658d94f98d07a10f

SHA1
0793878e1da71ceae9d65374305c8f43400ba3a2

SHA256
47141582f87054e90c6a96db05a94b2129f465677c896570f08788a3182b1ccc

SHA512
50fc5ac22cb0cfb6c2504ccd413d990c2081c8330e44ce973e40ecfb28ec2ff86ecb58d7a2023b65c7e054d022d5dcdb913647ce7d2d064703361e7416bbff43

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
49KB

MD5
87beba0a4928eed16f233aad2b50cc97

SHA1
e1ee8dae2d4257a777c3bfd6a12c58f63330cbe7

SHA256
255b667be4eadcff6a77299ea89d1b4dfd9e90b9293b2bfe9b0135911b822b90

SHA512
179df81d33ebb6341ac6b3ccf1995b2a5506526149ab98f914bb647845f0e68471b023d3793cb4cc05376f423c8879a257994be009c599efa47d35ca628f2974

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
62KB

MD5
38943f6fba9a7d3b717b8ba5261cca8d

SHA1
915d17976fd2a255892c3397069c0f8f7b881b63

SHA256
e4bb9e2065b3014e77bc840c189c443cc1c4b9771191cbceefd07103f5d19f75

SHA512
087b56b9a9eba5eb0df3e4c524a5ae1f8f15d64e0c7f91ce4546048302eaff05c16be3e7926cd6c3a0e1db441206202eb0d0f6365a372d1801acdc68104360cc

Download Submit
C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp

Filesize
46KB

MD5
03d2ac0d3053d6b2b0ac7171f4277b83

SHA1
a9c7758ec54a48b467cd3615b7d4677e318e7f79

SHA256
53218029474f63345a9cf4f251d98fe4641b14d7027068717801e0a3c5296c0c

SHA512
efe0fff0f442cecc943fc9a6546cf1fd844dbdb7149007dbe8646bfd416ca2969c9bbf6610691f24b38191abb67ac7c0d42c566959dfcf81a4e14d93dc67b7ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MicrosoftWordpad.xml.exe

Filesize
41KB

MD5
72650e7451ca0612e8bc8ddd0812644b

SHA1
6e32f948c53346ea4accde8a33efd201e9454d02

SHA256
b1ba8550952d0469dfdfa888d4059085c95c03035b6bb0979f7b423448da7e8d

SHA512
768134393e98b561a887bd5e1a0f5fca5031f4a439d865a56acfe1eebceac75501bee18d3aecea36972d801028bd544b1fa159c3837717cb5b2e15b2652832ed

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
39KB

MD5
440b70f999515b02aadeb2b88ee95a3a

SHA1
37d97de7103b658ab44e451dc3137b1172196a81

SHA256
7ee615670d2091a6b5f78824ce6c9ff0b0ddd2c9970b9a4573d46e2e2790d2eb

SHA512
c7292240c3f03b5c1b87ce32752ecd6f6bc09c440714f5a62b498b9fa84b63029fd1a1b0b87404eb14a80455f8ddcb0b5539a36a48f5be9d2ca35215e9c2c2ff

Download Submit