Analysis

  • max time kernel
    150s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/08/2024, 03:34

General

  • Target

    d36cc4870271ae40c7d8aedf44ba7814e14ea752b3a2fe8abea893de4ff930a7.exe

  • Size

    114KB

  • MD5

    5d90298e3a44358df1d0d43b7b140222

  • SHA1

    81920e6a3a66bdd369c9966237521264511482f4

  • SHA256

    d36cc4870271ae40c7d8aedf44ba7814e14ea752b3a2fe8abea893de4ff930a7

  • SHA512

    4ba1e61c227d410243497006a517dc56cfa0658f34665ad7af80f248e5d28d2702fd0f6fb125c2ece60fe823c9988ba19ab36df099ee89a89050f333f323a2ca

  • SSDEEP

    768:/7BlpQpARFbhn54fmiy+3BVr54fmiy+3BV6nE1016D27BlpQpARFbhn54fmiy+3h:/7ZQpApmi6np7ZQpApmi6nn

Score
9/10

Malware Config

Signatures

  • Renames multiple (5317) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d36cc4870271ae40c7d8aedf44ba7814e14ea752b3a2fe8abea893de4ff930a7.exe
    "C:\Users\Admin\AppData\Local\Temp\d36cc4870271ae40c7d8aedf44ba7814e14ea752b3a2fe8abea893de4ff930a7.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4312
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:3768
    • C:\Users\Admin\AppData\Local\Temp\_Wordpad.lnk.exe
      "_Wordpad.lnk.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:1672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.exe.tmp

    Filesize

    114KB

    MD5

    9f5e3c0a7ca84491c64889cb13e95fa0

    SHA1

    7f1a0d6d03ce4c2f2608675095fa4e2d3bb5edc5

    SHA256

    51678dbd8eb3a898760c3d6329be9562fb7863f6fc9dc211900810c04a20d1f0

    SHA512

    71f6249096b509ac4e4d55fcfe244c0077ffc8ad54be3c0dd59275a01b608f16d9835da8735d89eb8bfd7ba594c094b70ba7d91fabacad551461c8ccd07dfd25

  • C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini.tmp

    Filesize

    58KB

    MD5

    f795d6ab0db4bf1f72fc57c7807b5c6e

    SHA1

    0e8751f9da1197955bd1917a2e2a067e4a2841de

    SHA256

    419645e07898b0b8cb3bebc753e520934ede16bdcb449aec75817ade5a2b75a9

    SHA512

    d87dceacde916a8e169078e674f78d359e5b6527a02f2781654935f22532da1c2e36812d1a8ea8128cabef8e0e7883deafab3add307792d330401b1944388048

  • C:\Program Files\7-Zip\7-zip.chm.exe

    Filesize

    170KB

    MD5

    a907a80bf13de37a398368177cebc593

    SHA1

    6013f15ab4e1d18b913b06a83810b4bca3e3b955

    SHA256

    bb5c4791d1e3a5b5153119c4d171027c910102e8f1848beec0d1900928047117

    SHA512

    af977179c1e50bc1b8da6d95b5890bc275f48cf768de73b29178247dc646a2e72ed05f8b045c4a0160a87bff6b2bde7c5d51e67666d3661ed5188f8c90b58053

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    157KB

    MD5

    542c8d6e0d941b4c6ec9a5db6fac8fd5

    SHA1

    d60a3616b89d2d1fd754eadca86d4a74a15918f8

    SHA256

    495e54380e1f3c3fc8b204f1faf635f107103dd05037a97823ead43bbf6bb6af

    SHA512

    f302fd773f3f9c7792d261a2ab44c1412b98ba4ad932384ad7e533825718eea25acd4364eba358d5759757383895579cc8c0587466c63babd80a52876b81560b

  • C:\Program Files\7-Zip\7-zip32.dll.tmp

    Filesize

    123KB

    MD5

    537411335e348aa43f941034be61bc26

    SHA1

    9cae09a3554377dd2538f77c64424cef1afb2b7e

    SHA256

    bf832683abdf9d7aba5e2fbfc030dbb4b5edaa64639bda34e06bcc4ce8fe005d

    SHA512

    fc8989abdd74507ff78da4a1b02792a194e2bf6edae770eb072da5835069c5678e7a8fa236022663c399ea18ab8946e2e1d5a0654065f5a6839a23edb42e61d0

  • C:\Program Files\7-Zip\7z.dll.tmp

    Filesize

    1.8MB

    MD5

    33e92e29ee626c9ef1f85903d3b11441

    SHA1

    5256fb3c068142ece38c8b9b93232796f6ce438b

    SHA256

    e2a701d106397634ac32fc0a9c21b5e22bd81ba1ec11294fc40b9f45f9ece195

    SHA512

    730a8afeafcbc90949845a17edfeae87355123d6a734b9c6d942310f3ee638b049e3c4677555081d4b7c4dab32b17ea23ef8b6020ca9dfd4341288b7f790b9ab

  • C:\Program Files\7-Zip\7z.exe.tmp

    Filesize

    602KB

    MD5

    2a42657610093e3ec681a6c157dbb2d4

    SHA1

    ece0ca75a53d4fad4e87cbfe4374968a5997078e

    SHA256

    dbe75abac5e91fc6f4ea4af28a80c9d32bc876e43010e33e69056a0438f9cf23

    SHA512

    cb90d950d7c3293cdcedef9bfb86369407e16fd0c04f80cba65edfec1d6d6a20619b1863ed503bce10685a6199c43b3e7c4740a4c59213e174ce2f5b06022a4b

  • C:\Program Files\7-Zip\7z.sfx.tmp

    Filesize

    265KB

    MD5

    7381a0039a0c1b3f4544dabfae70bf6c

    SHA1

    ef37f1d446407d467859b8976d54ffca2ec90163

    SHA256

    b761cb6d33edba77dc477cb117e9064a65716142743966531a52d5ca6019188f

    SHA512

    d38adecc9085fd5d64e56d76c27708bf42a52af2a7f8f1b5e5917856f333a13dca8fbb4a56e6a9046503cccadf0a8bd6875f5bdee418e86882428a2f873289a5

  • C:\Program Files\7-Zip\7zFM.exe.tmp

    Filesize

    988KB

    MD5

    1dd1d265563e07a269596842d2c86b14

    SHA1

    0c57cb6e3db518f1e5b1fd11b6e1c66bdaaf8b8a

    SHA256

    c68baeae980e3f267a94f4c7fa92ed556c8a11442eedfc56c3bb7e9bb62d1d86

    SHA512

    21d53c5e761b03c2f27f76d9cea4c845cc6424ec45a841deee372be0223ae6182bef03cdc7e1ccbe1580203ad694a517b9f16352f8eacbe760e0d2dbaa203bb4

  • C:\Program Files\7-Zip\7zG.exe.tmp

    Filesize

    742KB

    MD5

    189eb44d2fe3a4fdec6d441b4169a8b6

    SHA1

    edc41a4c5742432592379f2427bc7a3735951bda

    SHA256

    e400b7eaabd17ece147a45a5c3ad8c37e0228d301195b37b712f29af4da4e47d

    SHA512

    d241c84981e9c2182d05592bad99096ec3261ad006c335c168db01823f445074a93de63ce5e29691fabf46d8720631e9c12e0d410e3b24b807e2fd6634bdc532

  • C:\Program Files\7-Zip\Lang\af.txt.exe

    Filesize

    68KB

    MD5

    dcd7f801623ceedb5638000d5a1d6700

    SHA1

    cecd7ff5275098e3456172ef3fa8239a31a09388

    SHA256

    fdc1f9eb6721cce7e91c6f582652957caefca69ccecb56df9231447a4160a88d

    SHA512

    fc59720d3b490a42ec4394bcf12cfa46c7780641568bdf8dc879eb20d87c272c6572aacc386d793b86a6d8a3bc46663189bfb02f9b73c79992c17f6c6949a28f

  • C:\Program Files\7-Zip\Lang\an.txt.exe

    Filesize

    65KB

    MD5

    8af94f8fa91af0826293f1011b2b97d2

    SHA1

    f53b5faffb8249cdda6c14183fea2b0a4c7e86cf

    SHA256

    5e3283e9ac5980788ae52c315dd15fa07617c6a7c9914b85d383e95c85d4b96e

    SHA512

    668a528076eb78848991690088ca640d58b81903a0be3bead6fc9e81090f56f585a37fa27e1c207f98756da7afeda47fa496a78755bb7a8550f0b30e2c25e174

  • C:\Program Files\7-Zip\Lang\bn.txt.tmp

    Filesize

    73KB

    MD5

    168a24ccacb90cdaccb72718d8c38546

    SHA1

    3c1f3b71d9e198a1e84e82046ac18ff2fc0c39ee

    SHA256

    9a3a2b2b229a334f7deae918ce18ec41d9865e06eb258876fa6374b4d1979429

    SHA512

    453e9767c61092b4505ed2825e05dddf3cafe824f8ebe21fbb4943e553eced99fa95ea320a9bede0e80ec07cc239698e261bbf40ed76a27eb402c0606887f68c

  • C:\Program Files\7-Zip\Lang\br.txt.tmp

    Filesize

    61KB

    MD5

    98f7b7a7a16fcc23e5b94c936b093804

    SHA1

    e66e22f5381d7e88340700b5d2c59f588047e836

    SHA256

    12df90aadea07d5c74ed3130541bcf606cee373632c5ef9309cab23c1095bb2d

    SHA512

    95feeb5c68166dcb8d5a25677fd648b7e9c33649a477851c210aac287a757a9387678944fb57023d8685b2e5d0a92cbf91b3d00adb5850b320d75245759fc348

  • C:\Program Files\7-Zip\Lang\co.txt.tmp

    Filesize

    66KB

    MD5

    3451222b182dc8a35ca5d069bd5ea505

    SHA1

    9bef52adc362fbf652cfc81c81d2b2d8cc11a6cc

    SHA256

    9dd6e727596979ec4ca14ad4fa8ce28180829d0b26be376f518d82efef254a9b

    SHA512

    f2c15bb3c8de140565cbdbabe5568ca75a0a2a97b91a9ec54c06b6c93949458562122367b65b70b6d7e28ef38a379bc8d497e82f7df557d949505b5b7e42cb8a

  • C:\Program Files\7-Zip\Lang\da.txt.tmp

    Filesize

    64KB

    MD5

    d1fdf46673ff3982d2ea466f804d9641

    SHA1

    9bbfd4aa4da431fba08636ef86e8a0268bf7e557

    SHA256

    eacc26f60309bc25a45b6806f381fd1b95fd5e4c66b6503a971df08c789a5e47

    SHA512

    1584d74863f166ec0911ba6d22769bf586405fee34c43dd8b7b71e913ae876b7e896cb72032c47e277c0d656c7a0bb90d570f3b1b6158e0426955e3779602381

  • C:\Program Files\7-Zip\Lang\de.txt.tmp

    Filesize

    58KB

    MD5

    3d4861b96704e27034a54a1f1ebe935f

    SHA1

    dc966459831d4507824f128080524a4c161a2750

    SHA256

    ef1d72e0c632efe2f5a55d15057e58016c6c055e030361b0c40057543f8d78e9

    SHA512

    9399504736a2e0124c32acd7f57dc34c8879579963594784b5db5a5d73b0d6294d0ea18875ec77cbecc40005572af45a8c8b33cc6b20925f68f15999d2884ed5

  • C:\Program Files\7-Zip\Lang\el.txt.tmp

    Filesize

    72KB

    MD5

    b5a04b887dc56bd42191b50beb3e654b

    SHA1

    9fb77ba40923276deb90c60bbe7d31da56cafe1c

    SHA256

    4aca308286e3f8c8981f723abb59ba23ae9fbc0a77137a16d7ade503148d5c0f

    SHA512

    5f0c0be62bcfa296f933e32df0b862971d399b71186957e4cdf43cf82aff9207e49c33c1ddad609daba9e8849804875883cec9017ae7d498d77763a58ed04eb4

  • C:\Program Files\7-Zip\Lang\en.ttt.tmp

    Filesize

    58KB

    MD5

    16bf4ab669de1ca1fd0206bd6d9c7876

    SHA1

    68c97d1b20057b6a629288f39e0da39a3bf0058c

    SHA256

    63a3a0fe27ee8e875f41225209840bd832e5ecb5b6c8a83c57d1c6f4ae476e27

    SHA512

    0aec481414f7da896163c5a62317abcf121ce7d4578f45a70644dbccd5bb6d901df4b145a56edd1d4935ddee323c14851cfb924a1e5496c00e7d0e38a6af6f57

  • C:\Program Files\7-Zip\Lang\et.txt.tmp

    Filesize

    65KB

    MD5

    29262990739a90722b10dd31de98a26b

    SHA1

    d8b684ea7b80048e78e32a5235c24c42b650dc93

    SHA256

    301ec5e96dedb15aa9a00690188bbc9a1f7f9b1bf29047817e406eeec6105ee0

    SHA512

    ebe079b96b58c7d6682007fdae9c339a1dc44181e6d935e627a0423ca556ad5c3506c4a5377e6a4c2036cb8f1b90486e33dbf2eb0359d0919f80700247cca2b5

  • C:\Program Files\7-Zip\Lang\eu.txt.tmp

    Filesize

    64KB

    MD5

    f89e3ebbe5cd0253371f0d35acdc2dd8

    SHA1

    5d265427f37aa488118fce9da5ea87d5d859e85d

    SHA256

    bcec301ef2362bddf81b2510ca23aef3bb0c8ca6a66b73ec056fcb750bacb8db

    SHA512

    3b32326521b880e237dd1142da2e072e378d592344b35e496fc25e53f27ac5baf3809f0f64cd85d90b9f93eba611f8f98fa409c7b2ad78345e6e02bb498a6f24

  • C:\Program Files\7-Zip\Lang\fa.txt.tmp

    Filesize

    69KB

    MD5

    bf45308aafa098ea6ec518671bbb479e

    SHA1

    6551360b8b7bf167f3d01302fe98c6fc79ea7aa7

    SHA256

    7cf874ecfe9ee68ec68b389b99abe30f4ffb196443ce46269d4e2d57c53ad2ab

    SHA512

    335e8bcc417c1f3cea9ae83c24c1d422ffe2e9efaf8d5eeab6b94d0a59d3198e0325c45e023b8f0c2a5fece2d034b240f5d20741122e1507ef8252ae5d7b6ec8

  • C:\Program Files\7-Zip\Lang\fy.txt.tmp

    Filesize

    64KB

    MD5

    6736b62472b21d6a63500bb7158ad34d

    SHA1

    4fc42f06541fb1692af8e5204a61e2680d42c738

    SHA256

    0feab0138da46c2e80cdfc50f136ce6233acfa858e97f22f713202157c7cf6fb

    SHA512

    ad1782e9cfce07d796df4a0c8343d06d69cd9c472f61c19b01f62bf3380f4a75f8077603b2ff126b8027e9fe8f9c68bfe1a2a0d7f16621cc98c9ddba0d1d6ce8

  • C:\Program Files\7-Zip\Lang\gl.txt.tmp

    Filesize

    67KB

    MD5

    d51bc22ad5cb8fe5cf618141ab3ae83f

    SHA1

    0770188108003fb632d35a00368cc8d054baba84

    SHA256

    326413139ec744e019f0761a9881fc10c851023b4b19c3978a3e13df9f23ad80

    SHA512

    b168ab62a4ca95af1a8dd67014caea0be22aa1f5dcc83014fd97d0f39027afd40f8b303f3cfbbdf2548fbb3fc27759b7da37f1e152eb27628605cdbc8364ec3d

  • C:\Program Files\7-Zip\Lang\gu.txt.tmp

    Filesize

    75KB

    MD5

    83387a89af2a217afc9f4759e7026cac

    SHA1

    6eef07242c1d57c2632210c9ce14e7673ca65563

    SHA256

    8e77b560a7102cb07bf174dd4ed184b28f6ed6a70d6c09aaad292f35af417bf6

    SHA512

    cd0abdafab0596f898a4c97faa0fe97cfc7d98250377cc14bb697569483ccd069b8cd0310f9a084ed9f518dd9e536bed95587334a311c229c6e5c07602f93c38

  • C:\Program Files\7-Zip\Lang\he.txt.tmp

    Filesize

    69KB

    MD5

    c8f66e25413fd523e152e00e8617b9b6

    SHA1

    2d0dcc25fe8404e4378c59df6e8429521d0c0351

    SHA256

    00ca24cf2e49946a2ffacf77587db19c01c1afa2e0a47708e1bee8c7b4792fb1

    SHA512

    4a0fdb47d2e8b9897b439000ee7268b6870cf4852dd7b79b808ff8bcc7daafde70733e3d6f24149fe1488f9afd68e3cd5903c032e6ba909305c68c0c764d317f

  • C:\Program Files\7-Zip\Lang\hr.txt.tmp

    Filesize

    66KB

    MD5

    82cacb013ec76930c30e46d5a11d00d0

    SHA1

    8955389432fb1dccf0d2e790ba3b94e55cfc7284

    SHA256

    88d25861bb212bd4b1de6c3476971814cbfc11b5a135f7887ca97844b3d13c3d

    SHA512

    fdfd36370361a99df56c8128fdee11380bbdb7f435929d9a07e04adfe6237e04065f010785af67a304d2190bebf393d2d455971d294b8a08a17531ab8e38ddee

  • C:\Program Files\7-Zip\Lang\hy.txt.tmp

    Filesize

    55KB

    MD5

    649bb5c3a3669043b512ef092b2d690d

    SHA1

    bcd5ecaf27d43421edb340388169806c7f5ff42f

    SHA256

    3e897bb72a8520c39d79a0a8a3f1ce141e68d80609a056f02f78e3acad93e645

    SHA512

    c5a7ea1dd5cd5f99ef83af423eff86b8dc562024fa7a2b99bffe41a8dcdbd05718cc609e769ddaaf659fb84edd334a8eaaf2a831af39657158b9d843e838488a

  • C:\Program Files\7-Zip\Lang\id.txt.tmp

    Filesize

    66KB

    MD5

    20579174bb524f202d2451cb4e935759

    SHA1

    de44ebd789cc8567473481bbdfb5d88c403250f5

    SHA256

    54810abf9863c292f9719ea90075689e5c51b744cddcd75b99db7c2944f493c2

    SHA512

    df455949350c81680f0549a84f20e6132521e98a24cc18751926416ab7b932bb2cf8fc696f421205042326b3c80bf907739f5cc9388d6a2819b36c7438786227

  • C:\Program Files\7-Zip\Lang\is.txt.tmp

    Filesize

    66KB

    MD5

    5a8194802e87d42ff0d2dee8dc7126a4

    SHA1

    9ffdc9657cc9e93c33df9c80cdfa50fe32784348

    SHA256

    90b8a2d46f95c80a64fb49344c59008dae409c7ce721dcf768ed578cd3f4ea57

    SHA512

    2c81296bfac041f4b22a36e475e531ae242aa35b1e394f5d67fe867c8977a4c8fe30312a78676b328ea60196fe3163121a1b95e25b7690cae1c699cb3aa1a853

  • C:\Program Files\7-Zip\Lang\it.txt.tmp

    Filesize

    40KB

    MD5

    37a3dbca84013ecd3acc4db282c793fb

    SHA1

    12fa3aa1a2108059c332a9f931657a67fa973952

    SHA256

    dd926dec59217a5c75cae4cdd7c8c84dc423c9b278ed1074daee3fe440e90c20

    SHA512

    9908f32afae391f02a841fb1839dd40a14233870d6625cb47391ad55d3a1a65f0ec47f3d066aa2151bb7119df8994302c17f1b6db8f4c911cf7c835f04c708c0

  • C:\Program Files\7-Zip\Lang\ja.txt.tmp

    Filesize

    70KB

    MD5

    7aebb0f0e0ed073af60ffa56cc3ec73e

    SHA1

    e2a9c49492f26dbd682f6d9273a3be1fe6021b82

    SHA256

    821bdf63cf1ed62f446182df8ac6aff06dd0c17da60ab87ddb4f613cb12a494e

    SHA512

    ff33c510555a543824f6bb5e8d00ff926624693288f8f747cca73accd21986950becea7a8408ae466e8f3622d5737060afad6040cd2e807cb8a589f47050f1d5

  • C:\Program Files\7-Zip\Lang\kaa.txt.tmp

    Filesize

    66KB

    MD5

    7db5402e29cfa4d941f2e7388309002c

    SHA1

    80c466ec38b61057032c346cc8f41663a17e7ebf

    SHA256

    fcebb32ec71ce27140c27c317f4d6ba63101873a480f7bb5243c4e4885270ef4

    SHA512

    f1e809e827c408cd76753771ee74de8dcbf2e897cefbe35b27962503e4d508715a5276041dd8348d593522eeafed0e13bae107557ff579ef719569cf72bb40b0

  • C:\Program Files\7-Zip\Lang\kab.txt.tmp

    Filesize

    55KB

    MD5

    38b4d7a443567c509e7605a33e23aa14

    SHA1

    11823979da986e11f2038124d157c7234fdce566

    SHA256

    02ec5e05c97a77c161dc46bc4260e5e1310ef5eb05e544a98bf50901c29fb641

    SHA512

    680bc835bcb149d52a4714224b966008e1a1f8bad1425f93fbe5e8e5c7c2fc2c7db8a30dba12b67fd09daf58d460f4c69a25eeee574aade2491634d85ce206f7

  • C:\Program Files\7-Zip\Lang\ku.txt.tmp

    Filesize

    63KB

    MD5

    166415fcebeeb4c4c838e5ba528d1413

    SHA1

    b959c6cd1f53dd4a6405ac066b50bee88e25b4e9

    SHA256

    81beef2d3eeef9e3cd44725e605a97b4c50249da29a192b81f3fb57a02a67423

    SHA512

    9c362ce1ff101c4bf10e20a3dbcaa0f7e305709152e3b25ecc9cf02cedb3d31532475a133d515c913a1f2d4b143e81d2f860291f2080eb40fcd44053aeebfd26

  • C:\Program Files\7-Zip\Lang\ky.txt.tmp

    Filesize

    70KB

    MD5

    0f5bfa8b6dab5be04261124688b3cf32

    SHA1

    4afff75d46ced8035f21b1de61b2a7f47209d6f6

    SHA256

    22bc097c9a6508b436b0803dbd1548860c25dda373e7461f08cec16ee3faed0e

    SHA512

    9611a43c3842ce1419c64b5409f1049671e292fee5282539a34db5f443b0210b7533fa5a960842fdd948d953c22b78a8b54424c7a69d3bff0d45f2cce8ffbb64

  • C:\Program Files\7-Zip\Lang\lij.txt.tmp

    Filesize

    66KB

    MD5

    52c5c33d6af3bb6055e34402a09a166a

    SHA1

    6eab361c519b6af86616dcdc18e0d812f66ce903

    SHA256

    76789ca6eb0fda79529886c55ec87330128f97e464a28438d695e5c693e08c91

    SHA512

    ee87003a59c21d689ac3b27d6fa05478b79ae22743a14c25f9e3d77101e094f23215e31a99c2b42b8e7f2eceb11c9b701fd87d1df49eff3741b5f448d6ca2e4c

  • C:\Program Files\7-Zip\Lang\lt.txt.tmp

    Filesize

    67KB

    MD5

    864a016d9d906a209d8d11e64d54d65a

    SHA1

    4dbb1fb63fe6bb05379378db2d0895d66c397f3d

    SHA256

    e90d6c8537cb37b9b4c6976889458f6b9389ec21bbe776f68fda24d3bbea415b

    SHA512

    42ae9224784de5018df2c5dc69df35609e978354ece8796c8e3024a688d1a2daaa611205fd2c21667f10ed7146a39e76053fe816ed1dcd4f4157e33829c85c70

  • C:\Program Files\7-Zip\Lang\lv.txt.tmp

    Filesize

    63KB

    MD5

    ec18558c2b54c42f46ce49571b0e04d0

    SHA1

    cfdb64e40e39e608496b2f2a325671680d140227

    SHA256

    b934d89def3672698c598aea453b72538cf8a52f5a912e6380e0990b6713ac14

    SHA512

    7f37222ac2660dc991e5f0b7f329e53f5950604c7457153a0778966ecd3ad8b446c055dea8753c704258f812879ee10fd2d6c9dbcfd03eba02f6c1ab236e6799

  • C:\Program Files\7-Zip\Lang\mk.txt.tmp

    Filesize

    64KB

    MD5

    ee9a2af22d63758fa775fff58d83d595

    SHA1

    e4ecdfbe6cbb3b5e127f56d46206278b65537f57

    SHA256

    434ab3ad26d861a679c94520d9471f250d9c3a425781b49969d1576337ae607a

    SHA512

    a99c65886da2141c1068a3fa6ef809935fd737c757b89414378d87b04427427f72494a161f73d4c16748a5b3fca67b5b4b25e60a4da5ef20fde8e6dadc786460

  • C:\Program Files\7-Zip\Lang\mng.txt.tmp

    Filesize

    78KB

    MD5

    a9ff9d2902bd859d67ba4aaf9cf5f644

    SHA1

    67a9095fe8c8bb9513b2c95e8be9579c3677e2d2

    SHA256

    681e0b4c1d510ad6ca2bb855ef5ff797c12ebb044a4299a0b5d53d47213bc1eb

    SHA512

    c68d651a3a805529ab105c999aa44a399c2f6bfcbb04570b0129dfcb5ff45b1a67a9ea2074f34d4480cb7a04a0ec8ee3ee9e0542e5861c5d78d3473ca3d9b51f

  • C:\Program Files\7-Zip\Lang\mng2.txt.tmp

    Filesize

    79KB

    MD5

    27650e6ff3bf116074f3179f5cfc572c

    SHA1

    5cc365511361074af5fc21847abb30c54ca108ae

    SHA256

    63c3c5f467f8453333971a6b54aee05e18b3c6b796b4f24aedc6328480c522f9

    SHA512

    4d97fd21650ee911e5f231065121198d5655658bc0a74e6282be66b67e2a62b4cbd89a1044da898e6147d749292dcbbd539dd65d44b7797be97cc5d4f000660e

  • C:\Program Files\7-Zip\Lang\ms.txt.tmp

    Filesize

    63KB

    MD5

    986d71d8098466cf7c08fd860b297caf

    SHA1

    22b99330f063de972a7bddfc6ca9913a6b3e0556

    SHA256

    01995baa37879935b78fa242ea9ee20e408876cf67e830269dda916f40b1684c

    SHA512

    ee3540a2ddcda2a0b0946cc3c9f6e260da3cf670e67be7e5ed55bc776a17e969ab3fa3b04586b3402106199a2847d50df9ffa6fb6e6c36253d93ad8e7eefa319

  • C:\Program Files\7-Zip\Lang\nb.txt.tmp

    Filesize

    55KB

    MD5

    8333adc90a2799985b2cf3e26f7cd5b5

    SHA1

    c9f7fc51a3765f11a19b15a3927a1aad2e0467c6

    SHA256

    b58da8c55d03d5575fac864a58cf2c736fea5eae63380925c56287691d87c38e

    SHA512

    4f5d7df3e18c0dc9513f64ddf28916e56d1497b498a16e1ef22b120900231a31e3bd05edb6b0f28fc5bf96b47e0e4d676745c6156c0bcfe6277b4e788b272a94

  • C:\Program Files\7-Zip\Lang\ne.txt.tmp

    Filesize

    71KB

    MD5

    38dbfd41f608ee8ae0cef44c4ed15bca

    SHA1

    8985b2e9d295de185b1a9c5ad4db3e7a1c5e2516

    SHA256

    57f7236b6aa9b7e3e7b02d831618e69837f81070984805a5769b0154c4fef1d4

    SHA512

    bd4e7402bb737e7c7ca01b3ac71fd17ea14131f18bcb771d302fac1d968702c0a9982cd99e51656d60bddfb86655177be64e59ff6b710af8b47e8993a6b091ce

  • C:\Program Files\7-Zip\Lang\nl.txt.tmp

    Filesize

    67KB

    MD5

    cdc3495da0785e2b169a7a1d1b954751

    SHA1

    fbc863d8fd50c1f545327e90acdfadbd2281c71a

    SHA256

    b721e179e8c5176481cd5185818be8bf9d4394a90bb1e013ac333ebc4cb55c49

    SHA512

    d5f101bec27742c9b3856d6e99149531f95c3e3eb6a08d413557fb84cbbcedd76031f0dd0bd97270aac012392914c62ffe598a89a7e361d5fe481641867ffae3

  • C:\Program Files\7-Zip\Lang\nn.txt.tmp

    Filesize

    64KB

    MD5

    d41c0a62990e18dce13ff2612551739b

    SHA1

    b34c1b641d01367f3b758459f068299ae9ed18db

    SHA256

    d9da4262feff90be1d98ff5f9d7aa143999c572f30b4b6e624241e0d222dfdcc

    SHA512

    b0d0deafc94b61e54cc32df439664d6a7b193bf2c6a04371b0dd0e5dc5c54acfa677297f7189eec13afab9f8bd15c83ae85251186a16a1317e871ed030aacf0e

  • C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

    Filesize

    72KB

    MD5

    66a64d444127c11e04a6dc879d46bcb7

    SHA1

    e0e585f6a423fd263d4451e29dccd6016c86ffca

    SHA256

    fcd40fda5da41490dbea06174155bc79e2eae2d9328b6e975de7d699d2d57543

    SHA512

    bc3cb924c30d8612f6256b7da44c3935f7daea8214feea38bba9d6eb7557063f3f2913d6ab0221b5b363e11ebe305a8c412fca4d914c8c5bff7c53b50f4500ce

  • C:\Program Files\7-Zip\Lang\pl.txt.tmp

    Filesize

    67KB

    MD5

    5a6f5f0d4d48034f5b2e4359ee264124

    SHA1

    e49da2453d5038f32a69633ed0100d4c544d29f5

    SHA256

    879d34a99792669cf5b6e26ec050a3eaf52e1d60580c246f49fef13c58a157b4

    SHA512

    aaf0b41d52b13eabd9b5c7af352a802d4cae33c7a1c876e9fb1fce5163ef6870fa6a8e9c401fa381af8866f1b099a454db845efaed0c31fd37aa729331f92e64

  • C:\Program Files\7-Zip\Lang\pt.txt.tmp

    Filesize

    67KB

    MD5

    2ee553f36c477d572c8eb0b50eb7ee4c

    SHA1

    6cbe70ebacd0a950a1cd0561879e0eab0174e951

    SHA256

    3020da3872dfa09795189209dc8a9e82aa830819fd2797277b85ddbe618dcf97

    SHA512

    d3eedb46fd46d81e6e6f7f495974af8917f77502a42ca34a1ee70d7520c50b46e07385aea14f25c5f39824486522b7b308359643b64218c418867eed2f7e4bb1

  • C:\Program Files\7-Zip\Lang\ru.txt.tmp

    Filesize

    73KB

    MD5

    4f111f71af92077d29e61418da30fc15

    SHA1

    5501d4f7f3bdf651fd93154932a787eae5414369

    SHA256

    9a45b3c3190e43b5e0fb247b60006cafe22111417f0033a8f77bc2269eba846b

    SHA512

    84abf57cb890bd999cf5e25b9ef20bcc8ef207fcf3ed3ca49ee3b7106da42079ecaa1742f1afeebfdbc5285bd4c4d52a5e38c91ea1627491b40512c983f7cd30

  • C:\Program Files\7-Zip\Lang\sl.txt.tmp

    Filesize

    64KB

    MD5

    6e0d83a157092696e20cc857a9c464f2

    SHA1

    89c813422b1873d54ea3b6646b0c1238e53660d0

    SHA256

    2057943a153551e332c55dde2bfa03dc7e3751572ed7782bfb4cc3d4d7ecdb41

    SHA512

    79aaae6e511b3331e663fa6d5a7755a4d10fdf66c4047cb53344a92df1019a6981162a00abd19a9d0c03d621367e31ef4cb5ce293adcb68809347eb8333156e4

  • C:\Program Files\7-Zip\Lang\sq.txt.tmp

    Filesize

    52KB

    MD5

    3640a94c7e7021ccf940f6d39ed7740b

    SHA1

    b286638f194b1231c1662ecb6bba730f9918e15a

    SHA256

    ec05b4acbabc2f21debedb1f311dbae9c383bd6f588272e4c6c117322bc11bbe

    SHA512

    f9e8d4bd0a590735edb01fee9a970d18d7663aa71a95a3ce466508bd8c7113ccaa202a04c9d2063d9a35d2d736696c7db770b27b44ccba6482ca8ee82209ec21

  • C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

    Filesize

    70KB

    MD5

    ad34cee5f5e45ec4d8c5dcb61c3b185e

    SHA1

    3c905f2e2489c2fc1cc1a1927424718bc61e08a5

    SHA256

    f144ca67294f1529c63f7828ae8f7f61c7eaa4a4eccf7a53856d9b946d039331

    SHA512

    2a85f8ae45eb6621df38c246f1a6a0277cdae96c5eee266df942ace15ae46d18d738f920369e1072fd732f971c256d03b38b635870837429ea034dc8cb06d501

  • C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

    Filesize

    65KB

    MD5

    88840cd34b2a82f259d8c1f080f12d1b

    SHA1

    c06ad7898de0b7a6c6e8365a2f1b5f2032f3898e

    SHA256

    dd6f1e08aa2cd08d032a8a7391f87d196fad9312e4f5a3dd8117eed7f7004fe1

    SHA512

    827d0551c948caf3e02af8a85cc0fea4a1396225e1a53be7be04f56d157c038464c6784b2b947e5cc0e34047cbb9360007fb5d5cf9f6498aadc75e7ba89d74de

  • C:\Program Files\7-Zip\Lang\sv.txt.tmp

    Filesize

    67KB

    MD5

    c00f23e31be4a01142dc57c88eddbf75

    SHA1

    acfbe2bf16ba04bcb9947d2f940c8c0f1d0c2027

    SHA256

    14821cf01f7ba748920c19c5d8c1b0c9a2b1f35ae7dba2caad55fa1ee3abe6e0

    SHA512

    62af0a282f5e2e61fc164797b701ae7b191b30e82915b3b9ba5211e7e766d0e9cbd70d7ec113f716eb7fc1a3ddd48f2c955adaf072d8f43b4ef578098c1d7196

  • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp

    Filesize

    71KB

    MD5

    d2017e8681460c62825ab0c4797cc2de

    SHA1

    e57ca3dd472790d8d8ba2d060816528f70cc5bb1

    SHA256

    5a71279ef1a18e749fecec4c625db53947c6bc3c41f986cd5bada945e0ba5b74

    SHA512

    bf937c7edd617b00e21843d9aeac7c61e4cd934767f3f13e959713b6579eaddcddd26a653bf30c5a1e3ccbad6d39b38e8fe8883b3012a0d28bfc86626db9b5c8

  • C:\Users\Admin\AppData\Local\Temp\_Wordpad.lnk.exe

    Filesize

    58KB

    MD5

    dfa42d08111b86b953168d8b2878b13c

    SHA1

    2a338effd2ca788b2d5dc2ac4c1498c5bd2f1e11

    SHA256

    5eccc024a386a5b1a707ba25abf63e2ae2bc66245248ecf42f75054078cd2938

    SHA512

    618d58d9d705fd558a1205335f3d687f41b5d13922f9b4133bae39260c64b57891c5cee9b2e34edb22315146021f8953f50a419609e6cecc2b59c04a0f1ea336

  • C:\Windows\SysWOW64\Zombie.exe

    Filesize

    55KB

    MD5

    f53fa604f5af16944a51d755a989aa5a

    SHA1

    f7cc2ac1574e035bb8b84921775448fab1574246

    SHA256

    5981c8bdb5c7e0fa5b96dc4eb0f106b36a8b48028ddb58f66022c9b58e1d4b1a

    SHA512

    e727f87c2cebe81bf682c65f0d30e8b898ccb3a8a343c72c035e76eff6888e303aca18dd725f7b165d41783f4462801a91655e957eda320a46c1dcb6d2b5e17d

  • memory/4312-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4312-1152-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB