Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/09/2024, 18:31

General

  • Target

    c0ae54200e6c96bb5a031dd5c29cf7a0N.exe

  • Size

    72KB

  • MD5

    c0ae54200e6c96bb5a031dd5c29cf7a0

  • SHA1

    fe9fd2d81b7b154d66a9a1a50a31b30ac1f33082

  • SHA256

    a1a09df3b63ebba08a2f018debd0b5ae50cc80465b7d599108dd410874a6cb57

  • SHA512

    2afc9b79a9d3d1a8dc13dc8e831b3206baa86417a27adc3122a6787809a6433aa6574a77886a0a684f74d393cc620cea9684efaf05c20943d72416adba6925f5

  • SSDEEP

    1536:CTW7JJZENTNyoKIKMwTW7JJZENTNyoKIKMr:htE5KIKMtE5KIKA

Malware Config

Signatures

  • Renames multiple (4697) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 61 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c0ae54200e6c96bb5a031dd5c29cf7a0N.exe
    "C:\Users\Admin\AppData\Local\Temp\c0ae54200e6c96bb5a031dd5c29cf7a0N.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
      "_desktop.ini.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:1736
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:1656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini.tmp

    Filesize

    36KB

    MD5

    997642fa85a72be08e8feb89330fa27e

    SHA1

    564609baf186a672b8f5e7b9d075b346d8afd9ee

    SHA256

    9363a460accfcd9cbe16ec6d4fcc33599827c7f9104a5705ddb5e3c00bb432b3

    SHA512

    3ace5f56c7cb651783371052aef85245b469e82e6e1455a7783c7295b7be7d714025b50213b5eb52ba88e9b4d82eb4bb530ce1972ad390b74503e46967abcb76

  • C:\Program Files\7-Zip\7-zip.chm.tmp

    Filesize

    149KB

    MD5

    f4d0eeaaf19b2e7c1149354557b052e8

    SHA1

    0dede98a32d37dfb0037bfddd1c9332d7c4a3458

    SHA256

    cd4d9ef0ec02fbe7f927ac5284b13c5ec440fd9eb4a8937547cb7eb527274de7

    SHA512

    00e8a2fde91aad91b8bdbab811d1313618ed1cc3874e07ae536bcae9b054bd4a74147486e276f2cef5ed35b57a44058899feed162eca8118ef92bd404d12f392

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    135KB

    MD5

    4ddbb106c99098b7d65bff4998c5d8bf

    SHA1

    f0d0bdaee51f2a4d0adce185913b6697bb9dc8c1

    SHA256

    7386ace490f91783d74bd8da7720090673b7fab13576b3386a22cf47be82edbd

    SHA512

    0cd3fd9699b67fd552a99ecfd62bf73a69a5ef534e708a208b67ae10152774e29f5247070a6f7d6937ae6cdc520ef25b176b2923d2d80d91e81420fdd032a880

  • C:\Program Files\7-Zip\7z.dll.tmp

    Filesize

    40KB

    MD5

    d79cc03348b8cbfd5a45bdab1332bd3a

    SHA1

    a29a92d74c3bfa5376a619572be5543329bd8eac

    SHA256

    4486346dedfaedd27a4e00c17a2a6d8495f5501b919e3de2eb4d1c138d25fed2

    SHA512

    137ce16a589d741843462b0aec10a9bb93296322a749b6dc979e15c68fa560d4b11e4cd2ed397d6850233176b4d05a421139f2fe58efea7548caccd609e3aa11

  • C:\Program Files\7-Zip\7z.dll.tmp

    Filesize

    1.8MB

    MD5

    66b23bf8c833bc1e05f3d21aaf04f969

    SHA1

    d0a3983763f25c3ea400ff2386d3e2b4ae72ef49

    SHA256

    70289aaab51d4b64b7546c447620261eb91f55ade33f2a12c58dfec8fdc3b53c

    SHA512

    a23f890206e0e72518cd24f56e8435f95ccaf50f474dc81334d5497e324748c5aa6254152ea0cc8d755f6d99d3923d91067656c77a7dda4c4064fd7e1adb0a73

  • C:\Program Files\7-Zip\7z.exe

    Filesize

    580KB

    MD5

    e5deb60a80fa6c337e4e39ad7e346ced

    SHA1

    da60b23cb56ed783c46763d92d9155ac80a77d38

    SHA256

    e081d9eef675f467da681bc46f55b6639701adf5441dce186035ab9bd786bf4d

    SHA512

    3c0af411ff3124f90398ca33e8c0e1912580f69ccc5747e5f6eac00682dbef586214366028789b1f9d05cdee17a161a94cd2cdb57569e61f18f00067beba1f26

  • C:\Program Files\7-Zip\7z.sfx.tmp

    Filesize

    246KB

    MD5

    7d2ecc0a834502a6362d6004ceac39a0

    SHA1

    1b04f3761cb828303518f205fbbce4a4183238fa

    SHA256

    a4abe23ad4d31206374c88e9265df928576612ee44205638e84fafb55e867bb7

    SHA512

    8ba5686be0010976c9ca4f739d4ff669ef9f5e887e08afcca56bfff7a5da9fdd7fbea98a9285dede5b3c8843cd055af2c150ce58307c98f0ef1c2cc61a75f2c5

  • C:\Program Files\7-Zip\7z.sfx.tmp

    Filesize

    246KB

    MD5

    7612b61600432c107814b064ed908b5a

    SHA1

    0370ea9e50631af7ada4c84473f3eb0f0bae3363

    SHA256

    dd42e518174cf5d973e7363681348eaef32be289bb7cb959431379eb2d716167

    SHA512

    9aec611e997c55adefed7e56d6a5053bd6040a768490e6e7c25c63683d71745b69f3df2ecb65d702c52ef4a567fa03badf18733c121639e0a82678b895f8489d

  • C:\Program Files\7-Zip\7zCon.sfx.tmp

    Filesize

    225KB

    MD5

    ad16bf8ded108ca2158aa19adc11c315

    SHA1

    d6f87d51ff2f25ea377edcfac29a5baedd63018b

    SHA256

    c9ab43d3b63647f48aaeb9a6c74506b5a1c13bf5b8bef2b6088af205a5f2ae4c

    SHA512

    43e29636690b3317105a0602e50d2d5fa8f0243b2e41e4573710b17677645f91e83e9a27583bb2a21dd1bc1efb9c16ad5eb44d1b6ec249fa70bff7fe486257dc

  • C:\Program Files\7-Zip\7zFM.exe.tmp

    Filesize

    264KB

    MD5

    4746086a466686f799a2023f20c1b751

    SHA1

    a4249af8a35872ce4d69798160048502f88c8ee5

    SHA256

    faf7b64e8f27a211cea66287a00c76b55706d8378267200d23f1d242da43fb3f

    SHA512

    57f9e0ebd8e2d1c30d95dd41c53751b048f049a8c71b1a5a4f3606a12358c5024d19b5d7e48a992ed9f2834b07466a99822d5bad6b159582c2fb56ffd9c8c489

  • C:\Program Files\7-Zip\Lang\af.txt.tmp

    Filesize

    46KB

    MD5

    82c51e29ebb3e24dba6a7f21fc597ca3

    SHA1

    46012c38adf6ceaf1ca0e3de478ecc81cd518309

    SHA256

    667ae5a85e0d77f28c6d59211345392debef98f2d52a2e4e2bc6975d75172c4c

    SHA512

    c20a2a1d00e83b4cf6bab41c4d787d958faa02a56da5a0ca7528e7fd2c067bf2505c437cea25dd2077a0ab496538ab872efb63d24d67b21105b709c8629eb3eb

  • C:\Program Files\7-Zip\Lang\an.txt.tmp

    Filesize

    44KB

    MD5

    5b88ede4cc5ba3bf6a706e093346063a

    SHA1

    3280bf8871baf6b519745aa1ee7cfcbda117bf41

    SHA256

    44ac2ffcf70084c2534b7daadd83d509de1ef71306afef5876e56f7a7f9f1bf5

    SHA512

    95de5b828a9cfa44d71ff1ab4f99d509ded49f92a5c630d0ba2d9e9f1e7be217c17585871a068eab32c3703643a086dfa3f1b30021df8d72e994c9bbf6325f5d

  • C:\Program Files\7-Zip\Lang\ast.txt.tmp

    Filesize

    41KB

    MD5

    11ed8fe45c35b0eaca817ff315deaf04

    SHA1

    33e188f5c2a1c209391ebaf55a34cefe4a1da15d

    SHA256

    7152d38111d21c378ed399b41470723120bd5fead9ff629c81d4589ef0aa3873

    SHA512

    b1c3faade48797cb4989ffb18f02a177450a2051d42a3cc765dba40f14257a8e537df8cd068661af7234fafcee3788c7289b416275005276af2f3acee45f85b2

  • C:\Program Files\7-Zip\Lang\be.txt.tmp

    Filesize

    36KB

    MD5

    045e735fa801c2ffc8a6af4307b39fc9

    SHA1

    2e03d0262969381263a4aae57ac762e7f19bffba

    SHA256

    5097aa43bd679669388c6cac426f9fb28001b178961934c0069f155f96af3013

    SHA512

    d8370eab3af6103afd5c56ca8ddd17b13161fafb19d9b4cc5bdef8a79508f9676b1a8c8127c2e10659b670090c4812d56ccba9e007071764d8bf457338a08b82

  • C:\Program Files\7-Zip\Lang\bg.txt.tmp

    Filesize

    48KB

    MD5

    8e43ad936e7a561b56902c41ee7ef2eb

    SHA1

    b9691fee3d3ca23d1fe80d54de8bb0160fd883c6

    SHA256

    37066af29f3792674557a67147cdec5801b39781df508f929f7c57f3c8e0b34e

    SHA512

    8eaa1355bc5d016e5006f068ced0d4d7d27ebf88122d3539bf0ecf7877743638af39e6af353756001f1287fa2b6c5643af5a9393820fbe82766bdfe36544ea23

  • C:\Program Files\7-Zip\Lang\br.txt.tmp

    Filesize

    36KB

    MD5

    9c5de763eab4a5e8872e93b962292ea7

    SHA1

    1382cd3395220ae82af157cae63a437a72daa609

    SHA256

    2dd2344b502724101ea223c7c24c2e372242a418eae3d032d6c99cb3fd53be07

    SHA512

    82653aa0818801f3c9431a81f661edf9f167de4d005d56f2aac6621fa84cda4a8d3ce2d4991c79ea2b1870eab5d19f47203a658439e1f0a6097a44efc803525e

  • C:\Program Files\7-Zip\Lang\co.txt.tmp

    Filesize

    47KB

    MD5

    a06698486bca8fadebca27a6c0cf83f4

    SHA1

    50795547b848a80c962117b9579e16ea27fff06f

    SHA256

    ed48d4079d3631291d88383893ed61f9146739099b8dfbf2ee63e2283793b06a

    SHA512

    e15ca735103b5a747bc973564427e30695ad69d5bc0a138e6df53ecf75fcc5a812cba73a8c8bb5ef651bf051343d31202ca0f9a08681572105ea4ecf42b9fcda

  • C:\Program Files\7-Zip\Lang\cy.txt.tmp

    Filesize

    41KB

    MD5

    a6ce2a7f2376ff6d7718854a7a083371

    SHA1

    59d425ceaa45923eb0ea0797cff661108d11feab

    SHA256

    87fbcfc51f898e31970d08e53a4ee60bc11f1c54618974cab239815811526f70

    SHA512

    108668d76cb3d19016046cc858196967c8c5b00f1c1ee3a4840b5f392b5befb670596c1569e3037f228335fcb8d835bdb4df9597ab328d26acef7df2ae0c6432

  • C:\Program Files\7-Zip\Lang\da.txt.tmp

    Filesize

    44KB

    MD5

    5bc87a4f723954829ba37b302e9bfa2e

    SHA1

    78f50793d1c08fdc80ad9a619170ea10d6b8df06

    SHA256

    2dcd3657d5f529a44c7682fee6051df0ae77c1800e97a9505cb05a829e03be69

    SHA512

    372cf22768cd94532c5973e1be43bf0ffeac67a115c2254c4c070017573784da2985d7891a72ddaa56985ca822a9d63cc9973c8f27d65b75bb1f63d6605ed8a7

  • C:\Program Files\7-Zip\Lang\en.ttt.tmp

    Filesize

    43KB

    MD5

    b48553402350da7e2310929293f8b67c

    SHA1

    4c6a9ea0b67eb1e1851e8b6097ab5a50fb4cfe63

    SHA256

    a78d188341a1bb79bce22e272f1b4d407e577f9174a9d1ef05638410549d4388

    SHA512

    281e30c820eb91da7b1a25002db7340ede85457d27152530d3fe4ee2e5e518bb877d4d8d3edb472cf516a0795cb2fce2577ede6e83a37c99524ba1abbff4dcea

  • C:\Program Files\7-Zip\Lang\eo.txt.tmp

    Filesize

    41KB

    MD5

    a38fa381003b60e899cdd7185914ac89

    SHA1

    75098d1d39b213276ae84dc2d55aecdb0a95628c

    SHA256

    d9459da0327c623746b06390c4182362141d775ec3c33da4f37997977802cc3a

    SHA512

    860f0faaddece3ed73278b383b95a766ee17255c914f12944b4bc362d726fb35e488a29f6bc1d5b82236d955f2d60520c4da4934ded9245b35b8d537aabb757b

  • C:\Program Files\7-Zip\Lang\es.txt.tmp

    Filesize

    36KB

    MD5

    6e77b82ef639dd9e247249e2ec471610

    SHA1

    15b4e5a8ab9d6f7deea8b3b2d845f0800c09005d

    SHA256

    d3cfa4b7668e81e91df6eecf1e2d2407f7889dbd9dcfd2ed2dbe49de60eb5860

    SHA512

    cb252ac3de4f5fcd0096df594dd07e327f5edbb41145e274944fa28a04691bdf968c34077c3286cf07b19ea37db08fa3d81f9f126aa96067e48ca610d95b5364

  • C:\Program Files\7-Zip\Lang\et.txt.tmp

    Filesize

    43KB

    MD5

    cbd78c9be7bd0626b2cd8a1a9e8b5a1d

    SHA1

    4cc34b9d5c85403781cf0126865c850e56db2801

    SHA256

    55ae467140558c632005173e8fe26baf83b909b6e9dbadf75d6a891e6393d96b

    SHA512

    d04aab2ea399a3a6dea28ae1ae5542d64d0038daac73cf81bedcf2ed3108678031735da0835fc13fc15f14849c2768f3e09f36d7566b1b508516d9e082f2f470

  • C:\Program Files\7-Zip\Lang\eu.txt.tmp

    Filesize

    45KB

    MD5

    5a52a4c8618c28cf1e5abe0aece4af3b

    SHA1

    9a9b73596aabde025b746116bf6f015c37e8b4c4

    SHA256

    c88ba28dafd4a5bbe5f2d0cf48a45526c08b75b2bb1a449ba23b73298f6643a4

    SHA512

    36d5a201b8ed567d235cb4f9369e070b1b9292a3eaac523aa3478adc3f9fe830f1f1c647aec1774ab57c2bd3e8836c35c20dc115ecc12cc9a7f5e42b7c48fa6f

  • C:\Program Files\7-Zip\Lang\ext.txt.tmp

    Filesize

    43KB

    MD5

    1e14610e51006fddb9f5228db442c866

    SHA1

    58ca5f1bf9056c65e938ce15a5f8905ed949af70

    SHA256

    c79d00cc01e0f83c3df4051feb77c10ab5aaec4534c4f590416f5925e42ecd0f

    SHA512

    c3ca46fdbecba2453ef8ee6a46939b42929a56d730c8e71ff3d912bbeab6ab578fd21607489f066bfdb25468b510db5c207f18ce8717c7f337a5d5cc8ff3ffe5

  • C:\Program Files\7-Zip\Lang\fa.txt.tmp

    Filesize

    49KB

    MD5

    82cce0a412ed30e85e4e95e9f3aec57e

    SHA1

    a1f3ecd858547a9eb48ce9213639fbcf89cdc862

    SHA256

    e66f29832293d332c8caad92c90008535e4764b5a00ea9e6c09c9c70fd493994

    SHA512

    d1b5b2480948565dca1eb2f793713270850e0e8808c3f6098e26666a994918de01ed3bdba387d71b27718a6c697c594931c1aa0f5db806d338bdbae6b66cb030

  • C:\Program Files\7-Zip\Lang\fr.txt.tmp

    Filesize

    46KB

    MD5

    8da719c1db412486020d290b4af7d577

    SHA1

    4650229004331e62967b5d86d71f8710d3306b57

    SHA256

    c22f34a831e611ab9cddd488fea209deb17ac0b99ff96e9747568196f4e3e821

    SHA512

    f76e2ee9cfeecb8a0424da7d30579a0cb52eae8bde54914c7bddb1b7128c61cdeb634d726aa0c47791ca28cae3fb2f21b373045c89b8d3c63a6d3e4747922c81

  • C:\Program Files\7-Zip\Lang\fur.txt.tmp

    Filesize

    43KB

    MD5

    0cf6ef08013a5adab9d1d8ec2cebca3b

    SHA1

    cfe8338bce0901df34e13b6dd66b17acaca35835

    SHA256

    31772fddf33674fd0967c1ab9a5fd2bddeeab35e807a18ba10c5c5b8bfd4df78

    SHA512

    24a9a3306d36e3debace0e3e29c1ca29bb950a3f4d845fa13d20a8b459a68d18938fc0b79ac52cc7d838fef511b5d8a3a6c0c9330989e8c12c2b72881f14cb97

  • C:\Program Files\7-Zip\Lang\fy.txt.tmp

    Filesize

    42KB

    MD5

    86208fd1723e838f278ef347c8b1b25e

    SHA1

    056ff638bfe47d0fa1d2da05ef7bf628d4737764

    SHA256

    eff95e8fe1ff091a0a8fd5e1134cba427cee9cc20c5e185fec76a95e427133e9

    SHA512

    07e9e6f66d195794491b2718bb4021b2231b2f049e59d078e323a616a50403be020835921d4d012d023cb01b471b761045fae2fb3338963d63a5af00adc91d04

  • C:\Program Files\7-Zip\Lang\ga.txt.tmp

    Filesize

    44KB

    MD5

    2d7f485712706ae67feac509928a2cbe

    SHA1

    950f79c9264a1f5e7bbc3519dbb4ab5fafb51c22

    SHA256

    8b58e86e07c5bdab76ca60675f32309064e663497f186f419638524a5b65cee6

    SHA512

    548e2c1e6468cb2e56785261e65238d0233ccbca7c9576794b446315c7d9aa840e59086d80a7e1c2cdf870c651b4615bff59cefc4d5bbc9d229cd961181640bb

  • C:\Program Files\7-Zip\Lang\gl.txt.tmp

    Filesize

    44KB

    MD5

    f94e1e6805c557738e93d3e3931b685a

    SHA1

    ac318552d89d87b5f7f79022aa6df3d9a4ce4861

    SHA256

    ccc5ce7c336a41c75fe3e71eb33d53c8b271356064d475ef7ac8ca5e37f5d21a

    SHA512

    8d2c9c24c6436806ea98de969db656f0ae33f2e1f131ab61014602285367f85f02ce5bd9ddc38d4ef2296cfd3deaab5ce469acbd89b625880c680d7f5016549a

  • C:\Program Files\7-Zip\Lang\gu.txt.tmp

    Filesize

    53KB

    MD5

    ad88e32d988989a06460cff101619e64

    SHA1

    d41bd7d35e8fd25720e4e5680173c31281dd6818

    SHA256

    58d708b011ad5f16780fc01f8b9df7fafe433d94e8f2abe7a45018ff5d35a06c

    SHA512

    ef7fe25a5eca48f07d2409e0da1fe260d0cf34c5e9b4b8124021469cbdba57d213e9e9641a432402240492e2823ca0e4535843cb363835728917f922f210324b

  • C:\Program Files\7-Zip\Lang\hi.txt.tmp

    Filesize

    53KB

    MD5

    779d323a75c3d908536901897b8b749c

    SHA1

    c6b8473f2bed908066262c2824d1eb8e56d9cd38

    SHA256

    f478ad2786bcc9dfe226f2e28c223ec4ffba6280400b92e33a2ffb88fb450a8c

    SHA512

    2ec801826ace09dc29a11d93d92814cca9ec3ad56f6e5b8434633f671fc1d786701b01474e00f5349bf25317acae0385a352eb679ce32d2a6f1cc3bc6af03310

  • C:\Program Files\7-Zip\Lang\hr.txt.tmp

    Filesize

    44KB

    MD5

    0c28e5305a50a06d401526f89835628c

    SHA1

    89f4dc44a564f6536bf1e1ebc0494e204f8e7dc9

    SHA256

    38d1efb35347838c269cbc25e7aac4484f4306c525189961e1077ec4de118361

    SHA512

    bc978716b376beb6c36cbff6958db777ac29dcceadc75588240891a2fd2f35caf77215870215ce97413d40a34a8f9a822323c82eb768403a57a817702a7efd34

  • C:\Program Files\7-Zip\Lang\hu.txt.tmp

    Filesize

    46KB

    MD5

    938b1e566050e02bc9fb80198ead0a9b

    SHA1

    f455f25dfba85874997c8d1bc19fd2dbdf1f6db1

    SHA256

    13304bb51279a89d662600411f4ef4e4cb28c45a09ee76dbb6e144763e656c46

    SHA512

    6a91c68a4af49d460e2201208c3c8a63d517665c716b3edd1cc4ed98914948eaf9cb11fd51f44471bd078b4200c6b5fcf4937b35f06e999a1238dd263d9cd05f

  • C:\Program Files\7-Zip\Lang\hy.txt.tmp

    Filesize

    49KB

    MD5

    ba513f95b6bfc2705e02a885f1f306d0

    SHA1

    407d51fd7c3dd0913bc2173e5d025ba9c7b2c935

    SHA256

    b313dfff6ee02fd98a85d5fab7621ca9864eab589f2fab2cb20058bbbc9be17b

    SHA512

    9810d2c4feee8d74ddc140acad401d4af098dd3b1c59f291849b6c94631f0cc59f91c5d7d322ef890c3f10fe5dcf4e2ee14be932971f49aa0431b4346c6f394c

  • C:\Program Files\7-Zip\Lang\is.txt.tmp

    Filesize

    44KB

    MD5

    2012ba3740fe57d273298945436ea6df

    SHA1

    842b875e50ae8ebd477ecf20219cdb6564b8223e

    SHA256

    0e9d8579a4feb8f5e83187ec5972e6bb85236d9db417f03a3818b7cbddca6ba6

    SHA512

    a11e66dbecd1df1472c6031104b9a4e1e18a62e56bd4f5568f83f9f4de18a44a5de09d707d5b8031c182bc681a76df85d2255104e9de636375efe71e846c1d47

  • C:\Program Files\7-Zip\Lang\ka.txt.tmp

    Filesize

    36KB

    MD5

    c80ad9fe9694707dcdfd2b483e63930e

    SHA1

    88b90ae0d30bf462dd86650bc96ad0fb73a15f3d

    SHA256

    653b16b48692598b1c6171adf9dd38b1baa1dfca539c666459cf7bc710fd49cf

    SHA512

    dd6e640ce5a34ef51533654ab59b4399170eb7c9da7b6322374289e29d7fc7807d4ecbb1db40584a1dcec0955fee04156b1b6e14f797dafb18a07fe95b267d96

  • C:\Program Files\7-Zip\Lang\kaa.txt.tmp

    Filesize

    44KB

    MD5

    6405d63b23160f3a4a55f767061469f3

    SHA1

    e8cf1f1d1835244340211e2b5aec8c74a1283b55

    SHA256

    ea0637e228f6370b4857d38262e3ef758c9b7b546d383b2fa1b71b7389701a51

    SHA512

    a9a98bdf328da3861298d564c2642e05c09ac381a35fe530fb6d72d4669fb802948416779db0013346f476ce2addcac45526abc6264d0caf5f72e44aa6ff5a35

  • C:\Program Files\7-Zip\Lang\kab.txt.tmp

    Filesize

    44KB

    MD5

    aed652c813728a8573311abe114e8e36

    SHA1

    dba6e41f2efea57b32a8eda1ff0aa359247def07

    SHA256

    8673d3e07d46c76d401b89ad47cb07e9c9c74f149c5500c478fe05b4a5df0b58

    SHA512

    5e4cf6e6335d5fb9a09e9dd21a9f18648b544c4a157fb1f8dda08247f71ce35305228b6f250fa58488ddfa5f2c50721f7044d2401691c472aeea0135c2e48c45

  • C:\Program Files\7-Zip\Lang\kk.txt.tmp

    Filesize

    46KB

    MD5

    d266de7678b0541a1ae10cd3e6c064bc

    SHA1

    cde82aaad2c0b3144e0fffb8eeb36ff2947195a7

    SHA256

    f4ac7c70ef305e9f78b6f67b8c43e929c55fce3f4d0259f63fd2cb8e8bf8ef92

    SHA512

    330414d647f41d6a9a143b6e92cc1d4da87af7149521ea909f242405e0868560c36e94b6b15d53439bb34fbc6f9b9a62f7ad9732569209a0b3c2d0b738aa2332

  • C:\Program Files\7-Zip\Lang\ko.txt.tmp

    Filesize

    46KB

    MD5

    403cc00d71d27958a9275e9d94a79a6f

    SHA1

    9e88a327fe650d05ee677b9f39134ff41ff92b53

    SHA256

    b193c8f045e92f3dfa73924eca8c923b60ff98ec5a491390e431f84f36f849c4

    SHA512

    e9887508a7e251159accdfb1acaebab2a5e898ed3a1318b87ce59569d2bc70453d02bf2ff8e1f41b99c5be07bd30922007f5d30892fd013048bd7ac7cdc2eac3

  • C:\Program Files\7-Zip\Lang\ky.txt.tmp

    Filesize

    48KB

    MD5

    3b04cb59225ca0b1d2527af334f5f31c

    SHA1

    c15546ec480df6a85e2ddeba09ccff3402c3ddb4

    SHA256

    c15a91993f7716ac09684536316acc4ff004236af97d61af49adbadaa1d2404f

    SHA512

    0089ae547c6f29ec7903ee09c685d4e83610fde747e24f91ed5f6202f017bc95c39b2524a737ae36c95b43eadb57ab7a173c365937029584432769b1f1cb817d

  • C:\Program Files\7-Zip\Lang\lij.txt.tmp

    Filesize

    43KB

    MD5

    ff57ea99b080140e1f46576843bc885b

    SHA1

    d3bd98643f6ae9c063d2fa0e718d32ff16476ff1

    SHA256

    4d4502962d7b9e8fee2794e45b3189b5a5704269afd9e9dd4011e11a1df6b11e

    SHA512

    2468e08699bacbc3318553926caaa747136f8704bd78a76016331fd55cb0f4f9ec61c11f2aa85826e491652268447c53e4c7727ffbe69db7eeabac7b47be6abc

  • C:\Program Files\7-Zip\Lang\lt.txt.tmp

    Filesize

    45KB

    MD5

    4e8f4259f6158e84a15ee2ac6ea3a43f

    SHA1

    39944b36405864bf6117bc570c3e19364945a4fa

    SHA256

    4d0288e3a11dc7e8a33e1bcbfdd17ae0c3731f8ee8933091704efe2a42883619

    SHA512

    c86db2ba51bacc141f439960e19f3a2a9d8722ea5b14959df8c60eb33724505c86f207b9a9102b1053edcac09e54ff44f9fe0481c3b5dc9b1998c687125e5a67

  • C:\Program Files\7-Zip\Lang\mn.txt.tmp

    Filesize

    44KB

    MD5

    8495e322166e8667455f215cc27ea8a1

    SHA1

    7f090ec19fdcf2b057ded5409291ef622159c092

    SHA256

    2ac4e49206d599f7feb1019a8d8b6b5f326c4c7742d5bc7d75173e1ea44f2e78

    SHA512

    44dd73f73348ba093fdf57dc5154623e2d39694685d027f53e1f657c2ab4014ab57ae04aa3a7cbf8038a306fc09dfaacb2f82512f83ef4e59b649eb04313e4b9

  • C:\Program Files\7-Zip\Lang\mng.txt.tmp

    Filesize

    56KB

    MD5

    427ffd0ee47aa38ac554c3ae8607a45a

    SHA1

    b33bc979826a4263fcfc1faef733230e5f2bf6d0

    SHA256

    a6d65c49422d2558f3b2834b65b6017ff307289c85e7ae07b50a71dbec20889f

    SHA512

    d344d2a326a78a5efe0dbb5d50de70e99f8928e4eb665d3dd44be5e83258742c29f32cc21c1ea062a8e4a5406fb4c1257a232354ce887ba5baeb5e91dc94c2a4

  • C:\Program Files\7-Zip\Lang\mng2.txt.tmp

    Filesize

    40KB

    MD5

    956feeb159d93f08e7e5b0f2ab5a888c

    SHA1

    c6211502a6015a3c75f8508719a293745ff98b81

    SHA256

    c937ae63265cbc5a05532ccb3c4ff89b81d9ffabcda870161a8edd2f22e2aab2

    SHA512

    40d70f39e65d946b53111fd4ab00d9455bb0a62321750b15314405e726e940ab57dd7bba8f9b4799d4fe76cbb09fdd552c5a43eb5bfa7e4ca45291b2561084c6

  • C:\Program Files\7-Zip\Lang\ne.txt.tmp

    Filesize

    49KB

    MD5

    1b91909d9e64a202b88830adf47a1333

    SHA1

    96aa4518cacc444e76699ec039ca3178ac4a393c

    SHA256

    0b4d3c91f7ff968f0c0c8283f6fb0b0fea7de6e36fb0dbfb9a8190f89322f2f9

    SHA512

    5fb890125b1cc006ed582d13d1ebe6ef40f1e75aafcb7f224fc24aac262692f254bd5f6fbb65ec7febd1b69ae3fade58a8849ca2bf294109fe20e39aa2ea1e85

  • C:\Program Files\7-Zip\Lang\nl.txt.tmp

    Filesize

    45KB

    MD5

    9220f9765f9631845b489022fa8a79ea

    SHA1

    a53d88fb512c2094cb21a551e7cbbdc6fab43513

    SHA256

    4771638981f8c12e8a1c197df98a5bd18d7c615760444b5b755fa996e59b7f0c

    SHA512

    6a4276f3f84c5b0351f40f3a90ba0b2ea84b41ba3eb424712d05180e57532a6f3f48293e14ee46ecce20f2a8f256724b8275bed89b81170664cd068f0c91a60a

  • C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

    Filesize

    50KB

    MD5

    019ba65a61bd8c24a73f7f1bd00f26d3

    SHA1

    21d6862ce26ae8e178d24a72798e38d76fbb5c88

    SHA256

    999d03fe8c584507bde13eee9f0813bb983deec5a68d28887fafef7479e0db7d

    SHA512

    29175183ef6b844d0fa269e64340444a1ca99e0844adfd8f375e56c3c7a7d45950f1148420273b19e96d63b98e3a087819808061675acc3593774e942a4c9872

  • C:\Program Files\7-Zip\Lang\pl.txt.tmp

    Filesize

    36KB

    MD5

    5d38f3c0570509f05b58845377244031

    SHA1

    2c1118147d2e60f7534058ff85f20605d77ea678

    SHA256

    52de4868177b40d8503e87f7a5ea09c6b6504dec8280691dc9a3b819e62e97ca

    SHA512

    e379f3c23d97231986fa95544d1d478fd2978018734a9f580b5bb39b33fc14bf4f62fe75a4388de1bea48383d0342de18483d47d34f8055a07e9a1a92e5011b9

  • C:\Program Files\7-Zip\Lang\ru.txt.tmp

    Filesize

    51KB

    MD5

    9bbb12ea8135574ddcf6c47537b361f4

    SHA1

    b5e230f1461a75aebe59c98c55dfc5f9d3be8dd8

    SHA256

    a4da3fc0dc55ed5b37b143810988524a6ee3beb62a3ba0b3c1736046b48b7038

    SHA512

    0e84c6de5ab310630055ea0b75c0e1e8bdf9151ba21d3f949e2e453c88f675a12fa5e8202053019507ebbe1692f6d8fe65f1a254e841a6b594df13218c5da633

  • C:\Program Files\7-Zip\Lang\sa.txt.tmp

    Filesize

    54KB

    MD5

    ae448349fe29d1aba1745824eb923741

    SHA1

    87f521d26d74e938ee32e33698cccc4d28f44d97

    SHA256

    602678da36f48a416242ba9a81c0f00299c0cb0a8b2553bb56134dddd5d2e3f3

    SHA512

    40475d6504ba4539138037ef1bd76812065b0ab39ed3362b294eb64f532574212fc5882facab3e966d3b1399725f5eba417f497660bbaccee13ea7b4a250b478

  • C:\Program Files\7-Zip\Lang\si.txt.tmp

    Filesize

    54KB

    MD5

    4208c6b9624832ea04c9574783701b2c

    SHA1

    5cdc31b1b750f9c9058446593bdde255763eba91

    SHA256

    4f17b0692808db751303121cf6042072875e9217c0a7949bb3862b0e2c34d6bd

    SHA512

    47f744142e391299cc2f95bb22db40d4ae56ccfce0f4be511685c0aedb4539582c0006e5d7c23ce4233effe84b49b7cc9f15e32c69d49f36f3c98ba3b432769a

  • C:\Program Files\7-Zip\Lang\sw.txt.tmp

    Filesize

    44KB

    MD5

    90b74f58a96c43ec9581a665fa042671

    SHA1

    a75151b7924279a070b724d07f0f9fb42024d71a

    SHA256

    8f5241c37334f865d4cd6e30fb22e5468f0d5ae5f050ec3a34b2091dc3d6143c

    SHA512

    05d71dca61328044216b9e809af114ca702b5dd43e862a836184381abc5b26f78559c7e1e7db964b87b30c213e91648ca07b2968231f5ffc7e4a6bd445d8dfe3

  • C:\Program Files\7-Zip\Lang\tg.txt.tmp

    Filesize

    51KB

    MD5

    2fc959005b2c9d0871ae6e2456330b83

    SHA1

    5e89f0d5a4a5ea126fe05354f6bd691bbbb884d0

    SHA256

    85368338cb74208e1d7bca61b8fd9e45d6422d92ebcedb10ed8d4efbd3df28aa

    SHA512

    03f501392b92c8b55a9d5e27861dced99b851497736697c103509f89436b7a05abec04eaa3506e3ea606cef8a096f9a4c6ebcba37118612e1eecf5e74981254f

  • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp

    Filesize

    52KB

    MD5

    513227f7f16fa2d985bb3bd535e2799f

    SHA1

    3ea9de52a3008d7f61d07b32b23b4ffe8278b395

    SHA256

    656fe2a209f69eca7e3488a05930af83d8076127c5364283a564dac91e839eed

    SHA512

    4bc973c3140ee888aaa11750536381153a7fcaaa5ec065d57367263ac3a4b000303adf32968337c0b3e6d462431ddeb86d957b4e474861d25ab22f174beb6941

  • C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

    Filesize

    36KB

    MD5

    08aaf593ec187267fc7ce6b935ce2f66

    SHA1

    f7efbfb80d922b12f5c1a33138c5db1e03837d7f

    SHA256

    ef8b0d1c59b8669233d1f7a78de5a53db71e48ba2df2a843c0d731d995447046

    SHA512

    8969b88ae37833d28383c298dce66bf19aca4c07445e41abcb73a832b59844b38abec1420241b631eb27864235517932e2cba772d62ed9a07a07ac275437f435

  • C:\Windows\SysWOW64\Zombie.exe

    Filesize

    36KB

    MD5

    a1920515ac01f7afb09c87bb3f60b578

    SHA1

    3e9d60b617263f4bc2c8a577aadcde0162c33942

    SHA256

    06dc404cecb509d10625b420e10aebddf3d25fa738c6e3c40e0255d5558896ad

    SHA512

    88608fc93d0edffe5c4e7d1ea0c30e3d63197ae6cadbca4bc495fba55be57e178c536836a04f10a47be80e8a51cd340cbc4d8f1a1795c3b99238889c3e31fef8

  • memory/1788-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1788-1168-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB