Analysis

  • max time kernel
    32s
  • max time network
    34s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-09-2024 21:02

General

  • Target

    Install_02026.exe

  • Size

    67.3MB

  • MD5

    413fd1eb6aa9f36e174122b514bfe4d1

  • SHA1

    15e80eaecc128276cab451303944d7e13c375c7c

  • SHA256

    eb0bc6733fc0aef4ac50d60ba355e8469e903cada2480e0d8deaa65a777d6748

  • SHA512

    446831c76f7268e4d2ec522ca3c454254fb377602a25f164d18e3dcc2352e66c7cff94c1413cc7d579ba97c4a0654fa9cf146b45a55d9920217eafb772174984

  • SSDEEP

    196608:LQFgLRKHqT3OgmAC6WtaqyF6tkcEERPUwxHB1cJ6TywN36X8psOaJDz6:LQFgvT3OoCcgtekPbxU2ywqJ51z6

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Install_02026.exe
    "C:\Users\Admin\AppData\Local\Temp\Install_02026.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3588
    • C:\Users\Admin\AppData\Local\Temp\7zS40E84EB7\setup.exe
      .\setup.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Users\Admin\AppData\Local\Temp\is-NDJCJ.tmp\setup.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-NDJCJ.tmp\setup.tmp" /SL5="$C0050,9075004,121344,C:\Users\Admin\AppData\Local\Temp\7zS40E84EB7\setup.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:116
        • C:\Program Files\Double Commander\doublecmd.exe
          "C:\Program Files\Double Commander\doublecmd.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          PID:3148

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Double Commander\default\multiarc.ini

    Filesize

    2KB

    MD5

    9b8712fcfb311a18d827ade7e56218c4

    SHA1

    1683ca1e45b4185edeff6ee48a18dec651941a4c

    SHA256

    975471f9c954c3cf29cfd8b7cb71ad6e295c3a2f1974657d1f65761bd2554c86

    SHA512

    4f987cc98cba93e815d8dd25ad862cccf9d660720025e96b47c382a26e79415c5dcadfc74706d1063e6115630eb61376aa37c47dc86a8df9751dd96d485d8f0a

  • C:\Program Files\Double Commander\default\pixmaps.txt

    Filesize

    582B

    MD5

    67a1278219c6a33e9804777435f3c382

    SHA1

    5e08302b8ab7b35a8e1e83573f1bdb1e21ca6dbe

    SHA256

    2314c42ff84a161bf75f65857265b199ca300c881f7b50b73e4e482a25881198

    SHA512

    8cea98810e1ca013c64e5efb0da72db23a4c5aaba2c0488c6adeab1867887d4828512adedfbe421d068d33be73b8701e431a28e5da913c1b3ee13823306dc2aa

  • C:\Program Files\Double Commander\doublecmd.exe

    Filesize

    9.8MB

    MD5

    9b1ecb1cd0ce4af1b97d13b0183202f0

    SHA1

    8a5005fe6f11515346cdf840b3988aa4af5af419

    SHA256

    6939dea8126f5cf97a3017b845e369c01f1ca0b0d5228a5366270e21feae6386

    SHA512

    0f4bf4eae5b4bf92f8f5ae8937e79e88f96cf8154664635344f699240733521d05babe5cce8abbcf7d94a49ba3f0459dca713a25a2ebc705094b0def4c19e814

  • C:\Program Files\Double Commander\highlighters\Assembler(x86).hgl

    Filesize

    21KB

    MD5

    1b09c091b11be87ca2811812de6a03c3

    SHA1

    ae5548b9208d8d627d58f2840c303b3c0a465488

    SHA256

    9832c55d7d45e671a8274d1b15c5b87c46877c2e8ccc7f63a61ac9bf2c04495f

    SHA512

    3bb98fb90467095a5a5cb5a020977adbc340a40c35c8e6f85a56bfce36287e10dea95de0f7c7ce4ae83c0eccad7c6815e55e7c95777d0bcaa2b11fdbd665dc87

  • C:\Program Files\Double Commander\highlighters\C#.hgl

    Filesize

    7KB

    MD5

    73b38b266aedb7ed19c438e2016dd681

    SHA1

    486684c243ce56f05aae28c34f3d51d989cab002

    SHA256

    d89668f817d119a2729e5753e2ba508913599317ee27d3c31a07f8fc9b00c4ab

    SHA512

    d783dbcce84d8f1639217a7f376e1fa7ee57da2f8a4608bf762bff623e10de91070db8d6783762740ee767e5d9c853e1cb913cdc7ed51b26694d9446eba587e7

  • C:\Program Files\Double Commander\highlighters\DCErrorFile.hgl

    Filesize

    3KB

    MD5

    60aa9b2f1cc7dbd6904c57d516907402

    SHA1

    a80782f63937ef9097706886bdbfaa6fe1ed6609

    SHA256

    1f4ce726deb30d0033c89cc9e90738d7a88d361e4aed7a37c127342be486fb34

    SHA512

    cd64851656dec2537af150bb63d60cdf907f6f12afe95d9ab5eeae46198a00f42904361de4c954b1cd667ebf1785eb57cb9b12f3752893444360b109239e38c0

  • C:\Program Files\Double Commander\highlighters\JavaScript.hgl

    Filesize

    19KB

    MD5

    d51f1004aeac90d8c692cac1e2767fae

    SHA1

    75ad4174ff6f10bc4fd9c14db4acd39509116b21

    SHA256

    99d1421e05aaed9785293651d795a01124e31af2354d1c414edf3319fa2ced04

    SHA512

    d0ee46c823a96bfe5f99b62a195d407fe0c845d0d4b92eae527ef321246ff14c9971290e12d832b9374d09f2b58b8b52cae17fdb314cfd457bffc8aa5618cdc4

  • C:\Program Files\Double Commander\highlighters\PowerShell.hgl

    Filesize

    78KB

    MD5

    97f309ef5fe7112c529fe376723a12fc

    SHA1

    3af19c91f99e983d0f1821ac411d92fcf6d9a48e

    SHA256

    ad3efb83c7af0651a76fdc111ccc8fff26516eb9ecf8d2ca0197e2efad3ab8e3

    SHA512

    50521952619773c5ceacd4288f2fe608a909ef40b0bf0318ef8b2b61716c6dbbda8319a6a1c466da55c11b0bab5908b5333f9c0b36aa437bf044b3f285c75092

  • C:\Program Files\Double Commander\highlighters\Rust.hgl

    Filesize

    7KB

    MD5

    f028925273a620fa77ebb961f6acde09

    SHA1

    c4d12c27c120ac4be6e06026dfea2fd9367ed7eb

    SHA256

    0e7b4ebd2e911ddf433c5fd89e5c7fa3f4580628665fff1e1374256529d42079

    SHA512

    7a71766fa3fb54dc6e77a2fa4e89f8b97c183be7c3aaf23749327d05b2df3ab82fbb65907dc528d91d753ed1881376b401dd57ae32d27f40cff0fbe29c431efe

  • C:\Program Files\Double Commander\highlighters\highlighters.json

    Filesize

    21KB

    MD5

    ec593a338132b7092ead48a749e7d7eb

    SHA1

    77392b48cf907c6de3e6651464929a4686e32889

    SHA256

    91bd68f5a5d93e3ff66202b02bc71d82650ec96b15845d940e20584cfc2b1a4a

    SHA512

    986cbd72b3bf61b4cb67fae9f6fca90d7b16fab13f656cafc726a8a474f5423ecd05621bd631e203734e8aeb3fbc56eedfb09a2b520f326fa6de38ef5d057d74

  • C:\Program Files\Double Commander\libpcre2-8.dll

    Filesize

    484KB

    MD5

    d5a01ae84c3a4df6d02081b63ddb1641

    SHA1

    1a52877b6081bc214d09a4b460c0784a94cae819

    SHA256

    c8584869e9a9ca37db91a9ee63623c30205bd3ce22f69c2988344b5041f17d49

    SHA512

    04c719613824e70934df97ce15fd956e8828823eeb4407d6a7d872a7b0554bd23530313ae081ebf23d86e6d412efe5f67221986ab282e2f2082019a83ba51599

  • C:\Program Files\Double Commander\pinyin.tbl

    Filesize

    40KB

    MD5

    2ae5469f9efac68b001a56a169efdf90

    SHA1

    0fea84bd75a17ccafccc7fc23f69de2ee45a9ba3

    SHA256

    cd550d66b8659aeaf3d9cafd349cced07f45c7ff373bcb5e9f60c6f59b6204fb

    SHA512

    4012175f1bd4e8d3e374d01c0a62cd60991dd5c644fe0dd66b0964001960adbe5018183794c112776cca7eb30704681f77f0f7eb8dbc7f15e311e2bd2cf690bc

  • C:\Program Files\Double Commander\pixmaps\dctheme\16x16\actions\cm_refresh.png

    Filesize

    804B

    MD5

    7ac955da2f0093ba3cecd52fbc95720f

    SHA1

    e4e1694a4595080d5bf85c01a826d374f6d37ae5

    SHA256

    0caadc897729ebd1fcb2c57d0bee7a15c5c23d9c9a5fd57087b96e3dd656017f

    SHA512

    663a22e9abf442bcc8b3b0d7842fe2d579c1cc9d28425dad3fb99c4bc725885ed953f03f7f8860f5f97cc7f2df61fde362882d7a0f04df6f378e909e75f89719

  • C:\Program Files\Double Commander\pixmaps\dctheme\16x16\actions\cm_runterm.png

    Filesize

    507B

    MD5

    bc0d3d5aaf8f72d4ab44601664c580d6

    SHA1

    5000245ec6c0156e78d26306e13081ae5d395136

    SHA256

    6f16b1e915d796f3a28ff29eaaf48d5f4a2325ff3761b9d9ee6cbedc6c7dc360

    SHA512

    a2d36a254f05069b070ac436645c35f11709d94f9b03e9fcf017984bf75863ee8ba59e25c737a865594a0e2ffbfaf369d379e2eb178c3ceaafcfae50b49260b4

  • C:\Program Files\Double Commander\pixmaps\dctheme\16x16\devices\drive-harddisk.png

    Filesize

    603B

    MD5

    2abd316fa103ac0ce774dfe849d7e7bb

    SHA1

    903333c3f954c2717e8aff891c6cb6ea0301a44e

    SHA256

    9bdcaceadc974cd5b909500abd340f76fa1fb87db218cbe6f6770ed8a5b33e55

    SHA512

    4b4c7a90d5d2f6b868846ba1455c029264492410a9a46aa7ac789918c16cee375d5725ba2cc3819ae8b5d922727fb4d7700a22601dd8589d32c95e40aa389a47

  • C:\Program Files\Double Commander\pixmaps\dctheme\16x16\devices\drive-removable-media-usb.png

    Filesize

    672B

    MD5

    7ba4277ac4f588c02a8dcc3bcd97b0d1

    SHA1

    8cb463eb4aa2c9428bb0ca8f29e668c6e8662bab

    SHA256

    f201b094f3577b4dc9e85ba2f5b65ba39f23b20ef68a60df8b0576db089e9b5c

    SHA512

    3495de9c4d61ba2db787d5b4cfcc7e955b192a546af874eb9b0b2777ab093e5b11da6842e1c47792fdd5715c96db3209ceec5c5d65d8b32be177857605fbf575

  • C:\Program Files\Double Commander\pixmaps\dctheme\16x16\devices\drive-removable-media.png

    Filesize

    510B

    MD5

    1307dee1ed87c3ef4c3b8c529042744a

    SHA1

    90e7c0e27e94044fa3f5e7e9a6ff60b07832da21

    SHA256

    ef2475d0cc2ca87f8c0e1727f334cee9af9e30fbdbf16a8b305dcdbb3a0a569e

    SHA512

    67c808e60ed495460fdea26eec1fe93aed2aef6508223b7b5ed9c718d289c5611a6603bbbccd3bb0a6212811409dc6f9c032902da5c7e12071cf71870c23586e

  • C:\Program Files\Double Commander\pixmaps\dctheme\16x16\devices\drive-virtual.png

    Filesize

    760B

    MD5

    7a1199bd446e5b28eed628783ad82c35

    SHA1

    43b20622773ee163b99a072509f299ad6f91c13a

    SHA256

    b9a316bc700f178445926ec3eaa5f70fcbf888b20ddc2c1dfc8c18b0af14a198

    SHA512

    87f84de1c245d767338b96adce69b56faf482d77eebba460d2e053890519e252588e462fa4a84e83d66001634b2a8305cdce25378588ba0c29cd2cd9a5c3464a

  • C:\Program Files\Double Commander\pixmaps\dctheme\16x16\devices\media-flash.png

    Filesize

    607B

    MD5

    a369a7c70733e55f2062f4588a798850

    SHA1

    8ef43d78b29cab521b7dc737c83c26f6af127ead

    SHA256

    285441d6d61ed6d9b4470e4704fa3cdf598c0ebf036c5da1111a00d80525dcf5

    SHA512

    2e36407e5ec5ab4351e8594a7cd1131c213c4011fe4c8e5c03182a21082d0c595e6a589c14d8922ecbfa85fbdfd7eef87bec2c30cf82291d9727396432d41d8d

  • C:\Program Files\Double Commander\pixmaps\dctheme\16x16\devices\media-floppy.png

    Filesize

    561B

    MD5

    81006eea87aa1f5a4876fae103b7a0d4

    SHA1

    83fb13a0fcb7f3d88607df017690c8224941c5af

    SHA256

    00f9c686ea71e4c6f1ddffd605e35dfb1ca4157f0e65fd47807b7560f2489bee

    SHA512

    ccadeaa64f56bc6d6c920f29b164be62ff0ed34cb722a701585d0985ed00007cec5962eafd2d1a87d956055c076282b47525efeae85eecfa5dfb6b8654100c04

  • C:\Program Files\Double Commander\pixmaps\dctheme\16x16\devices\media-optical.png

    Filesize

    931B

    MD5

    6a09a46c3cd6f8a392dff593a8fd8517

    SHA1

    24e65166f975d08e8a1c9988404804de5a22bb0b

    SHA256

    8707bdeb48a1511665273abc83a5b2b412550e71c0d87454ad6ad5dcdd643ac1

    SHA512

    fad1dbb3bdb2a1d2b25338ae1e337ce289c2ff9ac992952c2e9cef2aa453719c7e517c7e3710fa8b215cde18fbdba6c2b007af7bd56ecbc214b7a385e320977c

  • C:\Program Files\Double Commander\pixmaps\dctheme\16x16\devices\network-wired.png

    Filesize

    699B

    MD5

    79d42851a6b159d269457e228302e626

    SHA1

    01ae7a1ece86df869a6e4dd68453fbf27250b8f8

    SHA256

    6dd76f1cc2ffa882055669b2b144ff00ad3b92cd895cb5a6dd6c3f78b5562e6b

    SHA512

    85ae0cb8b110fd05e920710a1eec2121b3df02b600fffe359d5a07aed508dfd94816e2a936c379d891c5586bc2936987a3e350205718531baca896488f3c23f2

  • C:\Program Files\Double Commander\pixmaps\dctheme\16x16\emblems\emblem-cloud-offline.png

    Filesize

    851B

    MD5

    8611d4c7671bee369554847ac93f84bd

    SHA1

    c75301f1a4e67e404b54411d25a0d108b9eb7b1c

    SHA256

    ac32829c056bf697806396bf2e4431835d1740c97ee5042b5c6225ae1d9da94e

    SHA512

    cd8be53f15bb51bd49ccff6177e1062a4e67f71219593f9720920875c743551384f1fb8183e4e04d1d72ecef4ec8a5aebf65be195906bd5b8b2182c1ce09d797

  • C:\Program Files\Double Commander\pixmaps\dctheme\16x16\emblems\emblem-cloud-online.png

    Filesize

    479B

    MD5

    f72b398f1e1df024d5fd9e4ee6b1ebcf

    SHA1

    d6348404bad2a51d51498f5f44b10ddf20e71305

    SHA256

    f928bd9b9ee5880d398047dbc53adcb26b5708a4e822d9169e6fbe40f515765c

    SHA512

    b9dce2c9ac26f4aea36cba5ed5edd8fcf8d9afa545a136d8bc89c1991ca38d78b2d4b2aff1afd820769c59bb5098f1f785167dc2736140ce48bcc38a7c547f49

  • C:\Program Files\Double Commander\pixmaps\dctheme\16x16\emblems\emblem-cloud-pinned.png

    Filesize

    880B

    MD5

    7b0e5bd9ab487d041eb909b8758c70b2

    SHA1

    b78744a10abf79919f4084eca926a9e1905b69ba

    SHA256

    084e8de344cd52efc24984b7e626f5c85cab430954597e185079a841520a6928

    SHA512

    a9b79625ffa0d6392c3b472412238505117d3a8c698aa28df7f1dca374f4a588734107759bf83259fc4a2c72aadb6efbebe747b6822cbb4dcdd3287177cf3e0a

  • C:\Program Files\Double Commander\pixmaps\dctheme\16x16\emblems\emblem-symbolic-link.png

    Filesize

    467B

    MD5

    13204b47bcb42ad7a46cc6add80f6558

    SHA1

    3e29a110ce98bf36492be518320e164f575941d1

    SHA256

    2b0bb75daa9e860068b9ba3d718625861ff371f4353a49c26c2a5865aa4686eb

    SHA512

    380fbbf013012dd8ea5716365c4ba170bf64296b1553a50efd5bd2b5cd8aa4a016fea81a79f8ec8e31070df453fc5ab8fa078fca185be06fb2a81fabe99d97d8

  • C:\Program Files\Double Commander\pixmaps\dctheme\16x16\emblems\emblem-unreadable.png

    Filesize

    841B

    MD5

    a8deb420b1dcc84fb6245c53647ee1e8

    SHA1

    26adbe4e11b56e29ed68a0c7d880d9e4033b5e86

    SHA256

    4724157e29b64ef3425c9692d9627481386846ecdafb75dddd45cfb290486c5b

    SHA512

    b7e6902ef8ab14e2433703c45cf6463704f9ee016fdf8ef1ac0185a9f69ed23a8ec13a2bc93bac6df5bad6eedb9b20532dc01e83d9ac9ba14f6ae217e6fd691d

  • C:\Program Files\Double Commander\pixmaps\dctheme\24x24\devices\drive-harddisk.png

    Filesize

    719B

    MD5

    5e91dadacd07736c0de6ad4120da299d

    SHA1

    59214c1b20f0e85c61fd4b7ef8e87ef0cfad064f

    SHA256

    998a1b3abd2b3b9c3e4b3dc6daf21edf9d4b061d10adf15657f807883684b207

    SHA512

    a3d00cd5b90f2a3f233e9e3c9d490aa679723fd8d8fcdd5187457b0bfee2cd6a568f4cf8f253f4deb9e0f90a5863ee8ade1a7b47df6f5b3410dafe80621a3010

  • C:\Program Files\Double Commander\pixmaps\dctheme\24x24\devices\drive-removable-media-usb.png

    Filesize

    1KB

    MD5

    7187bcf7b9a641073f3edfc969fdc917

    SHA1

    56820d4524b4462c7b854b3b728fe39eaea092ee

    SHA256

    7c4fcd201b850f5bd793f8320612a73e869efaa42eb5caabe069e84ec776ae86

    SHA512

    0050ed36209e6b021e083e707b95cc557d27ea3941075b83bd730ba7499fde260a8643fba90d645bfb36e31895e7eceab195effc3577940d73e6df962b929f75

  • C:\Program Files\Double Commander\pixmaps\dctheme\24x24\devices\drive-removable-media.png

    Filesize

    836B

    MD5

    9df1dace690c45dceac4f921b590f362

    SHA1

    fb6bd7b357c23db2579144999731c25f31186448

    SHA256

    6629f8a49aed9bfcd57961e0844a8d30f508546a7e3ff7db9d4c8c0734039e94

    SHA512

    d76d200e04627ff54da49e0b2573091e95a63d0e1da8aa70c7b6a8beb4366e44047eb7160b61d5371fea973343bb3fffd9bf92e1a35e4c6f5e4885cb03739d14

  • C:\Program Files\Double Commander\pixmaps\dctheme\24x24\devices\drive-virtual.png

    Filesize

    1KB

    MD5

    4bf86dcf583fee9d99be0882e7d78b1a

    SHA1

    c15125cb77fe6c056623374140b4bbb45262d28e

    SHA256

    d58e724b214eb5c4c298842e19ccd23ce9bd91d43a736877b713291b71594999

    SHA512

    37b40b52184c5dc80b7949c764e693d7784e6ee1fe857e739e24b7cb357ef3fd52f430c45991b097a63c22c6206c5a6991ea95ba2ac4c5864e43a643c87a56fd

  • C:\Program Files\Double Commander\pixmaps\dctheme\24x24\devices\media-flash.png

    Filesize

    1KB

    MD5

    9f0ce30ee6f047a1da94de95716e11da

    SHA1

    afd259cc90da59b75c4b6fbca47111d78eee13fc

    SHA256

    0e026af7c75bef6f555e4c07d57d2f5211dbb266b091b55b48d164e226988510

    SHA512

    10869cb80398492f56eb2e28acd3464c715c711b6d43301af1e164af44d217b05927d9573b0b312370fc96f0bcd24e998b46d3408cfc33de43c31f6f3bb8cef5

  • C:\Program Files\Double Commander\pixmaps\dctheme\24x24\devices\media-floppy.png

    Filesize

    1KB

    MD5

    5104d542104e9d85bb391a15939b32d6

    SHA1

    a737020a5025d44ee043e2f389e1acbfc5dc55a4

    SHA256

    f9caa903b36b27613d91be9c93a9c97a0a527545ba7967a3030d9176b39f5b30

    SHA512

    dd1da766b14843d0c7788f96720a6bd0f8a9b00b3592b808727c15b67d727e5b8feb28336cc4d264c601a9e3403f64d662d4b07e9fafe91d97623a10eb1a7bbc

  • C:\Program Files\Double Commander\pixmaps\dctheme\24x24\devices\media-optical.png

    Filesize

    1KB

    MD5

    d1715884f20529c6b49225ab93646a28

    SHA1

    42602d917b993a379fbf686521addee7973d8fc3

    SHA256

    7213a60034038380fc2ab7595b0976bbb3ef6462d1c1ede66eedc02882b3f6df

    SHA512

    522a87d673a0bb6d1cd04bb5e270bb0057e4c46c5274ee1d44ab247df92632c95b9da9cd0ddf7b8acb4d7d07eb40600e8f9192a7518398d38f14e6909bb48761

  • C:\Program Files\Double Commander\pixmaps\dctheme\24x24\devices\network-wired.png

    Filesize

    1KB

    MD5

    d7d3e82aa43ade6d0c6602943e99de1b

    SHA1

    7f1aff04b554c59a20fdb4b2e3e640b780a93580

    SHA256

    95edcc3e9af1c00842e383e4b7805062c9392d2c60f4c7283fbf1b5d15ea6487

    SHA512

    c805fa5dd577d28e648631bd2627390391d7a526fdd5302798953d53641759671b6926e3baadd5dc210665bb113412fc6b5ac0abdc8e04f1510264dfcdf5d1aa

  • C:\Program Files\Double Commander\pixmaps\dctheme\32x32\actions\go-up.png

    Filesize

    1KB

    MD5

    0829e1ab6a407a7510e5b8766fd22fcb

    SHA1

    3b724cbbbb07005e679df10a755149d0c5731bde

    SHA256

    f7fee27d91c36076ccb35789c12b8ecbcd93f46edac196afdf83cfd60d3115bc

    SHA512

    59ef8d1e90c6ea00833ae58b3af06a3473369aa15a75d203ad226c9f606fd4c3dfc240284ee4560034bd58433bbda0715e6c8e3dbb1ac924143a698a1e94a823

  • C:\Program Files\Double Commander\pixmaps\dctheme\32x32\actions\is-CM4N8.tmp

    Filesize

    1KB

    MD5

    2b644c8d0dc7541c654abb1802339158

    SHA1

    544c4476a9c92535af144bf8941d405e52520fb1

    SHA256

    6201ce6a7fe774f4b5604f52c7c30b0592bda73928200adc71e3c22c68ac4d50

    SHA512

    ccd4757634d8bf1440af3119aecd45447b945a132f46c93b62447542843ba8a8d2b2776dd34505261e7c4e93367110da34e473c545895931adab98cd9c3c3dfa

  • C:\Program Files\Double Commander\pixmaps\dctheme\32x32\actions\view-sort-ascending.png

    Filesize

    515B

    MD5

    bbc6a5a9ab3a30ba1b70f3f501982553

    SHA1

    916b0c94ae03210f2056d4c9a2988fde0ab8bf99

    SHA256

    4da683c3fac2a8ad13a250001515230eb90b5d554874dd897c11a2aa3b6a8aef

    SHA512

    0a5494e8765d28d7a124129bac06df88cad1eb74de02b6f5dbdc0948693c87a6d70e0423e483ac00dcedf72789225c0785664e083a80c9c76d905b191947c153

  • C:\Program Files\Double Commander\pixmaps\dctheme\32x32\actions\view-sort-descending.png

    Filesize

    509B

    MD5

    40a32279c2594033357ea867b1d27653

    SHA1

    9ea8569993193817ccf09c9b8988749f1a7ca4e5

    SHA256

    c82da3e9d408d7a47f3177f16d9f8db1202cb80ff18faa727c01f7822dc19227

    SHA512

    80411bf21ce9bc72c40d88c31ca17028e4385fd6e5760cd5ed700430023c2cd73300f8bc6c69d503d1f20a262c4392734ca91427169142f7e78d6ceb89d8d76e

  • C:\Program Files\Double Commander\pixmaps\dctheme\32x32\devices\drive-harddisk.png

    Filesize

    1KB

    MD5

    a42dc80e58ca222bfea3479c86cecc43

    SHA1

    302810d8810a9016dd2da34cda4ea5e833a5d1a8

    SHA256

    e4872e9572487bce9eb2eb39aadf750ec94b401ad6c1aa993b44eac39b3e33b1

    SHA512

    0ac51cc8b6d7764d583d05072b1527a96c0fcd3547920b6260e4c14ba14da9548cc20d4969a3f54c8d0e2f9a1b5652f98de62dea1ff565eda4c860522452abd7

  • C:\Program Files\Double Commander\pixmaps\dctheme\32x32\devices\drive-removable-media-usb.png

    Filesize

    1KB

    MD5

    c351424286f8a33c5b163a7acf573cf4

    SHA1

    1bea4a8875f6701027c0a36ee800dea60785823d

    SHA256

    42351d013356a23c6d6c7b7655cd7692928d4f00f0494ab5072eb4074dc376dc

    SHA512

    f2e522a070f6fc2b977a54634099cc66039639970ca820a905fea0c0f9b7b7285d0ac188260ccbe3ead705d780c055f1001dde8bb08075a9b22957d6a9b8156f

  • C:\Program Files\Double Commander\pixmaps\dctheme\32x32\devices\drive-removable-media.png

    Filesize

    964B

    MD5

    1abb00a1d95933e9b1a2bb0d5432ca62

    SHA1

    15fee6b0c51024742c5ff9403d1bc69c25963034

    SHA256

    6f022b38145426647d365db046b215117b04d71590f3a4386aed400cc8214b2d

    SHA512

    9d7fa0b9644f2290fb95829b0fe04d8d7f13b7af8a7af64360a434e65416e21da405fae9380dbdbc87848d065da485768902113e9d76da705428606b3f5f2674

  • C:\Program Files\Double Commander\pixmaps\dctheme\32x32\devices\drive-virtual.png

    Filesize

    1KB

    MD5

    896b203705bcfc71067c07ee416edb2f

    SHA1

    e6940c773360b53e943cdaf77b6e2e64762c9c40

    SHA256

    07b33db95c079689287b35388a1a6505feae71873afdfa74afafa65bb90a99d7

    SHA512

    d359e6ab2b0cde03b0fa3bba6ab25624295d3d56b56f6ed8048a1d3deace6e56c0974f761487ca0177c2d0db3a871960074024a716c95ca4cb2243ae25918f09

  • C:\Program Files\Double Commander\pixmaps\dctheme\32x32\devices\media-flash.png

    Filesize

    1KB

    MD5

    65341c73423d8d2a0a415cb5b9e80139

    SHA1

    5d4593ad1c5e42103b395649c1e8db436263b383

    SHA256

    6d47a87734cc7040155564f30251dca353d5250924fbfb159cfbea907ca9c7c0

    SHA512

    b755081531b9e11d541e87ecc0414a10a94d7e0c508c2c5ee45aa8253d204a9226a259d688d31d8bbf559f6f77b59f6dc6b947f479669856be87fd0afb0af490

  • C:\Program Files\Double Commander\pixmaps\dctheme\32x32\devices\media-floppy.png

    Filesize

    890B

    MD5

    06a58df1a9a4302d8764b6f4307854ad

    SHA1

    79ab5f63355de3f50a7f80ddbf7596179d18c069

    SHA256

    b19ed859cd1b5be7235a7b6c3cc2782617eb73f4a87a05d71926251fe8b0722b

    SHA512

    7b94996dc4fb49dea78d068192686b45dd1a4ed89be31233b1f8b3849ed7f70edbc927dfc093f635a889f6177bd10396767427e0e842df0206e47ebe765b6174

  • C:\Program Files\Double Commander\pixmaps\dctheme\32x32\devices\media-optical.png

    Filesize

    2KB

    MD5

    570ce2a32ad6e9faf18d7c1e0b95514e

    SHA1

    c20760f9b3d2073cf9af50fcaeb76909954a1169

    SHA256

    ab2f8791d632e5cc4c1d95763a7b210d2f6dc1100a59ef281df3d8179cb48e4b

    SHA512

    b3f991d27ea41c9e1c87c0c9e9fdc889e841671d160400b5b5f6d8d3000ad9549f7c6fc755939611e9b471c49519fbd26ad455cb8f9aa66610cfd741c9c200ac

  • C:\Program Files\Double Commander\pixmaps\dctheme\32x32\devices\network-wired.png

    Filesize

    1KB

    MD5

    b49e42e5b7c073ff4b9da6ede693b611

    SHA1

    638aefcc7417ebffa3dc29ebd5a905b92200711b

    SHA256

    ee8a3e304fd10d72fe9f50540d9fe20e33a3dea1f359ecff27aa0c7f3b31e949

    SHA512

    ea3865c1c625d06974593392764abfa22d26b31e01c645d5b9823ec95023b90c1f23a21ecf66a231745f195643c0840a882730a69ec4808420612de7acd61483

  • C:\Program Files\Double Commander\pixmaps\dctheme\32x32\mimetypes\text-x-hash.png

    Filesize

    842B

    MD5

    5206a52474ea0c01a967130c81958218

    SHA1

    6513c79b0349780e6fac6e0a7d56773183ec33ed

    SHA256

    88e86e7720faea884117ec96a4019c87283e3e0bb988ce6abee87c667159194d

    SHA512

    71ec846bb0243fbf81462944dfbab0b52b1434210d8da7122c1ef4b0e7d026666d2aef64005dca57f0080441a69584722d7a87047252f4f7a94db15389235c5b

  • C:\Program Files\Double Commander\pixmaps\dctheme\32x32\mimetypes\unknown.png

    Filesize

    1KB

    MD5

    5cde522bb175bbb39bb87bf4fe59fe8a

    SHA1

    2e5265c26cf0dde0a8d9bf8a5dd37ae577652015

    SHA256

    06c84f0f9d229964280aba4fcc17266bafeb30f6bf07b75b43e07fa37f504a44

    SHA512

    7099292cab480da0933bcbce2fa97bdd27cc20d8ff9b48f653bfb88c6540bd3b53553040ae43841642519c8ebac43e111043c6925fb8d0fc74e2055f3e823544

  • C:\Program Files\Double Commander\pixmaps\dctheme\index.theme

    Filesize

    3KB

    MD5

    3bca8d19608640f5074e0dfc47e488a9

    SHA1

    da8920015207ca3eef08cf72f3c9c42cc6829351

    SHA256

    9bbac32f4f63584c202724fbb2cc26d1a5565cd2d7d07da4d86472d694d35393

    SHA512

    32897a6cc0d7b2699a0fe940d6a9c2b8d818027708d2b796b86b137c8e20e387893eba758b551a15586bb7980081142add030349d2fc4439fe560b07db8c677f

  • C:\Program Files\Double Commander\plugins\wdx\audioinfo\audioinfo.lng

    Filesize

    2KB

    MD5

    10056e2e53806d8076ef0797e2f2c91a

    SHA1

    0d54d1199fa5f65d7e9c93dc140c888b448380e9

    SHA256

    807855a418efd8489f7dd1988011f7e123a7dc84d26a376aa6506384763dc398

    SHA512

    4e1d3ae52edaa8f6df4bab388bcfe2b569dd282bdea3101d1bbd86486e8780882c71fe7c57be4c4f38ab40b28788ab7d88bac11bc1497786b3034c1898f8e826

  • C:\Program Files\Double Commander\plugins\wdx\audioinfo\audioinfo.wdx

    Filesize

    488KB

    MD5

    a50cef7b34d7804ffaa2781d0644b932

    SHA1

    8202bb1131875140d0a34653d99c3f701ea875a5

    SHA256

    0f5d48af4d855d81ce99099d1c5e0d56847ea4859dd6cb627a1e48d761b4e26c

    SHA512

    b9a766fc4ce93aad61ecf15462879c4ee84c4dab3f588dbd2183d07640afea9f87bd33114c29fb4d188be9178ec3f26ff2028b931d44b3615dc9ae22cc1f8b13

  • C:\Program Files\Double Commander\plugins\wlx\preview\preview.wlx

    Filesize

    384KB

    MD5

    ba42aeb59dafbb4ef22ff0f09312513a

    SHA1

    559df166baca1f3566438ff7ed64b628a9b24e58

    SHA256

    1a465b5cb5b242ac654747fbdb3af135a41417f446e374a40c2e0060a7079eaf

    SHA512

    636ceddf93fd55fb28a6716da9a95bb21ce6f7244c183a34934e7c6a2d4b87b9cb0f8a5a48a3a54168c449399e671f2db403fa2006b1e9472393ddf33590248d

  • C:\Program Files\Double Commander\plugins\wlx\richview\richview.wlx

    Filesize

    38KB

    MD5

    f3b87d1649ec796a8baa3ae54a9001ab

    SHA1

    256a7d46e45bcb4ef4ad63e04f126533434e3599

    SHA256

    1b35c800087e875a7e29be48e967a3c422edb79a0375e98525bc1bc9daa4294b

    SHA512

    6fa76f5280c5db97f436210a1214450bb8c9f3693dfad1e8e6065945a911c9b0e997e7c17de3d39473d15a7679ddfeba7ef24c57e6f52f2e0a5914a5224a4a0d

  • C:\Program Files\Double Commander\plugins\wlx\wmp\wmp.wlx

    Filesize

    329KB

    MD5

    b4be6010bda06cfae877e8e132a62b0d

    SHA1

    09c69be974af8c0afc1770bad1ab3f53208ebc72

    SHA256

    8539d50a29a9bc33c263eb760c7f31cfa901b580d2a37698eb7b474350aeb35e

    SHA512

    784b69b79e2745d40b0a2788030f7e1fbdfcc1c69820d2c54fd86c7ceeb0f34b36ee7185f168c87290984f8d33e184371b1a21cbd6cd87b5f801cba9ffb23176

  • C:\Users\Admin\AppData\Local\Temp\7zS40E84EB7\setup.exe

    Filesize

    9.2MB

    MD5

    ba83887461237a7c88f72aa79339ea9a

    SHA1

    c891b09adad0e96b0e891aba950f66d7b21bc721

    SHA256

    33ba72b281700e474ff44b0415e13adbe924bd35f30e6e213d6e27cdd6452a94

    SHA512

    d9f6f9abb9b410e69eb73889e2b4aecf3781e36c1c58d8d72dc179ec1ceca32e01e1dba5ad599e380459dff1d789b5b26adaa3c94c81e726112031e4cadee86a

  • C:\Users\Admin\AppData\Local\Temp\is-NDJCJ.tmp\setup.tmp

    Filesize

    1.1MB

    MD5

    34acc2bdb45a9c436181426828c4cb49

    SHA1

    5adaa1ac822e6128b8d4b59a54d19901880452ae

    SHA256

    9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07

    SHA512

    134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb

  • memory/116-17-0x0000000000400000-0x000000000052E000-memory.dmp

    Filesize

    1.2MB

  • memory/116-1135-0x0000000000400000-0x000000000052E000-memory.dmp

    Filesize

    1.2MB

  • memory/116-1161-0x0000000000400000-0x000000000052E000-memory.dmp

    Filesize

    1.2MB

  • memory/116-2538-0x0000000000400000-0x000000000052E000-memory.dmp

    Filesize

    1.2MB

  • memory/2720-1132-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2720-13-0x0000000000401000-0x0000000000412000-memory.dmp

    Filesize

    68KB

  • memory/2720-11-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2720-2543-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/3148-2596-0x00000000622C0000-0x000000006233B000-memory.dmp

    Filesize

    492KB

  • memory/3148-2608-0x00000000622C0000-0x000000006233B000-memory.dmp

    Filesize

    492KB

  • memory/3588-0-0x0000000010000000-0x0000000010090000-memory.dmp

    Filesize

    576KB