Analysis

  • max time kernel
    150s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 03:05

General

  • Target

    8483e47badd201418a4de45affd18166eeb375552ee685981de538ec4cdb960bN.exe

  • Size

    95KB

  • MD5

    488cadcf386827bae606577162da3dc0

  • SHA1

    96a73b95c00df4d9826b3b6b414f8cfdd8696221

  • SHA256

    8483e47badd201418a4de45affd18166eeb375552ee685981de538ec4cdb960b

  • SHA512

    619c1386677957b5375e439ec5e4eada3403932e6d8a22662048ec6ac56709bb7f399bd22de259ed667425bfb1d3ebebcd05cfd8a875ee4ef094415841efe268

  • SSDEEP

    1536:CTWUnMdyGdy4AnAJYq8YquTWUnMdyGdy4AnAJYq8YqE:SnpAekLnpAekz

Malware Config

Signatures

  • Renames multiple (5289) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8483e47badd201418a4de45affd18166eeb375552ee685981de538ec4cdb960bN.exe
    "C:\Users\Admin\AppData\Local\Temp\8483e47badd201418a4de45affd18166eeb375552ee685981de538ec4cdb960bN.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
      "_desktop.ini.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:4000
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:1076

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini.tmp

    Filesize

    48KB

    MD5

    5bd330abf6ca9d7d2dfd60d9a6ad105a

    SHA1

    4eac1f3ad948a89abb6ca14f5da895d38a483898

    SHA256

    2a6de47dd0b3988f1ec5e90ec81624cdab0c2a98c0776ba20225399bb3e3aea6

    SHA512

    a55102e1aa959b2a067ce68f8a3199b92b8632e90f99e3b3644d3808f3157c6a06e34dddcaa60d045717ef23bbb628643576ba6c32dc4d9f1e1733246d96809b

  • C:\Program Files\7-Zip\7-zip.chm.tmp

    Filesize

    160KB

    MD5

    43b7792eb7e7141b4caae4c2864c368b

    SHA1

    c08172477930de72c7d970c12cf4ec959645be44

    SHA256

    a58dbe0c598ad29179e9392750794105506fc463e15275a858de438bc8849452

    SHA512

    0f4b3b481c130489071d8f8d9f48c24cd19e8cf11e8884c9632b2a713de475b99535ae6376bb69ea2c650d00510f15a2ae74579846905fba5899de5567dc20a4

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    146KB

    MD5

    25c60b48a4a38fc562714495089f2d87

    SHA1

    f5927d3d10555559a520fe92d25e1bb480f40820

    SHA256

    2eecef1b9778cb37a71231b0435e6b606ef2a328fce91c2c2aecafe7f45a7f82

    SHA512

    b7ccdd35f1e351717f876f78469003856294b9635ede090e513254b6dc46079a9a17766a09c56d71c8c0a1a96b83ec6d21a93f742306962684a59ce47f5282d5

  • C:\Program Files\7-Zip\7-zip32.dll.tmp

    Filesize

    112KB

    MD5

    a863b7553794390437a438fa666f8806

    SHA1

    126d62f3359d23d7acac5e1d526148e74230c7cd

    SHA256

    8164ab7d870a7a88a0d9e01ae0e6d40f2d8f725b899e2d67455c8fd8322f8e03

    SHA512

    baaad5b3d275d29b90b787cbb7014ac7a21c069985722200165b539a9d07a7ed06baed89c55d10fb81b64b80b337b939bbfed634bf08b73d9be9efb0aaaa0ac2

  • C:\Program Files\7-Zip\7z.dll.tmp

    Filesize

    684KB

    MD5

    acc9fb01b4215dec657e238e08788a64

    SHA1

    1040e226edf0002f30638116b211d14457c09cfa

    SHA256

    5274f8d3fcc8407dd44894c54a4ef76fd6dc64a66b58bde275ba9d205426b3bb

    SHA512

    77ac7ca050fa5484b85f5066b9c03fbfedbc188fef8ad9b2a54d8dc621081e5526541432ed31037ff872e15569505d322200421692b53db97c67e8b5a77a7e50

  • C:\Program Files\7-Zip\7z.dll.tmp

    Filesize

    1.8MB

    MD5

    75211cb63ef824ec59a27354d5fd2258

    SHA1

    5a88b0285ec159f307472bd1a588cda5d3713f5a

    SHA256

    5427d3364128da4fe2d263c29a422aed443d476091972d78daa6806239ff71c3

    SHA512

    88551ebd6587527faef51c4e63af3246ba282c6b8f79ea7a6df3d98a44b51c6e8d91b037c294d76baf547a15303ad18fb39478d5bcf881b78e7ea9a9b3200fe7

  • C:\Program Files\7-Zip\7z.exe.tmp

    Filesize

    591KB

    MD5

    61c1d9f8549f70cfa9b776455d5bfc50

    SHA1

    5272279139e1ed3a021e53f5e300eed479f8a3ac

    SHA256

    7087f59056f513cc9acb6a09d3b911bcd840ed08faa7429d078314a0cd32126f

    SHA512

    e1c0349a3ce6d1109c2882aeec9b22a1b4a7c2d1f42dfc095664096d9cb74ca7fcb57ffc8f3a5193ac3f12efd66d4009e7a14e701cfa0a7381a8ce7faa9a9215

  • C:\Program Files\7-Zip\7zFM.exe.tmp

    Filesize

    978KB

    MD5

    13d57c5e7ff29c06bcbafe92858db69b

    SHA1

    e2ae62ef3e8374b13613835401dcabef7401c08d

    SHA256

    a662e929ff20c3f04fbe09eb6c4cc896e8baf2cdb5856097c7add295abfe6890

    SHA512

    794a31ed133f7c6a0e300bddcc3f5014afb21a1e094587ad564d4df8d1264abdfa82b1c1ddc162f2b3e24223fa97ed30f6c6772b3036da56f60aecf3a98f789e

  • C:\Program Files\7-Zip\7zG.exe.tmp

    Filesize

    731KB

    MD5

    1ffd3e920277c60cde715c7f94057ac9

    SHA1

    4e6e2b539214314a09a28baaefde3c6cc372158f

    SHA256

    7e6c9b8ddd7a4a0721b4013a4ab372dbcc803af7b5d8a0b2d8f19a473da08666

    SHA512

    9b2cef5163c48f3a987d2dc517f7f34d616c9c26672f1b50ddf3737f6f4589f5a89a58f295dcf3621e792814b9b097784a074bc8f8af28efc2ddb46d0bfeb22a

  • C:\Program Files\7-Zip\Lang\af.txt.exe

    Filesize

    57KB

    MD5

    b337194bd3c7dcdcfcd2c61133697ab0

    SHA1

    7c3b2ea298ca39e615240387d3f4cf0e781bd623

    SHA256

    c393109cd6d03c391c74e959f26c009be74ae66e2709c092618ca21ec7ceb454

    SHA512

    201afa6dd88cf6c62b01a3f1e61fce4e01174c934630f306eb893b51feec0f06daee4f4b17d3130681ab789d981bd2e3eca0000d6715d599b62d1af44636dc23

  • C:\Program Files\7-Zip\Lang\an.txt.exe

    Filesize

    55KB

    MD5

    414d111831ce180bbed7b26bfbf33d6c

    SHA1

    1c5b545b316ac1ae30c6a94778abfa01b6b5ccc5

    SHA256

    b5891ef27a72ae00679dfd63a46f6171d074f237ce7f7f748ea53fc01c2f71bd

    SHA512

    3b4bad436cfe7d7dbc7faae2c6b34c66e9dffcfe0c1e6890fe74a1b2489b0bf016db7a16375f0a9ddc23040a7d43908adecbff8172dae090d8e67fc310f2030d

  • C:\Program Files\7-Zip\Lang\ar.txt.exe

    Filesize

    60KB

    MD5

    eb32f471ff53d87fa3073590f9f06d53

    SHA1

    80c0198d5ef3c9a7602bc1ab3c072febecaa8cf2

    SHA256

    0d167ad3e5ba511323ce64cb220564606f90ad71b1506950c86b33b7c31899e6

    SHA512

    8a031abea0707fd559b0f0f03efc99aa0fa3d76f27b588aedfdbd3b75d212b6ad06ab667b9158207bf1cc351f846e22966f55ca72b0b31124e031eda71c29335

  • C:\Program Files\7-Zip\Lang\ast.txt.exe

    Filesize

    53KB

    MD5

    743a7fc92f41c59d2adc02af77cdf0dc

    SHA1

    6ca53682fadfdc9cae610e475aa2d99397a03da6

    SHA256

    749036dd1ee62fda65a8dd4c253df5902970662168fe440629e51ccd6a2a5680

    SHA512

    a9803bbb9373a8f9741b7d37b379cc8a7d190506d2b4501b6b82728d5dc8b4bbdd7bccc289c828ed347454ecb07c889a26e2f5a397d31c1944a6029be4f3ba8f

  • C:\Program Files\7-Zip\Lang\az.txt.exe

    Filesize

    57KB

    MD5

    d79df2c8dc8f81b60e4d8d7a50a14971

    SHA1

    29ff10757d01daa6d28bb62008c4ac876fa1bf55

    SHA256

    f8393a666ee18f317b4d4f82870e6ed11d84a282ec33175155a675f8d357a10a

    SHA512

    180125ca5b036b36c6c62af8afb565f9ac9171cea7a3d3960c955349546e975b90d25216627f73b06bf318e7c9fb2fc25ebefd45bfbc115b6f595668f9f1393d

  • C:\Program Files\7-Zip\Lang\ext.txt.tmp

    Filesize

    55KB

    MD5

    402670596ae71e7d784c2b95516ea803

    SHA1

    dc00971216fa0719fc7c0b80cc52927d9f292b85

    SHA256

    ce081269923957d260545a3468911ddc732472ea9a74eaad9a7969b1402a36c5

    SHA512

    1c7d7608bea78af8478c37c2608ffa44af46f7b50a6318b32748a6a1a6425d3ca3dc8eabbf98b03577ae9b4918851220e769557cdc2bcae90857c59389b56cc2

  • C:\Program Files\7-Zip\Lang\fi.txt.tmp

    Filesize

    56KB

    MD5

    83461a0b7ed1b175a4436f9c2f28e8fe

    SHA1

    7c2e4adf278797995bd070082ab892ee993123d5

    SHA256

    001a2e9165d61de105927cb911895370f3bed059968ade59e8506b5a9071a79b

    SHA512

    48a677d73dbe4d9f72f738da9fe184863f872a066fcf029c64e950d43746e365ba0b1b274cb158f11c448bd945d1d511ec467db9dfc61d6f7482bb49ec70278d

  • C:\Program Files\7-Zip\Lang\fy.txt.tmp

    Filesize

    53KB

    MD5

    a0c3034cb4fb8f85a69e8e10d3edf978

    SHA1

    fa9b300f5b6f46b13c1dce87683eed58a42b5f60

    SHA256

    f3c83ff5dc48835d2eb8cd94bc146102ace9d4d65fcdcfc01d755be177c46406

    SHA512

    1c51e95d6269d8bffdd6e3e098c717d5a2dc4105bbb9ec0ba20cc7fae6472601cf77185cfe1e86cd85d5203737975833b8aff98e82d9eb5ddbbb28ea3f7476c7

  • C:\Program Files\7-Zip\Lang\ga.txt.tmp

    Filesize

    55KB

    MD5

    6430c562c9603b28f3edfeed4e026a71

    SHA1

    7f9a868b4ae36390a2a9e8752133c4bdc73e6776

    SHA256

    19bb662a17bdc9c4dbb02d496bdf5630c75128baacad00f91e7e4c061660ceb5

    SHA512

    535ff9e5fe528fb1762100fb106b014ddf18464f94427147a30220dc9f09ddd3f158180e0f0f9d1e67aa62062443f9c40055866baeb147918ec8dd19b7ab0666

  • C:\Program Files\7-Zip\Lang\gu.txt.tmp

    Filesize

    64KB

    MD5

    c4953aa476977df528d10534fd08b9c9

    SHA1

    0cd5d9940283afbcc79a648e52820bbf63a2d675

    SHA256

    87a927177ddcf93366a8fd036e80774db034460426b8699e55298ebb3b35fd73

    SHA512

    39d816c700c200ffe1c9b5cf76cf1692261ccacf8668ef5c6a87a642c0e8093b5d16928a2d5264f209de441d1171aee859ef1b315420dfa8839e2e65f38cba1a

  • C:\Program Files\7-Zip\Lang\he.txt.tmp

    Filesize

    47KB

    MD5

    6c4a5acfd76a3c83f0382eb9bfa5763f

    SHA1

    e0164f626f490c9cd7cc78e39ace3796e3554f41

    SHA256

    89877f927ded9a3fb7994a60ae42a1d88f5bd3e53131dcce7538380a154ca080

    SHA512

    1c37f8715bdbd0936caab7a9970bc6f6509061137573299e52a77f57e4137b5a187f8ea0b3f3dbdb2ff13d6974ca240860c3318cace4813cd9ce02a26d849f5a

  • C:\Program Files\7-Zip\Lang\hu.txt.tmp

    Filesize

    57KB

    MD5

    13ad57ba54ac6353286786a867f392c4

    SHA1

    b2b831fbd5cdceec399437c5afc8ebe94ae4d299

    SHA256

    a89e13dd530843f03c54d63286f66f47aacec9cfce39cd891658414efe07249a

    SHA512

    e6de9a14c92e26f3e03c14d7efa1973047e189f19db70aed9ba061c2a648cf91034f33a5570853359ab765353155c43f6a98d71efc91f7d79bbcfe3a756db35e

  • C:\Program Files\7-Zip\Lang\hy.txt.tmp

    Filesize

    61KB

    MD5

    dce217e2b0ca7ad2ca04456d80e6ac6f

    SHA1

    59d439273544a77988ec50b216b8a4c428b6e2d6

    SHA256

    6e2ec23e42677e1f5a0856f40df15829998b7d62dadec3ff986016e10d71c75c

    SHA512

    a5590de1a35e0e714842858d247eac5f1d7c23b50b602f2b3ad4b06d285be056e394cbb176fc8ff49fdb5da1a9f892031c222e23f1b864b6acf47e526d3568d0

  • C:\Program Files\7-Zip\Lang\ka.txt.tmp

    Filesize

    65KB

    MD5

    ed07cd5279035a74d22dec0d14a03d65

    SHA1

    f1dd073bd1c4f695226a64d494f5114b5ccfe8e8

    SHA256

    662ec5fdcd501d29343d832d302245ca6314aedddb059853579bf4eef1801feb

    SHA512

    e55d7be96d8ca42f39efaf84820c921e84b8d54d7863ecdedabf869d1702a52c4ce5d8e68cd43a1dafe82b6387038cea3049e0471a51609bbb364c1c62858cbc

  • C:\Program Files\7-Zip\Lang\kab.txt.tmp

    Filesize

    47KB

    MD5

    9e6a4ba98b269ebed940486fa8967c88

    SHA1

    1b98ef62225b93e3e503bdc8e228342da03a0c9e

    SHA256

    9d61b09d539428831de242ca4c0c05fb3112564cc5b0af2a5df4c18cd2521e03

    SHA512

    a3ef3bfc8ebbbef46c7199818877f1cb5002a22147978e5cad508cf76484318d1876b86770a72dec78a3fe7e711fec707afae262c5d86f947274929f0be9788c

  • C:\Program Files\7-Zip\Lang\kk.txt.tmp

    Filesize

    58KB

    MD5

    283d0aa3495ce43e442e8f237a4bac83

    SHA1

    26595aeaac9a5adfb29e71acc8b6752e5587917b

    SHA256

    9081fed17db0ab3964d7cb1fc2296834e0cefc842cc86e51b45f211b348b54e4

    SHA512

    26a5f712e4a04d519b08585ef0c7fae3af1378a2c4f679f05ebe433e61b7cd43887b09ff62d7f4befd010c3d3b75fcf03b2168409d9dc3f4d7492043f8a54848

  • C:\Program Files\7-Zip\Lang\ko.txt.tmp

    Filesize

    57KB

    MD5

    c541b2daaaeaeab58a8718f85bec8c10

    SHA1

    78d2262433264a51ed13ac5121d32b3c533ce248

    SHA256

    321ec3208783220e979cebd31521d0435724ebd1fbd746f2a94727e5e40ab5d0

    SHA512

    5129252f1863a74a8b4e7baae1ffad72e539cb7e216a74933bbad681b08c654b868555dc773edb213abaefc7cedb242ef883777bea17f54734ee754bbd75df4f

  • C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

    Filesize

    59KB

    MD5

    587c8721c482b5f7849ccb440e9b2cdc

    SHA1

    18bd9ec9ebc8c7e77d757bcdf80020aba9dc0120

    SHA256

    61d322562ce2509a69888fd77e3ffa3964ac1ba658744ec9378aca5df67c47b9

    SHA512

    70ea4a9ec87f0d99e50876138792ba57bfbb93ff3c27a0eddab81d5ec7c850373572dbb1dad62047ef1929031df6073e5353756ebee2c3e7089c7055b506fcd7

  • C:\Program Files\7-Zip\Lang\ku.txt.tmp

    Filesize

    53KB

    MD5

    adfdec1e78c6d4e658b10b4bb38ce126

    SHA1

    5dbcf860be49ca22eb36c602568b03353a503185

    SHA256

    e9d0e316a0471037ffd7f451d7a9b07f2ae76b16e96288142979cf7e95751280

    SHA512

    89cddd5359017150ea1b9b8e5d9bd2820975162c7a2ac132be50912b2796de7f7f0a4d727b0e9722ff155cac19a8867d45b3e980def1dea69e11e9f97f84db2f

  • C:\Program Files\7-Zip\Lang\lij.txt.tmp

    Filesize

    55KB

    MD5

    6725f5368d7b6853b037b33b80a4025f

    SHA1

    a60c141d6f9219a970066fae1bcc372aa151e2d6

    SHA256

    6d15c4e7ecf3100d4c21106511e28fd72e9f28e205fe00abf76be6a296d705d7

    SHA512

    41538f26852ec0e96bc42d382af9e8f53609f08e633a0bbedeb1c1424a83b5d0e9529fb66810a8ca0029a74679dc70f8d0274eb9fd8fcdefcc20a38c3083ccb8

  • C:\Program Files\7-Zip\Lang\lt.txt.tmp

    Filesize

    57KB

    MD5

    8b40a65223bd616673ea1950a12294a9

    SHA1

    66b3ccfdfe0e21458a06d55a831a7550bc124640

    SHA256

    fd75cd981c899198ed38c5058968bd4bfd2b8ec09b0d7f37499bc46b39a18612

    SHA512

    98b300350721a21256affa3f47beb55766937b9bdcc9997123e525660d15ac828972a3507188452070befe39d058c83af873cd04c39d0415ac6bc731b86d6b91

  • C:\Program Files\7-Zip\Lang\mk.txt.tmp

    Filesize

    56KB

    MD5

    7229feec44883d33d33b39977d685258

    SHA1

    ce5034a81db551f1cdde1cc13dce382819e6a10c

    SHA256

    4432f53a7a00bf054383e8c0aa6f35b8f943e30b4d56ce6a0a8c8d4d12e2cf8d

    SHA512

    3b8ad8b6db1e4aea8319af46b039e9d97a0dae6fa0aafd4fb5428fd67c0327b4474dd8be6ffbb12850b1864ea1fe6583f155dfbc2143867b12f9444f826748ad

  • C:\Program Files\7-Zip\Lang\mng.txt.tmp

    Filesize

    67KB

    MD5

    b6eb676b29bdfba37a316fa53bb92920

    SHA1

    ca77c0e8ddfd61c31d683e201a68adc6548a5e8d

    SHA256

    93f1940c1ef1f844c7eecd6f3611cb7e5e4eebaa163d20980bb8dff42a87a236

    SHA512

    08f7b79c01c8b966cf1f23305cd4da8f668ee4c9e720c7e9e4f06d1afe5e46d1d54ced4e7eceee613892069082e10f7089c990eb314f8e708046e1b576273721

  • C:\Program Files\7-Zip\Lang\mr.txt.tmp

    Filesize

    57KB

    MD5

    d0d3983f5435fdfac11f00688031db15

    SHA1

    5dedbf24706cca77a1c540c69db95ac6edd7d7a9

    SHA256

    e36bb7615ab2f6c76552266bcc0e4836654bef3d602ccf12dfc31ac412766580

    SHA512

    faeda03679b158c157620d36e0ef5731ed3e5c7b61f6426262f852337398d0c69919b33e37b4a848682ce31640aa0104f88d3277a77ed6d2919f0dbad731c091

  • C:\Program Files\7-Zip\Lang\ms.txt.tmp

    Filesize

    52KB

    MD5

    e3329e01dedc3ee789e148aa4ea58606

    SHA1

    7e51f89ad78ca6d56da78ea63218d7ef10af8145

    SHA256

    e364bbccf31a3ef2d9f4cb8b28791c83627029175478b361ca5a91f08eeecf73

    SHA512

    25afa697bc3c31fb4ff8c9133ed66a8905692131e0e6f63b78e8924608cae96d1482a4d82bbfa2e4224c96ddb2dbad149e446636aab8a2529bf14b52044ffab8

  • C:\Program Files\7-Zip\Lang\nn.txt.tmp

    Filesize

    53KB

    MD5

    292cb5c4d123df5430cb8f499bb24c51

    SHA1

    0a9e45b1b2cc06d5d1af7f61629372f1440c0f7e

    SHA256

    4bfc388d771001246516858f810e1c6bdf2e02b9db0e8abed9c3adc58b8aa906

    SHA512

    47457f92fca25322aa46bbec310bbe88e71d73dfa1c5af71f9648e10aa097108553c79b1ed703308daa549f2f4ea2608ac0623ad64aa1c70869eb76266f5d3ca

  • C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

    Filesize

    62KB

    MD5

    1fdeff7c993890f856c9f5e3d66b956f

    SHA1

    a0067af5e6d67d892615a6d790d6a971884a27c9

    SHA256

    0627774a58408c04b244f21cea9f02d01a9fc79ea06d7267cedae9ad32ddbc48

    SHA512

    7129a20a82a81da99eda828f99e5489ecdc70b62326dc8d5a2aebf87c3d5cd6d7bf1da3238f4aa2f2aebae74aa5722da73e3b7ea34bf9ace7107683d30479bd7

  • C:\Program Files\7-Zip\Lang\pl.txt.tmp

    Filesize

    57KB

    MD5

    05843ecd6a25f548e2c0ebaf3474328a

    SHA1

    6c9f6785a4e13caab85f4fd96bec76d4927ed112

    SHA256

    51d66255b01a17802b08209a42bf40b0476148549a257e6d3488c5ef5c6a9a87

    SHA512

    8edee19a7ca642ef8d293734832db4b96fdd536d951bf26bd105077d804bcb11ab50a6bc85f15414f904448a802d7b8bf34a5f535c783e1abcb70afd78d11117

  • C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

    Filesize

    57KB

    MD5

    e48d7dc80dc5fef976a90d4b2a469e3a

    SHA1

    a7d358a52da3807aaf47e4dc626bfad50a61c22e

    SHA256

    70dc04a633754c36e6cdd0964dfb0241e78f2b723e24f7eea6ac1d3fe40628b6

    SHA512

    cc63920215bfa7f8915a5f3a24ba874a139c323204e8767a9c39a00c8a56f001efaa7974a761ab2aa9333a45e5f95fa7e09dbab2dffaca5a79e2519cb01527fc

  • C:\Program Files\7-Zip\Lang\pt.txt.tmp

    Filesize

    57KB

    MD5

    17913f7ecc098a2aeab4ed32d73b633d

    SHA1

    45b9ec8c013c45a7f20de891098fbbbcb793f1a3

    SHA256

    b4e570fafc24912d2c46364fc869d0cb34a7a677534812247f74c7078755ce2e

    SHA512

    2550495d6c6ff13e044fd75aa74b1a051bb6b0b3b5b21fb04c189720aac1cdf9281f7062d2ba89a8931985cf458d3833b73196a7dc2a4d5dfbd540f0b6e00eaf

  • C:\Program Files\7-Zip\Lang\ro.txt.tmp

    Filesize

    47KB

    MD5

    b4f9f9c6ec26723256b73c50e5d05c88

    SHA1

    109a9a9845a43bf4ba12e70309f33808e9375265

    SHA256

    216ec1d932f8f016d0a744425cedf7ce556d24e715d339f2d2d6440176fb7035

    SHA512

    9c138a794e0e8a37258e49bc527d5f9918b7003e949b3ba297dff1b5f2b6c884e94c4fe943034e1b6c4d1d740bdce53f06561142bef9ba76a5182d3d6551916e

  • C:\Program Files\7-Zip\Lang\sa.txt.tmp

    Filesize

    47KB

    MD5

    874de5ced584198ac530c5a760886d9b

    SHA1

    1862404f422910fdd8ba6b8d42b05d8eac480494

    SHA256

    54aaa66e23e253285f0742c527ab7f02067136362441f657d1293bc49a7ffbb1

    SHA512

    ee64a0c604e7f9f18e084de34af0ea28359d625b8998046b7a728db633633dd6b5429f61a1ed744bc094ebc964c68e072afc178d816890201457d359315cb0de

  • C:\Program Files\7-Zip\Lang\si.txt.tmp

    Filesize

    47KB

    MD5

    9ef3859666e8d631bfee5d7d55de5fec

    SHA1

    d1855fe2cccf21cc9d0e8a6202ffc1e6e6b412a6

    SHA256

    609e184226079e9a7675f48655a6e5dd2070112de50b211fcb665586e5130bbf

    SHA512

    bde8b45546bb10fca806b568342ae7cf359895b6bc8af1a7de9b5bcaa671143365bd82f1b863e972605926e8ff5a69848aa90cadbae5f8543c50f06a607e2ff0

  • C:\Program Files\7-Zip\Lang\sq.txt.tmp

    Filesize

    53KB

    MD5

    fe1f9e48bf65afc9c69c756802d2925f

    SHA1

    d0c9dac805bcdefb801e602fc7ca748c5aa7f143

    SHA256

    8089b1a07b4ed276739f2cad86ed8bad3f381cbb4815af26362e0e9f795b1939

    SHA512

    9ceb16e91d460e53dd4fabc95043967b6e5b0bb111a313cc3756adcd11a1f4e3ad5251d6ca44d13b2ac52e6c4347fcbf7a2bd84e3c8521d0b568fed778786bd4

  • C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

    Filesize

    59KB

    MD5

    8c583c36964c049a9ca0942182666d37

    SHA1

    4db54d1257b94ee1a0436143e81da23a51c75cab

    SHA256

    a9c4fa27bbba5d255171964316894111175cbf12b1c282b1dcac1821398a35a4

    SHA512

    7df8962704149cb9321af7e79f82f76e1d4b2f34ee503f21dd8e72accb98e5e4738fdf1a4e7e898762d6993d40fb727f596f938a93502435b7b1c89233d5ecd1

  • C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

    Filesize

    54KB

    MD5

    21f4166ae52160d4cedd429afa98c3a9

    SHA1

    c1668b68098cc67feca2a10ed11f438b1571d0c3

    SHA256

    26e6b9796c2e72bcee30a7ff25d15029a20419fc94ea79677cab582700634fb6

    SHA512

    e137d98f5f4200dd62de26fb6d0d7e64fd501b76711a8858408c438a6868cc8d7deacd4a70f98334c07e6a8f59da7a0b242ca21f998d5ca59e4dbe693288eed0

  • C:\Program Files\7-Zip\Lang\sv.txt.tmp

    Filesize

    56KB

    MD5

    6976506e6b39df8322378857e808d887

    SHA1

    3657c1a214beb07854a1607a07bbcc77597c897c

    SHA256

    154e32effbefb613e6f5a18f33ffbcf74a940937b124b63c483cf70d8d5a911c

    SHA512

    61cea460ef582446bb3c3a0107b46a0b43f2d18928fb93fdf0fe70ec41ea30cd29eb879f80bb2f45ceddc8dd199e8865e6c339106eb180cf6b484f4423e39db1

  • C:\Program Files\7-Zip\Lang\ta.txt.tmp

    Filesize

    59KB

    MD5

    ae722420e6ccd10b29d9f1e4430afb82

    SHA1

    325d2143809de920c98f384856b12beeb40d481a

    SHA256

    297b64367ac5a5dcad7f2e624b23d37ca4c6918be256773a23943a3d13288e33

    SHA512

    c57168f09b628936cf359044bdc13e838f5849bdd13ed91dd49a9f6ae6278fbd7076324545be2a9b2f9e0bd0cba482657170144a1d4a0ad63f80dac465875cef

  • C:\Program Files\7-Zip\Lang\tg.txt.tmp

    Filesize

    62KB

    MD5

    d9b8ea4d81fe5d2b0d7881c93159fd1e

    SHA1

    24d50233e3bf706ffd5976714f592ccf149a0225

    SHA256

    ffafa17384bbcda95711b979a44b1285811ce889d445faea61c1b6de4f5e8976

    SHA512

    53f7a59a8b549255913af33b2327b2c1824ce50176ca130fc136ce6baa5098e225ad964aea59c878fb58ee3649f46afdadbaf77412569c17ff712e517159d324

  • C:\Program Files\7-Zip\Lang\tk.txt.tmp

    Filesize

    56KB

    MD5

    d1d66859cee2a898806bcde448b66a1a

    SHA1

    fb424d017f20a8a80a23835f448d5e98df37001c

    SHA256

    43a1a63634d8dd8946e04f8995bf5993048ca9dffee8ff66cd15ea28c3c0789a

    SHA512

    72192a25e1d70d15b1d10fd0e20fe02db3731c0c680a483ffca00148c804de903aefaece4faddcd5817edad6da486b5746744ef3c4a05341acf999b83cb15925

  • C:\Program Files\7-Zip\Lang\tr.txt.tmp

    Filesize

    57KB

    MD5

    3677d4d48e936b799f3f7ea0c655f2a2

    SHA1

    a601108ddb2eee1b81ea27802f5c9bc518a84e7f

    SHA256

    35bf5abb01452a0be96675ce817cd2bbe93165da66939ca09d6a81f3384069b3

    SHA512

    0780c693a548a4b453d4586c68aae4dc6187fafa2c1218a39abdf7f2d5dd111bcd417f763b5a93f2c227c8d09a058e4abd61b3395c57657f8db68ce942285840

  • C:\Program Files\7-Zip\Lang\tt.txt.tmp

    Filesize

    44KB

    MD5

    5e831a12eadbce43dc09fa74391728c0

    SHA1

    34712d29c51a97ebc40139c93c14624826cc891c

    SHA256

    158a9ad8a725f677802978b9a1c7fe6e4dfe2bf2495754058516000cfde1630f

    SHA512

    d0008816adaf3fb07a2cd4a55565b436a7c2266db99948f3dad35c347440ca0d208e13e6a9257d87db2e990a7cc812fdb77f6719cb768931082d8be15abf11fd

  • C:\Program Files\7-Zip\Lang\ug.txt.tmp

    Filesize

    58KB

    MD5

    dbcc33814803b9dc812ef27c0ec6163a

    SHA1

    217c9220d3b464911ca854a8d8313189fed45c2a

    SHA256

    4e3b64fa173ebde98afe9b208ede1c8d3fd95e0e8d49e6c214b4290e6c7e52b4

    SHA512

    c131504fac0ba205ffdecbd20b315c5c1758a7307eedca17ed8f448564f696c7678e889583235a0714ebcd792d57093d9b371dfa82fc18f480fee69a7e3407d3

  • C:\Program Files\7-Zip\Lang\uk.txt.tmp

    Filesize

    62KB

    MD5

    e93cd7cb12dc9814e751f33c7d47c456

    SHA1

    73b02cf14d1a81f65f1212c85323edd8fdcb354c

    SHA256

    1c868edb1b57169bf929547b7af0d887d57c0eedd7e82846c57602abc6ac2420

    SHA512

    678dcf6a1a7979c406392bb905909b23c6b58a77945c00b573f1f0d7c83a7d99be09bba6aeede9f48f74287e572e1cf59c98895795e91a97afaa1a66c58afa1f

  • C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp

    Filesize

    62KB

    MD5

    194725b54e66e3eee3aeefc18d9cd5e1

    SHA1

    0de44ca146b2197e695330405b781b4ffe9a1486

    SHA256

    1ad4273fea4010236b95b902dfa19ffe5788e7a2972fefc845a56dd0b06a9958

    SHA512

    144aa49575480677e1bc92ad7ace61eb0fcc5bd567f9f301f6682e8c0f96ed427034b416d05c2a3fc4e6f35d5efbc22e3a533da0aa46b608c2878847c5431a7a

  • C:\Program Files\7-Zip\Lang\uz.txt.tmp

    Filesize

    56KB

    MD5

    36d839592e48ab8d57644d3b85168f88

    SHA1

    c1909cd93a50e568b8293d9bb7f8e5912696038e

    SHA256

    d9ea0fa86702bd455bd54a712fc0f1a13d796dd49c74f962053a08a6d8708eb1

    SHA512

    16d1a93c3e6fb3f03a06cef203dc63a1b86d748b686d5f02a8e5fde442e0d81e3c306798fe59a4a50f3dba02cad92830312cc1e868793d86ddcce5da5d823d27

  • C:\Program Files\7-Zip\Lang\va.txt.tmp

    Filesize

    53KB

    MD5

    9a058755bfd01271ba942a9d83c96854

    SHA1

    6625ce4ea6a5b232547b4c4f7f9eb7b10e7acd62

    SHA256

    776dc58b9fd560e5ac86341dd3cdff1a32a4013cf4fce72e9b07a98c9e178957

    SHA512

    2aacac6024e98d33024d983b1970fbf93365619f8defcba6284086a84728e7d7fb3f1b0e9ed48c6a9c7fba89ff065f0fad2be808f54a1472f657d718a8afcd94

  • C:\Program Files\7-Zip\Lang\vi.txt.tmp

    Filesize

    47KB

    MD5

    1c000e82328460c708b28f446e580be4

    SHA1

    af735c154f45c70f6d3fa18be6c3fd74b91fbfd7

    SHA256

    85e3c58814aa26826d5b6b37fd8e898133d8955b8ba066607986d5d61d2d1b72

    SHA512

    4ff47689427f2525159fd3ba40b9dbf65e5e52482a86a38e724e24c50bbbc6f23443a397774ce94e5ce9b37ed9584500477a7c867136f2b2cf6984454d95af5a

  • C:\Program Files\7-Zip\Lang\yo.txt.tmp

    Filesize

    58KB

    MD5

    d452cb6f09486af28b48b510119f9dc6

    SHA1

    ceeb4e1f246fba84607320365274088001c2466b

    SHA256

    b062cb9f6be48824ecbf9f858d93f6c6fffa892c15ae8e7b055dd244e5fd65e5

    SHA512

    3016d149ed1db2b2d4e60cfc0165a1aef7722c2ec83b23eadce7156fa72eedfa08f2440d800d5a82d9f58c1d1f964b339e259aa022fbd20e60ab619874f008c0

  • C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp

    Filesize

    55KB

    MD5

    5f72d52358bf56f8182caf2dcb2b5021

    SHA1

    3c53ed90f57ef8caa4880124ec475d91fadb58fb

    SHA256

    10aab6b7306a161fe40cb0d077795786900e2dbdab00c19d1875a4c3e3f8a68f

    SHA512

    ccc73f103b674f29e4b9f6b96ccc9ee7a7d6a6f70fc5afaf0285e559077b8b89c6f7ca1b8172605898e1df7224c9d992c67212902897276b38753ab7109a0f9b

  • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp

    Filesize

    54KB

    MD5

    e7d695a4eda63a69a7b3c5a0961a0669

    SHA1

    290ee0ad1993e7e0941d9dcecdbe732e8486212b

    SHA256

    03c6300ef84c8cda4745eec02b37e0fbc2d4c7638f1bb60339cf66facd39c410

    SHA512

    e134a2c3e544603c2c32bf4843c9d75c5f9a7178d5282604f9ffd17b65f7c7d2ea42b408a9ce3fd2e5e0ffc5a106f0d8dd0b6acb73fd0866b29eb690d70f26c8

  • C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

    Filesize

    47KB

    MD5

    0cb461632829e90e0d88a8adb9f9527c

    SHA1

    d5fba360aca61cd29eb2693c4fbff06b4e2607d6

    SHA256

    f5c7556df62533f0bef3a034a564eb10be50141ead0782964d23798dd15032ee

    SHA512

    580a83452fb6a240d7908109dbf95f0575ce6c9a012c4289961aa4a674800e7dec6ff452ca8134ae73a066fddb184cd442f7c09f180bd337098e38b0a98c2e57

  • C:\Windows\SysWOW64\Zombie.exe

    Filesize

    47KB

    MD5

    2964f65ae5522a397767ae21bfa1afb2

    SHA1

    59183fbc94bd895b32175b1c85828afca390f6a7

    SHA256

    ba00fe14f2a79d8f309f82f9e3e02b54e27b15bfa0a3cd81fb9d2e1646dbb534

    SHA512

    5004822e77db62ffebb44bca38425789a020a2656274f42c380238e1fa7e6c94e41dc1cec22f55f96910c7b318243f44439e42a72368dd3b21f5f62f3f4bb495

  • memory/1636-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/1636-1119-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB