Malware Analysis Report

2025-01-22 23:08

Sample ID 241227-yjdaasyngp
Target 7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512
SHA256 7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512

Threat Level: Known bad

The file 7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512 was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload

Banload family

Renames multiple (218) files with added filename extension

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Renames multiple (187) files with added filename extension

Checks BIOS information in registry

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-27 19:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-27 19:48

Reported

2024-12-27 19:49

Platform

win7-20240708-en

Max time kernel

60s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A

Renames multiple (187) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\hi.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ps.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\tt.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ug.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\fi.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\fr.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\yo.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\id.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\lv.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\mr.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\nl.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\pt.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\da.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\eu.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\sk.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ku.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\th.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\7z.exe.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ast.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ta.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ar.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ja.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ka.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\mng.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\nb.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\io.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\7-zip.chm.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\mk.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\tg.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\cy.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ru.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\fy.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\he.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\7z.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ca.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ko.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\sv.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\7zCon.sfx.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\sw.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\vi.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ms.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\si.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\sl.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "DAO.Index.36" C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%CommonProgramFiles(x86)%\\Microsoft Shared\\DAO\\dao360.dll" C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Class = "dao.IndexClass" C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\RuntimeVersion = "v1.0.3705" C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "DAO.Index.36" C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Assembly = "dao, Version=10.0.4504.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe

"C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe"

Network

N/A

Files

memory/2308-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2308-8-0x0000000002F30000-0x000000000313C000-memory.dmp

memory/2308-1-0x0000000002F30000-0x000000000313C000-memory.dmp

memory/2308-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2308-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2308-13-0x0000000002F30000-0x000000000313C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

MD5 0522d72ec2be1aaa14fb44bc916901b8
SHA1 f59a94206d98ca19545f1098415d77b3cc43fc67
SHA256 8d8e6bf970ed8f43b3fad8e40d44405a10026c8e52ed897d13c628c203f11eea
SHA512 19477b4b0d6426c681ae58b9972eb0dc2111519b13239d43aa4597a4ebcc999198c3dde8e93bc024e33d42fae302a890934ea606563a40fb774d541b0a5590de

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 2cbb1ed8693fc5b5e24f04d2736a64f5
SHA1 3f48e6e0833265bd53e833d7220147c40eb26a21
SHA256 7ec23c8055e598213e75427bb9149210d99453b32fd260d16eca07e4622e25ca
SHA512 636ca849a8bd1fe057985d01e2a23251bfe68234e14efd13d1b4311967c3d9aba9517887615f0ad5d5e26e6b282ec3d71c9fe793f54eb2e8fe805d3e82343b81

memory/2308-25-0x0000000002F30000-0x000000000313C000-memory.dmp

memory/2308-43-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2308-49-0x0000000002F30000-0x000000000313C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-27 19:48

Reported

2024-12-27 19:49

Platform

win10v2004-20241007-en

Max time kernel

60s

Max time network

35s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A

Renames multiple (218) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\an.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\mr.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\tr.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\lt.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\7-zip.chm.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ar.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\tg.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\ku.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\el.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\pl.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\be.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\7-Zip\Lang\hy.txt.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Microsoft IME (Japanese) IFEDict" C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "MSIME.Japan.FEDict.15" C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "MSIME.Japan.FEDict" C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "C:\\Windows\\SysWOW64\\IME\\IMEJP\\imjpapi.dll" C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe

"C:\Users\Admin\AppData\Local\Temp\7a864df50615c0db2bf24cc59f14fe1c4702d930af6e5db496ef5c5263d5f512.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp

Files

memory/384-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/384-2-0x0000000004940000-0x0000000004B4C000-memory.dmp

memory/384-9-0x0000000004940000-0x0000000004B4C000-memory.dmp

memory/384-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/384-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/384-14-0x0000000004940000-0x0000000004B4C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-4089630652-1596403869-279772308-1000\desktop.ini.tmp

MD5 17679f1d2769067c6777a59e74201773
SHA1 cf7d1729207743c5329abcaa4077e61017fd9e72
SHA256 d01d0f07f5cb7f20f5313fe9fdd5c457ea297d15d8748fdfae23f0864aa3b453
SHA512 45eb6d5495840fc5a94e5bafc3ec6da3ddac7bdd32d247dd885eac30baddcf4c93ea2e43c0e108b23fc0c35127d1acc5c437ae27298913d6594ee2e0d6f3c710

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 1dd12b869979b5e1057106a2c8b48b9c
SHA1 053331e7fbce5ef505693e9baea9622302473755
SHA256 5dfa0b5ca609f8d1e3f4846682fe233c39394703e7beba4cf7260200e93b39c8
SHA512 b869b78dca540465a2429851ce48572adf680f666b4d82bbaf3d7f784617d62b419c05d4f05962c8676842ca0ad61ad2968c25a73323240e1afa801732b2a17e

memory/384-43-0x0000000004940000-0x0000000004B4C000-memory.dmp

memory/384-42-0x0000000004940000-0x0000000004B4C000-memory.dmp

memory/384-116-0x0000000000400000-0x0000000000616000-memory.dmp

memory/384-132-0x0000000004940000-0x0000000004B4C000-memory.dmp