5e3a20443522cfc18e9257a2568ab775743ce6338a0ca6ed56a547dc348ab7c5

Analysis

max time kernel
164s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99781c175af0d112ef434d4d378d9f1b.exe
Size

194KB
MD5

99781c175af0d112ef434d4d378d9f1b
SHA1

ffb0ff5f5b7c5e2f5359495cc76beaf4038fa198
SHA256

5e3a20443522cfc18e9257a2568ab775743ce6338a0ca6ed56a547dc348ab7c5
SHA512

7a7c11a79f351d7b3933f73d215bcad3e8f23af5debb00a5f6325d0d7cd91c1e52c3b36ba2aa8057e84ccdf089a6c1e5b09f3de0b28622a1de303bd82cb8e106
SSDEEP

1536:W7ZQpApjIWe+eoO6OY7ZQpApjIWe+eoO6Ok:6QWpBe+eoO6OYQWpBe+eoO6Ok

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (295) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1240	Zombie.exe
3328	_Set-PowerShellExitCode.ps1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	99781c175af0d112ef434d4d378d9f1b.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	99781c175af0d112ef434d4d378d9f1b.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp	_Set-PowerShellExitCode.ps1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	_Set-PowerShellExitCode.ps1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	_Set-PowerShellExitCode.ps1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	_Set-PowerShellExitCode.ps1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	_Set-PowerShellExitCode.ps1.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	_Set-PowerShellExitCode.ps1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	_Set-PowerShellExitCode.ps1.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	_Set-PowerShellExitCode.ps1.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	_Set-PowerShellExitCode.ps1.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	_Set-PowerShellExitCode.ps1.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	_Set-PowerShellExitCode.ps1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	_Set-PowerShellExitCode.ps1.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	_Set-PowerShellExitCode.ps1.exe
File opened for modification	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	_Set-PowerShellExitCode.ps1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	_Set-PowerShellExitCode.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\sw.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1240	1492	99781c175af0d112ef434d4d378d9f1b.exe	97
PID 1492 wrote to memory of 1240	1492	99781c175af0d112ef434d4d378d9f1b.exe	97
PID 1492 wrote to memory of 1240	1492	99781c175af0d112ef434d4d378d9f1b.exe	97
PID 1492 wrote to memory of 3328	1492	99781c175af0d112ef434d4d378d9f1b.exe	96
PID 1492 wrote to memory of 3328	1492	99781c175af0d112ef434d4d378d9f1b.exe	96
PID 1492 wrote to memory of 3328	1492	99781c175af0d112ef434d4d378d9f1b.exe	96

C:\Users\Admin\AppData\Local\Temp\99781c175af0d112ef434d4d378d9f1b.exe
"C:\Users\Admin\AppData\Local\Temp\99781c175af0d112ef434d4d378d9f1b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\_Set-PowerShellExitCode.ps1.exe
  "_Set-PowerShellExitCode.ps1.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3328
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4192 --field-trial-handle=2232,i,9772508353233483703,11473701862007458502,262144 --variations-seed-version /prefetch:8
1⤵
PID:3064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-817259280-2658881748-983986378-1000\desktop.ini.tmp

Filesize
98KB

MD5
a67f3d1b59ad28c968a9dc863989b56d

SHA1
d1141fb5f22897b9ac2268331348e0369d4bd36d

SHA256
3552e3cf12a21786f75e50adba1f2ff4838702d5817da7161135448112de9377

SHA512
eb62ab9700514314ed3091be15f19f57ec8f6dad2a66f9dad659fa356da3b2a35361c99e5c64a5439fc6205405a3161ec222bbd941da52b219d0a24d5f4b6569

Download Submit
C:\DumpStack.log.tmp.tmp

Filesize
96KB

MD5
65e7b44ef147869af286822995645d4c

SHA1
c2790edf7e9980598a9d3ea4851a583adff3464e

SHA256
80ef0d7651862fb96a671c1e093b5bc6d3ca2eace32aa8d4332da3ba89d9329e

SHA512
8d7ca9ee3821fcedf4940b000d78b8bc1e6c23fa99d114c77f7a64076f282d5d80aaba63c39240d0d76cce79184d1db9cd33590e346ff0153759033cf0884118

Download Submit
C:\DumpStack.log.tmp.tmp

Filesize
106KB

MD5
d2e7bc56cdc0df9c8587cecb7d7e7d7e

SHA1
a1b0741144fa823fc5cdf5aa1733f7fa86e1945d

SHA256
f608f533b02858b88f4098012f166ef35226f996151d617695a4648e123908f2

SHA512
3cb12d8c49a62188ad7886ba74aa0e6126e705ec01b1bcef4a1bee6fb7373b6ee1ae4adc6a1125040df50e1a3562085fd43b49dd40c0107e972997cb120ca17c

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
210KB

MD5
175459c4beebc55ec39fa41f5636144f

SHA1
0d03836e97ecf172c83a8d7b499a64e5fac92596

SHA256
18bd002cf64e70c04baf5edba2e1877bbc0dcbcd2014b174c6763bda0847592a

SHA512
6cadc876771b62771a7bcd4731a969a9ec3703805bf5419a285ecf5710f40f320d0ca3645164021aa56e778be116143498eb81c5533e08023d947fd2488e4353

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
195KB

MD5
1e25c3fe11b512b71622d8cb502a4991

SHA1
132923c7302012a9f022933fd78c0be4ecc1a0e2

SHA256
3ac4b9ce7de6f62d3ea7f20f172f5e0eb1c87922c9e0866375e549dc5f097315

SHA512
8e243b21e195bc1168bcbb00441fe42a066296b9279fb543052064ad267e765f09e76d58878f39f69399a9f1f0c438bab3932f6e1a0e3d00f7db55df65e9d62f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
195KB

MD5
a50d1a02bedeeb92c691221b6731e08c

SHA1
011b0d577196202c61866e1a79b504d61412393d

SHA256
312399afd0aa84765a01f251e8c25f9de214c575dd0dc1a6696b2df2e63c0f41

SHA512
360287fc64b42ac4b20c928e7448ba636d071b9c0f48557450fb17c057d4c7c6c72a49ce3bff7124bf452d88172ae607cfafaf2ed377038ab90d228467fc5b29

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
161KB

MD5
6ee3514948c5b609cd6a08d568987757

SHA1
500491caab15a580363513bb2f41f69a8527f812

SHA256
6b865fadb983a1f14f20881dd4244fd5767e272683a40e8b05fc036c20e65a99

SHA512
930ab4e820e95af613d9e4aec9afb9504b2f7ba3e94e24e7afbe61f2ebb5f5d461f5e04127d52ef782a9b7ab8378d31b5063933008203b82f0638d969bb9baa0

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
05c2273250c39a3300e8fb5df12f5617

SHA1
4bd9d30888082bda9a8282e77f915819ca06ee77

SHA256
76c4535e567bbce3ddf625b1f3cf34c4d5cde7bb254091a478a2035641be8f2c

SHA512
3a7f8bf9e648cae28263d186ca4b01d671b18777f4f1eb765268085b4b685e5db92db1bfd73a0fb1ec189913af638e1a9168ff538658c3963e71ab5830809253

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
96KB

MD5
de039e1f9d52c9726a6edd39682d4b78

SHA1
3dc42a789c7f85cf2067607099ba067b1e939c8a

SHA256
ad37195f94dc4997cfb52a24fdb0254ee1f2f78789667c483e8a6767258bcecb

SHA512
b0bb5e324e28c5427e17ed50ff4fc29980ab07da7d60928e88e7e922474b938e8aaa9112276cdf78f462825bca94fe8490aaf999cf9b9dec30a1e25e31c49447

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
307KB

MD5
95471e53956b66f814bc588819e0c885

SHA1
70c0ca9e55fea3f1381fa647caf0beee8d281570

SHA256
9e9ed496d40f8aebea04dbf8318f546b0553248d29e1782e8183b255dc252bbe

SHA512
f814e198ba504fc67b2fa7bee74b80d34b2569ba13fb47894294a73a96fb1830cbf4dc5d6263593d18cf5c513a4814aa24e5247534c00102463e5f6532aae33d

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
286KB

MD5
7c79204759a95b72f3587b3fb688c6f7

SHA1
5605a2209a9df28caa458e4bafe838f744e65c7f

SHA256
696f43b2941cc0eea96f7f15cc96ce490ebbdb0861e1b6fdbe26382bfb921978

SHA512
2ed90fd1fa846cbf0de6452c7305de956c619a6126f62a3ecf2fb5e18ffa124df646f5eed0a76b36d64aa65f9e6c9979d1c29d7f615760a0bca9f50610980268

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
920KB

MD5
6b414c17aebb3b58150dee3ae4afa5f9

SHA1
3d085be072d7a5783080c9cc345ffd76e37274cc

SHA256
53f370d655aa10e01d7ae0e483fabde1638d5087ec873d95be25201d97eb1c62

SHA512
8f0682671c9c63cd934b53d3b5868cf571d36f61b4f4ee3b54554fc70a7ea5b4b1932dad0702e224b224eefdf46dbb7ade20a2718ace9c676762f8466b0e5c68

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
4e2808077aff26e8f71a2672dca51245

SHA1
6007ef02fa0317939a557d988f9d7b4ecc47d93b

SHA256
6284672147cd4bbe41bd98f70977ed8d1b6fe0aa378f08f05070d20126c728b7

SHA512
f06a8c561ce2f6495a41d3737f48c93604001a8657ca81cdb25e571de09a2aebd6d5d83f6d124c1cdb912c40eb0c91e16daa4c5dcb7a092fc73af75dfb22678c

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
782KB

MD5
6082e900b00665a24b08dcfc5197ccb8

SHA1
09ed0e1e4e629aaf34e12cf63769266638cd715d

SHA256
7028b689db6c3a232f408fe5920d925e0038c2967df673575296804c8264d650

SHA512
160f9635dd0312a0823772b822c5786e0b1eb829126e76a91405c31b5a5ec4b37c6042fb867f24b0aff64cbbe4a7be44b22f30208c47fd73d95c1312c240ec6b

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
782KB

MD5
07b88da2641902ea6f9d27893e9f0e1e

SHA1
80c291ef4a9464ebb51a9229551b031bc926a537

SHA256
a3674154b8d31e30adba6a285268ccd8184720ca859affb6af2745f2627e193d

SHA512
4116565f65922e9af021e0d6c44a7f719eccc4a3a2f21e5535836068ed5c5ae17793963ce51e420720b8d0576b0ddeadfda12d9201ba0e77886570cbc67a1f38

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
153KB

MD5
f582a4e375576f3783d1239bf99e45a7

SHA1
d560a5769fc53b1d978cf4bf8a1d21de121b52ca

SHA256
614fab77fff9e20c8eefbeb292d209d74fe9a96b82f4b8c1e549de8e366c425c

SHA512
cb402d6ced95b009e1d04997b933791d97c45cf716dac602ef2b7f7ef3518bed5049c777a7adf7ee9c5bba9dc41c8e8f9f856fe93183aa5afecdad759b7cda89

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
106KB

MD5
23b731b6a32876bef4e39f4cbb30aabf

SHA1
a7212d5c25467ee0317c2270c5a333f7e4d08bd9

SHA256
a88286211360253826af2e678d7982b924c970e846390870d49d6315017a40b9

SHA512
e4deb0d2902b3f3111ebf05b5ed7545311fe93568070b5f2f34429a54a413a494c0011a70898b830175f7c9f6cde9fac2872da8cb4aa7fdd8b298bf107101d3c

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
104KB

MD5
21d741b47f30d17d39bfaf4e3d15ee46

SHA1
be2322e41d5fcf0bf3c8fa25ebf597b845687181

SHA256
b5c1904d49d38d098f06bb1760e689cc7d27dc8da5248d99e394ee4c2dc92b96

SHA512
8f5e8034223dbdc5425d4a006b7af4235e93468d911b85c56bd19bfee2164141171cdf66bcc96ee911ac7c1ec83fd97f89329b4dc5c254631a0e0b4ffc6e6fd5

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
110KB

MD5
4ef959cd1ce218c6476721926008aeae

SHA1
2d774b2df9d910301e24082614dc5ad4a2e78aa8

SHA256
ff3be471fad94c0b3ae4f7ac9712e98edc24c2e6d37ff375e21e6a5bb048e274

SHA512
db4e150c934eda9e079995c74d77e71895903d0e49ee75cdbf68a4c56af6e7a402fa4f3f50bd8fde2e8b532e47b7db0c8346ee174822177fc1f48633cb0f4cfd

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
106KB

MD5
8e4ba3caee3f623f226dfcdc5e04614a

SHA1
db0d4468eb43542ddb24786df7a19447720076f1

SHA256
589d708b01aabcf3dbf9b7dca5edfa34fc513e4e7cfaa15182999da7f4c5b82d

SHA512
451023ac6ac9036209588fed9e6efcbf3f23f5dbd2e1bfbec55a5b242f6ace42fb9143bd36e17e6e7f11eb386fd814f3a64676670dccef8316b19d719ebd3e26

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
107KB

MD5
63c017e9b5054c0a8b3d7d41b50974bc

SHA1
c325a5abb46b59aa711528001c0b84554d1fb145

SHA256
b8d721ea042a0a3457576b58237b1f2ec1cf01a0efcb86086d74861e2b651df1

SHA512
401599e3891dc487a6f577454bd017a2664f165cdeb3d1c0eaf1fa181ba6a081960ff67cac62aa7a0a31b6122c1d8781ba7c104f03a2352aca97157b21040ca9

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
108KB

MD5
886607721df628fd0ece175a4ebcc92f

SHA1
ac837fb0c7fb271762d4ee7256ab311564c55ff4

SHA256
99b28aa4042d35555f402cd5fd83bb8ba943a4f1b07f26e6b9d66dd3552b6b1f

SHA512
832be456800f00cc91f28da3ef6b02f70a5f649b655a012e71d5bbe88e66956002b9098a341cfe961e6bc5dd03a0db2fe65296715361e4c86990c28c0043158e

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
110KB

MD5
d0a695401e8c14eb93efa91b4f883440

SHA1
d66c7b4ba773f614d7d473807dbd8b1e732239ac

SHA256
981f8a878c9ae556161050371b412783c1864524724f1297aa960797266f9ab5

SHA512
35294ac3f261e20e2cef7ce69a61766b12fe88ca35666416d15ec1196198d060ffb22f4f14e9cbf25852c9d5cdf140ab574d56c97f492c2295c9e9a102452344

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
103KB

MD5
b37a298d07274daf5c80440c5b75298d

SHA1
8df936c917cd22a7d6790f418b7dd78e0b7439a9

SHA256
9c82f409e5236e9be8df69427d0c4821115c88eb246b4dab92aa1cb5c0b4f116

SHA512
00ef884039e8b0a6944798b9db31d3a6602e27a74acefa0bbff19ca938d020ae7095e2a3a2d574443f4af3a7af72d7290ae417e592439d5425d346246d54951b

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
107KB

MD5
fd7d11377c9b7098e9c2f081f80db414

SHA1
3b6c206b1092771e440afbbcac0bf25eec22d2cf

SHA256
c3b5791edf647d897e1e7fb7797d777607a03a739bba13916d0dbcdc3daf9145

SHA512
5da2fa079512bd4fb8e8e816b5e66df5fc2c97fa304b71367806073728b6baeb6363a3ce475531df8e6f843278ebf246fe158602a118989c3d361d5027acd5f0

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
108KB

MD5
b2b257cb21f1daad2ec26b1129668243

SHA1
cf92379cbbeb0e22507318b603df33c6506bc356

SHA256
33584e7387ba8b96d2aae275321cc2f7d555e74cc18bb1af74b77a0c88203efc

SHA512
686cc77d8f2110846b21449bb5ba2c0a2bfacb5eb95434ad9f0742c68813f47b55b9aed0a82703a2d78192d8bf2e6332c7f58301ae6cb00d74af2a860fe6f5f0

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
107KB

MD5
5937a5cef97896f188246fe5c905638e

SHA1
72bec0a523d9a0caabe7f1cba67fad840c7c0d96

SHA256
80519c119688b5ea5737303a1e32cef878dcaea777900dbf0d035a72d9e4e8aa

SHA512
63b0edf4347e8f42a6bb2bda4ca362aaa718c58d221bc7c8ade4c605535e505ac05b98eacae2a1ca2dbbfbd56e00cdc51942896a01aeccd3609118ed0e0da93b

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
105KB

MD5
d514cc9262b6f0c1e719d5b8a73589b9

SHA1
84f408d58123761220a5e629d68420e6066584c3

SHA256
6989918a20e16ecc84585e61143d3be066ce4e9e0a2710169e34defb2b196539

SHA512
3611cea4b4be06e2b9d8a973a640f8ebe5a2f2a0f1c59fb1a8eaa108ed28e1bc50da821440642e1bd2d980af5738cb6c07da452885146c79a56d892c341b3143

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
106KB

MD5
605959a7f059598cedc3112e9600ec33

SHA1
fa9cf972e95df4b739ad3e7cca84ea1cfd542925

SHA256
aa5d5348be483b834b04ac04f35f2666dba9d141a3d00245e067d13487b2b399

SHA512
8dcca389269376801aae3c74a91aca5d80749d47ac717a594aa75fad1a97257317a1e0f26081b644da6f8661fecb5aaf2bbffadb9ba32e5d9650db7e6e944cbe

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
104KB

MD5
33c748fc852ff8e8aacc0ef741638405

SHA1
30b23cc578e2457c4750a2e3ae9e550cfb524520

SHA256
335f2cf415ad2252c3d92255a23ffcf72942a93b6da1af47f3621dfa7789c6c6

SHA512
a35f5eb708dde4163b96ee21e367f1b2ab9d4b0ed79fbbbca5bafc36c6c8bf4e5c19d16a19fdb759976c033bdd44f1ec758835abc52d08537ca2d201b872399c

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
106KB

MD5
4b23aba8329b2b718dab9abaed62ff57

SHA1
e68b2425f0d49b80f6df0f63c088d1bd91aba59a

SHA256
1b4305dc21598a9addc82fb66cdbf88b58db645f8087f1d023009f35c0c3c54d

SHA512
60914f003a9f9a6ddf1cf12398a1124f318e1913e980e616f61eaa261d1ff0f2ffba96402e010da6c554c2171c9f4012424ca66eaa522fe23139601f2bd90c5a

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
105KB

MD5
39851db76c9b52dabe8228cd8fc812a0

SHA1
d2f2a692d3b68d2cf3ff49f4f4a35df4865125d1

SHA256
43e4d03179ad5e0cd3a3fefcd18eb4ad9300b39750670e9c2c7c45de7a89c806

SHA512
0ff5362ee36c12baa41d076c5b6f58ba440d627244fb1baa572001dd2ecf67dcc68430ad22bc62aec62fff975e3d354f725e7d6ad8309fbc0f8bf702f9bdc900

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
111KB

MD5
e5946775614e86a2d5d11b4089473a8a

SHA1
f343d8c0ac0144ce221c22183bc1a15bbc82696a

SHA256
c72c802f91d58d4366dfbbe5d2666cc63cd96bb0113103067dbd370323eb519d

SHA512
a54c95c65575b5f29ae0ac1154df3920233661547797f25255fab1fbaa5144b436fc99055c2b738974c8cec44f9afdc3516c914ecb5e7f3fc4ae060e0716d4cb

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
106KB

MD5
7430898dc584b0b0f2504efbf9a72aaf

SHA1
07fff66407b5d9318d6d343c55b8f64775c57214

SHA256
8c532ee86e316a28e31edd26035afa52a1bd754399c13325ddd9f3f6b2845bf3

SHA512
1aeb5f11ed658f9deb610e594ffe8abef1afaa939d0947df48e1bac651992110cd14d37c5dc40354e120adddd57d72269b49f08edbbf49344800727c32793aa7

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
104KB

MD5
1430e4ef4faba32e2f53b66ca4413864

SHA1
2219c8cb335959035e55685c59ddc532ee93c230

SHA256
5037d30ef262c24934bf256197ce9bbcf496e1985f76f34d069cff1cdb635ad7

SHA512
4fbe4612ded755cde648d9e59e68d080c0c42dbda07fa671e37452f5f99d608d4bfc6f3918c9ba2aec29e49ed0b6939e93f2561546b695b7828ba9bfdf125b7e

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
109KB

MD5
56761adbebfff2c792c666bdf954464b

SHA1
1aff02b0af9e2fd60a91f1f2d034fa59d7fbab76

SHA256
78795835dbc88f96adbab919ec44e50fcf4773d249041e473d4d5c810c5c52af

SHA512
6697932d16f93df25a5e1d7c4c6e931b5e3395dfc738730267cb05f0e7ac5928d841ae251ef7e5777d185e6ed9f31085c35c17fb3f2080e28bdab8da7b24a179

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
115KB

MD5
33d4e97525997d94e2177fee2b7f5011

SHA1
49d04a9a104976b6e6cc2dd4ad7253285caac23e

SHA256
1c3297c0c54301b7604fea1ee7f2a46416b6f7031f196e06305c198dd53f1adf

SHA512
730dfd87297f2e7d9505f060ef664ae2f2939633cd4f602abe602da4c1413c88e70a6803a3e21e004e10a6f966b3afdd4091bcb4ef371a42085d34bac93a5c3a

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
106KB

MD5
a43e7ff7157bff2d10ce1305984674d1

SHA1
c7a3732c30f5b988fb355e6d02ad62328787620b

SHA256
50ce58c5345af432b2a247ca591400c3204404affe654cca122757bcecb152f3

SHA512
ef77c0d50bdc64159325c433eb9dd168a2d6b52591f5c14dc01103a610a29a36c8437fbb3edfc832f57278d887a7cd695667d98e0497b487a57e6e12b047b694

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
110KB

MD5
ba5dc61aecdd4dcb1c650134506bba40

SHA1
979c3da5c51ca6564259cda2e5afbca13a2edf11

SHA256
8d85a3c4383d750f18f579903407c59d17404de86996cc4c6eb20093a211db44

SHA512
eaffae13c1f7286800749eefa5787d9dd46e9b1538caad1ff4e42d0eeaadc12ded0d2787b8725ee5ded4e9934f45152fe57f297aaf32c43baafd749dcc375041

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
106KB

MD5
fc3d12206b4f4b7d74a126a5b829a878

SHA1
394dbc40d942f141e196edf903f4c4236a6eb477

SHA256
4c85ac3574cfabc6ca707993bbebef139dbde462dbc4283cb6a4276a69d3ac83

SHA512
5d2f22be026fd0707ad7523fa279c014c9202a3de33ed5e1bcc39e4d3b21b2399bce6a01ba2aacba61103c8838eabc07412ff774c8a931035b4e0c9e6213b742

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
107KB

MD5
6af5f128192bccdefaa760da18d625f4

SHA1
75df06912922f8fd25d1940ceda45b9857e8c2a5

SHA256
3f4c6c79fd3a795b4ce8990ef2edccc79b7b5ff5e31b2bfb9555dba86c7651ab

SHA512
16f4833ebd0d4088e5d4a816c6a1d57d592674b0e5193c25028294ba51e14797c5d056dc9c097cf63d4d63bf78a60c50b6d3481c1d9c8f195f6beab7e87993c0

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
109KB

MD5
0054508098cd210b9d3b47118071321c

SHA1
5f0110d2fd3f15ba5cccf090ff5a95731d2d6a2f

SHA256
6a8191d243664d088a8df71419df7aff8d1621822a892129e52a2ee7ec21291a

SHA512
6a5e2f846c92be22ddc568886f65445c0bb4d53e91deadc8ac893740daa261b8b7106ff3ad824ffac244cff56d42141752b8e645df94f262c32842d9c5491ba3

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
105KB

MD5
a5cd080b9c00c4d1f6c7f6b69ef42328

SHA1
3406ce23a92ff73bc25fefea9d18a40494e858b3

SHA256
f6c413286f2995d8ea9352bbe8aa570d6a7f0edaef9e159f478c2d6061b12a37

SHA512
76b027147d7b0150f857877d7a13f3dba59e9a6263c1a2f4b62fff2e5c2c6390224d0ed4ae7e1d7a4fae59788dbd012f45c6ccf6b83cab3df679337bb369bdfd

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
106KB

MD5
2f87de5f402f8c0f5ca04e513cc0de10

SHA1
bbbeada6eb56e5443d905d4df0817d65b5551cf4

SHA256
1eba74c9935c5735eb92885f78e73638c0a8af893933ad124514462fdee1beec

SHA512
ad1b3aca7cc256156dafb2a28a6653f9c7b33efb097a2fde9bca91335c414c0389230e97a70d67e0ed8b496f538e3a9f6859d57f1839a1da24e4fdeeae8c31a5

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
108KB

MD5
9b03b5f8705f1d8e799953fca439492b

SHA1
975d95c882a1a8d6220ca62d9cc999a0f17465ed

SHA256
7236cc4afa625407023097f53e72fb72e2cb4b1bad7a396abc2e70cd55b6c020

SHA512
e547193603bd2c1b771dc13edab30e10b8614a462d5e995d21408311e7160ef0f6fd977fae2f399593c5610bedecfae4aca2358accaf37863549eb23c4e21940

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
108KB

MD5
55346620fca01e4828b27f71c29a01cc

SHA1
95f964d09a971144f4425a45affcc9921399e457

SHA256
80d1ee2d9cf4afa0c2aa823eec688bf283f1214831b648dc17bf08ce45685758

SHA512
bb2389f0c9eec1e4528d02fdf7cd12939418f93afe0a4849eb4ab2e55b4daab875b4f254c1035ba8650d9595b703cb63f5444618ef9edf004ba73351fb9005c9

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
103KB

MD5
33cf3ea103e6f5df1a01f406aa0544f8

SHA1
2f99bb80e6b3bf9f787cec2b2e2d42557f9ace33

SHA256
5013a0d34a285cddc58e7cce8ff45e74312653326dd3542dfdcee894415ec3ef

SHA512
97f315804c33f2a9e6ae6ee9d3506aae55ce94f7031f7d81c659cbb45288a8da1b1c3c895fdb47a766b03103818bda90d33a7448888de001f5c9d40673d573f6

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
110KB

MD5
6c047870bcac1c72665c96657591a265

SHA1
c3bc2d5f13ec3a10f8ff9b499447486dd4b09d47

SHA256
6324354508796263f2ecec0a417ee829bdc16078243a4b3d65b0c8b41c501942

SHA512
3d53d1c7d5f598cb81cf1c7937e20cac770fd9278f01ef0fa723ba519fc3a62320d7da7bc0dc28ffe86af944858b8d000141ce5de564dd93da59e8eb1dd5ac39

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
96KB

MD5
4febe9c3c665e12ff4e903cb38b6a69e

SHA1
fa774472b246b9d64677595887dcc2d57fb77f01

SHA256
7955163092188718f7874adc9963ac8320fc6056385d3fd427c00b22a637d85b

SHA512
0ca51460c717d1899325537b1727c57d53bf2b25a679c653623599621d86bcdb5724050dfcff4397354e9d9fb203427ecd910ecb975acb197fb7c0233119e403

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
103KB

MD5
65add9a4b1e4368b1831d3cf20384a93

SHA1
435f9a964f0e773239b1d8072fde58caa38f6e4f

SHA256
cd2a43b8d72f351d271104984b7efd3492205fb803c3d54d948e4e93eecace47

SHA512
d28dad98a0d3f7a11830b08bd17cf95563792db67964c8d48ab586256ef158bbd7f8316b6248ce779345a6395fde64850a197447863c9ff5a3ae7100c2a4fee0

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
106KB

MD5
90a307a2a4eb667f99de40a0137edc4b

SHA1
b1dc033d097f5ea4244661b4fc3c65138bf73aec

SHA256
27ed23c76fcfa475c40021f6d6b4c9caa8ebdc02cca5f1fac4d519218564ea55

SHA512
b6f0f8319c0f1584f9567f82f8cd3de7e6ce74d0d7aef6a0b2759bf372b6027e89e2dd74c101a3b49015ce57437d1f8e7f8cc8f42492fe84df367076519d6dc8

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
106KB

MD5
8cafa7283200ca06f2c99df097398f2c

SHA1
e20a0a188de1ef826906b9fa6b6b40838627b05f

SHA256
67b9a0cee2714666fca330aee97bc7092f9154aae7b695d610135f788529cc8c

SHA512
45a93f23854f9dd110ac8ce34b981246d2a02d9f105ed1a93da6329764ce8151ce6cc86635a6830d5703e978da39054fd14f3b5feeaaf2f54d7c821742f2bc77

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
117KB

MD5
df0485eea88550a4172ec8f439584d8e

SHA1
6f247f9819f41e2f0be884f7755a3e7c5a2d2bdb

SHA256
76bf9c5e5c360a18f2a5e99826e17c47c27233624fab28d8e79b87039e4314d6

SHA512
d37a2569e80f576538161aea8b369858f6c274e01e8818914ac33af25d4ac1ac125c20c68727acfb094a4a23b423267403563d5d05ceea024a1e11a3a4ae7cbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Set-PowerShellExitCode.ps1.exe

Filesize
98KB

MD5
24592559e3f84790cced86809c47ffb8

SHA1
36f0b51f24092212dc2d55252a669b153548a89f

SHA256
d1496034abcd027c7be6c83e66bdd26e4c3d9e3db0ac6f25108230b4ddff5a9d

SHA512
60d4c178e9085a69f129285d28fe59a82a18595eb6927f432cf702e2e3aa0666f5f4e79e0ed904122972e46294cfe61ff996a9d0498087834b2b076b3428cd09

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
96KB

MD5
20819a50867c9817734bff05081eb980

SHA1
d2bca8e02bfa4065585f227795d57f87b5a1d967

SHA256
2d3f1e4b7fdaee61f119ece1abe7c189c7079ecf87f1be571a8ba3c7edc39f9c

SHA512
68345586cea0511a70939bbc99516c972ec9208f0b953b0e2e1a0b0be268cf4bcbd7c479defe7da96c1da26baf672771055d69b7e7743da31946d25c20e34501

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads