ae4e65f4f59530c4a4ba9f96e27c87aeb4084c6bba1382c34ef024b99e25b636

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae4e65f4f59530c4a4ba9f96e27c87aeb4084c6bba1382c34ef024b99e25b636.exe
Size

130KB
MD5

28edd8bb450e8fdd2f271b1db53bdc50
SHA1

b9bcf276cc54516dc9defa600d983e68ab2df75f
SHA256

ae4e65f4f59530c4a4ba9f96e27c87aeb4084c6bba1382c34ef024b99e25b636
SHA512

8d48d54cbb502cdd3fc2dff678e084448433dcbfc5cbd44fee847b879d3f3d034b105edacce44b76d3a9dc1a94ca1ae0b8736b9cde872358d3cc530351db85c0
SSDEEP

1536:W7ZDpApYbWjIlE77ufL6YRYvBj7ZDpApYbWjIlE77ufL6YRYvB3:6DWpwE7oL6uIDWpwE7oL6uW

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5078) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
224	Zombie.exe
4300	_Visual Studio Installer.lnk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	ae4e65f4f59530c4a4ba9f96e27c87aeb4084c6bba1382c34ef024b99e25b636.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	ae4e65f4f59530c4a4ba9f96e27c87aeb4084c6bba1382c34ef024b99e25b636.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp	_Visual Studio Installer.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp	_Visual Studio Installer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RTC.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	_Visual Studio Installer.lnk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	_Visual Studio Installer.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp	_Visual Studio Installer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp	_Visual Studio Installer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\hr.pak.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp	_Visual Studio Installer.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteNames.gpd.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.DiagnosticSource.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	_Visual Studio Installer.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.tmp	_Visual Studio Installer.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NetworkInformation.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp	_Visual Studio Installer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp	_Visual Studio Installer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp	_Visual Studio Installer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.exe.tmp	_Visual Studio Installer.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-pl.xrm-ms.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 224	4200	ae4e65f4f59530c4a4ba9f96e27c87aeb4084c6bba1382c34ef024b99e25b636.exe	85
PID 4200 wrote to memory of 224	4200	ae4e65f4f59530c4a4ba9f96e27c87aeb4084c6bba1382c34ef024b99e25b636.exe	85
PID 4200 wrote to memory of 224	4200	ae4e65f4f59530c4a4ba9f96e27c87aeb4084c6bba1382c34ef024b99e25b636.exe	85
PID 4200 wrote to memory of 4300	4200	ae4e65f4f59530c4a4ba9f96e27c87aeb4084c6bba1382c34ef024b99e25b636.exe	84
PID 4200 wrote to memory of 4300	4200	ae4e65f4f59530c4a4ba9f96e27c87aeb4084c6bba1382c34ef024b99e25b636.exe	84
PID 4200 wrote to memory of 4300	4200	ae4e65f4f59530c4a4ba9f96e27c87aeb4084c6bba1382c34ef024b99e25b636.exe	84

C:\Users\Admin\AppData\Local\Temp\ae4e65f4f59530c4a4ba9f96e27c87aeb4084c6bba1382c34ef024b99e25b636.exe
"C:\Users\Admin\AppData\Local\Temp\ae4e65f4f59530c4a4ba9f96e27c87aeb4084c6bba1382c34ef024b99e25b636.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Users\Admin\AppData\Local\Temp\_Visual Studio Installer.lnk.exe
  "_Visual Studio Installer.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4300
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2818691465-3043947619-2475182763-1000\desktop.ini.exe

Filesize
64KB

MD5
955b4dee712b6996ff1c2251d6d8b751

SHA1
50b678e3cc975d696100d0f15e4718194ba8db83

SHA256
3e138b049c45a846a841049e37bf8d4e24a65e3a38a2a8ccb687a2eb1f3a7363

SHA512
5a0d542157b9cdc3459749d7bd97733a0a675ba529c585b335a4cd2b807c6bb4c35c780c376698525145a82824a5e605d5660bbe5557370c25ce551c52f8a72d

Download Submit
C:\$Recycle.Bin\S-1-5-21-2818691465-3043947619-2475182763-1000\desktop.ini.exe.tmp

Filesize
131KB

MD5
d6d60575b26b103cba3bcb5d6da93ee0

SHA1
b75aee27894599335d4181c96253efa316aa69cf

SHA256
d6970c7e19a87752f0b50ed7a586f500deaedf66855ce09f8171ab0b760fa25f

SHA512
1b58257bcb131733157475f7a9dddd5cbe12a4bb2ed4dcb3eb296898067ecd68935f54bf1b027395b0544c9343d0618ca9c2fece5d0081d2e6fa5923a9b2386c

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
176KB

MD5
a22b8755193c19723a8b4655d3955f7f

SHA1
b50e3c05e0b1d5d1a9f8c2b617797331e6cbdc46

SHA256
958a124c73cf5a3d8536f897934d2850d42aef2d78e826fd7471fe7fd2dfb80f

SHA512
b318ac379e257c95ced2d87b7aefcc543eb11d75a7df5135f5a676e2ce8ea98808285fb2349397b517f32be2c4534c4ad92b03211e93df67ba3c0c689449b567

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
68KB

MD5
28c3dcb3af197c2b60a976dc6918ebd8

SHA1
0b9a10489c65897531bfadb664173e2ac02a0b24

SHA256
759c37d36d530f14e40d59128274acb409dc10d6f23c1a7696159ea4b7cea40f

SHA512
48d00383eda250d9aba3e7c5d9a8f8778f49ccb8d2d35b23c9c8fbb051c23e4adbe17911a5e461785462c38ed71efc0ba2931bf24a883f91b8f27e14cd6c220d

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
452KB

MD5
548a95e0f0c9146c5a8a704604809a8d

SHA1
1f78741d0ad33545d56a36c2092176d6edd64606

SHA256
8118138f688d362bf13eab7a3896afb438358f1987257eef04944be7326c32f3

SHA512
e3e9a88635f5d58b6d3ad76b56b70c02a603f4e9cebb053d0088215bc97fff686b323ae5b07ac1b914c51fa3a0e6807a5916fdc1cf6a359e53441f15a31b18ef

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
610KB

MD5
079e296788f7dacc19242127bb5b4b23

SHA1
95cbcfd566ae0d7a918d37aa86d835ab72260e8b

SHA256
554d5e92aa5cb3e60d58b2e48d2e82fec66ed65f9b228ecd929ed0204058ea7f

SHA512
41b80e8fe1714d1879f5834bc1f797d268658a4d3acb67ca0fcd7e13c1c9eb4f28283cd9ccf196aad2b63c4cf1a9fb960fd211cf42e244e9015ca99ec1c7487a

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
276KB

MD5
b70c02a1b3049f89f5ff6ed70e818162

SHA1
c695c3b972aa9bb5c661600783588ef2ff931e44

SHA256
c7789c311a9e90d679397e4999dffb4482f41f560c89f4334d389d6a5c7fb289

SHA512
f50797824b54fffe27d21afeaaaf5af4f04040d10a53d7fa3a69ade2b2a825042ee2a7c703a487d78f9a47b0ac2815c5b0f23076fd134ffdf462a3484b34f316

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
276KB

MD5
08a0118f5db61f8a1ec8a194803f418f

SHA1
1082369060d12a6b719c5fbbc6e4dee041138070

SHA256
1df6d3bfbaedd29899473727b38a70422532d16a9ed62527ee3251e9ba9da5d7

SHA512
0a6e92287134e9566d151610a09080a0d5aa2d0497d97d278d6e1e5fd5135083094fdffbb36352994aff00e79c50ece46a9fa651a8846c23de1a4900af09d38b

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
255KB

MD5
709f40f4b4adbce738af49872bf24326

SHA1
9b427846a6f61f2959cbdfe3b8781f27256bbf1c

SHA256
3328139d64644fed49cbf83958a7600d9b53d5d207d86731387543c2efdde6c0

SHA512
19b4263dc59a2e52816d96b0bdb3aca86e4e2df4de4f17962f25638c316ceefa4f5697864ee8b30a54c6ae17a037537dcaa82e200c803fb5e801f0704d5d06c8

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
997KB

MD5
69f2456397e89307e201d2d42d7f285d

SHA1
cd871c519c630e69374bba99fab4a38b187ce2a9

SHA256
fe1fd76bd75560e685997668a9d23ae9f1c790df243123783bea256bc85a52e7

SHA512
1aea887c6f8889830741a23ddf7767aabf5a82d5bcecad997db0e9f7512373c121a015a1e7979ace965d67edb543dda91a39aa43f2db3681e3c7646b8770ee80

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
750KB

MD5
3ef8928324aa98ce4619300c9caacb96

SHA1
349b782cb3a5a717fd8aa8e3455874df70888e8f

SHA256
0fa72e1e923a1da64fccb839f242f96469fc33ac1d3227c6d36ce75dea699f5e

SHA512
6d1f0cdc24cd11208a05cc069546f814fffcbdd60ed6462722b2132169488ecdf69764558f180f96c3212b08e45b431ccca8f575c55b6a6f4f0ed58b1f2f0408

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
73KB

MD5
4a6363c3bbf98251c42178e991afb075

SHA1
d9315489531196f6f1321c2561f4652f5a8a1665

SHA256
934e51a22e5396e013a9dbe29b9a50b9d0765a0cc159083f705ad2bfa804df2b

SHA512
4c3307abc0ec0871555d906f304e642426a7b6f4ebfac5f525769b91545cdf8c9d97ece9cd080705274304fe77210c044d89aefac800fd6be67c2a3e31a3fbe8

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
71KB

MD5
f8982d24e6e182a5e726b1367eb9cc13

SHA1
a9ae217ed7d57a957049042c907963eeca0c4b72

SHA256
e6454e4b3b2e1989163b9687eef512eafbfd681800d6e756d8e57468440c6c13

SHA512
16ccb3f51b31e9d5fe1cf63bd646a7c6c4d53752d2d3b9202ed52a6538d4038ceb21bb030c675064864f70ab3d23b5933f3e728fac99e8defac4db5a342c20db

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
78KB

MD5
92a5c6b6d4e0d008670333c80462c98c

SHA1
85b180056c177107ffcf4ed09d747cc49223c12b

SHA256
4634841f24326a69ed74254ac4e3586ebd6ab84f630870ac699ca030b8ef0d2b

SHA512
795d054b0976e588dde1e2ad5e49d1671b9f4b38be300e22a338c2a77170bc0432cac17f118e7a409ef6234b66b730f95523cd955aad95ac259a00ae92fa3212

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
66KB

MD5
9fa0fdb9c84fe375aa6e74e3b928858e

SHA1
1d0250ea064e901db111ef1fff00faa9d185e9dd

SHA256
f3dfd751d07c80630228c25e08a24d76d6da9c9296edc81273e0a885964ec5be

SHA512
e6bc3ef1e0016b37b3fb911f35f818ed6077a86dcd0d53064583b4d9b444ee663c4b5f74cb0b95d3682c80736c84de6272b009b902257405b93937e6ad015b05

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
74KB

MD5
78c225fbb650436c10577c97c62d51cb

SHA1
003b80c619fcfc80cc098aff3467d9dc5c2332d8

SHA256
27f39bac92f259ddb81232c495e1274096f3cf5a67eaecdf6cbfaf5cff403009

SHA512
d02b095fbcc141efd304ee7b7b176418e4b546408da2d13aafee90e142f33c971b8c18140371150f6fc6429302f9ca10e6a1cc9a387ec67e799ebe1a970fbf3f

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
66KB

MD5
6ecdf4f3dfbe4071bda4ab66fbaed5f1

SHA1
82cee098077640e30c5d8a4e7b1e732c9eea251b

SHA256
22c54d985ca8cdcd3966d596b4f57c71109965e879345c2cf16d2e8e5a883fa1

SHA512
137c373f45924d9e5764d5adb424eb16a381e6d06f5492dd6bf7f788e8bb17de5ca65e5ed1f45ff7009bfe90738774c414784153e9b9cab2c8eaea0cae429cca

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
80KB

MD5
324ab1943e1729d39653a3e039b7bba9

SHA1
c7ff468e6036e00723ab82a43fba17d1f8354211

SHA256
f7dc59dd5a6c1ee60496b031dc86ec9e65ae9fcbb1c031c3d665139787847160

SHA512
966d9aaa30b8baa4cef605c9bb77dbf9274313939086cb6c61fe575af6de1c4d0e8f397b69239ce1092faf701b8c635eb9b19c3887108fd48c4a873d519cedae

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
64KB

MD5
629d96ddbc505ff13c91acfb9c43360e

SHA1
f50536bf42fce99f3ff2ec08efb2c99405668435

SHA256
6fc795152b2b94554e8f04c30e9b52ab93cd1f1656e84c9f57bbbecbc5d7e71f

SHA512
6c39d8a549e06dd1c325174f4854350c17fde1015d358bd3142bc928ce3e35df633206c469b46054e5b7ab45f2a37c556c4ddc4e2f5fa2bc27524a8861732fad

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
75KB

MD5
82d1bcd74c3d2d0b31750f8638f74269

SHA1
8385c5968f7cf36e713b416f75a9aae5edd31c32

SHA256
79330a477051be3c155bd9e73abf51834147de9cbdc483f4faec1eb79ae752d1

SHA512
d3669cc109329279fe9d0f9ebe6e3901773c910c07be0a7626d5d376a7a820d85a935e1629c335c7afef00a6c4c910ca2f9aa069377adeede536c8e4ebc30536

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
73KB

MD5
af49730e0d0579a8920cb6c5da64844d

SHA1
23c1abcd5ec7b137d0d50ac7cc4058a9a5ab2d4b

SHA256
bed95c0e9604a44ab6e3335854610c7a813ed5d648cddda150ae406e903123d8

SHA512
7cd905f45caa2f79692a5012f065ea3ec413c54a24f4ce91ab065da70ab20355106231d4a81ed79127c8303c6479d280fe5a38402601f3c778a73a0590d2765b

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
64KB

MD5
4ede29ad8d3e782eab0fe5348c48c4de

SHA1
4139f3bfb03da1ae4d0fbb18772e10e6c4cb78cd

SHA256
58ae4c97ab5e648bfa41f7f9be178736ba284a2aec1ab838d255a17d076a97ad

SHA512
835033e0a9410414d4891b1513dc9a5e5934aac44a92b95ef48471d5d8df9d1736495e07ea6e84c300eb7f717edf806fc965c4faf0494c8213495ca41931f0ae

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
84KB

MD5
08c9c2d716f9357aea6635164c63ab0a

SHA1
02f3410ffa91b41213487f4f6cac68ad5dd3ee83

SHA256
2628f622b4143905e5810c1eafe764c9247e1e783a261ebb8555a73bd6b63036

SHA512
0e3aed7f7c57f51d541053c9d8875fb5caf4e02ad2a2ef79d072573b42fb945749910c966967571c6ee516cc41f3c814aac6a8e4f0c8d4e6301477cc0ac25f77

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
78KB

MD5
54fcb3d97b94dc202abf6f52a57d5bf3

SHA1
4221c4893f6fc538c7709cb4862f9a4daee0073b

SHA256
f19be3f1f45fe169eb2cba547310a85ea32f7b9ad8447bbc955d7c9ee7dd5d47

SHA512
0ead9a8158e734181a781a8be19ba3d352f032b4426f3745f958826780b03819721534dfca90446f430a826564de2eec4a2f888f78a28a8f50677b580fd0e0ef

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
84KB

MD5
56dcc164ff2f1d280873ce236748a078

SHA1
f8f961193f4cabb5f4b7d517fae2728416860168

SHA256
6a55497bc58a03eb34256594e2abebb4143a11fe2d69a32f1633d5adf819f21f

SHA512
8f1e725cc2ba089a321f067706ca4d72c3bbdeaba66e8f40259546dbf343e786e7015c3d74afb1da411c24c7bbb1841be46d59eeccd4f440b29b912bb06269e3

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
75KB

MD5
6fb59be58e983a7ac6f4a5684bae44d8

SHA1
4261843214bb74b17806d00b923cd2cd8c1963d3

SHA256
3c923fdc4792233dbcf739d304c3f92949b2b1db9bf56053910b64f98f6d95ae

SHA512
d2d895d372663b1b37a24870a88f053b31ab2142b236169e69d850d727028f4fbbdcff32d9d27df66827e914e6f395edccc5f798c4e2f68c4006c413a833a3b0

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
76KB

MD5
601efb22ffa9dec9f9e3ce0711af1309

SHA1
9f8e790fdb84817a4f4ae44d6b650a1998fa08d2

SHA256
d1c97460c13b49af8145980a66640f2f2ad3288b10ceeba2bafeb7db65f6aff3

SHA512
a4a7cc0c1183433b1239c9475d4947a61e156b2a5c7878063fad6c14b98192711e197264c0cfbdbcc1c0c064f75d03cd8ea32acf5aa638f2df355ff7a83a6acc

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
80KB

MD5
4df281aa0f593b5eb9e62c7f23dc5fd5

SHA1
14aa68cabbaeb7ef1e598739a372a882baa13748

SHA256
0b069da8281fcba542bb1989b03dd9c556c4822fe04c774b982c9778cb0453ef

SHA512
866c5bb37c32a3814c289ad6be561d28f1f426ba7339b66f1df866dab64865a5da3a19e42ffdfcd61f4350a2947d8c35f106713e1d04229da2851a62527a96f7

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
75KB

MD5
e26420ee01c96ee7a84ffd5a3f123419

SHA1
4a3a592226e0a99e5145ff2fc53f8d7705dc7d5f

SHA256
3d0de3ad85659c7cd0f8d315a24bccf23fb07f92e7df3cbc499c5435d8b7c275

SHA512
adf64c911489f525b667e7269a317042ef714838f42f2e13c022340248cd0cabe86e560b67d584ac6539acfc6f0bddfce23408942b0d2333f5220bf294a428e3

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
75KB

MD5
e6f1045b103fa4f4960f43f1c5d94f75

SHA1
7045b6b6137f53f42ba5714984cadf76320aae6c

SHA256
378406617e26cb2b027681e87d535fb9ab90bf46399240e3779ac53136f931fd

SHA512
b63c3ef37fc74b6f056a0bc44bd1bbe27e26654f04d47bb362973dfe6fd616cc5c6feccf143821ae50722374f48570882ea57b6007e1f09ee06ec7e8ae71a6c7

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
76KB

MD5
dea4daa0b261d24693635e9dfcd23450

SHA1
d7eca0e5c14e30c644b8896e5814ed0a7ebd8224

SHA256
b32de6577ded344bd062dc2818d7d783f4c84fe9abcd3f75d3ab2f6f77b565e9

SHA512
3f58eb264c38bfff2e30f8ba6ea087a820f16c7755ba388348b1674e1df0fb0de1a186c95e4784bbf25144967d4e48f53570d03af2717af98560bf3f06a32eb4

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
71KB

MD5
54c178e9da84890c115e27011231c2b4

SHA1
51c5d73d37fbe90f1d8bacd906d8531e6c626f7c

SHA256
ff020dbc60303e69ae0f10196edc315607ce09da7b33cb9293affd1df3037689

SHA512
8c7d0c269fe7d4e8511965a407b10566accbd2dae46c567661446e68d7be17f9c5e61789e076400a0014be3eb4d5488c007925ad6005621b02eb2b3c8619d8dd

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
69KB

MD5
438aa28942e40d6e905b14cb9585dabd

SHA1
91bb02ad949f0dfa056458c8facd4499b21c0445

SHA256
805c2f3fe9f531b5e4b253b683149037cc193aca470e10c3056d8761250005bc

SHA512
e17d9830b548bc2d51f58eaeb6476c74438a494a6bcc228b3767efcb4b568fd9be97a7ba3923040781cdea2d5742a6cee2488c0d489c3b9a3287aaaefe99db3a

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
76KB

MD5
f2feaf7e56593b0b46b744f7ff14a273

SHA1
ee72256dd5ef8eea57024ceae9434b6f5b6f2d67

SHA256
781f8c20f2a4a9c4b79f916365935e4d622b22afe8d26cbc84dd446a503d6b9d

SHA512
9e72c617ed396ef22a630aebe8d3e3e0c43d1a03586dbc5a92bd6181ebe5e876dd199a474ae83e94e474d6aa14042113bd5ff9f39cbf85a15cf8c6af27d0e9d0

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
71KB

MD5
a9db21d0cc54b52722b4ed932e3c6d25

SHA1
6be074685cd7216d5ce80a0543028d2de3ba9b2e

SHA256
232d87bd13fe07a9a58a7cf72977d19b73d2bc0ff6d9a65f368d3f05f3a402df

SHA512
d4f1bdd46b043f58b5282b3a23916d13a07ebe263d388aadd9ecbf8affe66233df1a98a52a40de42ab1340ba958a0c4a2a08a2257d9c762a941c88a04a253613

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
76KB

MD5
2d06d0c8b50560bc993b512094604246

SHA1
8d6af4e36571b75e350daa17094b050f42ef8347

SHA256
75a7817fc6b4409198efd35b23336e1676df5b4126828cd7b9341d69b8e80386

SHA512
35f80b2d1f6e77ab212a7a8299720203b6dcd154173c92d379c1542f5d87f7144af64ede404eec90a3c8433c73491d24c90f78c025ff446f94d8fb7bd7fb3647

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
69KB

MD5
deff3638ac9299957e7306e9b9eda7c3

SHA1
1aa7a55c6a8b6ce0c1a0ab166cf0b64148125a16

SHA256
d6209b1f11df3782f3554a2c5bef25664312d5c03b09cf3d85bee2b6b4217b73

SHA512
fe8cb7ade8c5b8c3459cc73f5e889483175f7a90122d8aec0148731d64a31f276520dbcd5beb92f4dde0fb196635a2498fe76552c5472124e6fc0446cc97ebf8

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
86KB

MD5
7a2a86aafb11b64b0bda087696ce980b

SHA1
8abf91162573958efd3f1138bfc4c214a095e5cc

SHA256
07272d1722e734e3796130b31baa40d193a7d29ee35dd993951dd3f8a6901251

SHA512
b0415422e7db06e0bb705855f6c6c40f4922149cdedb08c26bd85ce6cfe6b0ebd0018dfb8eeeacea51b33caae439627ca620a9a0650f0d7e39a89e229107ee28

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
87KB

MD5
a5fcc8166353dee3b8f842dff52b3c06

SHA1
8487767997ed734a469d31f6a03b5ffe7a7e9857

SHA256
3f798fea0569b4c50ffe3112ba035ca160c83ff61c6848dff0922ae57eb1b1a8

SHA512
1e194f884c07de6671d110466ffe9c472f3ff2705589a079000d8856ac28ee2437634e7182e0112c0c532fbd5c65370e8b172c626eb15cdbc01751a5f4806b76

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
74KB

MD5
af3d322dc4228e4169d1e6cd6ea54556

SHA1
fb96bf536d33d9cdc223130514db0805dd1e2aea

SHA256
cdef01ad056f9684c0962129645092f08bc94ee2311d58399d75f3aa9fbef248

SHA512
03bd8122f7086ebc79348924bb83df3588ef2091207c2c00aa0778baa85af1023e94f446432891b258c31dedde70ed57365565b0a1b7a3e55ec27cae41c17ce2

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
71KB

MD5
73518926b3d258a0bb4076cedf478dfc

SHA1
496bfd37f2e4daff5c395bcc144761b3e905c47e

SHA256
bcae72d588d734d8cbb1d537e8ee53b260ff46366de678cffbe642b394a880fe

SHA512
38bb44043fba0f4f8f6688a31f676bd439648f879cc94ae6aaf226e7db9c3172ed4abed15ab99d592d2ed6044f0838f45cc901dc2f47fbbc88c8bea948bcc79c

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
72KB

MD5
47aaaf6367dd4ed581140e4a787f90c1

SHA1
0a36bf74b39fd5ad51bbfb6ef052feb44d5123cf

SHA256
3f8c9513ecaa6fcdf8712ab9a76c4e12ad3321344196013a9d0001121030bab2

SHA512
43c9fb90111028c337711a207ce8a326300813a93778f1ae04174771416f3af66bf6ccbdd9ac80b961e7779081ec48eeb95f9d5a51259b36da7a783e1241c60d

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
76KB

MD5
30515263b19a6afe3aa7d0b2fd8ab98f

SHA1
3a9a0af0f9212d5c8a4fac01fa606dd8bf50b435

SHA256
b99b41c3475c0a49db94420c728650eba4784e9c34a6715823306fafc96e1eff

SHA512
d4e92d71960391349a0631479036729ba15d216ded7fe17e0f0a604da7894c7ec99c963decfb911183887ae6543b03e1499b303698c7a1503d8912fa0fd41712

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
72KB

MD5
c2b8a4e0935b4fa18535587ba58fff91

SHA1
b5c8dcfd54117d5cb624b74c4bb7e7bc07aca809

SHA256
dd352797e12513a4346c9bc369533eb877c251c09859ef572d46ba20c379f0b9

SHA512
3bb4896467e4f4c271474a6c15f791bc1e09ba86b58e23ba2a403193c8b6428d4c6bbb0638212281f725739dd81d0e0be77d36b5056934c62157a827f985f628

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
73KB

MD5
f3e1d86c33967a352fbfa62190112b7a

SHA1
363b6e8bb8481c82a808e2cc6ed3db537fb65584

SHA256
94c03e6258a675680d665f276ee416e22c99ace949e417a596e4d858968a5747

SHA512
df19b4b826c65d05c20ac5927498527f2d26f93617781f48dd99a7736719c9a114018fac0ff1c01d5651f5b35d4610e862f87a02b83d750e9af0cd60656fbbe8

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
75KB

MD5
5e9f89b9bc2538033e145c79357cf9a1

SHA1
d72dd09e41af8114952ad01f23b68ed5ad21ce81

SHA256
13485f42c5580f6d6408805503b2f3b12debf665a74631644f58a881dcf3e97d

SHA512
98e30f84aaaa8108a1487c18a1c1f44060257bb11739d23b3de862d5c01fda2e83f763599e65dae641b6dad5c9105ce215b87b84b52eaf3828982ce03f49e2a1

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
73KB

MD5
a38be63ede7fffd94f308e05d7407e79

SHA1
33de4a7fd66290f2556a8dbf6ed37461b37bd1ba

SHA256
65a0fcdb42ac8c3d1aef979c13b8d9cd17805a0f97936ccdf32ca0d3ae7e1e84

SHA512
6b3aab6f3b81dc31ef17b463657eb45660dba0b36901d49643d4acc9abc9eb460aba44c6ee46a45eabe8ee03bde2027b6dfe4d5a210ac04b02df0b462ce1052b

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
79KB

MD5
b67030156e1215a03de6230979567fab

SHA1
5cd76185cd36a53dcbb23e7e89403fc032cab917

SHA256
6ee8c9f244f070596532debb1b53525ea6c3d169ea28f9a260a86934a82ef19e

SHA512
d3437de5c5c5f88df8656ee2cb88b31bbe15433e460859cb3ee27586f7fc6ff38378677fdd21eb2625d6449a2b5f81140fdcf856b9db617d921899c070bffd5e

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
72KB

MD5
b8ede815b76dcf75650c659320ab8297

SHA1
3f4c12886e0212295d9e6b2a87ea08ae88e74468

SHA256
50ec68f825aa58a385c5e2c80e861b6e582a573111d313afc676d3e927a7bf40

SHA512
02c39c6250f18955e796480648e8caef31464efc1970fd5e7e7fef6f57d39b9a06665ff40909a97b82d5d328e52e8ef1c38ac5a70d55a8383dba3cc658e9f507

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
69KB

MD5
1e6f50ee47e68d62a4c5976215a3b4e6

SHA1
42a7de1b6a179054996bbb9125d05fc245ec5e92

SHA256
c4abe8ff03432a3a3448a75ff106f2e0c492aaf753ed00447f95d0fe09476b0b

SHA512
8a0a148479d97b9f7c9fb4fb9b4e967a8d7fcda7ac44ad8f74369af688b54ea9d0fceafeb5be5176caa78e475cafec605078868662b9f152473f3964a2d34ae2

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

Filesize
75KB

MD5
d28a348feac19b88e62380b66f900cd0

SHA1
f0143d0f0ad7701a4a5f35daf5ed31fe931a6b46

SHA256
df46286eb202e982ec73fd82a5eb82fa74973a755acc763fac0bd2176ec50205

SHA512
cfe4d1394bf7c0a2d264e8382a80576cbb3f3de958947da391e0e0689b6ce4916132ea6393c31f7aa13d020e9187b40f2bc15728e530c2d8e840a1a52e3b5bc3

Download Submit
C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

Filesize
71KB

MD5
48baa16414d2951f142e9a71a9b4e0a1

SHA1
0f7c1232b4a242dc544eb36ad1e6baec171e29f8

SHA256
207207f4799abf74ebc8b5de20001a6beff32759d77fc2f7c72bfec6de925610

SHA512
8cef3b8694b3795ed954d0bc8c43753524af904a35287380f29e6d75ad503bc69c86c649f41f908b3e6822e037a39eed8fcfc69a0874b5197fdf35e78d35ff37

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
67KB

MD5
57f0eb8dcd15b526c63f339ef7573be4

SHA1
387f60d50fd8db466e2e0a65163c185e10de4571

SHA256
377fe0c40496fbba280a3128923d04a162e4b6113bcc2f60c62367b44caafa2f

SHA512
9a10b3bf056e357f7da4f112050fff481a6f6764555f741d2ef48b2082e1b49c68781791368f5a2d8fbeee47f8dfb1fa4c33efcbb8924117b777428134f1fe5c

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp

Filesize
77KB

MD5
66ab2a6fa5f19aac0a7e3187321afcfe

SHA1
9e79c751ca33a0bafaa17ca7956501097620ebc4

SHA256
002e7713ea2008fe6b082dc4c6f98bf54318fe9163279e63d3d533ec9ab75fa4

SHA512
c8a8cd428f0ddec41759a13f4da6d4da700f29ba6408fce9dba6d38b2a5aa097f9d165b72ab7c0e2affb1b0d4d46e50663aac0b516ea727007cda022fbd9cac8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Visual Studio Installer.lnk.exe

Filesize
66KB

MD5
771511088808077f089224afab40017b

SHA1
0e29ea88e49bb33cd9c02fe080c82557b994b955

SHA256
841e35f72ef146ac66f8008b8607cd58cf65d6ef6c77c91a48be6d2e1e28cf2e

SHA512
26e885500ff8abe0ab288152c251bd37ccac2f18939c261c53e2c4c790350b60aa65b049cb7e8341b33cc4bde4cbe2db283c9d45b4706a6c1e1bb06f57827541

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
64KB

MD5
65c65e9519de40c6ba403c2e9f690b76

SHA1
cf900541f0c4928fa5d27d98bdb730ac54d68d26

SHA256
9442c30ad4cb1abb91ed5289e4f48b2e25d6ec77d6fdbfaf20354727d6934414

SHA512
2b1c5161c2db0ef4704f87a1c89a63e79118177968a4f0b4bfc4c09a4bebf5af34b76678e740a4c0044cca0f103b65c702eb4e8ede65a597d921efaac35fa7d0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads