0c5c2cabf5e34caf3437041cb14c89907a6f2a8f1bd24d0a93809ee1ac4d5544

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c8b4f6d77f17a03134b5ec90f9dccf0_NEAS.exe
Size

157KB
MD5

3c8b4f6d77f17a03134b5ec90f9dccf0
SHA1

ffc6fc5890e44814558e2925523780d13710c4e1
SHA256

0c5c2cabf5e34caf3437041cb14c89907a6f2a8f1bd24d0a93809ee1ac4d5544
SHA512

8cc16c4971ab88207ac9a6a6566c977e7be8dd0c94971b954e7e76071d733bf071225b9637dd17458d5df80b517411139481df8c854b6aa3cc556fc8b1adba86
SSDEEP

3072:6e7WpnhkElEa0NQn0NQ82ee7WpnhkElEa0NQn0NQ82A:RqthQ29qthQ2A

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4922) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
572	Zombie.exe
1596	_Desktop.ini.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	3c8b4f6d77f17a03134b5ec90f9dccf0_NEAS.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	3c8b4f6d77f17a03134b5ec90f9dccf0_NEAS.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationProvider.resources.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\ReachFramework.resources.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TextWriterTraceListener.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp	_Desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	_Desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuin53_64.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	_Desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	_Desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	_Desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ct.sym.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 572	116	3c8b4f6d77f17a03134b5ec90f9dccf0_NEAS.exe	84
PID 116 wrote to memory of 572	116	3c8b4f6d77f17a03134b5ec90f9dccf0_NEAS.exe	84
PID 116 wrote to memory of 572	116	3c8b4f6d77f17a03134b5ec90f9dccf0_NEAS.exe	84
PID 116 wrote to memory of 1596	116	3c8b4f6d77f17a03134b5ec90f9dccf0_NEAS.exe	85
PID 116 wrote to memory of 1596	116	3c8b4f6d77f17a03134b5ec90f9dccf0_NEAS.exe	85
PID 116 wrote to memory of 1596	116	3c8b4f6d77f17a03134b5ec90f9dccf0_NEAS.exe	85

C:\Users\Admin\AppData\Local\Temp\3c8b4f6d77f17a03134b5ec90f9dccf0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\3c8b4f6d77f17a03134b5ec90f9dccf0_NEAS.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:572
- C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe
  "_Desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-877519540-908060166-1852957295-1000\desktop.ini.exe

Filesize
78KB

MD5
811489afdd19f24208d2f85abfee94d8

SHA1
7aed942fe53011bed949ba548381474ebddc4aa1

SHA256
d66a5518ae89a12508d6f555125426317b4c4c6c8991b1b43561c91e8043ae72

SHA512
e48d00ca4c693820e046987c540dc8721afeaac6985633cc5e04a061a104244a32b2ddaaa30ae7a95fd568cc36b24c4f224f4a005138a6b66f824a9a5569c22e

Download Submit
C:\$Recycle.Bin\S-1-5-21-877519540-908060166-1852957295-1000\desktop.ini.exe.tmp

Filesize
157KB

MD5
6fa6c5bd36720fbff0aaf00e3e72cb08

SHA1
0b0ee9fd14b83e34bc09d7b65ab727acb4f539f8

SHA256
c91e908744b15fb8a1285a704b5d3270dfb578ec6be645ee550d0981c4b98ae6

SHA512
358a51872f11a32f49466292bd00392456bf203e8b140d55342d968877505c17c527edfed9e516a92f54c139db06490cd7da239e60ea44c0aca68bbd54f32e74

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
190KB

MD5
33b5adbc1240f7e2b86ba334034ee040

SHA1
0cda52015b553115fa7c0ff487b3f1fc5602364f

SHA256
00a9b514099e90550c3afab92f5c3d53ea3b371896db9857c6ba7d618b3cf171

SHA512
806506c70f5b030e3933fd713f0b2b4c3e195e1a06dca5e6fbd8d8bf9f85d051ee3401c7faafed04478458b786f9f2b499dc823084a268341e91bfc056972468

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
177KB

MD5
b22634579fc5fb3da90793a752f385aa

SHA1
d6c6f285147b9509287f865aaae04df44e41873f

SHA256
a73a44c3aed0fe8dafd60a59051ea5b215e494b9d0a316e0dcd73e0ff62cb380

SHA512
dbda1f369b8a681cf0cfe2141fcc77e2bcf77c4e7e80c19aaffb5c6c1a589dad4f53cfb676f9d05601e88cff201235eca526dc3cca1fcd7cf73dc3b9dedc5003

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.5MB

MD5
fb4b6ad110039cfeb01a21854dbef01f

SHA1
184c496ab7611fdd301d42d331133b740e40bace

SHA256
fcf811fe8fd361a337700d9804da9df8ef557cffac628febba6c996c65bba539

SHA512
2076fbc0dd2fef9d774c372bb152e5b8f2c857c2d6f1a68393e47f3461131fa0d770a3fb0a5e1a6193e7215ba0b079b46a3f5d74e66ca633c9396235dc7e13bb

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
1465cfade03ea8506f041b7277dd2c01

SHA1
62835c2bec3d965f550e07967281eb976faeb246

SHA256
fa8c2284c83ce9a4ce98ee013056e1b35f12b8086f63be534babcd938e83d948

SHA512
bd7cfd8cad0d6462ac113a714b811309b9f0e070d2e9291e2aa91d2a2530facf86a3715b3db77687ca9f4b29e875ceca461f6aac90374da51c74fdb039822783

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
622KB

MD5
ba72a40037f9da4c45c8911b118a98df

SHA1
c4b7503cabe588dc7c50417d1566492d85d66ba8

SHA256
992e28909697a34ba605eba2a51e54f8d765944cc6842bbfc083d23c1c6f179c

SHA512
89935f00b9c17969537ef730a8810a746ce7fc648cca8d5ca91ab0832b69958f89008875458a29c63610d5876b1019efbe37da1ef8242d8235f0ebe7071af683

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
288KB

MD5
6099224da0ca3cce2312254454e47022

SHA1
bfb8dda06e28b1911b7d8d2baceb2345debbdf27

SHA256
c1ecc4ada7386822a4ad7a2499ed69ad4551c27c0336841847ce0d9cb9817a4a

SHA512
cff99e4e600de3ef0dadbeec7fc9c5717d6849509b0a51aadb16c999487592e3d13fd92764085339f7b9377b79a5a12118eee0eec348c9b2fb34717047853515

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1009KB

MD5
da16784bb4709569a01355b7ec7b98e8

SHA1
65156bf69e79d76c01b4131df32c22b8555c6d22

SHA256
18c8929fd83b437a0a3b3ba7998b8327ac851ba9aef93b81cc05880d4dc34696

SHA512
4a4ca8acdbb2bc4279c552cc34521ffc73d83841ec9b2371ad2704c2339692f747e2eb065665674a552473d6279396edb090c9cf23b068e459da53bc36f014db

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1009KB

MD5
57955eff72998b4efb63181fc8ae139c

SHA1
1911a0e258264c4394093a025d2dfc648a454656

SHA256
6875e9931f8a9118b69ca2dd77b54b85ae232ddd8e1aa18babd71e7e00f757db

SHA512
41611cbc66cc9a0114404e933280d270a4a4223cea8799721704e4748382dbebf7d651b903d87552d473d432b46fcd3a1837dedfadc3d96a93bc779fceb4d334

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
762KB

MD5
42a1d462bca82232649d531acd8ece39

SHA1
7e9c75778d32ce7a46777ff756b994d93080beba

SHA256
92fc6bcb86ce580e0ad9b11d709f5d711d5669723a40390e0b2e2a6b7ed662f2

SHA512
cc72d30fbebfbadc5616035294e0e5fc58b23152878a2f9acfffe4ae825ee125a474ad2efee5e16f99c3e53ef8d10ac6dafa8355342e20cf6d46de530c4db188

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
87KB

MD5
a3f0fa89a2b6c132d92b9ea552d88ce6

SHA1
3ece8e890f0c5f6cd49a5b83dd43e9685f07786d

SHA256
d21de8305595b08602930336457915c2df958fe3248afb94c5bc69efe12a3ceb

SHA512
d672b29bba15ca4823086c5c01e7e19775ad47b2e26f97da7d74cef9fd5b4f60f54107affb3602a180180d57d3bfdc6b9891c9b93cf853f47a346761076c43c9

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
85KB

MD5
a972c51bbf7eb38cd21cdc6a8441b5af

SHA1
440eb88306c93a17b3e3aabaf87fac6a608f3172

SHA256
4247a10caf0ff9fe5838498f1b6f6739bc44beec1dc58e8c98b12a14af92e952

SHA512
8e22a4bd8719c4321f67df827c350a78078bd8cc52629b04c5c65037da78418b73734c2812215e5fe5533592ab3c74e606a5ba2da3a475f2f0013c04eb11a9da

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
88KB

MD5
5c3b92d0ef0fb304f3ff3631387ecf56

SHA1
ad2e5e0b433d0d5f0543cdf036cbc32e4a4237ee

SHA256
326ff9a3db2c63431f89b3601eb074dd8d70bb260737956ac23106f6fbd887f2

SHA512
4403fa3dbb929789915479f8d50198286442e410ef3b1183262c06da9d1e6e1d54adc919043354314257191b0c4382d927c2c16240affb6a149032bbc6a08251

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
83KB

MD5
d3f02aa990f1118fd71b191bf4bfd212

SHA1
8a3d9bc7dd7363698afdffaa96bc9e16f8d0b79a

SHA256
2df38b9d70473116a84ebef32fed5fea8326477a94d27c06d0d60787bb128f31

SHA512
6aad22d24ff308b0de6cb41d09b08baa1c625f33cf99e4b90b05b0be905c596c3cff3f9bc0df3fdaaac03b0ae59fe8ed9c29ec432ae2f02fe5e51ddd8d7b2458

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
86KB

MD5
ae60ebe2ef98440854a8ab9a52743532

SHA1
49c188689eb1dc54346d91946526b144325482a6

SHA256
c9a17e32ec7903a3cd33da935f3c991b566bd1526054c84b01b17aa371279d2e

SHA512
979a03770e55af5de407db1c522f6b4d376ca18cf03cd4c45e6a953eda904cfcd22dc3e466bb60290cd0ec3e3385e079522b406ec2345e0f3dffd0ccd8b09976

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
95KB

MD5
5dc0fa87d25f597c24b9d12178c96b36

SHA1
f93c78cce30d6eced8709e1e2b7e684d5d6342b6

SHA256
9f4180b715d4e1cfb12afcc6010dc9bdcbb939275d13a6b0329b9df7fa9fa357

SHA512
c29b84f99b25556cfcdc250880f067ea657137f825f15d2ffe8834afb9883ce5370b0a5b5db5cf98900d7e603b930f79b312758ccca1d789e4dc05631d01ab0f

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
85KB

MD5
6e3e3a05c4f876547fd0bfd6480e6337

SHA1
f2b199ff04d58b119d9db20b7aea74f576df9b31

SHA256
dc5fb3afc2e3a61820d578c10114340c9760a0699e382da126dbc82ca3643a02

SHA512
36614b533effaf7297790b66aeb70974c02aa5580c86f4db956146ed47e4877e09d87da6dfe715dda89fd2864af8dcb0d9fd700de25c874b7b74e361ee748136

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
85KB

MD5
db51c1b59f9518d047d2725c13225065

SHA1
785149960da44c0224115dc3a9fc9330099b2de1

SHA256
e72af7d5466290e7743c89f5379d698088e707a4604995829d3f4f8173cd3387

SHA512
56b87661268845454547886095f0f28eab4b67a9aede6eddceec9010111d036274e1baf5bb518e33c9faf1d85c5f9d4dea55d40f62e9d8ec10aa43575762e43c

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
76KB

MD5
84e5e466d8560748c811dc1403a787c7

SHA1
29e0775d0be490d669653407b29939cd67fe51dd

SHA256
9c8041c0a41dd3ce145304c22f082f831538b3c823b4a81d9ceb50f96b463c86

SHA512
52b1b06e993349face3f4197500ac325206b6aa27e7dfa915b2364803e540014bfc78034b1fb5395d150e1a9b54a1a3d677b58ca78c59ebbab6bb889a1cc1a5c

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
92KB

MD5
bd6b60ce45113d2d0f32e018b56c9550

SHA1
8947f2d9cea8b8e5599ec25e03d3ec909b3718ac

SHA256
70232bc059c985628a138b97fcec329a3458bceccd051c9a842d6cf5df80d8c5

SHA512
620b857bf479c07c8e1cb95aaeeeffc7d631139b1bbcb961f5bd01a814e9310e2eb479cad49d0578a000af9cc771babdecf468ce6b9c69230bba117b21fada9b

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
88KB

MD5
128c8d7f24ae3c1bd585f923eb66df66

SHA1
354b1a026442b404eec619f4524c788fe6a9538d

SHA256
2afb4a8c87db5a5766b3ed2c3c821f846064a8d6728dc9e7fd3aa63ad168a6fd

SHA512
fa1d5c22058310f739cf16cf4bf48a426cb267dc4b8cfa21a24a76f0c45b82681ba854271dd77107295188b2b2ecba9735ca7422ebf654699fdbca209dd9fbdb

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
87KB

MD5
cb2d896c1553e3be7475677caabf5a83

SHA1
d2446cd6fef9aabf59288885aad98842e9937a78

SHA256
51cf79726907253b41de448768b8c979ba75f01e71e0e3f79035641d32efe33b

SHA512
ad17d260bf1f8e33f8e6ad6b2a2d0043dda439e6fa8ce72a04dc151b553e5a9b4fbb52638b3e6d7a800135b6b8a202e78d66293a13bbe42013a4dcbd9ccd2850

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
95KB

MD5
1a183bd6432a068a268203613a33ac9d

SHA1
e57914b88d35ae985bb22a8d27def00b8610e5b2

SHA256
db61c64747d252d7045b6437860c6ca61e77ab6a886dfdf068158fd9f0cc957d

SHA512
0fb01a3d427a28a8d2088f6e14f5165435be341f3351d6d2478be0e534401a3fe29588daf0c89da78099ad9e4e26199be9849f3f0afa598d4f3b661570fbf9f3

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
96KB

MD5
f5514f0f73480c3d20c96331a076e9a8

SHA1
a206b3217628b4629a749c464268e1130a5419db

SHA256
56bd0a8a538707f7102915c61feb54c29ddab21ae61559fac3c3a7a4a0d5bcba

SHA512
b40eb539ce7239691d31b57053d928e5a3ba8afb19dab5423b57e6eb05273b81d17dc58b1deda0a4609383354c1200a8c506db8fcd6bb6af9d2e4418bd67d8ee

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.exe

Filesize
91KB

MD5
3b3d6eeec2ea44ecb6a56d6c17dfea00

SHA1
fa751423aa7e173d89e2a14dc49cec93ecabb514

SHA256
501c79a82151fc028cf3d404db194d764f4ea9bbf3e17ce42520ae1e307e3724

SHA512
d3e688a80d147ad0c7a317356ed6a6c56bce34c706ab5d1604eb3bb2e8abc708661cd97b57004d046959503bddcb9d33b78f4703ac51ded93b1312ae4087c63f

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
86KB

MD5
6238076c88130dc99a980cb5f41ee592

SHA1
aceb2ea5db84f7ee396d896fd56514c8202c4286

SHA256
f58a0e73e1095a85fd6ce625e1e870b6a16e2ae455f667f7210bb594dc8bf7b0

SHA512
6f497ffef279e48027784e335492a463eeaac1a7c137dcc0699ef3e1ec3598e7d60173f3e23da59e6d9776f35fd3f793a8d8e106e2962d9524e77b4a6a32c23a

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
88KB

MD5
77bc834d4fdc80d266758c5ee36f9882

SHA1
86217f06dd5d9442d977889c012526723b5514e6

SHA256
abbcd0b8b0b11d9bb2cffeac334deac9fd03ae81827e2ae22ca6dd2bc54a002f

SHA512
ed40ea27180fbea329533a9b76989407aaf36ac7639b73a06dafe6fa2f62065e64dfd81e021ed52a7f6531b5e65380488cc2d521264a40f057846dd2a70596b6

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
90KB

MD5
737e8158437797b9f93b25a8d45adb05

SHA1
099bb6c8051b6c45cfb83399e8b96485ae55d0d1

SHA256
4eccd688eb7d0797e7e0d143bea9e5f3add584a433fc61b340f8f473064f7acb

SHA512
0d985c9ca8394cd99d9b210b334e82cfd184aba04a254640550e327babc130bf838abc5b0fce2bf0b557ff4a88dd53120212ba2977d34700be12e500ce317874

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
78KB

MD5
fa38b5573a632fe3665f4e68d62f4d52

SHA1
a87e7849dc7167ea42e951ca2a46b07c5fbdd338

SHA256
93bfb60750407294cf2736e618838b0456be92527ecd1838f126889bdb2e278f

SHA512
597611c8b7d1413127dd5ca81aaa514bd719aebb2f8b47d20c35bad7dac6aef4ab630b3469ef2c6ad619391484622df4b19e8ac0eab8f1d1d13d860c77e98a6f

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
78KB

MD5
10402a7f3cd2b55df6e6a0c7b88f3e98

SHA1
873a5b0867e79cc099eb84c17eb621b8e88ce54f

SHA256
3336c6b1882862c8bb669590fe14f9b0d77c1691619130a53d06c9bba1f49bdd

SHA512
ba4b345f37ea1f4f7a9f0efec4bd979a8291446073f7d5d37a1bf198f81e6dc54dccb458f28bde34a42f1d5e86e7068945ea45d2df83147badc8bc32e6056802

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
86KB

MD5
87c523ecdc37d31a6a04667f35344938

SHA1
2b053e9c1033a08b1d03beb7494684901eb27964

SHA256
c1ecd2c18d81a714d73375e874632e2e61ed8401f03750f8f27e14a5c0b0e202

SHA512
7f7f3163144a66ce5e905fb380819e280ce5064a33192480695c040a12bfaeefb0ac7f02a5535bfa70645e40911864400f0a72e554d1a5d4b6750fafc0248c9e

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
88KB

MD5
d79701827c51a6bdb428821a4acd995d

SHA1
76bedb53fc9d6d702b11dc0c2a35f930e9677615

SHA256
753388e4110490113f1f7452a854b8fd40ae49d942a37b86547b2daac6915e33

SHA512
9e8e0b113d960fde6eca0c50d71e6b4b6111d514cffb5da35bc77a1e32c1e613bf91f22937de24ff2be241a9e04d9ee0a1bdc311c4fb69415d67ca5014246dfc

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
84KB

MD5
618da07823161700fa0841979a2ffd29

SHA1
ebb0a944dd7e8145fb2df215d45c0a7d63520ad6

SHA256
898a037bd20e2be6bbc66a7a8e81cefd60cc6b0a840477e12b0c68e324643f8f

SHA512
e930d9c0ead323c448423da5c6e4af64bebe2900d387f4500655633a6b1597c0ae8584b1fbb310858f729ee44b232b383f8300a4f1000f6d295b3609610931ea

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
87KB

MD5
5c609e271c52212b6ea02326561cecbd

SHA1
9c53148425facc6474e0516ccd13074bfe854d9a

SHA256
2f30a0593a9ab48f3b7267383159e5d8d196f8a81286c9ced92ac3ff3eebc5af

SHA512
abc2dcdaa9de9badcf886025d1db510e242b589b2342436a8b7a99d9758afcfe56142398cec8f140f010154bf370825b00f880730db80cc5a14122674a1f3f78

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
98KB

MD5
5a4e79989b5f28768f156082c9a70aef

SHA1
44dae5ae43c797578dac4cf0510800f1dc617268

SHA256
c8f6a064831300681b7001d2753307d35bfb9a5ab9e2d51424f8afa38699b953

SHA512
262c4f5858b3f512a3a6fcbc1341ff1720693aef1fbc498d76660ba49f3fc64b6458306d03c2b20a12945a2b3c7352a748f723bc2bf722513d3eded74dec9733

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
100KB

MD5
fbb70c86ebdb719b3d3859dd8915e31a

SHA1
198b4b4dbe69bdd26a0f9ec09c47394a9789aff8

SHA256
feaf23063232cea7fd7d882040c5140b0904a45e8ecd30716fc726a28cbb0bc2

SHA512
647227a747081e5d78404aa3452d1aacfb854dc40483ecabc71ade2a00d26210cb368dc005b862950b35ec446525b56474911dd12ce174d68ada7ed8681b9ae0

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
89KB

MD5
495742ad0ce0f00fb4fce08e58bc29d9

SHA1
36d2f531be070aecbefb4cecd14db75d4f8fd3ae

SHA256
5608931a3501ce09a9f7f076d45baef02c94a53e0260cd26cf829000bf8ef48c

SHA512
68b77837762d6c5b8e9b5b7d0643bf0907b9e9b47f8c45280d71d556ffcf1c7660987a8700f2438a9158a90636319607a1f085e416912de0f03acd5d7d4275a9

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
84KB

MD5
432313ff25064c7c4a326c3c79167c6e

SHA1
f6e196b090b925cb74e8e3c4d7ef19a9bceff107

SHA256
a0c4b427c55b3aa0d3cf15d62986770b68c9c619f94688d1958713bc654a5ed3

SHA512
a5141c0726cc78d56b40279412baa4581a2012e35ce588e1249addd28ad5f23578b2b8bdeeb458ef95aaa7f960c66dc595690bab58a3e83fe817a6c7ae1f4aba

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
91KB

MD5
514d8ad1fb8cf2e9d7e29ac1c0b2a908

SHA1
09c234dc46e0f481f88f4fcfcccbce32dd477716

SHA256
23c73822ce33cd3faba002e9114c0e4870dc02923de96b8a1071fff954414a1f

SHA512
235f0456178483431946760a929c1bb39c5423eb77f84e8b9e9bb251f5588d8fb9ae177ef4751c72866ac12cd5602293cf421698eb0d8bb0ee3c9e081d5e9ee4

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
83KB

MD5
68fa84c21c5560d7d7eeebb951b7db48

SHA1
bd058c2754a7b57897e861350c7926ecf582aeb3

SHA256
4cf1627e1a020166013607f9a5ada4eb53cddd3ca54dfa15c1f491e4e57d0b5d

SHA512
2be1f71c0c0c1866c3dc449d8121161187aa48575afeeebbab8b65aae3092e812eb91ad27938e2adf2d52b7500e92fecfa06e84da499578601b7124184d91c89

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
92KB

MD5
205bb7e8b3c4bbb428b910bd61b9304d

SHA1
15fb396817d7dfe94efa1fc30dcb4df8f0f9951d

SHA256
8cc02f411b7cb7e1cebd8486046bcb50468b2b44762cdb5de45074f89e8add87

SHA512
80f4282bb45334aae43b0b06f2e1d70a4a0da2b8724deaa042e688f732b57a351e9ff68b22b8e6b4042f0b7b360b8996e60b80ada5d3c8a44a7d6a9e30067091

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
88KB

MD5
5c797ba98100c15cb4ecb770f3d9fdae

SHA1
176fc08b6568926be56ebbaa92c82fa18a913232

SHA256
a8bf02bf5b6d8047e314fc405b46f316fc059703d99f713ce88e58a07c5876d0

SHA512
0cb7beabc0c6c5c43f8473d261644e89430baaccbed46b6a4ee6e0f2c1226439c05ad1317dda90ec9424e1932d3e181df023bef69a6493786f5f4e80b048e863

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
88KB

MD5
8f2b336fa6036840acffa9a1d8a37d3e

SHA1
39571388bb79b5ca5f1dc3dcd8907bc26c32360b

SHA256
23182810d0f2bfef4130af13e99110bd33ffadbd99145832503101ac3d1ba6b4

SHA512
6163b6da44c4c80c1871a313557a6fefcc9d839524cf12252810cd9c84acf9b006ebcabe6d8b74382b7ac7080ed2a8910a86dc359c68a7e3f787b607c6cde36a

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
86KB

MD5
ed2aa4d7b2d18b2ee594f4a871b25715

SHA1
03d4221b38380de00a65c38cc4cafa263ec76167

SHA256
bc37dfc5b73aa17d84dd75e4267d5d3183a865e787908c1f83d3a45efb8dce75

SHA512
8ab068c6696c616ec75f2c837024033dd9baf9b7897b59439755515e5908e82c2f786dcec5be8b7589d2a5287446aeccbda2f133801eba8d5acba093b968ca6b

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
93KB

MD5
914d3a397d5954f54fdeb17f98669a22

SHA1
de9eac263644bef4aa6fe928b4db0a1d6e33cb5d

SHA256
069a88adbbe6cef7e8229c3b9cabb10647f2c2801cdbee8612fcc42ebfaba81f

SHA512
b8cf4c7ef89ca891044c72ce041cba1028469ab292ee9a693108be055ab71cd88eac4cab60014df7a4a82939a5899ac8332abc62ccd22ea27249dcbb7aaac2a9

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
88KB

MD5
3f87914137b51120bdcc3e3e29361381

SHA1
8d9d871f5764396240707cc303ca81cc5682049e

SHA256
1e1b88f2c656f1db40068e8cd0846f7210e6c390c667331474f93b3d6682ecf8

SHA512
b5683d15b9b5046ac16ebdea4a88c4cb3e02b6684c8d78ec7f8ffc24729bba204581646d0d332fdb3e5af5cc7fff944535e50720a2e9f8b6b7ebf911c882d385

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
87KB

MD5
4f3f838f56997e792d9d1c911e57dd5e

SHA1
bdde74bc6fe299fab6e8c1c4d254ad852132210e

SHA256
9cc71fbf091de99118f7a937c86a5380ba4980925ff9c2df5924df6cbad00a99

SHA512
cd52ae4922711afdbce648394aa545d20fa78f76bed178c2569d3e172f2796ec2d09e32430e545df111fac21b2b57e9d1522f57a6cc099fde906e4c719d5795b

Download Submit
C:\Program Files\7-Zip\Lang\sv.txt.tmp

Filesize
87KB

MD5
8eaaa22bcd69d0a50dc50e32223454c7

SHA1
18ec800646095d5a28b67c829b2774ca8db207bf

SHA256
b848500ae2b494804e1fbeee35b7524f41137070c75f93f6673e3d2d58d193fd

SHA512
2ee69f92a756ffb3e389ae33911dbc77610bcd9d0a9bb5e4247907b37e996c793aa0973a7d17b3a25ccdcc9b5f51349d51c72e5f9f908562c96c354869d57252

Download Submit
C:\Program Files\7-Zip\Lang\sw.txt.tmp

Filesize
87KB

MD5
1137e59014b34a8c4799049f7abbcc03

SHA1
bdb78451858b3a7ba4f0a43ba51034b5a0920f76

SHA256
758afa78da5fbd47ff5b036bdb7dc2f82ed877369d5429e8a4b2aa5019f803df

SHA512
1dbb3171e40f76b1ad82a18293628ce7938a51ce4ce836d2994c2f9d1d6a6a54bfd9a32d9fe865b5c61a07d0624c38385e55ebeac8cc1551318d35db21a7e28d

Download Submit
C:\Program Files\7-Zip\Lang\th.txt.tmp

Filesize
93KB

MD5
d25eeddd7fbff02104224626585f7c81

SHA1
728d6d4fac6ab2aae344c34b2cacfbe999f5663b

SHA256
bdfc2f8fc1540a915b5c861132e8cc9ba921f43c19db52017ebf598b959c512d

SHA512
c95d8e8bd6ee93fdd40226540752db092a9789b9e375d712073cdc040012906225a1b28eaad2a45e62596fb21f69678462703863154793dc1db8104c2a08815d

Download Submit
C:\Program Files\7-Zip\Lang\ug.txt.tmp

Filesize
90KB

MD5
d0f015be6d3103c4795eb62e83562f8d

SHA1
d4d6d369f1284eb5323fa9f88af3d5c202fac440

SHA256
500a7da41b5bda5f123432ed5b843948812e22e75fbd7a208645685b5222f67c

SHA512
a4728773142edb1fe5c4c09ebe35aafdd97e09045fb4c61cd5a9862abd259da720c782d76ec8f974c23065732574a9c9357eb56644eee8413711665f30132440

Download Submit
C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp

Filesize
92KB

MD5
7acf11affa9b2b0a799efc8af4f6c4b0

SHA1
40c586e853f9a235ae5e68326c86a1dc06fe26f9

SHA256
cfe82849ee4f7a44d57af7896b81539eb8fee67b608163909de347de57c39e90

SHA512
a41c953b91b76f1ec7bfed3a6056172da212c1ac166d1215f4a4708f1a16a83bb0ef23261e9cd5909d6b32d4c9d59e87d18759d2b4deac8be09f0f2143faccee

Download Submit
C:\Program Files\7-Zip\Lang\uz.txt.tmp

Filesize
78KB

MD5
670ea07f89a30ce01976a9b40c11092c

SHA1
db511b56091ee9268e9514b4137d91a79eeaff53

SHA256
bca706c14e4664d110d6ec71548cca1831fb1a4be1844e3e2bc1475f485bd047

SHA512
7697a8027e592b34350b55587cc62b9c118b11208edb39874db0a59cbf30498e48f89acaac60e433c14396000c2ec3f94bb92b2bfcda096525db10d086f3ba85

Download Submit
C:\Program Files\7-Zip\Lang\vi.txt.tmp

Filesize
78KB

MD5
08cf028b12d8027c9ac8bad55ae58c66

SHA1
aad4de1c834705755865bb60848b9f0053aa806e

SHA256
36906f44ad2e174187aeab96769288e5efc57db2ef722d9a34981fcac247e53f

SHA512
ba6a6ab830d32cd1262897012c265008a41266ef5c5d490d10992c85aa168ad72e078f1602148c0415e64efbdb1bbd3a2462ea62f95d8da6cb603b2d969bb650

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp

Filesize
86KB

MD5
0ad77c5249ab67cd838963e18eb58f44

SHA1
6bc8002db0660f0850a06768809f9b03659eb953

SHA256
3a054372cabc9d678ddb97aa8e9a5aa2b44cc68062e5f6c0e049b44244a00fa0

SHA512
5e86ef3de881870531d0d341066860e0f04a98d1ee48ebacbed0b973a636f4af27bca36d4549cbefc0be9163eb22e07bbb6290fa2dd27bc72d1ea778e970ebb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Desktop.ini.exe

Filesize
78KB

MD5
89f98cfd0b919607a84e21b2970bb984

SHA1
9faa652c084cbe43c6d113fbe0147145e846580f

SHA256
a25af5bd843594664a07a09500df3f25af2fbbdfed0d8540932d687d893eba06

SHA512
188fb496029123d4a49126fe1a5ebf091abfec28c9aa083675e6283d8e0694a28da2e164bc33cc5b93c616cfe0657d36cc943a030750764d15eaa9b30a25d519

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
78KB

MD5
e87597b626e4f0dee6c2c26440251d7d

SHA1
0c2512d888cae66f2691d824777b14ab0608b440

SHA256
fd473791c27b5f8d585746790d27d7515fe465a7dd62e9988ab9cac312c52728

SHA512
59b5d8e43b5982088e1a3487b4774f609a0fd1efbdc6086ae2f0b6efe7f2735c4a136c8e3f0fd218c31164278ae78a1eda828f2e4beb580af6b15451a904f69c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads