7199861d9b2920f6dd6147d535dececf27a17e536b530fca5cd8593dbbef699d

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7199861d9b2920f6dd6147d535dececf27a17e536b530fca5cd8593dbbef699d.exe
Size

180KB
MD5

0c7f504812151515f9ca0ac0cb5510f5
SHA1

55c3e3aa81f5b36e99f4d7ecac83575ee560af61
SHA256

7199861d9b2920f6dd6147d535dececf27a17e536b530fca5cd8593dbbef699d
SHA512

945f32d92d11c7cf5ce14aca5831fcf8d6527a8d30336caa6c1ed9e4ffd315dc617a02db1b3f1fcf6702020442ac08c45b51dad7b12c6cbe32e3706c5758e1b4
SSDEEP

3072:6rWpcOPxPke+e3fFpsJOfFpsJbgE5rWpcOPxPke+e3fFpsJOfFpsJbgER:tFPxPke+eIgFPxPke+eIR

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4777) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4604	_desktop.ini.exe
4040	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	7199861d9b2920f6dd6147d535dececf27a17e536b530fca5cd8593dbbef699d.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	7199861d9b2920f6dd6147d535dececf27a17e536b530fca5cd8593dbbef699d.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\th.pak.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\cursors.properties.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ipcsecproc.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONBttnOL.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.Json.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 4604	1136	7199861d9b2920f6dd6147d535dececf27a17e536b530fca5cd8593dbbef699d.exe	83
PID 1136 wrote to memory of 4604	1136	7199861d9b2920f6dd6147d535dececf27a17e536b530fca5cd8593dbbef699d.exe	83
PID 1136 wrote to memory of 4604	1136	7199861d9b2920f6dd6147d535dececf27a17e536b530fca5cd8593dbbef699d.exe	83
PID 1136 wrote to memory of 4040	1136	7199861d9b2920f6dd6147d535dececf27a17e536b530fca5cd8593dbbef699d.exe	84
PID 1136 wrote to memory of 4040	1136	7199861d9b2920f6dd6147d535dececf27a17e536b530fca5cd8593dbbef699d.exe	84
PID 1136 wrote to memory of 4040	1136	7199861d9b2920f6dd6147d535dececf27a17e536b530fca5cd8593dbbef699d.exe	84

C:\Users\Admin\AppData\Local\Temp\7199861d9b2920f6dd6147d535dececf27a17e536b530fca5cd8593dbbef699d.exe
"C:\Users\Admin\AppData\Local\Temp\7199861d9b2920f6dd6147d535dececf27a17e536b530fca5cd8593dbbef699d.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4604
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.exe.tmp

Filesize
180KB

MD5
4a5e40e529956375d2791c209da3367d

SHA1
c66ff73397f3c5ecc76832f4ea2d3ff278dab7b9

SHA256
941d2c1dee49091d011464c2e8bb397e7752f1ee0fd90d8a8320e79316196af0

SHA512
d0c0fe1e7d361b35ca10ba765f64e8cd35decf5c8e3002b715872fa922c2b1f2f7dd10e07d570da6c50656ea6816e680e5c5feb23c89dafd2522c6f9c2d4ab02

Download Submit
C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp

Filesize
92KB

MD5
574b584df9399c72c2b2633792642b08

SHA1
4ac40802e5c69a9f5efa2ef679b7d0a682dd6d4e

SHA256
2da98b68f5ab858fe13db1a8bccba512c92e0d2cdf4bb45fdba30fabed2fc12f

SHA512
0b0a4bd342b9a8970047bd08de8442d07af176f09a0d4c49960e9558d4044769756480fa70821cefacee9aaa87b7ef97b90f9f1677846cac7a4893756e1f7c00

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
204KB

MD5
6cc567b171f4b47583be2915210d1b60

SHA1
d31032eca46cae2e8b05b2d2f9ea8684cd4a0c19

SHA256
cf25ca40127b801dd1f4a56b7e3a1f19d496c0bca2782172236eff0ad731c10d

SHA512
47ec2b0a656c48381e6dc967c62ea538318ebc98a5c318c048d47696534d7160fd45cc027f09afdd9dc2ce5d6e3af8450550a0a9c841df5cc9b20da42ac30a7d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
191KB

MD5
b06fc1ece3356dae22b519f7495f547e

SHA1
5af01a8f1ba9ce984b4517c035588d8481248f44

SHA256
b425684c02a0d1ebf4cafbb972a6c1b6e62ef0afb76a169c07e983a8b916658e

SHA512
8d79448eaf52b2c6b3342ed67f2002409a3ce95bccf4b89335954e4866d3877222adefa45a5fe5b8b1abdbca7a982c8a3628e4e789c464c6c1251d153485dcb1

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
157KB

MD5
4f2bd179ea2daa1693db71792e23b650

SHA1
25edbdfb997175008766fb165882fc4a7cc5596f

SHA256
4f20fafaa4f45d515fce8b5a1044ed0660e55d7726b731dd1adc00273fd2f815

SHA512
1830d421a6f871b4c709464192e1941fdd231cbf647c6bb0399dc032b28693e8d5138b14c8fc93432309d3b0ec6f41825ad54434cf4d5e7d06f392713c5ac2b5

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
632KB

MD5
2dfb35b03ddf4c240994d6900277a292

SHA1
2c07571d403a8968feeb635fe42d06dd70016989

SHA256
d83c80b1a19583454fc316f844d02a137bd510b8222b2f8da0a35a7b3085183e

SHA512
b36c2a81951e16dcc21e462dcd5e762bd65feb2779b24fbcc1a6dfb8d9b0a46f62faeced33777aa36f689b4bd6297ce1fe16ac10db5404900c0cb50a9c31496b

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
301KB

MD5
3c7914e00c5a0aaed2fc7b1933b854a8

SHA1
7fbd87be7edd85bb95d3a4c66e6f8bdb0dfad8eb

SHA256
d8ede108f8eeb92fe92fb46d89cdc5ed7631426999f38741c7807be4f77ebeb9

SHA512
06591240557623e97f5930bcb0c8fc7d6b5952535d76f19953a5d632c03ab42feb48cb64b6a53e44e35f2dd71f728eaaed81a600ef46d8990c366f96480378fc

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
280KB

MD5
de29da02bb520a9042484ec94f55a131

SHA1
eaee96f904352e5681c9575d1eb130b73a00b238

SHA256
9d9b211ff410d619ff80268b435b2254f9dc6cbc2ac798982df21d6ae934a7f1

SHA512
1f9d93d7fba8fb0c3bf0afb53fc08106fe53d4f326b87d43a5e941a1fffdf2aa0fdb54a6ef8fb88fcef7593754571f661208588345f889d574aaee360d8c8d44

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1022KB

MD5
aef5f9e969f5d9da15b9e9466d8fef1b

SHA1
a3e7406707a7d138e5992a985b42ec51104ff91c

SHA256
41a561b7398b24be4a63e2ca8a138eb02986469f78f63bb4f399ddffee14ff3e

SHA512
b915e5e1200cd3fe13706137d6ca1e00e44272d25283024231858e340c5adb384dfc4ff2934481927fb9e62c764d575ff213b277d5474c6497724fa2eed6d1b6

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
776KB

MD5
7a1db5c7e20fca56cbc3dd6a3bc7a1f0

SHA1
7d9f25ddc06f5d04574a6405ffec8cd42ad34765

SHA256
3cc73337d0a0a79b70a5b0ea30747a71d7757c89b7a256f2d7b5bbb54d704541

SHA512
3a9abee3798d014f06e2519f57c820b62b5f1a53d07b92c5565c27aa99688ea8205ac1bc62aab83c88844ecbca773d1ca78374173fc1317e5eeea2a152faa3f5

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
98KB

MD5
6600af3eebebc85d80eaa9ca0cd8e868

SHA1
f8b7f279c5e2df894636161c48c6dc946cd92416

SHA256
bde673004b13bfafb771997f33635cadcbda728c79b4d400fab831c9364443cb

SHA512
9a76e26cbb36fe0b1fa53c694568488f3f4720626e3ee4bfbff7fa85920a93d05fb369c58eeb17659ac3ff3278d15912c4c2d3f5134751f7c1c577aa869127e2

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
98KB

MD5
906d8a3c6d017e7029c0f8ceba8a7d10

SHA1
2570d65082443be1da97ae863ec7be884409757f

SHA256
eb8adc9e05cca649592a02ca6b73532c744f4e67110337679019b7d916168ff9

SHA512
b1ca8ca467bdbc0542220e85de98ef74252b2f93fc9edd6003c5ee1fb507d5f374729c7c247af535046a7aa637a01fe5bbc3b445cc8c9a040f690fcc110bbb47

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
99KB

MD5
4c8c0d1f69252db415722efd111cf668

SHA1
edf4b59fb9283cb7c3d837f1a963ba83213c8f8b

SHA256
053c5d21fd781f62f597b9b9866b6357f690802f43d3a6b08419c0adb501759a

SHA512
d0969c346afb3cf6f14244d6aaf07cbcdb8adaa60f044547457fefcf261fa4e0360cf1c746b5acef0955ea9ab31e3e528c8797b86abb0210c14e05227cad90c1

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
97KB

MD5
dfc6148adf972dd473b93aeaa6db1a89

SHA1
864be699ae4c59c672fa31a30d37f626d587a7a5

SHA256
f48bea32d2f335f5dae46b4544fafbb0219a875002c406ea93584e10ac57a7c2

SHA512
82d2e26043875571660443d5506636f538fd52a99444e47ba3993621d09c6e746126a3a4030773501468b1d5b5f225d64f0f2a72d9e70183dc34635f585efe29

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
101KB

MD5
914e6258bf35504e5fec910360908836

SHA1
cc7416a8f428869cdd3d1a0fd9a625272de3f8c4

SHA256
32a73daf41be62db51cf299460554aeeb86d2a498d2e0aa245b19c024a92918e

SHA512
e8e2267374acb83c61b821dcec522e5e8ffd7101f1c3a3c4527a9dd119fc48e68d83201554074d31778c89a88ea43b4f05693d4fae9ef10a65a06d6c90546fc7

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
101KB

MD5
44394b2dcfef86e77c008264da9b2c8e

SHA1
d4576553503e4734ad81efa1d458379e4cb3f4d9

SHA256
93e31364ef33b1134343f60e0e1ddcfe815e1019ab62024aaec7eac0ee254900

SHA512
e1645364cea22ec862e0778f35ca7b74073fae6f543cd90ff070bbf61b238c7c6b1d4f0a2c1a509ff938da756d5fb4fc70f307922dfc035792f8cd30da3882d1

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
97KB

MD5
eced073b671868d5c371a01bb3934465

SHA1
7a005133021240d8dee721fe575668e01890ef55

SHA256
5673bf889d8be331c1c6fae19b36f4f3d3517d1839e46bcf75da8292b3c9b0ae

SHA512
deae94d2d014f39a0ba2435116fa9f7bb421f8d555dcc336e911070bc551c1eb5ee46814b6ca0ca1795933e2a6696e5d269edd21057589c34d1693699abeecb9

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
97KB

MD5
e26d2b731e82917d1ff5783d92508b52

SHA1
5da99e662ff64764376d0694201ddc31e5aaa30e

SHA256
aecd95214d5a998b3f657341f13ad7da338bf1308a945d8c3f1d422ada13bf9e

SHA512
1cdeed8390a59ffa984f16df41eaee9c139b1c614d5f51bc1f2fe17f8cdc84a2d0cc3ed11c7d4138eecab75d383c313308030220a907d25b35d246b3fc4a47f8

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
101KB

MD5
8184ed47c0105e1e0fa23a9e00129ca5

SHA1
3d93320ac8c90a5bf2e966507dfb4f2b72d4c9bc

SHA256
98683d9daff922947abb97aa9384270a64135e44a78c2fc92552ac6a399ab2e9

SHA512
6af468e74c23d4306e74dcb99dd3b9970113ecd923529f2a979bcbb50f95655aa5a270cbadec2f987021a275a1a4adbafede911bdf626ef0ff539738920dd15c

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
97KB

MD5
f5207fc905508761938fce0e40d1c75d

SHA1
abea051f60b2546c78d806991046fd720c349c5e

SHA256
c0f09b70ecca03e49a70fe2cb700b655e38d108fe1305c3760a0a42926c0e677

SHA512
b81281be00ab4ed90ef2f2b817568a0da7706de50f5dd4d79ee50ef5e847e1edcde566f0a26c658ad1b48e16fa802f115abc28391dc63487368c17c2a6dc9ecc

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
96KB

MD5
d44f1cac171fbfc585c36d4bf7eb0935

SHA1
73545e53b682632a992ccaf27cff2912e5760db3

SHA256
7cbf27e79856d6504603981671f82912358b09f3f740f850179024ccb875f83e

SHA512
0f708f373a4aa3868a0e01da194f3afaca9b362991913adfc0104a060c7ff9366fb30629b23673d8c11189c463ea063430c37c67c3e5c6d3daca98f28ae9d3e8

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
102KB

MD5
600371d8ca36f6c6989334973de3b225

SHA1
9a8c606669c4c078f0b52d01b28e262adec19dfd

SHA256
de70d968b7f3ff027325565f0f873ff13e591ea46870e63ff34174b39b2d3df1

SHA512
6217dacfaa0ef10e483f951270836632333a97a5b7277e3ff962823c04f1444e6c9733ada3138f21c37287775464cd4265902a1acb79a9e656bb156132c19e96

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
95KB

MD5
3a371f53ce026cebd3ddcffbe84a21c1

SHA1
edc1769406d14eb9fb69e563caa3eccc8f737315

SHA256
bafea95c118dcb6f64f567afe455102368123543e7c1374f692248f489d84a20

SHA512
06498a06e39d65cb68dbd1f9b9f02beed7b4f41d83f82be5946a5f4cd9342b3b30526014798ebf25f9dbf68d5485e1f2850cc4b8b2b46dc1459fde8adcd88a07

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
92KB

MD5
21afb457daab0e4994cce8428a8d30db

SHA1
110efd92e7f289583a04faac5bb597c2af93c1b0

SHA256
becb5f95f2401ec647a2fe706633e0eb292d93a538d2d2f7c835de275faa1f6f

SHA512
d2ecd2852fd3311b35456b3b94f2b00d87dc1d7257ac2701849bef78dde3a42fa44fdaddf407c7126721d2845c5264d67bb3ca52c47060e67626a36e73017fff

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
100KB

MD5
a7836b7a46bc318c91fbafe646b136d2

SHA1
92fc33e45955fe59ccafbedef5b4ccb578d20a0e

SHA256
b328bc6ac771d5b6d41ca5909730e4535e4a49618cd7a4fb519cf78536ca6d6f

SHA512
8668787b82c3b10db59b842f3dc342c11e2c9ee6e5a018536dfc6548258a473872cc6e09802bc31777ec24031088b0bc125eb1a45b6c223face4cbd1957c741d

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
101KB

MD5
be25d93f3f7ef337b3e34ea5f83e49a9

SHA1
041fa013e91da18517b2c3d0feab65f5dd3f95ca

SHA256
90afb2162ac86eed54896cebfe0ce190959c9748cef978a8fe727f927d1fe677

SHA512
31892107d3b8ef2697a99eba6e285f606ca63973351452941e71bab63a10126eef2178f7c5e54655332b0f57f6f2e7ceb11d1ab5ecc86776e41cf85217922956

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
109KB

MD5
20b729e6829062c46db5a8885c33025d

SHA1
70316d8b69fbccf3f0bd4cc9d31ccc5f6b24875b

SHA256
5490ec995e2828f5678af3c459a7996f6f93c8b7044a457f094251b79dde3c4e

SHA512
c7c0cd93604c77374cc797cdbbb78b14a284de0df2cb53a344daf13604cfab08ee6a0e22385a1d28b67b0efc658ccaa4b7cdeca96b6f08c8b83e76ea3fcda7d5

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
103KB

MD5
41cd8c8c16de74c98b660846ad557e15

SHA1
cffa1d7b8cc025e1036def1bf017d85ea7fe012c

SHA256
b4204e914e1186bd5b926b8a29047cb5cd250decac8821004ae8e247cecf7ed9

SHA512
24b131dcbcc2328277ab8413643b02dad9ec3ad0101e8fd14b13216bdb8e1452a2119dc661ec4cc3c1058059fbf834ab6eba79ba3628d1787c31978dd0909681

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
100KB

MD5
e3bcc459f42bb16702528c757cc0fef2

SHA1
c4e75675bc6192ad0af6c6bf38bb7a1894ad8b6c

SHA256
baecb99ee9c30c72921d66d7f840f8114f78dc39761cfa96316cc1d570f16393

SHA512
5f7a284971d1eef575d343e21bec9e7a59ffa7086fb0354a1ae87adcb1ac9d57c1d47275a766d72f941ccf693265c83df0ad85e9f629ad81bdb14408f60754bd

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
105KB

MD5
4ce4421b8768bec181acf9a40512dfab

SHA1
44b65f23c7887d2be0d2b1ec46d3ea1830c4da47

SHA256
a7962c0cf4b07a2144eaaa68e3b1f580bbb45d0fe1d12700420fa39967ac86fe

SHA512
76bfb2dd133a925737e5d037b6966ddf69ded7deb4132adc9778a716caa791268d2075faa3a26a8cc4d5fdf28a60cf101ad2471f999c58ea12f8e68faf95f0c5

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
97KB

MD5
77a08da5422f2ad9ed6045612634e013

SHA1
6c821597865c9c68b13897e93e8c917fe9bbf012

SHA256
97e6aa6d13f238d826f5e4464d9cb7648fe756def1a7905fd0b86a51eb2fb342

SHA512
79538c2db2ff8b061ca4cfc2ac201ec4d24538656694d1e686c1d0a316a389a6dc51ad7b3137f6f955c51c8f7b6b6197132084947f8d6722e22dd12bb9c873ba

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
98KB

MD5
80db66b2deddcb55ad095cc557cdad14

SHA1
1462cc87cdd8497ab788605ba5c7321ac775b72a

SHA256
d3a69e0f76aa9fc2c52d9143cedc0ea1c9966dce20f6dad21443b7fb73a2022c

SHA512
2ae5b40d8dabc461efc6be755d5ebe1c7a95317aacfcfeea0d21e8b36d0b73ccf9541772b970525b19bda5c047ca9e149f5655de9188022607c57248c47836a0

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
92KB

MD5
11ab1403457f8dcde57d9aa5f2b40cd7

SHA1
34f8db3edef42a6da65b1aaba4bf2bad72f1a96f

SHA256
44250e2c70daefb6d725cf13c77232c2c9bda382c023cccec36745f79c4251e4

SHA512
f49d0f916d0026113dbef1e6c096aef742e46550dba4a0d07dde71f334e64717513229d7c431906d022937a99415b0e4f6a52b06015a7092687d3df5fc88197a

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
98KB

MD5
6d32e2295b7f2f3c0e51e3a6bcdb97ff

SHA1
edbe8085579e087705243faa081c3b4f34dd9e5e

SHA256
bcf86fd2b1bf39278371d4281ee39e7b0eb9193c5efecd85d4838e735e07141f

SHA512
32ebe64d34134c417a7853377c486a741aa2e6394f3bcd67f3acfbdd35dc55508fb0070c8895dc850582e653f370dd25a0139ccfaca232ccb1ed6242e56352bd

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
106KB

MD5
ae6328320534d9e3eb182808254874fd

SHA1
c2d0f47ea0ccf0d76931a689d02b7dc487d312e1

SHA256
66cc59eb9eed68f62e1c11bf1ce8718d7d32e96f36b6a3917f9ccddd29074190

SHA512
b1af80df88be583c0f246bea32194ad4f5125135afa1068e71e58cb2c347303fcdd424648f9f6141a105de2bd9eb4667e1cba857c15e6491ac58ddefe45aefd8

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
96KB

MD5
43aead47d715d721e6b6b7686edb82f9

SHA1
df00893c910cd9cbfaa5cc3957c19c128aca5763

SHA256
2678550bf7b955df91df9e01bc46d1f0621e10b91de89251b8d573d8d7cdd4f3

SHA512
86da08ca34a9a13e73841eca67ab82bf4713ca66c26f476bc741bd859dbadfee68cd192a675aff4f6605684e418427b6b57ccb7f8903848b06f8e452efaafbad

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
92KB

MD5
40064cd9fdbf1c8c7026697a62930d46

SHA1
c650cb00e2904a349c37dec1e058bd32d2034a70

SHA256
820662b23cb08a71d0f9c2e764d1a27a0956455c76fe63f29d149a154cb6d329

SHA512
5f4b8e32b658cf67e8ea8b44aae03e63934bc5971d19c98655cf8570744a869d1971309e8a0a8aa192006c63711b9ece67342ea6968b72eeb12a1d0b83e489f8

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
100KB

MD5
78e108c9baab5b9fc05d3edf78ca1e3d

SHA1
0b7caa915f81b23971e9c30ae5a5d43509cf180c

SHA256
e197d03e92bfe27136ef6cee5184fd8ebc02f6ca3ea53c5c44290948fbd338a2

SHA512
a63288a93c78e5de82ba63f6fc93fb08b5cd6b386492f86a676786c6edb6c97198e72c8cbec6cc7465cc5ee602fc22315f9f06af224f7045523363461a29ac53

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
92KB

MD5
e7d0ef1a800d7d8977b3630cfbebecca

SHA1
16a46ca915eb4f5a3ee3f388a2d2071c1d1e10e7

SHA256
be35ce0c6734d6b562e149d9821d4aa51a392184b7763f37ab76e02bb716baf0

SHA512
313232576fc21a090de239e087cd410716263befb52c52f344380a21a762e6079367507bd55a70c4bd4135f15c6b1b6421a1dfc86611b70b89aae9df1e44b926

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
96KB

MD5
0995407be0ccd2e46662cbb85a4ed8d5

SHA1
3d6a0de0c6b5433ae2a8b8d6d38352cffb208ead

SHA256
becdaed0dd8fb2021b09bd532d2b7f9ec865fce4e6d7834642a877b1295a8180

SHA512
adb7de21b2506c33b87e9bbb8a7e3d70bc332c9e6fe7203073cc2a0a49965d5814af91495e3108fc1db8a83b0f87b14d922be3b816c39c2f5f2a99fd2f6d3694

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
101KB

MD5
3b253a3e4e58d2dacada9d215ccbde93

SHA1
8e984995324c6dc94f6660d098b842fce6ca9036

SHA256
acb8f6be22fe256074db7c08f9231b348c11812aed24151e5a9afe4982728fd9

SHA512
d786859e466db83ff76ba6271191a72edb94e58a361752706c5e2745684bb8804e3f66697ca85b3af5414b6dfa24533ddb35fb94d86bcd5ce0eaa56888f7e963

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
100KB

MD5
6fa40d5fe8b90e206e01ff7f5f47aaed

SHA1
f1362f1d11c88e112160cdff4e400b506a505d0a

SHA256
6cab8b1e52ff949845d0e624b928b2f33c8a1d5b44e8beac0fce62ab39e27c5a

SHA512
00e4ebf493986533cc39385f1c4a6904d8fb6a2e6d580067fb18a117b3872f5b2821da6570e1b9f35e07ec583d855f2796392891a10912bb44adf9688205c26a

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
100KB

MD5
a7d4642f1d6fbb9867e570daee49a68d

SHA1
ce989e6204325e937ea2149c297891ba0bc64db3

SHA256
3f24bee2e511dca4b725204d9d0ffd224ecf21dc18e0310db298054b02593ea7

SHA512
37288b73ac9ebd14d040dbf105fe374046aa5a0267699fc688a85036876dcba4ee27bdc74fa39ed17e114291b75b3438a171b43d55e6d528dd3721360e8fa947

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
108KB

MD5
0d2021d3e9bdaa6fc36f164645aa610b

SHA1
a61a1db6a1292793465f8ed82e74eae77aaee6c2

SHA256
09af82ee9a805f042cf59e68328b5f93213f00d1f430117f61ddf0ead7d9860f

SHA512
661c73472aaab3b7afa147c601edb3bfc64feac45910b67c0e035a1e38ed00066c44566d736149c78173a72cb3fe4d138bf5ef0598de3fc5caa3ceb3bcaa18c8

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
101KB

MD5
89c91963756d234e8e51cc60207fc812

SHA1
7f26c302ac222090b6c5c123a670192bfbad5809

SHA256
04471122d944ec65207ffdf80e38afb2c01878c5f206b9f54fc369a449875c7f

SHA512
25c221a050a515a1fd5f5454319c9920b53576171e507ac9fd7de809b1cae78e7157f070aba3d642de81ef19b80c03a443b127cba38ae7aae09e15a6460395c8

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
101KB

MD5
8485d5f0ece50983516882e488d70c69

SHA1
f319c9a64f3704ef09e87d7758cde0dc97164506

SHA256
399b087e4970e81adc3c875b06bcd567671add87b79e07c7ebcc435d873a498d

SHA512
e210b43240fe26829654818ab22cf9a845f25842f62c3e6448ceee60a913236bf388aef1757e986e78a0a27c0930d088b4ce052d02d4b61d4e9216dffdf45d9f

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
106KB

MD5
a8fe48b140bb9b88c2acd01b113eb77a

SHA1
20c247953b6a9c23c8a894ef88b24136c78590da

SHA256
9ddc56ab0b085552e7c2a78e3df737b916d8410cdf02206825f186f2b46e9913

SHA512
6693ea8f05ff9bfb03be652d322403cc6e1604c07ed541fdaf7e2b43fdd680eb819c79b0d3d4b238df6dc7aeb23b91c1a412ee600b1a1494a1c34d1d7defa67c

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
98KB

MD5
95d8b3b9a696d7847fc6baf1e5ee355d

SHA1
d1f94c9416dc5d3d4f9bd0fc3d8d0fe49009d680

SHA256
4704fc3d6988f8dd905aefa9f065c3e534c24cbc6a812b7d4e19f710751f5cd5

SHA512
679cc849eec04d1191210f943c2d8d2f49e4a0ff23b0566e5f3a7008cd2e66c5ca84b8efc803aedf7b88fd66a6da67e2424e865695ba154f8a29ea043e3018db

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
100KB

MD5
44c8a2b9f3ddc7249167f9405ff88e0e

SHA1
842a91470d0cae8bad1752b422f402c905eb254a

SHA256
9beb17d00f43878635efd032a6933627e66d3a0e37e217bb47acf58b756d1745

SHA512
369d90f0b8c32472b4726155b4800bc35da930524dc5e7b28d037ce2932d0b620596fa8551f2fe0317e88d419a410194f0fd50f5acd5e00bab35df201be9f030

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
101KB

MD5
aa5607cdcff2366bfb361fbf4b070502

SHA1
1f0328dd7a165cb6087d40eeba2373828bd0bb10

SHA256
84f677e175a71ca68d60c42e12362318e4726bd6554302b29c2705327ff2e198

SHA512
9df5ba5c8eb1187ada9b41c93e2d09d70b00cc67da58fbe85bdc336bbcaedf9be1f02a5db1c5003524ccdf373368b726ef28b9776143e92fcc88a7e161c8b677

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
101KB

MD5
8e919f4565b05933b01e9c8967404818

SHA1
c44454805cbc38ca95879830b4200c2f89f72d22

SHA256
b38c431a311ac338481ba1830bb5667774dc70b8aaf26acb5de5d2a71ffcb00c

SHA512
8cce18dff8814bd9d9f23d1aedb71b4df8205ca5de3cfbd765f6f215c773c4cbf2de982fd5dd178b38f1b679b4c5768d8627503d60390f64550fe7e5d9e6864e

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
99KB

MD5
8e05872fffb301d9663fa9daed7c7d98

SHA1
136fbb8ae681f03c1039409b9d21f75b9954307c

SHA256
d79217d68454399bc2b744bbb236347ce5ae3144bf5f8943f5d7c6ca54668bdb

SHA512
a744055c5a97b011bfed4dc1f09f8d2f387581476d3f880032267723ea1bf21cc4d192be52ab1d7f204fcc0011dc0c765fce8844fc8d7a65312e2c00fc4463b2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md.tmp

Filesize
97KB

MD5
7ee1670e400d2bce40f024460cedc3d0

SHA1
33d489e63c46c8a14e360304b1e4fa88b3405cdc

SHA256
b0b023b898fb9a807d137347f5b1742551786ea92c23cb104c514bc887b4962b

SHA512
3c47ba764e46b539db0ec14ed14c79122e464ed50f491e86a1b871eb0850999c2484d7da11a1652bd3677d3b223b87f4103ba9554f859abe2448ae4612a33d20

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
92KB

MD5
21ab895b8f3c3f138ba885d9ebfc5fbd

SHA1
5f6f252728a02fe8e32acb2040ae4ba8255a6f36

SHA256
a3d20e4d4278995e920932b7d10a516674e270e8a1c26d3a98e2d95c381324f6

SHA512
c3dec628e44298c33dbbf8f9aa11bfb6642e56612a0e2883c522651e163e446a0ebbeaa08e44f75f54641485320fe58d4f6a0dc8a940cbeb713bad73be8760af

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
88KB

MD5
492a2584a6fc344baeac75cc362edcf1

SHA1
cc997a9866fec185da0e11ec5582daff4a1c5740

SHA256
b6a75750af4d00d07bf4c59cde2af6a9627afee063815941f647ad098206bad5

SHA512
87f1b300bffa30f988b49369ed24603217d38da3b94b341bde863b717c46abcd9618c5ba1ff3dc306588602bf7109d7262eb0a21fe0615db347ee1d8c7d2f64f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads