031cbfb225a965be310cbce258beb2211548e4da2c5c9a424a0bbdd46a65b71b

Analysis

max time kernel
150s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

031cbfb225a965be310cbce258beb2211548e4da2c5c9a424a0bbdd46a65b71b.exe
Size

144KB
MD5

0d0f0aa067a9ae5b41b6cf543147693e
SHA1

07eace5bc7b73e0cb7b429dd688083c6b8b766b1
SHA256

031cbfb225a965be310cbce258beb2211548e4da2c5c9a424a0bbdd46a65b71b
SHA512

ac1bf1f1c18db94d84065543947d6e0b594f24d6f052a86ec42ea9040c3868b97e2e236a76b8ccf34a9f5fab6909fb7e681b724f51df2b39d8d5ca1020458c82
SSDEEP

3072:6e7WpP9oVLQthbYY9oVLQthbUvVe7WpP9oVLQthbYY9oVLQthbUvr:RqAIqAT

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5066) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3440	Zombie.exe
4816	_cuninst.exe.ignore.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	031cbfb225a965be310cbce258beb2211548e4da2c5c9a424a0bbdd46a65b71b.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	031cbfb225a965be310cbce258beb2211548e4da2c5c9a424a0bbdd46a65b71b.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp	_cuninst.exe.ignore.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebHeaderCollection.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClient.resources.dll.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.LEX.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	_cuninst.exe.ignore.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	_cuninst.exe.ignore.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp	_cuninst.exe.ignore.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp	_cuninst.exe.ignore.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp	_cuninst.exe.ignore.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pt-PT.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\meta-index.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp	_cuninst.exe.ignore.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp	_cuninst.exe.ignore.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp	_cuninst.exe.ignore.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-phn.xrm-ms.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_cuninst.exe.ignore.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp	_cuninst.exe.ignore.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	_cuninst.exe.ignore.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	_cuninst.exe.ignore.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png.tmp	_cuninst.exe.ignore.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	_cuninst.exe.ignore.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3440	4068	031cbfb225a965be310cbce258beb2211548e4da2c5c9a424a0bbdd46a65b71b.exe	82
PID 4068 wrote to memory of 3440	4068	031cbfb225a965be310cbce258beb2211548e4da2c5c9a424a0bbdd46a65b71b.exe	82
PID 4068 wrote to memory of 3440	4068	031cbfb225a965be310cbce258beb2211548e4da2c5c9a424a0bbdd46a65b71b.exe	82
PID 4068 wrote to memory of 4816	4068	031cbfb225a965be310cbce258beb2211548e4da2c5c9a424a0bbdd46a65b71b.exe	83
PID 4068 wrote to memory of 4816	4068	031cbfb225a965be310cbce258beb2211548e4da2c5c9a424a0bbdd46a65b71b.exe	83
PID 4068 wrote to memory of 4816	4068	031cbfb225a965be310cbce258beb2211548e4da2c5c9a424a0bbdd46a65b71b.exe	83

C:\Users\Admin\AppData\Local\Temp\031cbfb225a965be310cbce258beb2211548e4da2c5c9a424a0bbdd46a65b71b.exe
"C:\Users\Admin\AppData\Local\Temp\031cbfb225a965be310cbce258beb2211548e4da2c5c9a424a0bbdd46a65b71b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3440
- C:\Users\Admin\AppData\Local\Temp\_cuninst.exe.ignore.exe
  "_cuninst.exe.ignore.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.exe.tmp

Filesize
145KB

MD5
4504b6028c217f52d659d98f71d2203f

SHA1
cb76e252bbe211d3c7a4360f903f14dd09cd0086

SHA256
8846e7e37aa98e73c613ad7699693ae3a54651663b9828618ab944ca8de95efc

SHA512
bdf734d88300330a05d8c4c8fe3ad3e45d9ccc2769b2b2d97d6f4ecf044160ac7d3ed5b8e50dcb2888abd61bcde19a57f9c888731f280ac9eab6555eee238be0

Download Submit
C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp

Filesize
72KB

MD5
2b80751214162568236e16ba9482080a

SHA1
e966b27839b0be385fa40603638dbb35667bd0dc

SHA256
ecbcf30071ec79d762f2cb89d4abeb6f479e421ae05ef9f6369b3f1dddbe5a76

SHA512
e6ec89933ddbf3779b8af8a72a686d876b048c6981ee9bb90e7feb9293865512df6cfefea7523e77854b6b0f7f3d542fc4f2a9fd76c847b129f87487b9c257a4

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
184KB

MD5
f0be27dd7818ca74f2560c25d1b7422c

SHA1
53de0792b7ef2c21a408c892432fed6d412f1910

SHA256
23a6019db88953eebeb4b9cad9f35698f43ea5c2bef2086633c612649b41af84

SHA512
c20dbe0fe84e243d51f6461eac90bc2000538d156409827accbeb3f07410ab613274e36bbbf1d4fececbf04b4cb475a7edadf714777f848e3ef18dabb4287b87

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
171KB

MD5
41eb330a116dfde9b706917c52a7f3a6

SHA1
5239ef7128125c442e6c7d977edadd3777a87092

SHA256
fb466bf71225f371769b36d33eb9e2451dbf047560b2c51f1993c1156ca469ca

SHA512
d8d6ba013493002fbb003ef6268ac44137e01ed66500ee7e468a5da9a47e1ec38d945ff3e67a81e4208d834df0c6b6c47d89d1ed734b218a8088bfb1d9809448

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
d14392eb3a2eae2e19f46a4ca9d1d7ab

SHA1
4332f7c3c3ccda5e73bafed12af3b614049f4c12

SHA256
e20ef3170061898271d890c1dc0633f02449eae5037a3e8c75225e5487008daf

SHA512
8c2e29332812166c462610dfd16c47708e9af2bbd29985d173463e776aa3b7ef18e7af2786aeaec6740f2d2ec4a528cf0f97066754cf7344d2a0b3ace1c34971

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
616KB

MD5
e624e975fb6cdfc6802d52698832e103

SHA1
ff84b1ca0587510dcef4d0516f7290d230475a87

SHA256
79e62bc561193fc53ab1e5767cce9e4bf2cf448bf0d829794cfc4aed70cb28a9

SHA512
c3409415979a355f615a04de2af31e513a3eb967871b9bc9c879ca88ef4e8ca8dbb7c6f89a885954641cd990ba11d4485369c178805e57949980fd172c99ece2

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
281KB

MD5
678bc9745c7b4d9cb5e80da733aff99f

SHA1
8ee0f6bf491ce4dde8878d5d08b85aa3dfc54cad

SHA256
2e6f275acfd4e92c5b66ddd6a88ea62539be2c35fd8e9ac8be8db10160cac20a

SHA512
a2ec7f2fef44e1f53265276bc6bbb72b7b91e4764e039716ab450e66d675295060ebfafa4bad0f89217b9f73bd34f4b23756035add31c5612cc9452bb0b01ca4

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
148KB

MD5
31f56d83c1d8304070732a1936d11fbd

SHA1
c4bf5f75598162ab134134e05c83293b1dccefc1

SHA256
f31f65725346b1f043c353eae3d02b5859e9d76c484208cb1bbdf907cf6d3f2d

SHA512
6c4971756453d6ff4b0a36472d6046be52ad965151f4566afd5512d076712634d861dd36c993f4d159b1e42e20f389103db10c05a19bd3ea670950f8cb539cce

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
260KB

MD5
70a0e335ec92b2ed52114206dbfb2e01

SHA1
9256f89d0f1c2d4ff2d0ac6c86f8367ce444b410

SHA256
5dfee96bb0ada408eae4a215e4c6e1abb72dc1740082778b197127e8c4b7e0a4

SHA512
90a041c27826caa1b99fc9e2754031ff9514d3297608be8d34bb8400cac2020225f79cb60c417d679c8f173c299cfe631b317bf74878081cf6983542fb649482

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1002KB

MD5
991728a58660d7028de63f3f523c910d

SHA1
cd488ba79f973f454a2179b48e84c37d4e96f8c2

SHA256
0d8cf473fc8bfe867eb8390381528b390764cba68a45eaf57443d457aa9f400e

SHA512
542e700aa5084c36fd7a5eb9443c9bb5cc4e10a26f37db2489ca12470348fa29a6f2025710594c124d3653874fca41600177e1abc220603ee06b2d01dbee89dd

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
756KB

MD5
f968e39727fca372f436971be9f48009

SHA1
064fcdb6264c028d39640a86ce3f2eaac40b15a8

SHA256
77f0931ad689904c4a3906faaaf60e6a1ecf5e8fb33caf982b4a65539f89699f

SHA512
c5a0a986ec8e28c771853473a1ac29713a64e2846f54be4b95ba77b3303167742f4ccd7560ae0c1a636315b805fcd261f1632642ca144a66b752844aea97f89f

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
129KB

MD5
81a5087849c1283962caad1c409df1e6

SHA1
9891f2a5c04b84ec897c8c2452067225ed69130f

SHA256
879527174729c9e006f85f0a6aa1c69126786bd7bc104608cb5cb99c398140a7

SHA512
5a5d4d20b924f1a857df4ae48509cd8e59b88942a2c90c92692020efb9371b4b24659ade5f6f932ea4e352771bd4b327a24eac353da272c9c4f5214ea9e270a8

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
82KB

MD5
f7a7ea675bf356165b51e8179a177389

SHA1
b53c8323a49817edad5461978caec81bffdeec27

SHA256
73bc89587e7933abd61055367fe227d33bd223a9531529ceb39a8c4351f321f9

SHA512
2401419db0b877f1477aff1a3bbe72b80b9b011b10a12c9fb86c7781516bb2cdd6413a455cd030680debb142de56db5cd02e374eb552d25d02d0336574a35d3f

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
81KB

MD5
c460a597cdb498daad70c9ee3575f90c

SHA1
ef828327c7e9aac81fe4907c3df00ea0e040b632

SHA256
8925d8ffa41234c02d8ace18bf70d52eb6f29b1540724ee8b730caefc10ba445

SHA512
5e2bd8ea27b8c571b9f04f3cbdd8895ac44f48295e1fcbebceecbff9ef2b81099e2541b1faf272049a0de6f7a68e46411cfa9e6f565d2fa046e636107fbb8941

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
83KB

MD5
e609fee96d72f021f3709f04582a6475

SHA1
28528d71afb459b63a8acfeea98636238bafc901

SHA256
36e2488970f2f8889c910e152fac6c154acf4244599b08af232f9c5c9e709c82

SHA512
da572019e600840a479fdc2e26ea496b101aae00cc723e101751cb652046013e8afaf0f936be34a4b18d78bd96e3feda755c7a26394747ca32600ed21f2b3ff7

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
77KB

MD5
4e783ae43334bb5f529c37d035f6d5bd

SHA1
5af57ab6cb596543d659893215bc0d20fbb3739e

SHA256
0967359348f97c93cf0370321c826685aa4605b7310cf1ed5d58895817b2ab74

SHA512
2736c8febd75d3eb657c9cda0aaefd1aa7ac6251325f252e6618e8eccfd4387793a47d12e0fbb740d1cf4cc9013be585c625622b6d53e9986142ff33f9ba236b

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
81KB

MD5
dfb5a5749a0fdcacf7ca5135568213bf

SHA1
1162c5b2c4c6c2d0ad3208dc183bb40169b77ac8

SHA256
7fdc00190618fe06c5a58ecbdc913ebb471be66cdd6cccd189eef0e22c9e0be1

SHA512
f6cbfd378bb815faaec34221c6bec88adbf9e1272f7176e0de3ad590fbf45284ac95d794c7314202fa568bc5b1500e649ca6489af148f6885983d00eb161e3b5

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
83KB

MD5
b47c438238e23b1a5b4a6629debadafb

SHA1
1c2bff1961660504a1dbc01ec1386fc91a551f1d

SHA256
ed4465ca8849e32f3c216f33310862f10b494a762edd94a2924e3376194045b0

SHA512
5839b7b3105674ae39a3089ee82e170f0bff3ae0ab45c1644bab4b11a2ef4b29176034086fa6bed0a68ef193db0b5d9073b7e296550dcc16077a0737af21f571

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
81KB

MD5
829c1867c99d063655e2aedbb7556410

SHA1
298e7a1b75aaaa0badee1b6075b3ca22d6395e7a

SHA256
70f01172773f5cd55330c088b92a7da76332e1546cbc76782f208efbb9061f91

SHA512
6e01650ebad3557546d6c209ec688ffbbc80868a9f32712f109535462b4b6bdd1e35a6507c973a62a043dc7daabd650804c1e45c78236de0c14b51d94fdfe6b7

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
81KB

MD5
928ac91c18e1034179303ff61610e4f5

SHA1
1362d259f2a6573e45ec117c0959685d2faac712

SHA256
733a027826a6856903589643fdad79754c1c99583df88d76de78b8a84b2a6b07

SHA512
c9ee896d96f831ec87c2aadd87948003bab72e2e9995f0c3b79c2243b5334a97017dfd1efc736136d6938d942aaf7e07320c05e7f706647086f6bd541ebcd2f7

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
88KB

MD5
6b70868637629b52a3ccbce11ebb0307

SHA1
0c6a63a33638b6b8185171bce9e100fe57e367ee

SHA256
75297606f87eb911c2dad885bf420eab9ea6302b944e4c03b398f0e443a33930

SHA512
cc638bb155abf4c3fa866ab5d69e457ea0ccc4b531429c6f9c7ea7f7c926e51e77ce9639cb3856aa9a04fcb334b192d72659e3e4939b8dcde63f5bd64546429f

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
80KB

MD5
92bec9d52ca718caa2954eb88eb6620e

SHA1
596149505060bac85b37a12f9990fe2725555f6d

SHA256
855b1b3a9edd1810fc083e71dc7057cf14c521f58bef81ff78263b2fce11b4ac

SHA512
6761af49f0029c3e427d7bb9bffe788090b2eec4c06561e8f3d614098fe42f8b61814a60506aa49d7a2dc374d07d61bf4552cef7a9ba370e114b290e03904a53

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
77KB

MD5
b491864924b2c9d2b350ee59b5f691f6

SHA1
20a87d554ca0d1f6950c26b0d1637d10f6d617d7

SHA256
a4c3dee4188deb1d114c4debd036ae13017c14e54f00b01f4a3e013065bb93f8

SHA512
cd7e4fe8a88f950c8b6f6f5b9e66ccc469b454515ebcb8ebb2d7aa547f8bc4ef228185131cf7f9d71986a7687867984ba3e7330028898ca0aea3c194026153fe

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
81KB

MD5
30118c407cfe83e55222423b7071b6e5

SHA1
ac6957cfb3cdb8d4f6697ea5914eb02aade5afe2

SHA256
1de9bcbc58ef417f43a3c69b22a44c5644722b6d2571e541c040aa933ecca7f1

SHA512
d29d73f9dc89146af8f383e794369fec6ea25c6ca2338f57413dc180552bbb114d848bd0b12760103b30afa20bd3d8d0eaefc8d06dda63d5e7fba42789394199

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
79KB

MD5
3d585642f599ff58199bc621adbfa254

SHA1
4b1735f18b8b68b3964ad4e4494de7c902d14f3f

SHA256
bbf032eb233b6a2643203d56c023d4e1c52f273e2d5f621500a8d571b5c81a59

SHA512
afba2831d4870b8b7c466b1ca8a1f28948f9d094fb6e9c97727c13c7bd0e5d46255f725038396b1aef3f60f0fb4014631106106dcf2f37b87f3df3c3731945a4

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
85KB

MD5
1e452dabc027d3e7b179c4aea24e7009

SHA1
0ff5773e6a3cdce2ac60db87691435b6931ad7ee

SHA256
b3fca8eea7d360f28cfac7389a8368dc0b7c82da1c58f96849f06ea1de2a8e4c

SHA512
184f569c4e42bae64de46fb27d15e08f30cfc873f6e45c772f991e0f64b2e5f64e358f01a98cbecb4a91bae6c514fa6800fae04ed8322e8eb507bf15eaa2f6df

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
82KB

MD5
8a77e0be95162587f680e1e21c2ac985

SHA1
38daddc4355d3b02757513535b20b10b5f751cfa

SHA256
1e3045b4b5b6c0b3dbeb09bff9949fe9f94add8a1d324a6595662e6b529caeaa

SHA512
172f900038150c78522a86db87f78cdbf2e6097c3e7edab310ed5344bdc1b6c789364a02612abd8087204b82d17a280ee92ba0fecc4ec3d04e1f89d4979d3135

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
79KB

MD5
1f63ef6abc673e912f0919103aa6d6d5

SHA1
176c08eb1d032a61fd8407d4b1353d9f1aa72fa2

SHA256
52979079b4245fa412c2064b521c6516b5f5f971b7daae7ecb8e43bc5c3b6ff6

SHA512
2f1e81724de029bf57763382696592f3a09b4bc58bd6c13eadd0d6580d9e60c3ed9ece1c299c51d81c06524f26fc95f5051ded6acc421d77810abe1bd1c0e371

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
78KB

MD5
8957cc28815b6a6ea67553f9697b7be2

SHA1
6c4baa36e62542fe230a9dc70442178c98e5eca6

SHA256
7033d93c528edb5bc3263f5f5b758496c35e8c4bceb04b2e4401c2afc9151eaa

SHA512
36110169320609230848be5c83e2dea370de5fd89c4b847560de02c09adcb43675a46f0e9ee61f7bb7c284450bac09be065c6525176756be185b82e89c080853

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
72KB

MD5
49f3faedc4066dd29f4c19b7c8082a6a

SHA1
f3e7eafff702713abcc1c75a62d3ad389a28e436

SHA256
5e941e6d7021d14b7f0f192c8458b5666b3a6ee4a39b5632cf55de5b2bad09e0

SHA512
c89ef230c6b3650552ac05de0c8fd8ae9c864e314a552ac6de57fa39ee70918b21be8827c7a96cd0b107702a99d65e7a65366b581c8e1c4af7b945880c85e94b

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
89KB

MD5
f501e18ab1fb59b8ffe3bbd8fa3f9daa

SHA1
ee74fe31b078449999442017323af62197c73eda

SHA256
9fcad2fce7db6a0ea2b5fd3055dda9755e78d5a9cac7dd2d17afa35a8370ca36

SHA512
2ae0559fdcad8a76a95c7a753f695edf55302674f6d3c2eb1b387693bf49060b20847e3edc7f1c05e33b7b2804a25513dfea6e2ba402543bd73091e455d17810

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
80KB

MD5
1f6e7a337789c488c81221ea218bdd55

SHA1
6f94ad208deadbb1b4ccaa37ef78fa677f9dfeef

SHA256
106c16133d89f1b51459b7c6b456d11e199d89dbfeb801729848fe6789c9afd0

SHA512
0b1477f1891930862c1be162ac86fe34acc0b18580fdc5b5d3a65b565ab3dbe7e76692e49727a52c6b6046adaa7b0b6102a17b407093d3a98184636929a756aa

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
40KB

MD5
3aa6a3cb1cf24b4312d6e12932c14142

SHA1
f5b9c9fa43578ba8d37b294a72db81018a366638

SHA256
fab05a8cae6ef31e1d87eb21d9ef9628f4377da390762373a0acce18c3b97520

SHA512
8f21649354d23a43f4ddd0eacb50a2ebefc350a899a00f3a46a102e621876307815a29924cf3aca0298ea727306e60c2328e6cb30e0bc9d0fc22d4544a0c941d

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
80KB

MD5
7bf4dbbc69d8098b6b571303a0dcd60b

SHA1
38c52beafcdb502b28600fe3d8ce6feb1e2c889d

SHA256
449db9efa5c0f2046bd06dd3ccb1cf74fa44ca807a9a570e0333f33dda59baa7

SHA512
a6b9e670c50482c224af60cf9234dd2174b1594da1c0b84a83dfb0792d66b18f02765635ad41e2037f361b0bc1b9b002ef79b6dede642de5086d08d379b0609e

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
64KB

MD5
499a1cf75919943e22fdd0f098797d95

SHA1
83eb23cd319e2de937336e0f105a998f3ab17f72

SHA256
875235390be972620705b7bfce61577cb144e182ebf093140f7ff5044311842a

SHA512
5e43ab7eed646c5f705cc3c3494ba21ecfedb2cee2d71b31d67b13dca59491d583e680f952aa9fc8bc8e1cd9d825fc6f2062882b6f0a44f5268455d90f17b690

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
80KB

MD5
2c2601efeac2d0cec0cd93d821881193

SHA1
7817fd0b8b91692d67ce098fc12ee9ac45efef61

SHA256
ff76ce40d03ea9abe4ada4fd11a7bb390427b4a493ce4af2fb9e9129e31192b4

SHA512
52b7a89b361b2f515cb22df2ccc3cd54c831cda06a6569de76a8c69dfb0b194f33d0a1de3d77fdd29b0688da0405e2fa02b3f72eca859179be89eccf5593697d

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
80KB

MD5
6ecc403b23d4a534c7dbd4e857b07001

SHA1
4f5a1aeeb07f157c06430890ad2e88388a82b1cf

SHA256
9a1af24832c3da2d25a45894e0e12e6d19184091ee12a236a7f1fbc9b3a7734f

SHA512
f4314fb9eb93480ac5699de5d3a13e3d9afa4ae24c3c39de8a03f0f1d4c3d1c6b0c3ba0490300814561eec2db4e2ee15be42807b9b3ff179948bfca54bd90cb1

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
78KB

MD5
e96c80353d8a99909fad13eb8eed6fb1

SHA1
4728e0cb24530b5b09c24705fd3b606c094752d3

SHA256
7c00145eee2497ea00a9fee4add0364294138ad30caa95a1e45f481ee4f8ae97

SHA512
7027fda7eea11ff5e4cbeff016258155c930baf6f675cf0cdafc70e98152527eba00663fbea496acd9fa6837d712c7c003fd16d2d4781cbdff91eed7bc52b9f6

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
84KB

MD5
34c2e5ce5e42f0fb88846ff0080da770

SHA1
1276b03cfe5eec009cc3c6e2986bd7db2a41efc0

SHA256
d5fd840b048192daa0af11b6016e1e1fe28d4c7e966060a331f7aaf5acb003fb

SHA512
b2799947adb557bab9028757d3a11ceff530a2c0e82de7f208df3c3ec32269b5f9e734148beab9b3c4fe34f9f3bb240bc0c710d604dbd7eba0f9f92fb07f922e

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
80KB

MD5
7a9ca0b33b6e60c5d9f6db790f60443e

SHA1
085f0c762dfd282565030374206eaf4bd040ea59

SHA256
7eaf6c98bf71a5e60e4df4c2ae44ea493a6ce5d72147c84c35f72d25a587d10c

SHA512
e8c8be731de0c9a5e4f68066f546423c67a6cecf0a2eb4f291113d2a325ada301dab1507039204c0af4d4f64bb57e1d319b44bd7ff19269a3d0b2f0425ef7ccb

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
81KB

MD5
7d153a986f9c3ea0bacd109edbfdee26

SHA1
d31965fffbdefff3799a1cb50f5ecc2c15588832

SHA256
49837e3dd730834fd8cf8c8e18e9b1383520e6b181704c079feece2cb5a5671c

SHA512
ae0b4b594cfbeb730a4a6645acdd6f4f490b99d28c469570210bb3f4674ac2094e10437840b4479cf5e8a327b3a0f806ec7bbeb5b18f3a20bfa2e6bde1c0c430

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
72KB

MD5
78706e772c8797579387b97984b8f9de

SHA1
003a5002f9a5aee4b0af4abe2e9f66f65f8390f6

SHA256
90b16279836693c072922e3076abb7732b66b2c199a7f0c7b1c11522cc43c702

SHA512
d26824aff875702fc21369fb7671a0d44819db797d66483ee7e228b9e906bdc6f1d6e735f6f85519984cb57cc09c3409a96a130f848503f00165376974294f2c

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
93KB

MD5
17b1b1405e4d7350b4cb86b1d791263a

SHA1
bf5a29134849cb88f62fdb0c3100604e4aa29666

SHA256
e2bd19c12ca20720204b9344ab299cd6b4f00b1a9c5104c60c8518db7142a346

SHA512
8abc4f8be8d911d1ffe8d38bea30e9a067b37f029309424f6f69a0abe88445e803370dd6221b2b00f91058cefbdd6d6636dd40e64722807c5c89ce7eec55016c

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
78KB

MD5
7ad1ce88961c65277aa4c44674d35bd5

SHA1
5896eafd4998777debf124756c12c28b8c8c92e9

SHA256
957db37c7dbb3969b3ca812a337800c4968e3a05419877f849e1debc696dbcc1

SHA512
1e9f95de171a8484d2f6c524146438d41d2b5cead44976ad5a2dd449227c9c34ce91790ff1830a5e7b44b791c1325ceeeac62729918c5452b5eb659371abc9d8

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
85KB

MD5
cf6a2d1d425d57aef6cbb6af95fbeea2

SHA1
73489b844b461d0b797565542f53262be5d5f92e

SHA256
d8acc32e5ea2bd0fff2faf05f2cc98d82a98bedd60de4404da63c4fb5031d356

SHA512
e570dcfa2ef7e652fa7e40e25996f58e91c0bfb209b2448af4a998bdb82f4893e9a2d3595920d558532074c467e9c1584a74eee86aae38b2af943fba0b6f9255

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
81KB

MD5
061633e52656c6b008ceb379c6a5b47c

SHA1
c4bb2369706f892bbfae5662e8b57bf059054045

SHA256
d75fe042123fd089d4b3e65bcb6b5a3d76a679f8b962a03bfb1d4bacb77b7bad

SHA512
01ab9c7ec92f6fa54ed0c1712efbc84221226d60f2228ca3b977d8a2808e6f58a18421b093ea7e9c3317d2420abda9d5552f51bc30c4ed37be78bcde5c69681f

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
86KB

MD5
4662f20b3036e35cbc79b63b46bfab68

SHA1
39af3c8250ffec246decb603bc8de054ccc1301a

SHA256
5e8e3695d7a9532b3c9a15bb97b715c8cf43e10946d9cbb66939fab9f91b2f34

SHA512
f50217d19d2367e534cd945618e3e294a11c3ab7ddcb0587b1db017b16d40289c80b67925d0a9010f037ce02c1dadb1a10c2aacb9a6792d8d99690ebb0f1300b

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
82KB

MD5
4cfda7bf2e1661c1d9cdcd7c2434c107

SHA1
96148712768ed0f19d1bc15dacf12035fd2de273

SHA256
91598d6d7dce34e1581b0b96998b1daa181e287ebee8e1645f6cdaa3bba21bad

SHA512
80fe7e46a2b42f9cfaf8230fb72ea29e8a2f5a0857f47f48f457e85fea290eaaec9284d7b3c6094eca7c95abc99c8bb3fecbda86e0e965578caef226a6c84f68

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
80KB

MD5
2e189dd25c2d44a63ab6c4a20f12c653

SHA1
2cf9b9504a80af79d1122c06475243118c320d9b

SHA256
fbd3a1952ea2b8e5220e448e706c2023a9d2ca416c31de8b0805f4be5a94f58c

SHA512
a164b5f57b5ba67c16098f8aa87e08fe98e17156c6f9436b04ba4527547d47dd643c22406b3f240bd7961a6c632e04b08e6dae7fed60c7918b801d396b866706

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
82KB

MD5
b7fc3a43e0ca4e54c60e1a1f56b6af41

SHA1
a50a4718cbee1ae40042204ac77d63f26b2b66ee

SHA256
113200a3a3c96dd884f0e291348d4e43800abfcc4b1fd9d2d37aee21e9012e0c

SHA512
f66c0b4687d9d2a9be0f83c426ba5db8cb4d9d09904fc34cd087c6725c64d2cab01fe8f101fedf2be0e122967bbac18e821bc6b859882fcb3b02811d6c6fc682

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
79KB

MD5
9054bb261d812a74a6710d8171d96b1d

SHA1
96a3bcf037eef0052a5a1c62665499e75f468947

SHA256
f4ccccad272d24ef1543a20913b188cb6c56f4238fb26e6444807f3862fc740a

SHA512
baaade2e8e6661afda306a2075eb79225be79116a80132f982f29bcee7141ee3e4fac5d441cd960eecdff2d3da59d0adb8197046ec5755ba9762f2dc50a7b6ee

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
87KB

MD5
d588eed586c3622187cd7afab12278e1

SHA1
81f4fa92bf189e421de89ff9fd7241a6c3da59e9

SHA256
31cd9c3e78c2829c36c4358fb4b430e15dd388a7843e1c91336ae30d4b7c9c1f

SHA512
7944751330d43bfebb473a342d019389f8294a5459023a5a585a46cee88b91b7af0db0ffb059c3903fd1d633b61a9b996e716c52bb9707434d210488b4823eff

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
91KB

MD5
f1075b64d0730b099d85969e60361eef

SHA1
eff4a4c29a140a5945798ea15835bde8d82a1a95

SHA256
f6d6dc55c122130217eaee75f5a6b2acfa88c4f3b3920397ade64a7362d18aa9

SHA512
c5bd275e2e6030d5f6c8488c930bd57f122a67e08848b21d29dabb5f28380fc203e787afa57d426b5463d93e745e8a49cf3cd493b970801ab3a83107326b02f6

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
91KB

MD5
85cc059901c4d5c7591af0258800e3a5

SHA1
2535e9514f64ecf4d582fddb83d5d825ad5dd259

SHA256
b61cbd0ee7f79cd6f51c323f1f86d78655888119a2ec6c3f9084dbfbad29298c

SHA512
bc261ff4a02f287173ba2b582a583c159c4805749b9fd58b303fe11bcc7cd136fd79e50e41c431bafa8092bd50466f15d78c82d50e93250860b7bc7f35542126

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
81KB

MD5
7b4e8c0f6d4a5a13dbef23dbd803cc6d

SHA1
daafc0380de5b3d80646ca1945dc2a9fc9a84690

SHA256
7b87aaa54b5236cd902fe67decf82af867053ebf9203346e6a5535be3817dccd

SHA512
f3ba520e1f0eb4858945091d396ac1e6bf3555cb3464198ea107346db8c7fe4b6bee5b559dad5e273222d1152a22d772c2bf6cc66f1b0a954c5ff708fb2480a3

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
81KB

MD5
2f7fcc44d8dc090fa2874c2a3b008113

SHA1
7850efb84ad64f02ed6b22771929e8fd5ce29eb8

SHA256
b4ab2bb95c14c7fe05846911c32618683754a201e57b1625e1e5204959424bb0

SHA512
d470b9778a83d798830ba8d871985e74e2430c4a710833e082f944ef1ef7683351e902426a06191e4e91b445398ee666a10322fc4dc0a722cf818832306588ad

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp

Filesize
81KB

MD5
b25b30b6c34b805f19e2d38ff7d2f067

SHA1
e1f0ae0a9d7acbd41729223270c97dbf71410213

SHA256
538fcdefd12c57c14febc0f47edfd483a6fbaa282b5e565a358acd7ae3d173bc

SHA512
f0d90f2755bc5c8873d772b7215f2837efa5ee080b95be21a3d6f612505b13d33b9dd48a53bbdadc4e9a06bea51a027c0b55003634f77338b281da114666b51a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_cuninst.exe.ignore.exe

Filesize
72KB

MD5
c99fe20cfaa242ba3c1f6e9eb22ccf52

SHA1
be075ff6fe9a218e01ba076c4725f7856b5f32ed

SHA256
584a787d1fe221a5a17be61e6a0ab5f936d992b9adb9d73a3d0517286e1c1608

SHA512
57476a936c3c47015be53aa6b0aa568b951f4016e21b6584e8ba6acd29b35c9cc180ccce070326d33714aadf55a6908f0b4d5d38e4ead43671eecd6595d8a010

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
72KB

MD5
bbec26481c81367cbcc9234314ead60d

SHA1
3b8be726ae6f0ed8ba88f482575d4cbd2d585ca6

SHA256
aba8c6490b4956cffc9e7fdcf952cc4b94f301112b62f300a45f88e03d3690d4

SHA512
21bae7496cf13f349c4e399a66701061406785d619e85d207bd9d27730ba29f4a5c0b7fe738eaea9c857c4b6cc9856c582a62bde9b888c2957ec56a896d48885

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads