0f82fe244cc88fb3cc39635f3406f320686a03e050995eb3a0d206438ceb63b8

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f82fe244cc88fb3cc39635f3406f320686a03e050995eb3a0d206438ceb63b8.exe
Size

81KB
MD5

2b61584b6b8e3e0c0e08fbe340cbcdf0
SHA1

b9395ff3c9b7824030a41863bfbfa960fd7c7607
SHA256

0f82fe244cc88fb3cc39635f3406f320686a03e050995eb3a0d206438ceb63b8
SHA512

0d9ca584f41e189675eb0480241241e70ef1b427f4e8bf32d7418092cb062f09884d91b86ebebcf69e8cb6f3e73ff9bbf5d9366f39f20679a1f1a6e7263a04c4
SSDEEP

1536:W7ZppApBULcfpHLcfpp191h7ZppApBULcfpHLcfpp1919:6pWpBwchcNpWpBwchc3

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5208) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4948	Zombie.exe
4372	_System Configuration.lnk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	0f82fe244cc88fb3cc39635f3406f320686a03e050995eb3a0d206438ceb63b8.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	0f82fe244cc88fb3cc39635f3406f320686a03e050995eb3a0d206438ceb63b8.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp	_System Configuration.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	_System Configuration.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.bundle.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.Json.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	_System Configuration.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\optimization_guide_internal.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp	_System Configuration.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	_System Configuration.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\cacerts.pem.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\msipc.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp	_System Configuration.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	_System Configuration.lnk.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 4372	1708	0f82fe244cc88fb3cc39635f3406f320686a03e050995eb3a0d206438ceb63b8.exe	91
PID 1708 wrote to memory of 4372	1708	0f82fe244cc88fb3cc39635f3406f320686a03e050995eb3a0d206438ceb63b8.exe	91
PID 1708 wrote to memory of 4372	1708	0f82fe244cc88fb3cc39635f3406f320686a03e050995eb3a0d206438ceb63b8.exe	91
PID 1708 wrote to memory of 4948	1708	0f82fe244cc88fb3cc39635f3406f320686a03e050995eb3a0d206438ceb63b8.exe	90
PID 1708 wrote to memory of 4948	1708	0f82fe244cc88fb3cc39635f3406f320686a03e050995eb3a0d206438ceb63b8.exe	90
PID 1708 wrote to memory of 4948	1708	0f82fe244cc88fb3cc39635f3406f320686a03e050995eb3a0d206438ceb63b8.exe	90

C:\Users\Admin\AppData\Local\Temp\0f82fe244cc88fb3cc39635f3406f320686a03e050995eb3a0d206438ceb63b8.exe
"C:\Users\Admin\AppData\Local\Temp\0f82fe244cc88fb3cc39635f3406f320686a03e050995eb3a0d206438ceb63b8.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4948
- C:\Users\Admin\AppData\Local\Temp\_System Configuration.lnk.exe
  "_System Configuration.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4084,i,2113996974559895641,18156918660790954073,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
1⤵
PID:3144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.exe.tmp

Filesize
81KB

MD5
0687c6cfeca48425627d56e07b00bc72

SHA1
a35fa5d7936fd02acf79d26f07cb334bf913612d

SHA256
787595836733e95e1bd1d1288130b6175c63396c5c46d04e53c3fbbf14db24d1

SHA512
12d78b9b5f8994a3bae6f955e4303fd2a64ceeeb741f223e72721b2cab51a7a270f389b473e1ec13016f15974da028101d570c5cf03e8b819265bd54595fb488

Download Submit
C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmp

Filesize
42KB

MD5
c88a243e969577f7dd099db2fd937da8

SHA1
9b4e6eae9dbc86e38a575c08cc10d9206f8792b5

SHA256
807dcc87a38f7cd6913d859c24e172d8e4b230cfe8f52cd0446aef69aadc9bb3

SHA512
3acb3a832862e4c98cb912fe9c694d485cb83fecd01977a4d4cdd28d616269e8a5d1b179e1e943d2b8dfcf3975bae2f62d9ae46b970efcf18b30fba57c75d2e4

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
154KB

MD5
dadbeed289aa96940f966cd21859ca93

SHA1
5e6fff23e0639a932c29035b443141e6c147e26f

SHA256
bf6e65445e126af15e12793a284ea4ad6d65b4c02f9a7811bf908692ae1c561d

SHA512
0115aacd1b1e7fdec9b9f488aaf3897bc067527b47d60268d52762b8ddd31ee33b0ac1ccb358ccaa687c54f3bb5a875a84a5bff95c0326f198d22712724c5e04

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
140KB

MD5
4d33fc6d7940e9bd6d647333dff2e5fe

SHA1
68a07e6c674551fd939902102b307e46726a8715

SHA256
50fecd8bf4bf9fe5c71a7914c9e563b26926c0b76b5e1a0f6580f30f9b4503db

SHA512
d58e27edbfad1e89613207121a550b777195cb0351104c1c9080572208facade137e74edc5c3238e05ab2bf6fa13d263470d2220e7db432bd16e654f7fd4ff65

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
1dad591ae95adf4f04793c38f0790925

SHA1
0e17f9a68e4b8786ad505f69b543c0bc13a6dbb5

SHA256
35bc1b04bad00ead8ef54a0e4dbbcfebbe6c95b734907f6068770c4041e792b8

SHA512
3c4a731e9339d3a2e2f3e6737489cf0ab3df213649182961d3fb6e99153936e36133046860f12534b2ab0d549fa54a565d74c6506cf25579c412bf17b5325cc6

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
95d3ab6eaf4a8ae341507c7dc08a92a6

SHA1
666ce2516953e48706b22a1a557e55a48473cc89

SHA256
1ac55032d365b745b19ab401d48012ea5df6e6dd3b5b8028eada6ed51d463be6

SHA512
0852933db8fa1bcc3535ef0bdd69c7c17e23a6f2df4f129fc270d6f67275fc7a4ee27eea1c88ee9153a2dbe7a16f3b976e6a5db55bad063ebaf496225fdcd931

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
585KB

MD5
de83ca2bdcc5fcc50b0273b830459a3f

SHA1
b231e5fdd9a97705167f7800ecc3c03fe10f81a1

SHA256
3b991c978aff67a9af0f4e90356c383ea5785e69b7cf4a478f081771ec9bc3e0

SHA512
99dd33d8649b335e0729a417992b9eab845577597b5db2db14aac1d9fe1808a5a7a156f8e3a3603bac27e7b61d2d2d8fa5ef1dd45b15ef06a0617fbee0f593c0

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
251KB

MD5
93e7a2a2c93675af556fd1ef65bf6ce5

SHA1
ae44dddfa979d872343f1750999ff644051bc918

SHA256
2cb6440b0f285e57d24c1b9ef8795b161832ebe42c6ee7794a683e20719069e7

SHA512
1e9a64b2c77591383824815889ed65d76f0ed412d0e3c7d9d117e00766b4324e4234ed4df3ffc5fea600d6ef25111f6870a7deaeb05c4ff47a73ae7586ec4fd2

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
230KB

MD5
2b64bea60aa053813220c2f388d0ec5c

SHA1
c39e812c0be143f8c9656913224ec1d705ea2362

SHA256
15e0e6ae8e2f8a918e35090d0fc619957ff3278e2b59e2f6b1c7e5ac057f8544

SHA512
1034cb32efc5fb2d593781b1c7b17967c87dbc36bda0928518aa1c938905bced302cbec5001172f2dd99a9564342b199e715ad4491b598c84b84a887b249fd87

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
972KB

MD5
862e1d982103259fdf4ee4abb4d0cb4a

SHA1
8eb295cf5dddc1057d7ef54fdee4309d5802c2f0

SHA256
f7514a1627a3298ad2e76c7a0995bd4aba31b05f638c8c012efc0131efe10a85

SHA512
bc159677c6033658b4bfcfd4783dc3c01f0df6d3aa54a1ec3d66147ae84609e0c58f3c514adc5689466bbb1400d40953d098115ac8319c001157846c3ad09a3b

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
725KB

MD5
d8fe1b8630b68ed0d666eba315def3bd

SHA1
4a46de5b060bee79b3e89c961cd1b5c38b5a50dc

SHA256
6576c0361e01088fdc26306eb24aae95acd9f2442d55b46d96ed05cc4edbc8f7

SHA512
387b7f9246510c99fa66df8f5428b7e9ea80d4b330b9844eaa5d88295fb4dec632b902e62af00201984ef05681857783a80ce15aad2cd27400479c5b1c0909c1

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
98KB

MD5
49d5e6b6c9bf9c72f1b2c8b09780a980

SHA1
8850521de275e4d1a579888b7f2bace89357c4a6

SHA256
bcef1e0d02dfbc3cdf1645c4c13eb2d0885ffaede766f57fc984723e236ce9ad

SHA512
2898b37450d66ed3ff223b3b7ec18b095ef40a0aa6ed6acc76d3ba622258aa6eb94f4ffe666c853ff2f36aecbd79f851f7dd85d7d0034f4ad536321069981d47

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
49KB

MD5
5f6d3e94098c9eefd813d4da68301725

SHA1
f32e3849b7e43757f6539f7fef739b1090469516

SHA256
2ce9909990a8862c1ff8815573f9678280cc90784c3c992e309e1b59fb90acf0

SHA512
2aff79176832ed5d5f276b03dc4f405664501120f073482585c77edf39df2bde29a553a49398228301175e6624a4e0eab031267d7233c0089551a75249951b67

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
54KB

MD5
ae28448f0e2b09ecf85da17833405ca0

SHA1
1e667869f527db2d7e72164b9bee4771aa695db5

SHA256
dfbaabd802cee3d782c2932464fdbd0c4c55ff795c061be0e59c775014118a86

SHA512
7995ad926f8bc0803142e23ae868054091e31d1ad3a78ef848f28308b4f7fde2764c723555fcaf7218064801fa62ea626d2e1112223c06bfc3b79dff3597249d

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
52KB

MD5
971e15d1f782f330dc7c0460ed52d0c2

SHA1
3a15111e24cd22a7cb7733761fdf807a42af65c1

SHA256
1c15300d1f1662226dda12ba0da5015bebcd5f2adae05cfb6d12aa3b38ad5388

SHA512
8fc3aa56a24989cdca95710066cabbff15ce1c117bd9ec761daa5d802000a1d08b91709480b650e066997a50ae640ad8011d5680d2bd13e99e2cb8c6fef09011

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
54KB

MD5
7983d83c666c0a5128ab5db7d55bc000

SHA1
314d8df1c53d456686bc257791d0aa59bcedbc59

SHA256
27143ca0b520e32fe6ebabf3ef0d42ba21161d0c9f2bf62ee1ee0573a7ca9b02

SHA512
ebff4402e3bf87277ce95d19558754d899d035a86f28e6a26a9e36d9d759ee61efee5281aee8d43af08b4a2c6b13e5dc9b95fd083bc9e26f136e80af857dc306

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
56KB

MD5
134bd4611e47af8ce6d54e41efcf172c

SHA1
4f9db10d1d06dfbb55a2875dbdfe8602e8e83814

SHA256
90449c2453d5a374c878b5b0540d05d48b25dd03e152d6541b59604d083b0f52

SHA512
ebe4848ac6255228b1dd2ce454ecdeef963370e43329c6e229b7e8ca58f53d4d624a1d489a90eb89da6ab997e5d47818066e9e7ffee16700c8fd9a8c15827d6e

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
47KB

MD5
7ac313510cef1d2c6b2c4532c2859416

SHA1
474ee421645b50c18b3c094c17410de1f98046fc

SHA256
18299e4188eee65e1e55ac22ae9254cda17cce1006d17eb58b67b25428a158e1

SHA512
315fab8371db497351e854439e60b30635f147e0008b30af551df8f7a4d07831d0a7ca08c9c7dd57a3bb441b04516839982540865b5608e4b32af4032f6b31e4

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
44KB

MD5
06e898dc9ff1607dad05121523a97b15

SHA1
9adecb51aae85c04f6a424e4a6382d1a515d49b7

SHA256
4119986b6b7847e0715bfba04d60bba3141731ee6befd2b6e4da0355235ae3ab

SHA512
4160cbe15d3616bbabbb19d3fc598ecba6ddb258ec5538ccc3baa7808fd4c5d8e5147bc3c16173f7b5787e8f0fae52fc2559e934fcf55ce4ec4bba76ca34fe67

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
51KB

MD5
228d8c41070d4f60e9cc346ec077864a

SHA1
0d45582ebcf716e19acd44dc93161a17451aacd9

SHA256
9f834070fe53b0ce8933d68306eea25097db5efae7706f66d47b259b7390da25

SHA512
4e73815368b88ffe67db6a88e1f322cb63c3877d791f6ce697951a1cc5b661741c87ebef6a548ee79409dcd2c050c783261613af5209034dce723c57ac4bbc90

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
58KB

MD5
774e5e280b16cf67f0b3470b96b2ed96

SHA1
3eb899af802aa8a1ad7e3e8d42c2757922edd8db

SHA256
00d87d665e8e9ad264cd290ff18f15f29231cac847b4043aabab5b46eadde405

SHA512
76adf9d26edf24d5d32ac2754d5aa1c1e350bb8948c21cd59d7176fa9024e7fc9ac65a7ed56772151dee08b8d920527b26a8d9d57344aee9bcaaa3f6303f7f0a

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
39KB

MD5
ad0124834ecec198bdafe1f5ac83c97e

SHA1
956205dd458c299004971e4027a5bcabb5cf5520

SHA256
f80f31ab990a7b3f47917c6199cbd21ee9ee5150e0920750aa3c4bff7a356ec6

SHA512
ea6c2340c5efc83d73f01a61b6c8cec8c9519fc80d579314d70bdd8ba7402601c2009e2bf146d4ced86fd6ee3699d8602ec6684d56a972f969238c66e4781d7f

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
47KB

MD5
c284b0c6e944185f111181b251dec7c5

SHA1
6ab67310cbc23ca5735b79591237ba8480cedfb3

SHA256
9bd98f0cd7cadb71c1a72d59f335d8b878b0ea6d91a16f19c580e7c16a0d29e7

SHA512
0363a017d57dc2417a782a2d2cc5d8e75b9a2fe1d2cbcbf09f56621d08b633c0e00344767caf372269aa7289adbd58413221e07bd2636b2063035194a65c4e77

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
51KB

MD5
2c015f6453bbd0b5c9e8977ae4319cc6

SHA1
4cbb7660df9b07efcd3d57799b8d0d83783823e5

SHA256
731d44a7f11074b426738fce6b4b2d732393c24d6c259f3ad0219e518bbdc7a3

SHA512
3650de8c4ee9b725bf1d614c6e1739b7f42d1af129c162e45ad180b91fe548356de5187faa3ecd6863d38f320df3e24202431b6fbf1de0d995e8a00f82cf7aac

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
50KB

MD5
22df9fa37c4f3258f35e8ca6b83d85e2

SHA1
bc271aaee48315cd56ebbd65f0688093723e0db0

SHA256
5767259bd66c4c0854639e40ea0c27f15b91d974ccd7892f98f304827d5d3cfc

SHA512
1999a9af3cf68f4248aedf380a5d3b19457092f14203199ed3575eea6b8ba7b9c7ade84af1ec15e30e90f67a1ca18598db5970a8bea01fbb3d0388b76432a5b6

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
51KB

MD5
cf332679384d0a86d922fb1d588601cf

SHA1
1feb69981f22d5821e062b362fde082ecc6e8b47

SHA256
98ca7e950ea3971d61b14043c77b88c8889ce3021b0f85def9e50cf472a7ae79

SHA512
3c675a195be129a4e10c31e6423704127a8fa6c4ed2b3d180d5d5809dc9faea1939f6921435d61c2dd39b063a50810172f39b2071356041044540c2bc414e47a

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
49KB

MD5
f3c8dd8d04529cbed1c4d97e24133369

SHA1
985fb64042faf717aa05da9fe6adb5f3bef8d429

SHA256
ddf3eaee7882945cfcbe5bcf6513c6a25f04dc94f4c6cad8d156cac0340a05e4

SHA512
575b9c56f7a37ef828de44f6edab9f952838968816d6ac0306980506da079f334d8ffaf34abb02872f38ffa47f2a056930b67889b3cec1c1f48e7cc06bd73127

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
50KB

MD5
f45a834e83bb33fe2983617d2c4d58e0

SHA1
13b3ed98470839b76e5752605d0cb7c088f9da96

SHA256
80971d23265978888df0ab776af47dc177619f1aa8900b148d3970cca94efd45

SHA512
93363a88064051cc3400d1bbc731353d5e8b1cf52e08b3c2bb9b9d4b01fccbf2dcaf677a8995f7fa211e2ce609fa54578923a07b24f9a5d9ba1b9aa02d62ff90

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
50KB

MD5
646b7598fd3f2f9c7977cacba760fc63

SHA1
74c3c93f056bef63bbb21f116cd0464a9c2e1676

SHA256
e8f11127686d84fb4996336b269cfa2175441a474487e4adc145879d5163a2f7

SHA512
ca2622119fcca28c74da2132f6da24392ddca77a2250bbed8063f94166ccacc90e47f4f841f71a890d0569c4ece63aa1fb88a4fba0fcbda1d6e43881339085ae

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
48KB

MD5
3f2e661a2f8a0eed0b1292c156b599f4

SHA1
2a07c4d227490954059436453b9a59dab29effcb

SHA256
8d5924a84af8f555cf732e39aba71fe63cd2614592aeaa4078a54573cc8a10f5

SHA512
46f950901d815de17c0db4e216d4ba8cac36be3dc08a03a5947824efbf3fc4e61a4fe7b5dfb6bdb79314da6124991465a4761870c4274c6750c1afe3c2c87ab5

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
53KB

MD5
2e0b5149f644e59e6135bba78d4aa6e0

SHA1
e284c312b85e9b1c36b9ffa13f148013624b1b24

SHA256
a92a0cee1cd79ae7365d4b7815f4fd7204525ac7b1ec9f18060699702dedb405

SHA512
3852888fc8320f11a64c252cd855e77d0455ace6a67190079fcf77a9aa722a3cf6c8ae14f937bf4c5cbcfa02ccc9136200386056ea17f289b329c30ea773b70b

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
48KB

MD5
adfad5a761b05828a2df5ebd88905824

SHA1
2f4b2ef0195fda622eb24d41d795ea33e5ee59a2

SHA256
c70d679830be9d0dd15e5a86e9ff3962403b42b58c0bf2af86e90e3aae85f2f3

SHA512
f97823337583d47af390f9104b187db4e5395d5e3cccb0fba8a0ba93118c8bac81d5b536a2d480d07c7ec26fb1f7abc16ddae674043b69e6ccebd202f72f4d8b

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
49KB

MD5
61b3182142c9102da416fbc40d94dc5c

SHA1
869c86050067b57d435ddff106a451fb6eda1318

SHA256
d75b28761053c9e04dc360dcbdfa1beae4643821b080d8fd65534da1939801b0

SHA512
2eb8015b05a3f10901eb65eea03fdbf09339946c4032bd3ca7d41545e66dad2b757a8747cfe011a8ad03a55af9e318c3eb5888cdeed1be8a3037908424ed088f

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
53KB

MD5
365b94935ba6680fce1f00f397b7771d

SHA1
d00adf6cb26d60adc5c8616d9fbfc8b022642f65

SHA256
7af4a5240272ef51f35a1c829cb5bb57f7c53c39423ddb411ecdb259dbde8d94

SHA512
7d8ca085fa9f670a7a3e30fcf2cc4c2ed2dbe9a265e7ef939f16b4364333fc08465638683ab8f92e4ec7491f9c21a5e9c599f20c2bee1b0a8f7b76475af7b024

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
57KB

MD5
9719f4991b74a79b9d1d34d695be78f3

SHA1
6677b3335da01d5d96e9a78035c313cde467ec4e

SHA256
db5bc90faecf8e62ad301464ede5b3e3f3503f11015a543b85bb858b4da1f184

SHA512
c0ca965cd5efea8421ab13391b33cfc93f79e94b9abc955cb8e3771eaf7c3edae8f9aa4b6109f4c262a4a99e7c3b3c87a764c338b41277deee4acd0de0825a15

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
49KB

MD5
a45c456c17b13b54e3766d352afb709b

SHA1
a18eab60570e5d01c479df93ab5a3e7d6d51304b

SHA256
96aa093e343289de9d02bb2e9bc7d38222135362ea39e7e9ffdae507585c8bc4

SHA512
ef9665ee64b2a668fadbef3c4d43fe08180d19dcd511e662b7e98b5ffc799b5bcfa70c210f363e22a55b3051986708c13cb470689f9ee3fcb9825b38c4ca7a40

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
52KB

MD5
ac5bbd3f29bc5546730fb06beaf790b6

SHA1
2c031038f046cf5de14a47793512b6d7c31dded4

SHA256
c97580543048e08a291118b74ec1f55206b82a67c82f464d6da72654605fbcfe

SHA512
8ad027148ba6ec2eccafa4173bc7fca3469bdec84629e1886501a717d52f893dc6e5ccbff639726ae23a2ccd94e70f5f1285baca44dd1caae79eed8e99b10b7b

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
52KB

MD5
8d5994b47040ae0e2beaaa8cf9eb3005

SHA1
8a5a96cefb1d0ce578c7a841fabf35f0d1ed9bd1

SHA256
19905301d91f6518cd3a9fb5761d4b6f14c53a70753e2dc1f07e9f18280b8b16

SHA512
b23275f3ba106d435fd46e7e2384475b1b7e40974c0d5ce7cd26601da657a0998a4ab66172c01484766cff6805aa08b6ca7f33ba22a035dd40ccd882dedcebb5

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
51KB

MD5
fbed194cc50a66cc0a0de18c49077d7d

SHA1
3545e9d3106ec18814be145e5888079286fd7420

SHA256
f97e93686dd0771335b4db5b93e080a28a96c84423538b2087a254e72d3295e4

SHA512
b327f08c5d839d5ed8467747499d261b5f870a79e0198439ab49999cd58ef0f6ca2672755a70cc007061a85d8fe30d5f2eb53246e33f40d2d64ae64a577c88a9

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
54KB

MD5
4b173d335a074e073d82aebf9b53f88d

SHA1
fa15892daa08d49708523e4bdda48b1ba63018a7

SHA256
3d7a5f9fda8d2ac013a326808130a757d3b84785454bb3bc6f9c63af460aaabf

SHA512
04fb28dbded3cd3db9c23a53a17a5099ffc9bd46b08a26da16c6ae73d7434867329a564f67070d76396ef995c2a5d99ab15040a3ea712c3d050d025cc9f6e160

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
49KB

MD5
07053b62646e49f018f41ace2ab7f5a6

SHA1
e3d00c98fe6f00295af680959f62c0353b421aa6

SHA256
772fd93f169613eaa2c87d9ea4283e16dc7f8cc9e1d3682a19dcf74de0baf227

SHA512
d8e248322c638aabfc34aa4c63645438e894c7e8b9dc9a1043b904d0550349c7c1ef4520944bdd9470cafaf717bd4a6a63a3084a302f96c59da1662bb6a062bf

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
49KB

MD5
e8465ab2183b07c0d2f8eb0da086a50a

SHA1
60fe091edccd59d830a91785012a232ddb7d8824

SHA256
2a6af68b7c4a3001f4ee5150fed038676dcd81788dec7745d57b1bab1c753255

SHA512
da02bdc324c301b4eb2ab7db0ca3d731911600b85fa7646858b62e4d6b29b15ae71c9722894b479eb249a36e379826b38a8018c442ec0ee297be561f32c7687e

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
50KB

MD5
744a102a37b868ee7ab08992da40d2e6

SHA1
05f7dd40a6b9d88a0163c6acbf6b27c8cb11de92

SHA256
7577a7ec449343a491de7c6bed1200b1ecfcd3219a36f1c29ca51e11dac12bf2

SHA512
9fc3461d5438b6a1195c186e881276e9c144d9d23ad4da4ae875ce0fd4597da4699fc434349699bc97738cb6f269b5cc329041d301a94a21d6a15f49d97774b2

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
47KB

MD5
215abc84c987adeb66658f631b093516

SHA1
6a94b6e2dab88793c1d4b3f0f182ec07d5a9e5f7

SHA256
1fa3a9cf9439420f03227946b919f7716d9f8548156b6c985919511def615aaa

SHA512
812abaf063b34068be9595a4400cda979a99e8bdec8544135a68071550b870f29c9491426778197c974276db34d27971a694a193d46f2ace08c991c992a49125

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
52KB

MD5
33ac2beead3006529b0b9f326f1bde75

SHA1
0fb5ae9f63c58014af27b379ffb426e49e301da0

SHA256
c71b15c2dfaa67b7d7325d7830357656d2fa2d506c70310bf4e4f85549ec80bb

SHA512
a136ca629392221caca6264710d162a41a2528090fc85060aeb5b78e29b6298bdae4fc9a878635d073cef7bfb1abf4b03a8c83e8ba4d09e2c59b924586bda73b

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
44KB

MD5
891d0919c6abf5ea5389c95e2b105aef

SHA1
b7d3ccdca8bd256df51683198190af72e414c3c7

SHA256
09456fedb3ada7d37e95dbdd03df022adf6ac7f6844850416894b2b81ab16038

SHA512
22a0da833cc1d6e75ca0b3238d28cf61fa80f445d37863c3fd563bed12a0396e74432bcf69a0b8dfdc8556e1bd424aab237c2633c7512ea5d5a8d89ea72ed986

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
55KB

MD5
8060cb8e8a50001d837207a1a5ec35bf

SHA1
b17bee68a619faaa23b3c4d8ff7dcc81d2bc7ac5

SHA256
3dfb3851c9385274ae03e322057aac6600243bcf43f4dbd94ff24a319ba4f579

SHA512
4cbcb334ec7ee0af020c0b36cb76a4fbba9c870d2733c0aaa153894315d5b25bcb59f126de8431e565bb83af3de6bf04a8e78359b606734822482702fee64eb4

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
56KB

MD5
a93de2b99d91380107e14f12783e2477

SHA1
ae3b51360fc17043d19652a8710d57adad8b04c2

SHA256
732e61f40633eabef6d82faaf67efe23e23572f775ae3f9171df0a08a247d3a3

SHA512
54b26259ec74abffe1f4c12cef0072adbaf63224f71bd65ff33179d46350e027b36ea5e936305f7ab4b441b590c8cd33371e39534f21a1d70675ce85bdc59530

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
51KB

MD5
4767e8de3f02cf81249a96b52162ee4e

SHA1
83d938292a5555b37ddf2a38ae1e359449b445b8

SHA256
3882b931eabeee9729af682d8072e4bdcad1894b559e34c0131de72721f476b1

SHA512
487436ff20f400f783cc46311ee19acc4065a04e6a79a2b4a3dc750bd38d71d645e1f2d14bcea5c976d37b428119944bf9390b7a792e6ab72809fd466c3b7326

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
51KB

MD5
b920cbe7dfc88b9f825a65b2e532b562

SHA1
39e938746f8eca7e86139c55092359480f0678f2

SHA256
461c7735f45c2d52975bd24ffa498ae7ced2b8cc95026ab5adda20a9102e8a4a

SHA512
71329556aaeb4e58ead597c43de381b02fd801adecccba3dcde5ae258773ca0e98551c358edd0e80b7d78f8c743a0e1c7a376c45e5c735c78d3de59756de84f5

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
41KB

MD5
b50a5b4afac8caca9b39a3beecf23571

SHA1
bf015f52ab45758fbaba755b69a3e3496d134996

SHA256
88e3b50a0ad108104adba53c3d8b72e55069f336623c374280d23c4a8fec1d16

SHA512
4123cdf63189121ae1f4cd70d19385730d9b915e51eb3ff532ec9b7c4f1c3ed22290804cb8170eeea9733ebea8def6c741f419cb52681ccd55a0fd460c4a7aed

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp

Filesize
49KB

MD5
e0be8be78c5d50feaa90bf979af39d3d

SHA1
43e1327f4b662316869cb4b2e27189884f5f9058

SHA256
c34c4ad8a4ce4ded022c57c78e25c2803ded90806e6f3d7c34fb9bdfe0efd1c9

SHA512
0e7f4ffcb3b565adc366f3c8955b89a116c055045fbdc6354520d313dbfa011c9c9c7359a18c314988052b0cebe8b9a0f700876eabbb2eaf6e0a7e5b559f22c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_System Configuration.lnk.exe

Filesize
41KB

MD5
4d0732e52392f42abad87c3a325feedb

SHA1
aab29685cdd0492f75bd74d30bfc7daecbe6418c

SHA256
4fdc4a778ab0d9aae2d8759c95f5ba9aad78cf7eb100d3621de1daf7f7ffe419

SHA512
4711b763c83172105611974b531fe1fc3f70095be7da5b071055f01cbe97b37c86221f37c74f608f84c0fcb06ef917a9005a97a20fd875f495ecf193bf284839

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
39KB

MD5
52c4ca6c94fa29e1791d7f68f054bc1a

SHA1
79e3ac6e34a5b336bbd58e12f257eace7b2a4454

SHA256
57b9654597732d7caf9f9c285b25d8cbdf686025ff1c1f07c964e4cac45d9fdd

SHA512
61f9954dbf05d528bbfc26aa4ab289368eff62a734a5dd424abb6a22899926a860915ad73c639cb46d55a67f88ffb383edbc65a47ab22274af4c667b1dc2ca37

Download Submit
C:\libsmartscreen.dll.exe

Filesize
41KB

MD5
60376f4b0d1f81901d581ff84e9c32f4

SHA1
ee779109ac367200260e5ca76ea1c0a41db963ea

SHA256
f50736da66abe31455b485aecc2c947ed4e13007b63d728c3a5112fb07b4e201

SHA512
cddcdb48cd5f6ec3c573877d0ecd0f9d169a1f2120c920963702a6e422d23a2acc939ea38f071ebb36e2f3f3df24f699fd0667afa165474b59aa3997476a6de9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads