38048c45ff746bf8515a88ef69bc245873694d88ef6df5e8a921bd360d5e6f3c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38048c45ff746bf8515a88ef69bc245873694d88ef6df5e8a921bd360d5e6f3c.exe
Size

196KB
MD5

d168b8725b4839102a68d43cd3611aa0
SHA1

84cc88090bda2f0280b399b4f16cd1bc34d7eff6
SHA256

38048c45ff746bf8515a88ef69bc245873694d88ef6df5e8a921bd360d5e6f3c
SHA512

72608801ebd16a805e60e7ae638ce71e1622b2abbfa941148adc2dc316979d751abfc4205e31c12dc8bdffbac651049c2904e48d68a971a24e50cd24b744107e
SSDEEP

3072:6DWpwE7oL2e+efZwZ08i8z3MLVDWpwE7oL2e+efZwZ08i8z3MLb:dN/e+efimJa3MLEN/e+efimJa3MLb

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5054) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2400	Zombie.exe
2604	_.arguments.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	38048c45ff746bf8515a88ef69bc245873694d88ef6df5e8a921bd360d5e6f3c.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	38048c45ff746bf8515a88ef69bc245873694d88ef6df5e8a921bd360d5e6f3c.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	_.arguments.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	_.arguments.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-pl.xrm-ms.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OART.DLL.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	_.arguments.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp	_.arguments.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoCanary.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	_.arguments.exe
File created	C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp	_.arguments.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	_.arguments.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClient.resources.dll.tmp	_.arguments.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	_.arguments.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Xaml.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 2400	1436	38048c45ff746bf8515a88ef69bc245873694d88ef6df5e8a921bd360d5e6f3c.exe	81
PID 1436 wrote to memory of 2400	1436	38048c45ff746bf8515a88ef69bc245873694d88ef6df5e8a921bd360d5e6f3c.exe	81
PID 1436 wrote to memory of 2400	1436	38048c45ff746bf8515a88ef69bc245873694d88ef6df5e8a921bd360d5e6f3c.exe	81
PID 1436 wrote to memory of 2604	1436	38048c45ff746bf8515a88ef69bc245873694d88ef6df5e8a921bd360d5e6f3c.exe	82
PID 1436 wrote to memory of 2604	1436	38048c45ff746bf8515a88ef69bc245873694d88ef6df5e8a921bd360d5e6f3c.exe	82
PID 1436 wrote to memory of 2604	1436	38048c45ff746bf8515a88ef69bc245873694d88ef6df5e8a921bd360d5e6f3c.exe	82

C:\Users\Admin\AppData\Local\Temp\38048c45ff746bf8515a88ef69bc245873694d88ef6df5e8a921bd360d5e6f3c.exe
"C:\Users\Admin\AppData\Local\Temp\38048c45ff746bf8515a88ef69bc245873694d88ef6df5e8a921bd360d5e6f3c.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2400
- C:\Users\Admin\AppData\Local\Temp\_.arguments.exe
  "_.arguments.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.exe.tmp

Filesize
196KB

MD5
a458232f26089b67a75343112b112ec7

SHA1
6c29eb98291a501cf040b5c97071f2134c72837d

SHA256
f0928149352337d788034ef424f202350615c9721dc14f36af420d17f9d385ce

SHA512
3f7fbdc43068074abd91cb427e7b314b7473e664ef549d29708faaf668aa779906da08ecf2af2ca76d4087fa21c545a0527691495e6abe28b7e236273b0756a4

Download Submit
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
98KB

MD5
3ccbfa28285325e19528224529aa39e6

SHA1
2a273167e33f8a08e92bec90023e296af51b8840

SHA256
1e30c78dc05264b98a60fd8d6d88228950a1f9b2d4736a26558f761929be7234

SHA512
b26e7470fe79e768934e8480cc16b8a4305532313659cea6710135463da584c6aee1c7167f625b71df295054da7bede9b8d632913aad6fbcb1e70a56de3cb33b

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
210KB

MD5
42f980fdb1840325bce506dce478363d

SHA1
957db7be70b04ad2d1ee3dc91a4863a700707270

SHA256
3c972cea1d08002e090499883d7a2a238bf2fb0f39ac32c579f739985507812f

SHA512
46905c18257a302b3431cbc57ca6eb03374a13aba8fceb773b40c21fda6ae5a973f0149fb5388abd74de6bf5b92c47207411edda8b72b9ca55fb3a708f5677d6

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
162KB

MD5
605d1b175dab12d800d75c0484c02aef

SHA1
62a219842aa5661821313673435aa0a618582bc4

SHA256
80d85fb57ce8088a69be7b9ba79bc7a7112697d3a80c439fa32bc5f155c32a87

SHA512
191ed0656fb085bd458dacc5ddec7597220b0bb9472b2df93b68af91afe468ed0a6cf1b284005a4b4692bf2d0728312ca98ec6153e27442898ec1a9402870f0f

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
180KB

MD5
8c613358eb7f3f6a1397fbe31489b5c4

SHA1
d762c387d0eedd9591ede6439e6f50f5848853d0

SHA256
883308e116040292eaf3e881f02b8aae60afe0f9240822398fa54819956bec25

SHA512
c17017000d9825a1387526d29f9979570b83159049631b090e7a4c9914ff60e1f848c021f28e441f179f81865e91d9302eff14dba2be023e57caa0ac3604424c

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
641KB

MD5
81fff6cd305c3890c9dd8d5bf4ef97f2

SHA1
76d31a82921c1c6e6e8c99b4bf447158773b8dec

SHA256
d8b98553eb38af6075bf89138fdc85e01e732a0c592f5e0a28070e1a4dc93058

SHA512
4926dbe272d102cd465b631d3674b3a4bcce4d9af7013c40af45dfeb4bd8a9a1b531e30be1b0e70d6fd3118dd812002e248ee0dcdb53e6030a2469f1c2a3280d

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
307KB

MD5
1671d5c9e1ad1419b903f0a8e56ff1d4

SHA1
b5898677b7f43427aefac2de8cba7286d9495d9a

SHA256
88f83eb869db4926b87df91cab540ad68cb40246c2b8ca2bd0946daafac311bd

SHA512
66f2e30d228c8e51574138d1554c56051adf25be431da5d26603caef3261b8853757360e1a862afef081f3359b603373fc5836fbd4da91bb3aecf8b74ef7c16d

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
287KB

MD5
0ebcb05a06c60e6a70bce754c2c89c02

SHA1
904c2a7471d36e453d0f2165dc548c501142fd4a

SHA256
a0b01239ac595600b330e4b040662d460fbd877211726aca0e21abd279bd5edf

SHA512
1d0f3beaf387553c8053f3da8380966fc87065b6bce5418594427dd2e7d3bf2856414f4a7b29f293243237d5f1dede2f968ba18cb5a25e18152261303def2363

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
4553f20cb9a3f8f32e36ea3d26fd0afe

SHA1
943c5feb87fddcc1c5d1895c2792ce1430747ba2

SHA256
9bf35de71f9cda935ea646e2b1286013f8b35ab79f4ddbe614f9e8e0c7533bf1

SHA512
4b5fa4d73b008eaa8688ac90064add95d8d6c8fd7a0e132be5a127cc46d5fca78790425029871d8c4e76694655a96c9c4344e51bb6e0b2d4b4bc4e67505e7dff

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
19cc32ce2f79e8abf348c7860a2e3025

SHA1
833bdd9f799d84efac40cff00cf370c5df424865

SHA256
40cb925eb474e71938664dd7d6c321bcc0a171bde08a100d508669f6376bd5ba

SHA512
49e45520bd5f354a023ed4d2a5bfad2f24e6e6db091234d94f2ba02076c4297ea77593e638279b141d428d459b2c3f171fac22661dfd2e433fabb3d56326c450

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
782KB

MD5
94ba0a308b26776c01d1da58dc0bed4d

SHA1
111550ca03524fb1a493dd441fe928f95fa3cb3e

SHA256
28623c8ed196f530b2005123c95d6af87f7bc6222f98f8c8b259b7d5abbd33b3

SHA512
d691716eb3aa82042274b92420a6c878cf6a69b1e6205eafa4b1f69181607f64b425125c7a16876d918bed777b59c87c0f3bb2616e0292f8c68840b00cf1b393

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
155KB

MD5
94f2a689b4e9ec1ca9672260ba804e53

SHA1
623aa0f77d8c4df8d752ee80790e21839a55eed2

SHA256
0de4fe4dc1619b13ee6ce1b5e98dda3798d4bafdce571ba8eed8a71c25e0f475

SHA512
e99f07eded606f76f711cbd0c7159495d938a46e5e34e50450b494aec05bfaa9663c7fc6ef1258b1b9fd6eb5ede03fbe7fbdb11bb422d658fc32e0db3cbb4519

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
107KB

MD5
64ab2fc59551f07891e678f4bcb89eb2

SHA1
afefd10497b0b6bea9adbbb0113f2668cbb78dba

SHA256
d549f241622f9ad228163c15a577594024cf0b087b68c3939d1cd83271833d28

SHA512
63f85567aaf267cb83405e2941ce24e8b527371f8ed49836a2946110486da30f5b0c3d3aeabb79a5ff0836cf28be59bcfa3a60d6b957eb74312fc3cb28aea6bd

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
102KB

MD5
68deb1e1cb3ecd7b0f7d1cb8f2a6513d

SHA1
0b645134ae55a5ac26ad1e234ff5c6c34b6898b0

SHA256
7a656a912d1b6bb12f7a9a403fdffe3c3a7080a5fc10f2f56802341170673bf8

SHA512
1958d27c07f179a253eb76de86ca1b1bc72a32c62ada772757dd404ac2ff3a9106baf42b1f2f07369cc9cddb88dc6ca466d4b6436d9f702ae4270276a0792d77

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
107KB

MD5
a2f01d9fb87cf51f496147981401edd0

SHA1
f34f4e108d070b85e04e59e7c3e74047a6b04eea

SHA256
85447f650c88294ce67a0b82ef47b4533ca1cd6514b797001a93412497b8843d

SHA512
3cd489f187fc06dc7b3c78a436c366839f89edfbd5ac0bafd30ca9520da6d05234356883267a2c0c38db561c674cc873a6c02c00e82c086d90090632b2e44ba6

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
109KB

MD5
8cb39fbf98e1c439b7604db0a0da7207

SHA1
d2d8b62302b50bcde148ac42bf5aeffb5f3675be

SHA256
74ecc184b1dac035699406519dde1786c8fb6c58d1ec7ffff29dbb4b44eddc3f

SHA512
eaa735e0e90696398ceaef250cb6f04751e30d4c96efed342b4ba696a6ed9cfe5855d1e8d6ef5e05f0756911cf0c57b518aaed4a4fed4455c55b32da04c4eb84

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
110KB

MD5
fb38b9387d32a211151bfc15c9397d00

SHA1
f8c643bd7a59a4d08dde4708a3a818bdc1b635c3

SHA256
318d4f7ee6abb77970da1a70d4cf1553fd3caf694eb66607f6f9828efa8f06c7

SHA512
4f98a2df99f6fb143c930fd15b18a0d835c127a7fdcb0adb65b0f8a7df173de10e0e2f155da4433fbd882fb7b1de2fd010ad48bba83b91dc03e2e17f04fca3a1

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
110KB

MD5
e96496da077d95ff43677ec09fbe701a

SHA1
6a173f1eaead9569615b8c5b1f49a37da7ed7156

SHA256
cd7427d9ad88accec2d8f0b2bf9e41a947cc0b16479b7d9f9498214804fc8caf

SHA512
ac97afa53d81c6683d896ca147215f9aa23158dba4e3f526786aee7c647f2dadb80eb538b6f23e9da424407a51ce3d6ec325fe265fc617432dcddcfee718c006

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
102KB

MD5
6c029ddddf044b6a081ce7830a9fafb1

SHA1
71a9f572747f7429bac27720bcfe11d0e6df143f

SHA256
99e9819529ce43d6fac6260fa14c2a7d2ab2e1d5dd84b1dd010d0931ad17592d

SHA512
5224f52534a1600fab14a74e0ef5396f1696cc3b1d6ab0a46a9a129dc416afb99f7d969ca96c34f824e905d0675e0aba9165130286918a1562fde68e351a9169

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
106KB

MD5
87ca3b63b78127d62a245d01d28da2c5

SHA1
496e5d88fc1a3738d97b8cd421905f18cf5ccbf0

SHA256
193a26c5dfddcfeb774c078eacefdade947d5d8546a6d5ca51d046b3b0c48ade

SHA512
699ae612dc233e35d5ab0bdbd0a4c5f6bdea649c1b5163a01b835e6a0cd68154a4861aaa710f99930872f51bcb422ad7feabdf8a6a9f693df89d5399b25b8865

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
106KB

MD5
0b563eb1d2491b04f8a31a56a37e271a

SHA1
5277d944359b64b5168216376d7d9163969aa72d

SHA256
00d22d27fc18047d991e421b6667257a4103f6e046c4f48df533a277b9bab45e

SHA512
d529673103611cdc18ac1b03bf1a904d1e3747c1f8d261894cd74979f40cdb6ec9c6d5fb08023eaaf85ddc5301e4fc80aa1797c2910e5a33f965770bd0e6175d

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
103KB

MD5
c07db5dece298157b4a5e9f9602c3a69

SHA1
7f649178e2786e27aa7aa83809727a6a86fbf9cb

SHA256
e8aee29bd546366092216afe695dcb9007c2582399a66eb8ac291f5a459750a3

SHA512
d56c38468c5bece7e83e6d101c09dc835e4d446071c6e84301189fc09c42c9d6190985bd027a93fd6fe2592a6a0b08d47d457ca4171a9ee596e43424c3288b36

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
105KB

MD5
20a654074d98abb9512d858eb83a3c8b

SHA1
852e43aa95834de19c6c4e6bf9933713797d8c3a

SHA256
80004b50d983e54c45dcca7edf249a2bbf0131a9b77d9960959fc4f49517ec79

SHA512
d7228066ef53700616cdf6c670ae40bac1171804cdb18bce78beee74fab0d90f4f5d8940294f509bac2721453b23a5603fbef3c3daa444db476070c036c324b8

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
115KB

MD5
a43646161f25fdf18251b556368dbfbb

SHA1
104289debbeef006ed40596519f01f8aae016f84

SHA256
1ff474203394f6ceda1e728e1316fa8fd981a056327f832c405cd4758cc4badb

SHA512
a93c5f6931e20644006c80d3ad7db2e168afd1de8c100f823d2ab17876b904a40cef65f921627e010035699c70dd9d3f77b64fc081e4815ef51f086080e0e357

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
105KB

MD5
3e529c846ea519181294292350656149

SHA1
7f2a32761f06cef6443dd54ee59863fd0b4eefc1

SHA256
9e4b98a02cafb3a8822cfec0bcaee6572d9b821af22c7219a69c3474cd651a5c

SHA512
e2ebbda8175afe0211b4f1771c9cebd35c242164b10840aac08ce8290bc2278edcd7c6c8e8f4cefa8c28ab529584b6e6f4b6b1b1bf45a573ad52f795d9a0e296

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
103KB

MD5
7907d67f0e1a40d964573611c7e67328

SHA1
57d7e1518ef9c6165b544619bce4bae5707aa086

SHA256
f3861007a54ec6fe964452d8553ad7fdd6487b001931ddefb2b94686cdef7410

SHA512
f638fd9b6c8f61604d9b325de1ba7638dfd42741f40911145e0251e04f45c76c71ca76c46abcbf3d0491f97ffe4fa8463ae056c1737b89cb95abf3cb63005925

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
107KB

MD5
2bca83e78eeaaf7cb9dfced4a3ad70fa

SHA1
99bf260f9193bb8154675dc5d30cab8404727393

SHA256
c9a4df76b9602cea8f27af412a4a93ca9e3826e2b555234b09a8788e6597b9a5

SHA512
877d19449ad6cccd4036b6c366588b0aa7e3a6c5b3ff138e422a76e33d3360ac462a8e1506de57ee60bfba5b0304381fc49a4b06caa20e56697a39854d2e354b

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
104KB

MD5
307b43e3ab38cd7435f6cec5a11fec2c

SHA1
5b246bdd869b2f44c299a8e50e1114a60965f2ba

SHA256
891940990f47d3e5d3329c4ad109984a814cda7f7a3928760f7310d17c8c6bd5

SHA512
12ea3f475e42e291094bab0f689bb2cee86fce7a8138d791b359f8ac58581e8b4a54fe238a7c203a01e541c41fab5768fe472b3ddee98125f37c6d9690f21f5e

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
112KB

MD5
db0fcb466047d8c90584460458d0a375

SHA1
ff287bb524c86f0819aed2f9b168fd4b06611929

SHA256
fa714089f91a77051f750487f0458058d9bd1bd5963c555cd7ff26804afcfa61

SHA512
ff4fc36701bea2118041af4b88e674836712a59c6e2a1d87a9234106b95941da83bb5a66894382de612cf151239a731f745bc4113429b4d8eb59f7d62d1af4a8

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
107KB

MD5
fa85417fe4abaa381f1c4b21404245d2

SHA1
7dbe4a22bfc7b73bccd19a4d1780d652bb63e3b9

SHA256
e78c9e39fd3a23a5c5eee0e11b4d42b42e8ac2be30e17336363aa4229e53633e

SHA512
d6389ac7d4a74ac8cc29d2aa6556e2caf828f77d6aab41485d9b140ff1878f4e98d1a02acebf2da820ddd1186099834c67a9557113dcf9a6095dd0e889eefb18

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
105KB

MD5
768cf0587afe720a873308cfe0dccb9b

SHA1
17b99e32476ccd1ff8c3534476830c194156a644

SHA256
5cf7c8f413fe31088396390405ed546c89c2095b39f18ad3dbc84d5ab5999567

SHA512
4b7e0230249f0802bca9b8d4ef7d3a3a02b26528cee3af549871e0b69f61324045bab265a883941fab30f362093ec52f0a1ac93e0a04b29d32af4d25cf6d2b8c

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
97KB

MD5
377f1192c7d2029a9355973122757c1f

SHA1
1e792e1e5fc062d1cc13842aacb6309464014c41

SHA256
d03424270e82f5deb2ef9ecf9e429ba5b0a43cbe15a11383731ba97ee75e42a2

SHA512
7c403514ba5dd93a0886d81a66f3e7fcb963790793672bccae19c1b215d7d240016828faaeff16db896e9ad80b28b004d613d311502723b6dd5cdcbd81f0b23e

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
106KB

MD5
c6d7a1203148873f05f8f12771a168f2

SHA1
054d63caa05c26658c3231110664269c73b47abf

SHA256
4dc7f8f2c76832745d5a0cf7a8c348283f8c530ea1c221eaf7ee546d070259aa

SHA512
8d6862317e02878bc17662b72619ef65ad321e916246e04481bd1d5ae0784b8e840f625f12fb652ff3566ea3fd9617029239ddfa84be4fbe5a3eca5d02b12750

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
107KB

MD5
2f9c6ac8c37885e21bc7c8ed64ae0690

SHA1
30feee40ac881823b18ed234d182111b270a5cde

SHA256
45c19343c3fc631b706ebebd2228539d6a376f8598f16223aad48b4e9bd5aa9b

SHA512
4143ad9ba53ce45c9fe944597cab093e887f04701334b93b985a5fa02f7b5840df1c7fb4b38909bbcf866e4ed2477a6994620db84d58c7b501458b36274056cb

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
115KB

MD5
7540c70c496df4fd31896e908df4110c

SHA1
6f0dbb664d7ddfd0a5696891965c5d38faf39df5

SHA256
63b97bd231a86696b7775a7fb5c04284382bb6e637e6dfe258de576c95916810

SHA512
c2c40f03343a20a58c39f77fb7aa13ba2091c84a99cc1a83339cf6ba6c693a850172119ce04748bc0f38e32fed29de1f165bfc07838c8a4aa55027dbdde2df24

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
106KB

MD5
7841e55515a11a1bba30153fd17b747d

SHA1
8773d127ddd798ec32d02ea225ea95d4e6168a30

SHA256
b8954e0fc4bfa384c5eb989721cd5ba2998d1e6c2f737ca9003513b271fa4e02

SHA512
a9e29d2956f01f5dcfc58afedeec2f14d48e128ab682aaff91d442d6a3207430debd9d08e7bde361237519bd86fd901624a578eff80d3ce26a7e15a328731462

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
107KB

MD5
edb573a712feeb6c51a296ae44100729

SHA1
87de6d9f0bf9f2590b1c23e111c2848a65382623

SHA256
2f5e88d915b5312ad3db56b0fcfeaff970c1519207928cf5a5d636d99115fbec

SHA512
b5d4e8ae413907f22902eff2220d532a352cf0698d2feaa9f379dc6ce22fd2cd9a19726fd0a5c4c5bd78291c67b130f49a93f8f2e5e8b8315fa400f690e4d69f

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
112KB

MD5
4fb7875784005c4469618c8e426d5d02

SHA1
6970de99845649a6af646ac07bb991770208d39a

SHA256
27599d493cceebb2a32873aa77ce52cafe48fbca9ffebe656c3fafbaec4bb4af

SHA512
579ecb9042d5ee6ea384222f39e992cc1c04eaafcbab88f5f4d0dd266c729650b3061c9ca6b43efbd4d1db1efd2cded527aef55d67342323a5d094b590f36deb

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
106KB

MD5
855649dcda98b3b7a69ae5ab37cb5f13

SHA1
273fa10d1fdfffd12eaf1094e89d3933c25420b1

SHA256
5b8f9e1830c331b182bc273e7b06511d2782d0eec91c6f758204dd68dcdd916c

SHA512
0631a445a944f16619ae104dce470f186f23cfdb69d1a41e50edceba1d6e72a6ae20107dae0ce57d77023dee961b2faadc89d71ae286090fe59776e29442b0cd

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
108KB

MD5
e7512ea87ea53d0d358832f2c2f31d1d

SHA1
7c346706b21677572a593826e1bbb76bf5aeaab8

SHA256
11c8ccb46fe2b9b1ad02aec002fe0e1fc37e7ed4fe70b8918b410ba5a7038312

SHA512
b818db8f4baca524d6082786be0d16c2d5e015162372ee8a5427da3b95f2af830962d58a46b7f92d60e845fe940cfed9aee2a859be4146471126c5d84ee17d4a

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
115KB

MD5
329c1cd82e3e6f15dce99d1b4390cc2b

SHA1
f85c152a694cad4fe120f820c8f385853886b6ea

SHA256
f5c478f23388bfcfe8b01d3ba8b4d611af9678899fa033cda36b1a92569fe4d5

SHA512
96823830384c36f32c710880f61f0e708bd9cf620f47851d988515e461377090a1d813876a73b3e592ac6dc0d3baf499e29fcb4fe61a9b03faffe75bb5e986b1

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
106KB

MD5
1abac6404a111d3c3f891b00fa1ae83c

SHA1
e6026e81eba3ede5ee6f7523b2607114486db160

SHA256
ad22783b2a3343e20d3fbba50ce61f6db13a70213fee230479172eae873d93c8

SHA512
960bccd07b3e7e5cdbab5c875207212670c625cf20a968a50b833fa162e8dcef609f683406289fc70ff8f5243c32cedacc67d95164787c283cf93ec4d9ff7629

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
106KB

MD5
7865b9e7115ba2b310e1257b7eaca473

SHA1
7cc18d988aa17d7bd8d1209128317b2be640e140

SHA256
4d5a2a87baf39b57a72235502403c19dc4d8354c7ec738d26057fa9519cf0d8f

SHA512
e4701a9b106c4f1f08a81ebb8c343bb2f3ad9adcf88935f97017efb9f298861735e22f330cae14a305a85b6553243ebf7d685b8aba8ec00fe0d0fa808cca6f68

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
110KB

MD5
4da03293fe65a701e9d7af472106d06b

SHA1
c4498bfb121af4102f115ab92667223d4e8e0f61

SHA256
b2974f6f691e676883acf3ee81c1752f4ff19831c3cd7aeb3c61f0ff5687161c

SHA512
ff1e19df6460c5b9501a73a536e27fb1c24b8e5601e0a1d1db904cf8c8ce8e7553fd27eef4f648ce15983f999a473e983a98c73a86f14198e904172b9b50bc43

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
109KB

MD5
4613048c360bf04b818010b300fa98a5

SHA1
c61e8c82c9a928ca2f7cf8531483bfe3f1a095a5

SHA256
3930c34278c7002d0d88f67189b2a55bf3dfff424b4380366817d48714429221

SHA512
3d64142d366b3356212eec91028ab33b4ae1029d40af06ffab7b2deca8f9a4ae0e6909d34d5a98a009bbfe77296729ec3bba4b9f9f1c01dfef9d0eed42c27333

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
107KB

MD5
81758c20825e3b17ef1efe6e4aeedc03

SHA1
decbb2595562dab07f14e0a832bad9eee1b5788a

SHA256
8c6b30b7f7d71e3e1749ef1fbb9b938e746527beacd3bdc216e412276c7892e6

SHA512
b14e12d40cd103d450ad415bd09e76fc6d47b94fb72c928faf24c908621d5b06212f69e11858bc9a1bd006f8de8502cac18ce4014287047e49e62e76c8a390a8

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
106KB

MD5
0776fc6809a2ba07f4a3d16e3f9ed1cc

SHA1
716c5e991829415727793783481b699c506127f9

SHA256
0b09aeee063b7776800ee81a1c560f7fe4b7ea91c820b1c1a9e26d4f651cb7c4

SHA512
b65c8e097c9637cd4638bb7addd099cb938df7a48f40232a531213d6ed2a0c7047e0b6222e87c71b22e2d5cc0e3bf52125e135e72794946aaa7109dca365de0c

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
118KB

MD5
979bcdc240e6c54c68fb9f236ea51e7a

SHA1
580a18b56a5d51b95e4410a5e3ac0aff17033c94

SHA256
d5f5300471fd32cbe78360bacf2049759b12c4b72244efbaa7e32939094ec74f

SHA512
4296b9e94d1bf958d7e800f5814fd3da11ef000b17e49df6031323b2ce2dd1c5d434f7f1c6a4d4a4b62156bc3d6da77b941deecb600994d34076095fe1069dab

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
119KB

MD5
81f990311aa63550c1e5938cbced0705

SHA1
55bdf3532e44fa16e8491deba665043235265884

SHA256
bbb54356eb869cb0124881545c1d2476734d4b6e2e614b7f07bfff6a66e22520

SHA512
a1b0048ca88c7202f3ac0cc3eb94c8b7322ce134abc4b39f99aed61336355e32aab52eb3c1f7116151e204e74098f05b01177935ac326f22181346c8e490f375

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
103KB

MD5
7d1255c75e250247d9eecc76d43510ca

SHA1
b12c1a5167133781bc85ef243ef566479641f078

SHA256
8ccda970db75e92ce31e359285fa0f93beab78f3523b91c200edd86db6a6d5b7

SHA512
a4b3b15111354f12f6de37eb42bf5deb92aad924383ee54b4c713581dd86aef4db0e20b59c5ac8421ecca108c4f2f320892a1d391df37a169ff602364b47bfb0

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
111KB

MD5
eb966759d61de916d68bde398949a7e4

SHA1
b0ac08dc254e97869f5954c898c5ae3170f80ba0

SHA256
27cacc42d3684740d005d6914df0ee7b5a087ee98274e5d475c7ade7dc5cfeab

SHA512
ae70092a599d4ee4f06d37b69f66570d5ab2ec9ada283d20ff2d3595f0077c630174f0ac2d6c439273cba33e580248718c43c108e43e7a4e265470f43089f424

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
107KB

MD5
e3e822e67d6ad812677ee4ac2a4f0e9a

SHA1
747a5d1a2dc650edf8a5665eeaa759956b6c9d84

SHA256
cd28a7a8df9146a9c79428cbe466fc8c2e8750d26432537372bed7d7ebb00545

SHA512
c4c006c642ecc340b24efef8646b125d5d49500de0e944467f75a7e0d8637ed0a5b1cf7d7f0c3b6d601e77a5b25e67c590fad021cbaaf98f2c9677673cbf7721

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
112KB

MD5
5440ef50fc816b6481764f714761ea17

SHA1
6d42d33112fd18fef34e20163c9c459c50f6b130

SHA256
039441209e4122f8a22bbf8aa25d7ec19593dcec0b22789344c07a50d554e50e

SHA512
dd891b8355700c3529192710e717560b109cf00c8d5fd93c6ce8f3ee728f8f19280bd18c7e2d4cb25664ba87bdad6b70b844bc242c6bea9ada3caed050926e84

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp

Filesize
108KB

MD5
a6a4ddafbc9760e8474d41d084b29573

SHA1
40b623cdb4ed40d2c79440d9ccb57e77a9370239

SHA256
292436f96c1edab983a5c3e3b78b7fc10f97a1156bbc06dd7722ef566960f832

SHA512
298875c6b374a3eb25c65cef6bb9efd1a962e589c214c6bb447f6621b6271507dc4adc75fe5d288cb0d31d2825a130a7070a774a8d4cacbd7d634e163142dc92

Download Submit
C:\Users\Admin\AppData\Local\Temp\_.arguments.exe

Filesize
98KB

MD5
bc5c7f4064f1a764ed0b59c082600411

SHA1
a39763a9e08d8b874b718406b102dc1ca793724e

SHA256
c557fa7465cb7ef408f4e8ef9697c44850a03292cf0258a73f8d48b44c4eefb8

SHA512
848b421d0c3529e00937f64ab66a4ae94ba0352892f928a6a9713213dd1855a75fadc144cd0b2dd339541e2f33f0694d3079286787b7b87b52fbfc8ac68497c4

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
97KB

MD5
3030ef30040d3cb91937640d4eef20cd

SHA1
008c45e82bbd527e186caec96429f75e55f2ca47

SHA256
67ee8ad67e2f741e75fdbc4e16cf66ef325b0e026781cdb733850081f6acb3e8

SHA512
7558a58f4150ec00d9124509f8131c5f3cf35da4224892729158f267d8c91315b16d3a6fcaebbfeb8eb5b8d0e585788b1f992e1b5b6a18ad7b3558555e7cc5f9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads