3422f3926d36070274480edf8dd1a87557d9c0553c04fb69faed6bae0e7686c6

Analysis

max time kernel
149s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 02:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3422f3926d36070274480edf8dd1a87557d9c0553c04fb69faed6bae0e7686c6.exe
Size

94KB
MD5

272c72e63e782ce6c202a12b8cdb58a0
SHA1

a80ea0b4ec72cb716dad952a6a6ac4d1268c41a2
SHA256

3422f3926d36070274480edf8dd1a87557d9c0553c04fb69faed6bae0e7686c6
SHA512

cab5fa2f7b11b5ba693e2fdf9379688b1f21eac959ded533ed2cb14b13479fc6fd7edf1701b6f5b8db8aab7ebfaf871db7c28046d08d36c48aa77ff9484afb12
SSDEEP

1536:W7ZppApWmjXWY/IY/57ZppApWmjXWY/IY/9:6pWpWmVjjpWpWmVj9

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5069) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4500	Zombie.exe
2708	_Memory Diagnostics Tool.lnk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	3422f3926d36070274480edf8dd1a87557d9c0553c04fb69faed6bae0e7686c6.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	3422f3926d36070274480edf8dd1a87557d9c0553c04fb69faed6bae0e7686c6.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	_Memory Diagnostics Tool.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp	_Memory Diagnostics Tool.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp	_Memory Diagnostics Tool.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp	_Memory Diagnostics Tool.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms.tmp	_Memory Diagnostics Tool.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp	_Memory Diagnostics Tool.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png.tmp	_Memory Diagnostics Tool.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp	_Memory Diagnostics Tool.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp	_Memory Diagnostics Tool.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	_Memory Diagnostics Tool.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp	_Memory Diagnostics Tool.lnk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\vi.pak.tmp	_Memory Diagnostics Tool.lnk.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\blacklist.tmp	_Memory Diagnostics Tool.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	_Memory Diagnostics Tool.lnk.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	_Memory Diagnostics Tool.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms.tmp	_Memory Diagnostics Tool.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	_Memory Diagnostics Tool.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	_Memory Diagnostics Tool.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp	_Memory Diagnostics Tool.lnk.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt.tmp	_Memory Diagnostics Tool.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp	_Memory Diagnostics Tool.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	_Memory Diagnostics Tool.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationTypes.resources.dll.tmp	_Memory Diagnostics Tool.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp	_Memory Diagnostics Tool.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	_Memory Diagnostics Tool.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp	_Memory Diagnostics Tool.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	_Memory Diagnostics Tool.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp	_Memory Diagnostics Tool.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto.tmp	_Memory Diagnostics Tool.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp	_Memory Diagnostics Tool.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp	_Memory Diagnostics Tool.lnk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 4500	452	3422f3926d36070274480edf8dd1a87557d9c0553c04fb69faed6bae0e7686c6.exe	82
PID 452 wrote to memory of 4500	452	3422f3926d36070274480edf8dd1a87557d9c0553c04fb69faed6bae0e7686c6.exe	82
PID 452 wrote to memory of 4500	452	3422f3926d36070274480edf8dd1a87557d9c0553c04fb69faed6bae0e7686c6.exe	82
PID 452 wrote to memory of 2708	452	3422f3926d36070274480edf8dd1a87557d9c0553c04fb69faed6bae0e7686c6.exe	83
PID 452 wrote to memory of 2708	452	3422f3926d36070274480edf8dd1a87557d9c0553c04fb69faed6bae0e7686c6.exe	83
PID 452 wrote to memory of 2708	452	3422f3926d36070274480edf8dd1a87557d9c0553c04fb69faed6bae0e7686c6.exe	83

C:\Users\Admin\AppData\Local\Temp\3422f3926d36070274480edf8dd1a87557d9c0553c04fb69faed6bae0e7686c6.exe
"C:\Users\Admin\AppData\Local\Temp\3422f3926d36070274480edf8dd1a87557d9c0553c04fb69faed6bae0e7686c6.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:452
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4500
- C:\Users\Admin\AppData\Local\Temp\_Memory Diagnostics Tool.lnk.exe
  "_Memory Diagnostics Tool.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4204450073-1267028356-951339405-1000\desktop.ini.exe.tmp

Filesize
94KB

MD5
939272695c9c61dc7b71ba610d5275a7

SHA1
fce8c81ae9abd864db8884d3c45114b89a3c5740

SHA256
93fa21749b3e7b3aee12288166e26aae9863d73bddbee9e038efb291fd10ab1a

SHA512
58e59ad2fea2432feef39a62a340356da3d5ecd80e62344983b98bccfe9bd3c2e048e37e6723d8817c4577feb1c71f273c70ec2e64530b2172834b683e6da1ed

Download Submit
C:\$Recycle.Bin\S-1-5-21-4204450073-1267028356-951339405-1000\desktop.ini.tmp

Filesize
46KB

MD5
39ce78cda7e940f6712c90f66bf31cd2

SHA1
b245f4e87f8b708a197004c642ca58ee358b81e3

SHA256
126fe01a775c17b8aa1cc5f16b31f0ae6ecf4612441e0c21156bdcc98b9d38a9

SHA512
24dae611c7f135fb0e1bcad9257a60b7119f84841aee02ea108b050d7c92af0f66ab00774332fc7c6b475b0e654c2cc914fa7b9cc909a2760cc0a7cb427fdcf9

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
158KB

MD5
e4996da91d9a592993ddb2eee5bf7788

SHA1
6553ae263e6b2780d87c5226b486f1593d33991d

SHA256
89d207b59f4b7eb390cf26fc59bb544bc3c880c1b0e880df20dd9df8b627ee82

SHA512
40103444c315a68b10fbd3634c5fa9ab508cf4baa9cee0d002fbbefd46fabed05111c1948049b12db0749abb2bdb3cea9485d379d1adbc5ebd1d84bcd9d69ed2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
144KB

MD5
70d25fc520a4a3cbfd0295219207ab05

SHA1
60d9fa0fe49fe457d20e1c9dfdba989d482b0d30

SHA256
3c25f7ed6a3296fc60d702351aef8d5e8c7d72bd95125bad33134b308cbaf896

SHA512
2847fc3fb2cc8be695f51185a37dbebaba5b03e8378cf1cb45f3fe9b001ead66c5f701260c6c4e8c6613562018340eedcba0f52b74fb987efc40d5f067123c22

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
110KB

MD5
fab67758de3d00509e27640bb3e15dbe

SHA1
f2dea82b49ba185639a01f8bc5b65fe6ab9cfce8

SHA256
001f6fdcf1458199016de351f8090f9393c43f1016142a5251dc42b662bdf51d

SHA512
d179117920125e9d7c4264829d6c27eabaa4908033f1a99b3179b4764d7566a1d4e761335f76a601a6a49478e671514a77f6968f42592ceda732d1d25477af0e

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
7729ef07d4b094dcb7915ac8d58ff3b3

SHA1
447e31673606f9b7dbb916fe9f4856fa3f1069ee

SHA256
a7581717d2a1f56ca0e132e866a410b50967fb02845f2c0f1574c297f6198903

SHA512
6e06cc90b165e03d4a7a5d2d93dcedad17be6c13c474f3e50c350e8f1e157e5dd264ecb7e58adb24423890b2c5197686e790ab40cc34b10de4f2c426407e56ff

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
589KB

MD5
fb7cc41c46b624fc8f76461a59d702f9

SHA1
f242d0d8883b33095cafaa71e944269934411a56

SHA256
7fbe14bf5012c49d736afaa58dfb04e97196a019c8231a94030fcf63982e568f

SHA512
dfcffb1202a56d3795637ab4ab24cd80c2d7b03af9f95ff03239681e390b6d1e6ec4da13b6c7958a435968cde1d486b68229370b9ef45a80c1998cd02d112167

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
978KB

MD5
56f8ad0749e44cd000ec29eed7963a3d

SHA1
e81d5a4569ace6fba63ba331f31121772bf74791

SHA256
4e86dc2f6b542ef3a2ad2057c390390c439094302e491766de50748a57cea802

SHA512
01a17bb37438e559f861a6e554c08d5dd4b5d2570ce60c843bb0ce4144f1503d6b811d512760ed94ea18c19edb944eb0da4a45b628ecb24cfafbf38591510cc3

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
732KB

MD5
d958892ac8613b1e1b8e7a74469240c3

SHA1
2072e04f44e4195a6c05dd1191062f9a4f5e4b7b

SHA256
14cffc8f3c7efd9c4013cbe16bb6c644de0c1f14b4491c0a62f379ce8786d593

SHA512
d761e8e558a08b713f2ff21867921284a04e122eae4c25da9ebd4f29b6edc325ace15b8ccc1b94e1c8738fc6970873e1ab6a38fcbb7010d9f86101cf80223c86

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
105KB

MD5
bf95f9eeb3f443380b0a405f393db427

SHA1
0a3b24928e90b1bdfc59e0618bb347e60e2c06fb

SHA256
ae18d939ac86e3b9e3b9e1426d7bd0103989f749462bf9e3c601ec8ac6e3dd2c

SHA512
2228c568594581439da3bf8a39e3f77a77722fb48f7bfe3951d96a12d0ca58e8502fad3d0d4eb9cc730f0385f4574273df7fad11f70458b581945e7e29f79dfa

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
58KB

MD5
cf328b60459d173bc6abc137bad3664e

SHA1
97716e0506fc351f487a6271247a9af954c4d852

SHA256
eff3d71f80024afb49c7f575fbc47b1f0cc908970e092ce27aab286fc62b517d

SHA512
4b8eaa8902a69f45d537dfb74b2fd672fb0cba04af9abf298f6a990ee1e2db385882371ad9cf6834bcbc788e2bf9d4c7033c5c0caede60b3688333802054a6cb

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
59KB

MD5
09f47cf5711b056671e4c63034f7d725

SHA1
24432b204b2e0415cd98f0ee84b84a7b98132a1a

SHA256
a60a070517b63d8d2d08fc9fa04627a649462b7da3045561a401af8541f74819

SHA512
e24f1326d8f2d15d9eb9eca5b9fd36b8ad9058a0f70b4c3dfd4043b8242820721c4b9a10d9160bf84f864c2f5d515ffff860be410eccdb4be5e1f5e764ee9f2c

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
57KB

MD5
b790264e032b574a67a8427c68566dc8

SHA1
ffb81b4e8dff3c577f7a9e35b18638018c80f76c

SHA256
bb47437e4e05dde2958947ac0a13d11084cc8845998d3435b82d1de48de5f802

SHA512
c0559dcda285a87b8a9614106c0753fda5073899960c433b137f23628b4794272361d18f68f46755a064f36ef98722475e09264aa45e9f4b8c4c079918d6dc7e

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
58KB

MD5
7dd37bf24e2937d0b49f9abba0f5db2b

SHA1
994e5884e6c13b50bb6ecd04af12224d0f0fe345

SHA256
8e6294357f4b35ad5e0c42b51266dcf841b57187770a1a5502ef551fd62df738

SHA512
67324cb45189ca22eb654fec7b0fcd55286e39f33489378b25fa94ac3ce585f4a4d46d31eaed73910cc5a1296f544238fa86beb1b1fb8c248dc51fe67af82592

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
63KB

MD5
69381d2c51662ee4f2abab1ce817a6ca

SHA1
8eec0769bc3a38a5b5eeb2c1f448b854f9b35612

SHA256
6fd87dd807f58484e2c8600e4504ca83cf816f4270f71d981743799022a074ab

SHA512
e93fc325e263220f5167b3c13bd071c2a0f48427a0421c68d1494751f616739516ed1f08be718b6fe6079ad21b96f498b321733ceb78283539f900963a5b93b3

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
45KB

MD5
ed123828907d8cb2bf2a5fcee9b78c04

SHA1
afa12c74f6ad22f38c10b9cfa4856e5c9a1c1210

SHA256
3f3b33b1472e3f8ad2d2932d24051ef0bae1ded9dd2fd33a86d90a4bdf5b77f1

SHA512
868465a53ea9c0435b320c7f493546ff56eeaed3235dfc52cbe3b3ec976bb782dbc8f3e7002021feb8dfdb308d56b57b7c0f8dbed47ccd4f432e0c6d84add469

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
45KB

MD5
41e6875615e1eeddc5e89cb55f03d4d9

SHA1
bc06fcbc9ed987af4a774972d79fba31e2e3b2c3

SHA256
d12547b28f1a9a9858dd454be76b5cfc926011b21b5f7d34f74f21a06463117f

SHA512
f710a5ff1f8b405d946585b40b1250c79dc58f0df85dcc098d2b78f7b3dd84c87880b742fa62d658283cdc04842810045dbddf93a6b4c502ee46bd1f68729639

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
64KB

MD5
f372941a56d31e4ae9e1c5f6c02ba071

SHA1
ba4cd61911db8f62d45006529871d546d9150337

SHA256
1cec20a0d0adc7c055298d5694e335c68ab92f89c9b23d268bb29ede85cee5c2

SHA512
59593929a9ed7a6272ba325b186755d65c39be1c3ab3fa04210e9b583ef0192cfd612ecd85b4fe95b482162fc5ba08b47e6097d695ebbb85c197fd610b1264aa

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
56KB

MD5
0ec7ce94360548395d0b2d1725fbe2e8

SHA1
4a4d25250624e47de8523ae0d280e5a6619f8b88

SHA256
f95497db63e58043a84a762465162c33c2574e95104510c18c2499b2ec4b187b

SHA512
bbadc660cce507befb399dd291d9bee6974a89d70c3b15f3de7114472115d465790383352289a339335901c93c9ad507278cca8ec86ec77f30e68f0c55065121

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
53KB

MD5
9b4f31d75e73198d090f65eabf830b04

SHA1
3f9d1fc6c482be63089f0ab98c896a6331b356ad

SHA256
99312ec8b4d57b5c013bbd00751055789d62654371cb0258f7291729129c04b4

SHA512
14e4619513ee1348911e43c83e89b20345dcf6ebf776ec905c40ec842613b87b8d4299df9589f9f2bfadb69643ebdfbc7cbbdc440801edf7d659fa692612d295

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
58KB

MD5
25db8ca001917f188c87aece2cc58c59

SHA1
e5b3c7eaf462015b927431c44c0299d8548f795b

SHA256
7a82c8f00a4746e1c36af93cccbddb9c59d494450655d1fb656e482ea9b8c8e9

SHA512
0761642dedc1c4c39b80523ffb66ac1a5e62214435c351f6830a0b0646575bbdd63ea591093c3d6370b8a200c333ff0fdd79ed7387903cfcb07105f92c95255e

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
55KB

MD5
11a6cd5c0c8a138e7cf06d60d6c4ca07

SHA1
ea42999845916163a14e171c0bbf9f127ef4e3db

SHA256
3a6f721b118926f043d93f94a19a711afbcb36eb411419a7ce6e34b1671e8cb2

SHA512
b8b79076529e703baf89e4faf13448de3916d07b83d0718048811d4800891a352965410cf381216c2706feb1c5a2c974194503041348c5528cdce1a92a011118

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
55KB

MD5
a57c3fcfc432c0d146a3b6e2c1f72751

SHA1
0f9cb6f32f8c96018e84986b33ca37a7c4fbaf8f

SHA256
f713122d6cab0794f9aebc51b62600400539769879338df0922471221bd603e5

SHA512
6196d4120679c45b8c6e6e4e06824166fc2d93bf83c7f16b7e5414d5ac39b6762d5d235fc0b71ec0db2e8c782899a694f28fc3e5b0aa5de4f0c906208b740b52

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
61KB

MD5
947cc506c27b61dc12af350bce9db50a

SHA1
194d34d444606913979c1d898787783a977b3131

SHA256
d7ca228606c4c58827378434b0dcf49ecf1144ff14134f13720ee16ab1fe359a

SHA512
96900042e0c7de964a78bdc5f51fc9a55603095c8d4283f6bba08ffbf216b9f6a6c3264111c1b050e4b079bdb7cd6c1c6a78e335bf3db12ee1359900b2a210b6

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
57KB

MD5
92c531fd108479399846f3e26eb04947

SHA1
1969642929cddb9df170be19790dca66896cfa39

SHA256
12982cd538a367d7bd4f722c61a35062376b057be76ac583a685f9cd235b7e72

SHA512
423b8d60bfa59194a9a63b62ea7b8ec8ddb31b4cb09d5099dec54404e6b1881e6191ad139862bf3f493a5ce7c3033eecf03efa22ff3ff07b363de724454d4526

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
58KB

MD5
3cdbd07cf4e42970c2604b24c5e26aa8

SHA1
48a6e95880c43ab4366800f0e2bf062ab1baceda

SHA256
63d7d3e54586a07433dbea9579e1e3d34de9fa1dbe84c876c139ac954d3a996f

SHA512
e2ddd16941086629ef3521b99f450e7e9be1622f7931a6147a3fb220d44863d8dc427c51f405685e515af1f89bec10e6a38acdf8730ebf7028a24244cbbd68e5

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
53KB

MD5
c664c3e127091da2fc875e4a415d1447

SHA1
10e086feb420c12f07cd7012bde2be73a739ee4d

SHA256
b11d5cd796d2dc2bde21d1853af5a8c458897c7e1dfb0c8e311fc922f5b2533f

SHA512
995abb23c7bc519b6a9010269f84fd090b36fc2259a255b5e02f2f4bdf722538d4f6c545c314af05f43bd5777c1d5923524dc8dde63cd113f5e8a4e98fe2fe4c

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
54KB

MD5
fe3dc76d9103d0c68b6e680b7281cf74

SHA1
d81c372af50808d27eccc3e7b12adeb0d255a3d8

SHA256
dcf876ad2c6f2450a2b948ffd0d9dba1b088433a6cab0f2d064c118da421e7b6

SHA512
6b6d1bad2f33d231a0e671127661777141b2d6e939cf81a43af1d80ae495faab9f6acec99c70f2fef1ecb82fe0fd27a6a83eca5262e039ccdd3104301b5af1fa

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
56KB

MD5
562673127c78707fbb8a9472c202182c

SHA1
3dd6462afc9a2e04d280ff893f1c967ca684fe1f

SHA256
ce44c991e69ac5c2b5722168eca88ca451e9c6add8c87ebe3f8e248993109bc7

SHA512
aef96a15148215cebfb14dd17ddeed11c2f53f07d35fa65c3ca16074d2fe3446c0ce6567f6c245660d3716d1f3c4daa814b6a7012b0bbcf3a4eb576844d7b575

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
55KB

MD5
dbd52a8dc6ac00d5fbf11afa951dfb03

SHA1
1144fb0957eaeaa3a90920805f66beedce166fd3

SHA256
e304236398313c64cc160ed4918dfca4f663cad13f04f8c18e8c1975a6a59174

SHA512
24da6a0d089d45d7c5948ae7412b684e88feca606f2d0bb325109ad861b6df90d2b5a3af6e459385c2124ea6d91e38ca91cef08022cbcf00915a476b0a213eea

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
63KB

MD5
b946475fef762a735b1edbddcf68ff07

SHA1
956e0eda0421e5f383323e94b4fe8901e0e747c1

SHA256
54d4ab9ddf50a44d0d823e87231bef56754e9045d01fa620abc19d2c368ef927

SHA512
054ab0854cad969066756ca59b8a6b919388b74c3e6d4298741631c88dcc30834467223266ba51218590c226ed75aed1a3f4fc0fdb9fb8aa57939124e1a6ad03

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
48KB

MD5
71a2039681ba8a783a68da5d8381d5b1

SHA1
73c05c7c0a50727f0cbc5f7d3915e0d7d1103e4e

SHA256
4d3470f3e764167ff369560063b093395eec0a591dfacf9d424ac4dfdd3f52d5

SHA512
af901ba2e931e45a18cbd96c48290b9eb207fd03a3d9e6c69b86ebf7a40d05f461cdec58c860405959105ff3eb1906d1125e40769ce75289ba1703250664e4a5

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
63KB

MD5
9c83986398fe3a812af84ad5c4ecde06

SHA1
ecdccc4aeb72dba7a4eebe19208ebb6c5ca6683d

SHA256
b8b8da86483845fb9c0308c97a21d62252e6d0d86c4acd88666581ad6ef46047

SHA512
ee7d1fadcd8465a446d727bc57882637f5e8c0cde56e70d6ec177aa0dd8b5da220ae50dfb23abf550f878ec448036fb3617879c3f67f0a320eb7f174c7815c03

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
54KB

MD5
318756a7a29b21e7f614627870fe4b5d

SHA1
f54c9f6670d7c1b9c6a49ea0934786620528d3ac

SHA256
5d3bc7b0075b1d6a77bc1c253c967b84f9d15ae35a1baf4cd2ff999f83c11e68

SHA512
a7c01abf0b4353cb2c59f54eca3ce6ffa46163b3776c7303509da6bddf872bee060a51fb83bade8954f93bafeb0035d4620ad089ae226d9abb2d9f298b540192

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
55KB

MD5
bff009237d9ad2f94ce24f25eea70781

SHA1
41282116d20568558313487a771c1c1b5d5b96ba

SHA256
cf6d44a584811edaf6b09146e445e7efbba994e907da62b08c48f2a67a1d67fd

SHA512
e9047ddd7cf0259f7b951e7bb1943573233046c87b87c29d0d3234f0525bfbf5a330d8ecbc3e40e2b08c7a254e0fe61c5eaaa8ec1580d1c2766eddddfd2783d8

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
48KB

MD5
2137eca7d7de2e7e4056fd29ae82cf24

SHA1
fb92e40e2ffd203a64332d05de549e901f95d21a

SHA256
76cd07f053b6bd7863b4e6d4257b8de79b68e26d334ec52ca7cc2fbc3cfdea4d

SHA512
ded3e68b9cef95fdb6896e4ef8216b2eed23294bc53949b767f50090f1c4dbe4d27282899cde34bd04e5fea7500d75b7c9195f8fc8f2e110fb6bcdadeb28a2a7

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
58KB

MD5
f66b9509634215540fd6138841628fd7

SHA1
dd7f88975ceabd71271702221d62e892d65ab679

SHA256
4d6ccd865ab1f5ae646cb38c4a4aa90e5301eed73208c2238e2da05d192db566

SHA512
97b649dabec8fe2bd77f709d087bc8a5303221507c436fb9894d0e500c0130a0cdbd401f2ff0dcd5f5b090f4aac66262ed42575252a18920c7fadf8503f8f764

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
56KB

MD5
4f9904d2d9baeaa47456164c378dce77

SHA1
54edc2e7acf4f953c869e0d576f0f9cb7dfadd12

SHA256
6d182c31a284dd490e7ede46d42a0ed7efd572b38486e1a61853bfcf8cd1c990

SHA512
fe16a1bcdb15da3713aa2beca2fb2c24e7038d67663729dd8a4cb0b704e1671a545ca51c95a116c0bde9383347727fb5e0a6ccdc7e6bb7f9a2fcff9cb27b887b

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
63KB

MD5
f9d2a5fc7039a362960d430d75870406

SHA1
476a1e904293940456cc44723b4395698cc6a109

SHA256
89ecdc688ca67b57167589bb6d5a5cc3a0395d6c9554708ac236947f7ac02090

SHA512
aa93d27ef7644a41513a8d0939a5070028dffd4f2ce58b86f300eba26e57774555476e75d7a76af448cb0c20c11178017544c2be16105b190013596b1d160d9b

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
58KB

MD5
8328c425d313f8e4d45746111a3eddc2

SHA1
8df946aa3555a7c56e79910cbb2da2383ba8bbd1

SHA256
1df68097edaf13d130f9e82ef33d46442f8dc9078d76914536e3a0afb371dfdf

SHA512
4f8768283dc292a426adad719a4ff4323c87f2ca575f61c103abb2d25ff371db5347b865a85ff86399bb80822606383cabc79da526cd2d09aabb3bd62c673c05

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
58KB

MD5
3b76fcdb85d958689d501f741c4fbd43

SHA1
ea99074d237781a36bf059e9924206074c736d46

SHA256
98b3ebc05a1655f2a3d14e8312d30aa1ffdb006d276fbc376e8d7b5770da632a

SHA512
e590d19e6f6ec5062a11ce034b45f3c44c16a05f53ed2e0430cb9ef69f5ee3285bcd2ab562a439ad7619a64b8fd401af5402692b61f8717baa654901b527a580

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
60KB

MD5
275e2f5782abc976393e7087e3f84ac7

SHA1
3313390d3791823c6169b770f451f4705aee56a7

SHA256
62ae12a8da90d9fc0bf8508502036add35044478d69b8e2e98331181f4b4fd64

SHA512
80d4fff3cbd041457d26aac591885dd5d77c8b62c484954fbea4395aa70720e84fe9ac21f789cd68e738c33ea1a3f5ffb56c54bc7431fa193573df46543ad03c

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
53KB

MD5
655650b3f7bf5e58bb37abee3eb93458

SHA1
451bfe1fb6080cd4db79d8d928daee7dc25b3c6f

SHA256
88abb6ac90eaf3e3815d2529da4279512eb201ffa72314d1539b04876efc5518

SHA512
c825cb88cf1010d238f1b4cbf230fbc697a93fc7e1d3dfb4cc79a9301c3b78c7f8f47d31136f0679a8b6caa579c94236a1dad9d0658f3749c9315042a2170a6b

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
56KB

MD5
ad46972331206e5e0945c8e3038a7887

SHA1
888b7d69df30e4224dd828f336dbb8ffde15b13b

SHA256
efc205a99b18780a6402571e6c239c3a7419efaa3e8890ea6b390f81999f2e28

SHA512
d45a3f932cdd46bc03a687e0d39ac136af8a56d2385a5c05c28c26bbc15458b09f30a29bc6a7c9b110e636df3e00399eabf561d58964bbe4b9e9cc34f7085fa4

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
57KB

MD5
e6b74b766c54bb47c3545d06e287c605

SHA1
9be6373646a6a0aa2566071fe6512da55bc1b081

SHA256
684fb193faab02b3fea23feaed941a45b95420a4077a02b21d5725ec2633f2ca

SHA512
ff05224683e19fbbc8d4475e097320aeae887b72ea205f8271f3e6fb5fa79221366e190866d112682520834764902bb324e5dffe2d21df47b6611555a3623341

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
53KB

MD5
21e7e6810ff209e651212334868e8f77

SHA1
0976d9614b212fca2cf55c2bc9ad5902008fa062

SHA256
798842121c0e19cff78f601f962a592487a88933a34d0fb982042ab2fba54863

SHA512
82150937ab75cd8741443d86beb82ef807a0bf0f5456bffbe1265be8299bf2f0eb902621833b0f78adf18e64f042e8296738869e64f3d90f5b49605289320c72

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
45KB

MD5
b1889b211565d3d5350efb8a454ac6a7

SHA1
f5aea8d75458a8288d34d6aeba6e84bf20640621

SHA256
24ba2d4d2605636585de9f5bce34ef1eaf1d5528c09e52b4037ec7bc6fedf5b5

SHA512
aed376bae024d93d42a377d01479f8925f1e78d18b38f743438eeac34eb4e5c3689f35446ef1223609653ceb59f7776e1be6dfa8de2ba8894dc2ad9956f84642

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
56KB

MD5
5899a7c3bb5b9cc4376d7f5c0b4b0944

SHA1
db4276f4fac8c9a40a4bd982ab93ecc28a51d0a2

SHA256
b36c17100712eba2d006bf3fc34311e7dbf4a89f7d51914a3f1256b66ca265cb

SHA512
f3f36838ca1f6dac36d74a999b3868a74f63c8edae36e89c38309341c259e153ec7545a2c1f5a5f325f20ec397afc701d1defacabc2d86727a19dad78e3190e4

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
68KB

MD5
beabf426ff618538eaecbe60c47a5b89

SHA1
f4501fa6602cb89fe675bfc778fcdb70672956ee

SHA256
b33ab162f360fdfceb4bea1f64a8e3ed2473c4df4d1d133a85a238723a352b83

SHA512
704a4b92ccac9bd810b89f59b9f713fbaecd889e974867ab9944916677e7a2e4da11b3acfee265e70302099932f66d0201295367e22d58db4474457570b77133

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
45KB

MD5
b5e187ef2353dcc77e9a26ab55b9566d

SHA1
3b252aa6f566a69f9ead5ea719f433799a9538f0

SHA256
1913ec4a0cc171005a098dfaa7f1bc1f4ccb6b5d0a0d95aaefe9bac2eefbf852

SHA512
0d35874e988ff941008498276491254cfcaa45ecfe9fe31bcfcc79b2c494e8cd07bc7f252133e967ca10bfc2015f9f31db2c05f2dacbd39e9598b4b968b6b438

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
54KB

MD5
929f2caf0a1bf7e765611498620ef900

SHA1
77ee0d4aa5f3a6d029be5973a0c063d0f9bb2a7c

SHA256
905330c07cded9715f4750e0d45d580e7151e88f8d927e1e38c9c4dc3e1f3f9f

SHA512
378260ddc9a9ec948242353c595981ee92c7292605bbccc191c235663d56b4387a0a317b3b9cae1d18243a4203c25c6f1390e0c7a1897f6660be1628eac1f6a9

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
58KB

MD5
df008e263d764ef2187b327c310f4b02

SHA1
bd523eebe4ee0489f2a7ba270b3ad37b99efb397

SHA256
441e97e444b9934726a6c41b60bfb8b97e38342653d4f13613bb6804b908f6a6

SHA512
fb1b6904f25eb107886bd3c2bf55bba815b6393c73f34709304e2ab82f63bd9338f07e9805dd148af5ac7835266a6beecb0815d813dad103a194432ef57999a3

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
54KB

MD5
5d33815ba5ba25c55bcc6db4ce454177

SHA1
7de3c01f4dd1d402afb934fdef45339244db03b7

SHA256
c8a7b4db59fa386f20cf45a631f4b497b45ebea12439ce950c3b1738d694dd7d

SHA512
973f4f9e4149efa699770102fb235ce74c976f32b77530067093fd43fddef6fdbe2d97243d521925e1e7fa4a4dbbdc3be16888c2b0582b923d3cb50541dfe68e

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
55KB

MD5
34ae33116be19ba75c20aa2bf7f8b77a

SHA1
7959fd5465afedd4051e606127ecd1a87d9aa7e8

SHA256
0df1c272623bc1a956462552bc12592f4e6cc2f82654ab42399ce8113d407a5b

SHA512
fa2524dacbff43fea4da217953e110165ab269bae8944cdb1cfafc6a8d71ee1e97585e461ee8e5db43012673c698f213bd3de2a946b9cd23cc027186de0100be

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp

Filesize
66KB

MD5
54e9d421de38d8a38287299fc837c147

SHA1
bd715b08faad97c7bee6dd7043acec29bec74847

SHA256
0c92ea54ebe719bd607193ff58de839d3a90a2f7a2ffb85e356a63d5520c6a90

SHA512
9e3114fe2150cbe76d4b45962bc5badd474c1ec526d162564119e77acb5d8e6b6179ae3d4c636139546e261b75edd746ec6f7d9bed4fa283006b04fbbe73012a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Memory Diagnostics Tool.lnk.exe

Filesize
48KB

MD5
55f549489fc8d4b2cb0bbdca725c3a00

SHA1
e7a856dc1d34a6274d54b101272d2a25cb596c90

SHA256
c6e6838193caccd64678d053995e26b392026ea885d0780d4063f6fcd7c409e5

SHA512
6b81fe00faee31b37f491ef827a204a21d744fb8c5a18a00e8cc41d5eeb0b14b5ff27233f8f3bdb6f07807db136446525128113c8187837b07e96894a9446881

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
45KB

MD5
4084cf24aa3ce26c9ae5496e0a50c333

SHA1
2c0719e168363c18ab0b541794c9093e71219813

SHA256
3aa97a2d7c417a5e872cfc4e3290912b62ab6a423a5b48e2869bd9342f290ae8

SHA512
b3515f4ed57678c25f4c140e1e867f2003c3c06bcf363c03e1197be47c51625adbbaa9f8420e3f883ffc2cb84572482a16b2bbede52436b5ded3448e198b7812

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads