093783b50f5208cc7f534f18217316007218a4a20a7420a4ad5753169ea56c25

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

093783b50f5208cc7f534f18217316007218a4a20a7420a4ad5753169ea56c25.exe
Size

106KB
MD5

3b3efcbc415d1082ac5982a2d6b51870
SHA1

cf892915819a92ea212dafaab54a1a4f1881d7a0
SHA256

093783b50f5208cc7f534f18217316007218a4a20a7420a4ad5753169ea56c25
SHA512

20a523bf8748b78f3a9bfbaa0c990201929cde8558cab1a5dda30d0240e7e188d80816540e0be0c080906e77e6a391e88d99b9126d9ae94efe24257ef02dcf92
SSDEEP

1536:/7ZQpAp9XxXEhpUaiN+UaiND7ZQpAp9XxXEhpUaiN+UaiN3:9QWp9XxXeUabUa6QWp9XxXeUabUa4

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5235) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3444	Zombie.exe
4824	_RegisterInboxTemplates.ps1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	093783b50f5208cc7f534f18217316007218a4a20a7420a4ad5753169ea56c25.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	093783b50f5208cc7f534f18217316007218a4a20a7420a4ad5753169ea56c25.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Primitives.resources.dll.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationCore.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICI.TTF.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fr.pak.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.EXCEL.16.1033.hxn.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.Common.dll.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ta.pak.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PowerPointInterProviderRanker.bin.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 3444	4416	093783b50f5208cc7f534f18217316007218a4a20a7420a4ad5753169ea56c25.exe	83
PID 4416 wrote to memory of 3444	4416	093783b50f5208cc7f534f18217316007218a4a20a7420a4ad5753169ea56c25.exe	83
PID 4416 wrote to memory of 3444	4416	093783b50f5208cc7f534f18217316007218a4a20a7420a4ad5753169ea56c25.exe	83
PID 4416 wrote to memory of 4824	4416	093783b50f5208cc7f534f18217316007218a4a20a7420a4ad5753169ea56c25.exe	82
PID 4416 wrote to memory of 4824	4416	093783b50f5208cc7f534f18217316007218a4a20a7420a4ad5753169ea56c25.exe	82
PID 4416 wrote to memory of 4824	4416	093783b50f5208cc7f534f18217316007218a4a20a7420a4ad5753169ea56c25.exe	82

C:\Users\Admin\AppData\Local\Temp\093783b50f5208cc7f534f18217316007218a4a20a7420a4ad5753169ea56c25.exe
"C:\Users\Admin\AppData\Local\Temp\093783b50f5208cc7f534f18217316007218a4a20a7420a4ad5753169ea56c25.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Users\Admin\AppData\Local\Temp\_RegisterInboxTemplates.ps1.exe
  "_RegisterInboxTemplates.ps1.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4824
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1403246978-718555486-3105247137-1000\desktop.ini.tmp

Filesize
52KB

MD5
c4abf5c1f22eb3eff39ce8e8f5309f0a

SHA1
285a7298195011036095eedeba155a4020656f2a

SHA256
79cc82ab0ca9e5e1a9681611a55863b6a51d0d94c129506ccb3a4f1d3288e464

SHA512
3638a653fa9b5d5981da66e364507a67963ae5be3aed8f586a676179a1f3644a08eae68265982e87a01136b497237b8038d86bd39902e9dd619cd0bf86368fd1

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
165KB

MD5
2a265708df367f142cee7cb4c0268c51

SHA1
5ce98ab0d7e4b2e669986f68345eb1f28514088f

SHA256
8c816e9f078b1bcf2405e3b077c89bc34950a3e44918afe6f24f9d439a538dc9

SHA512
a9f35fac745fa283ff5a9c5b4d50405bbdb1cf782a73cb7d4a3d19a74b696e19e89cfb08af506124e90f035219935f384ea6422f8476025bc8b433256e6b0c05

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
152KB

MD5
6fed9915c6e21cefa50bda01327913eb

SHA1
293c8d28cf6cd7da7dc44ce386129a0c4e9a7837

SHA256
bc10b36d5051825fde397c0967bec2fbd31020b51fe1399a764ea64e31b48c20

SHA512
5c934e8263b0f2029e2eb60436589374c94e8f3dd4bb9d3315b04f39e66534dd7bcaf6d2f69753c87556d6fec13d8d929252f1db601482173f060ec1aa1dc82c

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
118KB

MD5
51b428144899f35f37722505c357f891

SHA1
39ffb604580407a7ae8975996c1110ad487147f1

SHA256
c029ee3e2ca8671b07ea54602bda44663755b6975e51122a1e742d0a69638c11

SHA512
4ce04f762d37305e5a2cee9005d68adfd1721f5d1e6067738d083aefa64ebec0c3633f30b36fa81069a3582ec0b490dbf5a31fd0376c3c0624c4177bd32a5a80

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
597KB

MD5
509e48b4a9d3d85002b94e8f56bccca5

SHA1
b730e1a6accaa1f42bd912806d910e69faa4b1da

SHA256
f7366ae262c033f83bc8266ea6f18158cc523ea70dc404b4df1c2162e1f9f548

SHA512
c60beb179f6084a704fbcf7ce2cf09cec1809e29c0a7001a7eff0e88d6a19dbfb07c6c05b789e1877d4dfdadfc2752a6b6bda4541ef63391ac4364225838c174

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
984KB

MD5
be09b9f8d90af84c8dbe6435538b8810

SHA1
756dbe0ed7439cb9a7eedbc0bd14c54e7f46522e

SHA256
373a00f72fe7b6b366c13a765afcf5cb5193564f93ad70aaab6a435be4cc023f

SHA512
3d6df1cb4baee6e4f8ca15e5213890f91398b840ded4e756a196eae201b87cbd5df4ed975edb650a67442f65c7989f8d44bce937c260bf59fa92d3d1c2a96812

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
737KB

MD5
62d6934cb16a06df76af782188ecf33c

SHA1
20ddcc007b54fb2bfc99ecccf822997f34936ae3

SHA256
37bc06fc0fcc56f69f789308c9cdcadff6267a75209773fd7d02179b39ba7c5c

SHA512
f85a7786edd4cc7f81fea76714e557ea006b8993dada646d339f2c1f9d30117067169422093afc6e1653bd144228786abd0c7aaf9ef87443beacdbc011ef1b8f

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
63KB

MD5
80bfe22ae86a43564a71971546361d74

SHA1
76f445111ba9222c6a3238c92883ef543cb37de5

SHA256
f60e75ac958e1e884dd70c08ed081ff7e0f12e87f58d72db6d34164abf9deded

SHA512
9ae45e18b09218c9238f430bd11aaa6a774a18c02b14bb8839f997384f3f3b42c9ef49c2ab9084699b290f16b590abcdde29f86b1abc73921a76c44ec19a3ee1

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
66KB

MD5
f39a71d6f2b596b8159288e455c7e12d

SHA1
739227f5d6ca6eac2152f4b960462f128e0473e5

SHA256
aba85dfde34129f546128378d694ff42179103421eaaa9bc3e82ed141f64264c

SHA512
f70fad1a8e523d7834e9c810a44f0e66781e54c1a2111a99116f7410a41b3c2a485d3c49a01f1d524fd9d89040561449d0e71fb31f7b755b9ba31a438890179c

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
68KB

MD5
282242415c07f8c4fc13842d7072e319

SHA1
01af9d19c4badad79eebd3ad685bbf0eb2da9a81

SHA256
49192cfd8d9ffc8bce8bafa406c13af0fd558d97aef1c7de15abd15da81f46ea

SHA512
3782d25a50601e944736562181d63b71268ff415ea85cf91f0f0d01b41d8948a430cf630b0ce84c83654d504e213dcdcc07c58e2e603f38046b94d0c2cfe6a81

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
57KB

MD5
ac6fc2266ff9d867e47be62fba4c83ac

SHA1
03fb3afc08d913e02a221cc744e8eec9a7a7bb2d

SHA256
4a86e0c06543764a950969925cb558433c2401a93222c309a4a5d0b6c555e3a0

SHA512
9692ecd1dcf3c9a19dbfdd5e44b77dd6b34984f8ecdf44c8cbd0ed22b4e86ce2f66b0f460c36615afa40fb099597d6a1ae4457b4b131b5129f2f0f0c410bb8ee

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
63KB

MD5
b9a426cdd9fb5cc94e69e8269b4a9710

SHA1
0a1542c5a878926dc6c3d3a4470b8f4229043af3

SHA256
df5256525143ddbf2d5fdc1286c606a20deead13f8ee817beb304f873c6a84db

SHA512
ba60f17267e56e83581f0610955513c17459a97604bd487147d5ec8a7c47a03040b12d531b2f411a8698061d28ccedffae1c1ab262f0c1d30031d8ec5e54c803

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
64KB

MD5
9f8f61eba9891a2219bc5118e496a352

SHA1
c90bb9d500cba07a3f3967941e7807ef195d1a2c

SHA256
d1970e94b63e18a2a9aaec4264746e5f8cb1fe711e6f3081ffe9aa4db97b92c5

SHA512
da8ca35ccb992b5f8ee1084ba445cc1fadd23524b5bb3315185c04f3241ff50551a261d4122388584a80c846da5a7a5fd2c4e91dc188d1d36e836b9e84097726

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
62KB

MD5
b4649c2fa93e2a00d5a9bc907769c437

SHA1
c4fdf2170d80ee0279ff6756772b76e37e7e598e

SHA256
1a2f427ee5a79c48fc1ebd3f957cbdca921bb3de3b434d7e53d104e728a21bbc

SHA512
9b835dad0808757da00d02230362359eeb2c54d468283a57dc5d637c31ff862ae5b8d1f2defdb0aa9c49bf727f99814e2298027e551567b1d1b82d3d0681d8f7

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
59KB

MD5
40582692b3fda7a9e9919b45d71331cd

SHA1
901007fc53c7b4ea1a0471345d641660bb9e90aa

SHA256
d96b09a0f16f4624e16cb98744014719d4911e18a6c62590d1ca5cb55f053e99

SHA512
f91ed5418af91b9d54a8b917e9e62106a015a47b29e5dd30253f41b79e599c9567f7ebea9018e455eec542ee2c81676a1005f76b06bdb424c5ce47485033a328

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
62KB

MD5
cdf39b779cd6be884fd5e57218c480ef

SHA1
4d04476c505e8ac5e590fa1c11820226055e1a0f

SHA256
3430b3e4a5ad271df1d44fbd9489cfd04c6c449234c7c1e06173d4e245d267e7

SHA512
a435f4817b8b2204ddf69bfc9576a79605fee138a360ce19b78c8d0aa5abec384b74b2751e91e86393f1c4e98a21fa090d6f499f4aca8437cf9b941061b7d869

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
63KB

MD5
47b535dbf2db64e41897f839aa2b7e34

SHA1
15c7c3e739c2c0086428ea142b818a92bd9eba60

SHA256
9ca6c2ec74e1439cb54acc7ebd978caee8f21ee6bfdd4174dd60d0c7c9027ae6

SHA512
5bfa46c0aa7a1630ee9f8dffb0461acea539ab541d3f8012167913027ab14ed2e262a3a7679560d6e49b83782f7d5d961ddc86db9500bb3fdf4fd0d29c859bfc

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
70KB

MD5
c61ea0d12335ff10dde0a80497362589

SHA1
e42445d0713844b8e2af50280c190c73ac349f22

SHA256
fae0c4b949fd6e0714e17692c2f51aafaefe7f677c4674e4949bcf53cf67f964

SHA512
63c78b65d11002ac148b2980d7e25a82d9c68e1f606af4fd2bd09168eb5fa56bb59419c0d2ab176661a3b5193651a39fc7724f2474acc12e8e7bbe3da3e2cdf6

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
61KB

MD5
6f7b9041da468f3adc6b02560613acfb

SHA1
14e44f55685e9641bce806925afbe81e3d471749

SHA256
be6949cec6a53d02c716583b4736d291d3786e44b9a426a277079e06244980c7

SHA512
0cd6396e354dd4dd9f9e062f340a1f2206127478513682388dce8eeab3c270c0403e742c9c16b2c436335b478e7093772c465c455af421b34e577e33fed03d05

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
59KB

MD5
7646f181aa8e1104fe9e367e2c77cc27

SHA1
2f14c2dda8f9aa02fc7df4d299fc7ced64bfcf42

SHA256
0b9cd039e789719a6b7c228a87ec733a93a0969c18cf80bd7a6950df6c7f4820

SHA512
58220b53b04a7a14395ba370d274d87be648be9aac5bc617e74f151d5c57f86a3a81412da588d9533a569d35c28b9aae64f5e2e6a6cc8cb4d6ab53d26a148ac1

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
63KB

MD5
41c847bcdb03c68f2fc04e133fde3b97

SHA1
0f901a9e4e1b16163a2f941ab10d57ff550b5958

SHA256
126fa91736e7d70f53bc8fb08f99f34879f14a4ffe64f350c985de8f098079e6

SHA512
ad684acc07a641047397e4997fbccf2b7c551c7e5bb1268f6227b890addc4422879dfd0e425ef13c177f3bec3ba65c2094651ce293a1700dafc6c72b95a2c21d

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
60KB

MD5
774962c226cd784dfd8d3527cd66a5c8

SHA1
280d85b36e814861ee4f0e2177fa3a04ca40ac21

SHA256
385b345789a3fefd8f58a4e45288c2299adfeb0bc53e1f2cf8ff6f6f95532118

SHA512
8eeceb5b3648d8f73f7e90203eb6865485c1f4252845ecb75cbfe646139ae897285bc09db5edab0b4e54264d7f468881128cff8713bc477175b2b7332dbaf879

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
62KB

MD5
25b48d3fd9d2459c9e64c55c5f16cdf9

SHA1
43cbb1bc3394aa59c9ed9a6b4650b1402da5a865

SHA256
c5f920f5a0081769a9c9d03e1302013a3e35e3d114980f205f0649e33e10089d

SHA512
01f52df29599d47d4da61efe55aba19f020e961a344e44fbe611d1e6c585f74a9407197bb77160d5c06183590a58891cb0278844804d8fbe824dd7d2f676d986

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
60KB

MD5
aa8d24603b42c6d7d194d015fc336958

SHA1
4946f1272af7c442bc43a38af66555b65476d131

SHA256
2f872f6228695860a5d5a951f2ade638abd75b58e19733fa823a11dc82f0adfb

SHA512
bbb05e998e23ce1ab64576a78c01bb1025d8123f6c7afba9367f94970ef3708f3d5e641871b36d1706323c64ec684c29f5e95f2791602e638c5390034881c93c

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
66KB

MD5
9ce49f532aff0dbc1dc670efcc6024e7

SHA1
c6100ad7570021fd460e8f3c77ba9c479c165850

SHA256
b3be4a8958a4d609c0aee3c0d91354d3f2c52eb7fa1e35b5cc8c36cb6bcfed08

SHA512
b9a62f36b8c380c92be5dde983cef638bbabfab7249a7d186b9729b08184b2214db90b27eb67f61abea18566fbb9ffa6cb5bb7a02d996fdee2da2655b9e0d454

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
62KB

MD5
936c5a66fa0cc05da81b70baad3afa50

SHA1
cee46597840c3725f4a491f7cd197738777da638

SHA256
b0a10a77b60d713a1a9604e041202e60517a8eb92d680e553af66ecebbf18078

SHA512
5d001099f960bc61eb0e99adf7ad7db05dd184c91e86185b040d3450c0f59aedd4dbd6b0e5eb69631f2ef4a5d6bca891818ba9c5aa7af32bbb2afe207fd0bdd7

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
62KB

MD5
38224534b09f0ec6cf7ad76001c5317e

SHA1
ecb4dcc0f0fe1d8626ff40216178ca31fd04faa9

SHA256
1cf69f100a74b5ccbf3f1bef3c9e8a34c7693a54052f3af5f61a524a9015a903

SHA512
a34458009687a9a6f06e5272e299712985714b8fea7b944086c361cc72ec2888daa52c4611d60de2cdc79c43e4782789af844742b854945dcde88b50de10842d

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
60KB

MD5
d3457c11b5a24db7a9bfd616a3cb38f1

SHA1
287b48fc7c99e9806706d2b6d8021043810fb7b4

SHA256
0f8daa34690e8e1fe62644e0b1ee34939fd86e0dc6943d31e49638b222974120

SHA512
09c9f013d1b3b5b6352f66749fb2dbfdfad2586f7f96b48827666e80ef77a3b66acaa000964797ca8fbe6f1d99e6c364955aa7623ca5869b2e36bf01d309115d

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
62KB

MD5
2f7ea1b119f40a6baa0659d96a500723

SHA1
ab134dfba33020de0aa182f6fb1913e50a69364e

SHA256
3c7470821869966068b5b876554e26bf836e40c13b5f0a79e29230402af797d7

SHA512
08df266a7aa5b8d0893e779da7b9999d01ace0682aed180c997d092edcf62da6cca2381f008821f277ddd21db5a34da47dd9758c2304602bf5b1e5486c366d4f

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
63KB

MD5
d6be7c8049d09fc6c8246146944fd321

SHA1
f762a438d43bb56c1034e038347cf2189867d394

SHA256
4a019102d909926ac5663497d884a30968ffd68f089252f074426f732524812f

SHA512
ab37a7f7edb1e2e77bb6aa4d68365697ef873ec6cb80ecb57a9fb9b4fe5fd409fe6d4e3a57fc7ae276d043e8a90b376697c12365873c04dc8643653629b5827e

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
70KB

MD5
c8e67988eab23616ed1c6c33fcf09fe9

SHA1
744e2eff7a7cf6148bfb0fa976edce54fef24ca5

SHA256
b567b50dd8c9f369e95e846d5ee7041d0822bfc1ec3247a13a6d3894a7ecd6ae

SHA512
3076aa665faa80c11aa48a1ef47b4022f8ac706f2eeab8daafa4ebbb09628210e44c5cee31baecf18059e8074422b56a40ae4f05ecb9745ab55b468c520b8129

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
63KB

MD5
4c7ff6cda62647496615f6b1133360ea

SHA1
029416f543fe8582a53e7c70e0fc2ffc2cf4df28

SHA256
2061faa172a33dca196295602521e4870853d1bb97a905f655e61ffe0512253c

SHA512
0d6bd96447fd224564543118c7aa4f0197a6eb556b3ff68e182ae5fffd1720e7e66489267f21cfd9097bebceb7bd680b2a433ff07cadf39601ad3d1d71a2a0c0

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
66KB

MD5
4ceac5b9c338b3a57b8f8b0f8da338f2

SHA1
55f8fbb9114ad066d30c352a7bcac6b55dda04dc

SHA256
2a1c9278bdcf3f718e450e0ff4387acfde2057c8121e1ee9f67cf8947a56b711

SHA512
aa2cbeed3bb7ae3c9294300adabd8002d57d433c6b6e152f9651b0270861cf6bc96207058dc90f097a1fcea6bfcff78eb8f7c73468971e91a81e55fe0084cff4

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
61KB

MD5
d1da29d3f6ae2d630b93bf8917028ae1

SHA1
eefebe202b33066245b213f2ca14c21c1272d756

SHA256
e7436f966001aff98e97d6dc67e8bac3476ef5e6bbdccc0b579db0aea7c0b6c3

SHA512
767526698724d12a0891d5f4012930ec38e916c61896dd010e5272965b93949a47b1f3f1ee4d85415095091ee9bc0e659f5f6b30ca5aef58dc79f6e1617d6034

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
62KB

MD5
10e9b053a0c0275bd3be1545940b35f2

SHA1
903d02adc8ff8f510b94b69f116579752f5f4fec

SHA256
5b12a655632f99bd5c797ac207d020f8f256f81cd6cc0473ab52fc8485a952b6

SHA512
45dd3f5629de53cbd9a6407ebbe6d3c9d64224fa3601117451894564020191b266e318d9dcb758403c07b80b3f9603e19e435c1d4ec535e6042c70bf74029830

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
62KB

MD5
8d184737b6c3af8c4281d01338aec799

SHA1
2e20d6309d71cc0c5d325658b64e6b2e71efd1c2

SHA256
0a20fadc475de593f9e5323cf45f8df7a05963ac7bceab4a85bc2b4bbb1f08a1

SHA512
ff7341770bf8f16439ed265710a1dbe768369df041d6112c65137c7cb6d57568383651423b07ae5688178b56221627371cfe28782446e61b23312066d6362ecb

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
63KB

MD5
77c15bf24e82a30dd3a1da228f932fa4

SHA1
5a5d137a2991288bf8ce8888231adc639499935d

SHA256
0fa6d9eb10dbb886d93e92133f269a7c94503ec9f0db00c15d2781304682e410

SHA512
d28de577ea5a0d32aaf80e987daf6f8bd5e9f85afa7a09b93312110351345d2a93d078a83cf814e3c0525c2dcb0a7f52faee8286da0d793518c83634ac891920

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
24KB

MD5
3d75cedde2f04d6aa63f50c8c962fd09

SHA1
34b99f651a0f870b7991e506f6d8a52c62e3cfa2

SHA256
ae21a0abe55f54190cf44e33df207b0416d948292445f6148c6eddc4125ed594

SHA512
8297dad41447f80dbe2f8738758fba74b036e5abb46d75f8de20f87cdc879cee3d99ae006715010b9cf274a8b25ec41c8e624c88a6a26fc34fa1c433f82d4cf9

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
62KB

MD5
392188c2c9baf8c01e469ba4fe528db5

SHA1
5bb0a21b5fc154f01b87662e413de31324aa0508

SHA256
14facb4ad81f1a8d676560e1895c0149320b65422815b15897681c621711abe4

SHA512
03dbfa7956ca2a2fb9bb7b5291faa923353311037a8a9b9cf3cc60be9280377b847684ee327ff645f437eabc934e41cb29968bd52ac0996129c04b58b4bdf241

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
63KB

MD5
0512173c7a270a49fd6b5c8a756956d9

SHA1
1be3a03c1e31fd21dd062781d7d32c8e5b4f6205

SHA256
d712e0c3631f950e2d0c32cb1f565f5f90f1364bdbe3b4ed44f8ffd62789fc1b

SHA512
f50904f5390e4783b716bde066823f09424addccda52047b5f520b439109b585d6cd3da0ad74dd201f7dc4055be52a3a63559abba8c635410de55f0cf7099808

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
64KB

MD5
9c88c746f3078c366b8c5280c5759483

SHA1
641dbb0dac679d0feaa05f2473939d044587353e

SHA256
ddb9d0c1765f14011b769ed33680d929525c4cfcb7d3b4914fdf26deae1153cd

SHA512
d55fff1e378fb90bf6e7b1490391c6949aff7085d0446b2ce387ca913b6fd0b3842c792e0e8bb96130ff93e67eb5b91d9013366ac8b1863ab32c16f1329f163c

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
66KB

MD5
6fa2d939b0819df967713bfc66197fdf

SHA1
98281570ef3aed08468653813c9d87df67e0982c

SHA256
44afd78578a3c23dfb0ec73f3b871e2814eca34c03d47028f3c44fd445962520

SHA512
edacf1c35b1882adf7f6d5d33fa5cc104980fc96b78259ae8cc3ee628208e65c2d66d0ed2054c92644e3808c0f7c4d26896ba53bfb37f4bdae35bc5a8eab1723

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
58KB

MD5
b678c33d0c4ca35b8c5295476771afc7

SHA1
67fecf12fd7071b88cef52299cd7868aa89cd5e8

SHA256
e2a94a920fb6347bff666acf508a5470d95ca50e0c5ffbbb852e1d18aff7bec6

SHA512
a02ff38be0cc7597ab34fc423d15aad56ba3f0c46c5820cf5262017136f71dbd0cacfcb4def8f057a7c6cfbda53c8ba1311a314b155eed5228cce19f121db03c

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
64KB

MD5
9ce3dafdbdee8b022113b79e74ae835e

SHA1
e011af56b108761cfdc206ff7a0f3bacd3a91ec5

SHA256
9178b741a18793a2c76d3a0c305a62293df7d911f535d7b3b87ea98dfe29e57c

SHA512
f6a6e8cdc5c0a9369ff4bfb3f06c48d274d5543c20f2e52e616ddf6436e1f98710ffd1adf27366b3794e3ff9ba77a29430523c94eb58637fb637f2b6943084ff

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
60KB

MD5
ed0d247ce5215672312a3f774749d37a

SHA1
66a8cf2df26b2dfc7c814890a1d913927ba98dc3

SHA256
986a4ae4a0d4a3376691191a10b6d1c8b84b311c791f8ca80018221fa2edb7a6

SHA512
786169317c5a446a35490cad8f7277c02db53a2002e771be714efc6643c6df66e6cb43c453a3e5f405b93c969d7cada06346563b1cb4c9c4f160ba1021f72f13

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
60KB

MD5
813d26d9cc2e27eaf3cc65041230eeb4

SHA1
a77a0d0dadd15d2119c1b77c96dbddecddf6285c

SHA256
84050a5cb5ad6aa03066f5f3e5d0ffd6362c9ee0593339e2d7616f2ced8fb539

SHA512
6f529c9065dc37c4534aa7c072a8a085ae7dda8aecceb95edc26e16e325f05798ecfb2fe30b7ad169e13f3dc0366911d95d7028c69e6912a8b4a62665be495f5

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
57KB

MD5
8254a5c95611fa73bab022942008d8d9

SHA1
b4fd01e25b4918821fdaad4a0474c1c31c9f227f

SHA256
81ef308843140d246e4770821f4695aa62c96dd2415d61b728801f3d3713af3f

SHA512
460b32b63afde8f8d7726876ca2aa52a77492aecce7547097190f6857da77b68330dd7a48ea25b1ffa746a37e72def7aedc022c4fbb9733c5df4707f043a169c

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
62KB

MD5
1125236050dc0a2afb6d26220d7f1ef8

SHA1
52d53ba72f3206c6bb1ad9869853dc2c3c7f7899

SHA256
6c6baaf7ee46dd4a3e21fce91939f15c882ca956401dc69331be0db8b88b84c4

SHA512
520cb69775bc2f262dc6bd4839aadadf2399fe9fc300a3b6bb66768b36b7e185ce7d2d6ab49711b4adf0378b1f67ee053d5a012da69615190976ee1ee90d41b1

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
72KB

MD5
b84d5ea842214a4cfd0ba41a665a60e4

SHA1
930eb4cef776879ada87cca7aae94f8ff0093927

SHA256
9c555530de00ec27fd393b371b16cef0d4df442c9c9944c725e54b5dfe29544d

SHA512
0a779396a0c8863140b9322da9d8d038c0b69460d5b437d34468bd4491c226ea43097119c33f6c7f706edcef926be9c07c6ff529d054673cbbcd9b2d2ee87f5b

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
63KB

MD5
28f2c4f3663d4a61320c7c79685c4919

SHA1
3f1b4f44b85da2e4a7204181939823de49f8c002

SHA256
2497a75c5234494c06830ec25ba4d96ad7d96a4f9024201ff217e44b53a7389f

SHA512
8c9ec593d5ced380dd2899e12c971b7b8df077df5376758b889fdcecad21a91aef55836a6199227797523a8e74324c52874547956e536e35a2d4b702c40a0109

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
58KB

MD5
8088aa0a9795e6e179e62f63d95a4577

SHA1
6bfac8a78e5fd1ce2963bd806c28b856e28171ed

SHA256
ea005692b0b512ae29ab2305c56fad8da617cffd1edffa1353811dd1853d77ae

SHA512
3a43e8b24ab4435d8b77102f8735138338b84705c232d7ebe6439c6a33c62ccaa766395a4eb9c5720655892bd8d2797dfc2eccdebd65de37b777eca9c716594b

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
67KB

MD5
e578c5a0352b01d27d198c49f0f123f9

SHA1
2e6625aafe63b92220a4de1082140f29d45bf1f8

SHA256
608dba93b8d396a425ebd72021b82f59e22834ac4bc3de74063b3d7f91a92cba

SHA512
6d4407213ead60a4d7691a244cda9e8098401b1c1e08954a89b0fb7b21bc47e9700a0ae4b2987e1ff2c6f0827c2423300a0a599a5ebeb01deda93a1f492f9b1d

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
62KB

MD5
c4a146721379fd82df22ff5e03fd68f3

SHA1
0836a93957ec40dc888624dfab2fb0bfcf9949a1

SHA256
e4af7d418bcbf256a40557cc39f19c5a4ded62b0088eeeef220035155c97b5cb

SHA512
ef5267d38057d705a4f60e97c15a56bd47a5171d8e10e063edf6607b9dea88385f69680cba592a1b57634d2f0e859aab0042713ebef0d10c8cad2f0fdcd967fe

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
68KB

MD5
82f685ad6fe7da3298bdb6fdfd77c288

SHA1
65095adb6591f76ae38000c33f38f5e385ae0c4f

SHA256
cb3e8e95bbd58f8df18b0601e9b1579a052c4b16ae891d178d877219fcfea03d

SHA512
6f188c476f065329e35bcc7ba445f65704e565f8bb06006b68ab7689f1d106aa8680bb1c5ec9f14e1a673ce56eec70bb1cc246af180b2731af98f020414864c5

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
62KB

MD5
719e5bf7fcba2d1e9889b10b0a9834e5

SHA1
574f858452e06788d69d579af9cb0113d15285f4

SHA256
cf7cb50afb4234516387af69db5995f50b563dfd0fa9019f265c047b18cf5f7b

SHA512
61c6da63b233e58827f8174934781bfe97eea43b275c231d3d3191e6b3a548ab03bd3e98651e70ff886981701695aee896a983e96b08d1974c352c8f02d130ad

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
60KB

MD5
0db210e28f6bec1470a89b189d230272

SHA1
43f5f38ef04785ec5adc47ff27f04e6d6416c771

SHA256
4bb9debe4d974e52a3ca375f969891fb61b8e873307af38920c9ad0bd443c5d0

SHA512
960877b71e9000d0c175cca5bb91984ab1e95a6783235e70f962dbb30928bee9b727e394aa98a98a4868d119a68bed7e5f6f993df5f73ce7ecb450c4e7aa7991

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp

Filesize
67KB

MD5
86664ace7b816e6fc48c6e643027dbbb

SHA1
11e8cf8749335e054769073a606e9ab102461590

SHA256
e52bfa195bf06e6b906144c07b4a1e9a5be4f4ccf63eb45c04115486bbdff884

SHA512
f44a8d1db09fd1fbd38181b927bcf3a6ad6ded2a7b834d25dbcef8b3b85f377cd5a2d6fe19953957eadb89979c62d55902e38fa6d5fd2fa6c840f0a02d302f9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_RegisterInboxTemplates.ps1.exe

Filesize
53KB

MD5
1c1edb169cfe335bb88201a534bea35a

SHA1
1a7ca6f38a1cea47ed9973e40c2e68eb2d094eed

SHA256
ae56f3357a80318c157c722c4c6da7f7bdfb593b6d925166965c53de7ee943eb

SHA512
32062bb1d2dac9ed68960fb49ee276ac89b2f71c2f9a81baa63d3694af0f05293bce6613a94f4ff6ccc49212e14f06f634a96d50290bb532e2dc01e62fa9d3c6

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
52KB

MD5
1f9684bd39a64c48a849bc70725e3459

SHA1
8bad3d608f74944b0581df456ec90a29a4492683

SHA256
d25c999036f03db4fea6abfa58d77f04ad57828aad888d01212b38b987680808

SHA512
13cc199d93cf4cbe0f5cd2b16c37d48e044a0d2dbfc98d2652f9a74eb656aa71abb8fcbee76260bb5ac29a72c2bfa06791d600be0d8676c788501c91507a10af

Download Submit
memory/3444-12-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4416-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads