ccb4a1baad3d93683a9b25296fb5bd1251a3d6330196e83dbeecd2b7970392a6

Analysis

max time kernel
149s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ccb4a1baad3d93683a9b25296fb5bd1251a3d6330196e83dbeecd2b7970392a6.exe
Size

176KB
MD5

3a2f75b8763c1a79bd242d2d5a70d84b
SHA1

910c1261ea84662eab76387dd2747300aec757aa
SHA256

ccb4a1baad3d93683a9b25296fb5bd1251a3d6330196e83dbeecd2b7970392a6
SHA512

c17f93933c40d433be813529cbcfaaa15687b881aa1a82418fcd2a4cbdb222378c4c5d9c91db824ba438d37ae6c608dfb2156b1cf766e51d70a97c73d285403d
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBF:PqFF2Ie+eF8qFF2Ie+eFf

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4676) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
856	_Get-VisualStudioInstallerHealth.ps1.exe
4128	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	ccb4a1baad3d93683a9b25296fb5bd1251a3d6330196e83dbeecd2b7970392a6.exe
File created	C:\Windows\SysWOW64\Zombie.exe	ccb4a1baad3d93683a9b25296fb5bd1251a3d6330196e83dbeecd2b7970392a6.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.exe.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\he.pak.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\gu.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\TURABIAN.XSL.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fa.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.winforms.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ta.pak.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	_Get-VisualStudioInstallerHealth.ps1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp	_Get-VisualStudioInstallerHealth.ps1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 856	1116	ccb4a1baad3d93683a9b25296fb5bd1251a3d6330196e83dbeecd2b7970392a6.exe	81
PID 1116 wrote to memory of 856	1116	ccb4a1baad3d93683a9b25296fb5bd1251a3d6330196e83dbeecd2b7970392a6.exe	81
PID 1116 wrote to memory of 856	1116	ccb4a1baad3d93683a9b25296fb5bd1251a3d6330196e83dbeecd2b7970392a6.exe	81
PID 1116 wrote to memory of 4128	1116	ccb4a1baad3d93683a9b25296fb5bd1251a3d6330196e83dbeecd2b7970392a6.exe	82
PID 1116 wrote to memory of 4128	1116	ccb4a1baad3d93683a9b25296fb5bd1251a3d6330196e83dbeecd2b7970392a6.exe	82
PID 1116 wrote to memory of 4128	1116	ccb4a1baad3d93683a9b25296fb5bd1251a3d6330196e83dbeecd2b7970392a6.exe	82

C:\Users\Admin\AppData\Local\Temp\ccb4a1baad3d93683a9b25296fb5bd1251a3d6330196e83dbeecd2b7970392a6.exe
"C:\Users\Admin\AppData\Local\Temp\ccb4a1baad3d93683a9b25296fb5bd1251a3d6330196e83dbeecd2b7970392a6.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Users\Admin\AppData\Local\Temp\_Get-VisualStudioInstallerHealth.ps1.exe
  "_Get-VisualStudioInstallerHealth.ps1.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:856
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2753856825-3907105642-1818461144-1000\desktop.ini.exe.tmp

Filesize
176KB

MD5
68f4cf00817ee01310aceaf7c6a5eb19

SHA1
58bc82c2c1d48b3d585f31d342acdc1828cdaafc

SHA256
193c85515f0188d70c3d641d15288b48c3ce9573f090c9271a87ef55f8fcd47c

SHA512
97bb436ac6fb03f7146cac8f8cebabf48438a42addf4a59c6342b478a67de9e6245d19eea479e2ecc87794cf9dcdef345cde240ca2ab2db92bc272187f8628ab

Download Submit
C:\$Recycle.Bin\S-1-5-21-2753856825-3907105642-1818461144-1000\desktop.ini.tmp

Filesize
90KB

MD5
42d0a200fa3031daa986ee706b9b0ded

SHA1
024cabf1ab3ca0664015c2aa6494b70d46b0663f

SHA256
7a0d4b33e178516fc415f20036e961a9900afcb84d4ffe490ceefecab56103b8

SHA512
bdf18caebb1c34d6fe6be3263138e54e99a67ca89ed2889a84f66712dbf24ef258d2372554d32a1c7d6a0661021889dd1f79dc43d2dd84c189f4cfe8f01cdeb0

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
202KB

MD5
67d53d26e456e461488ed17a79e73cba

SHA1
9e3627c7e12f72e51d76144fc62298eb1dffcaa5

SHA256
00ea1792cc65aa3586347d5eb9a5a919f7c79e1505a49f3ce1d6ae4abd66cdd6

SHA512
76a359f49792d8b9c80f7ae6b9f1cfa4ea732b19a5f7bba9da71dd91db6ad2d977e8530d459d096c83f2557728f50885bfd97b29635c5bff3cd635b06c0160a2

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
188KB

MD5
c9d55513ff0b39d4ecbfd866389b02f6

SHA1
d6b62b810af795b2f56b4ad01989e28bfc2b77c5

SHA256
19b71ab988f57bb793964f0609bcbd7ad41abc02d05a7cefd6b152396bc0d2c3

SHA512
3e4289dcff7cae9afee821f5506655d8b0ab8c6a6fbdc43ccc52a4d7f5bcf7e4c564b1ca110f15e279de8fd7e40795aa98af15ef8b6ca2347b452ec8e330f017

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
4d180c30a49bfc782495cf24a52e5614

SHA1
d573cc1ea432c843a55089540280655694f150b6

SHA256
27f672b5fd8c89e662af3b78fd3933519845405536edfe0c29079ce3ccf81ead

SHA512
d874119c5d230bff17229bbc762fbce005ba52bb348dcde89910d1a782f23be1970d6b54d7b1c6a8bb58107c0442a0e68010e18a84aa32028069985f1315ddf9

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
633KB

MD5
71ca4912fb7089dc8dc8faa3d4ed7b72

SHA1
7e5b591abd37e29322fb93963b9989f16c1690e4

SHA256
e2be1cacf2d59647c7e84b905b593245d36f46fca682af42278be5462c58e1ef

SHA512
5cf17eb52bdbcbef6bcf2e82b59d83ca0758efcc0cf640d8f2460ba1d3bd35a84dff46de7e2898a756dffb7102724a15ffb69c80d3d9d956c9cc89975eda4df5

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
275KB

MD5
e9f2db3829e10a1502bafb4e07c4f256

SHA1
0d0eda0957f8bffc50cc890a7281b89449c09578

SHA256
8ae4ad78f8c8091e0b8565fe29ce5f71f11f998efdcee32fb2934aba927fce8d

SHA512
104fc6255fc7c1a98b78cedb5327fcb533a7da3dfb6792d1d08759e579ae0fe3673f51aade74dc32a1cc7bf64127ed5ad36e132692a68bc88def5115a9d786ec

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1020KB

MD5
5b0a4f289078c6fd89d283b440e91049

SHA1
8bb4ed32ae9879c0e7bbb2bbccf5bab397c07077

SHA256
e630f0b2235c9a17d6cbe7741d4e12257f9137297dfab1490c20b0057337ebfa

SHA512
bc9d15b3b43d321dca3c593af3f6146c6e0610c51957b86537c657c4b132a59b7a49b8ee3caf5e4278d10beffadeb7721037f14b5235e8d900099a60f38db6b7

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
773KB

MD5
4375c8cf67e2f377acb3098fe43bb0df

SHA1
b7ecbba26250addf636e801e9b9faa8c143c57fe

SHA256
a24351303705d1701ef8ae44511ff0550a1910b2bfb9442b6c2217395eaa0c00

SHA512
e9bde557de1b7faf719a6a0a9102610875e3674625f2dbc64ed438e3b843599a04da3e83deb58e61be5c888e9102e56d749bd94b1c57bfce269d263a964f7018

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
146KB

MD5
e548a00220e94b0d576200e1fed0c9ed

SHA1
78067de993ecb8f00e0f8b49ff59e9f30fe9bd9e

SHA256
52037122d9d9d5e7b556f33530c67e3eb2a2d6d01f0b8ec93ddad4198a6bf4cb

SHA512
d611213f443917bbcbb9869591ec6d0e2eb04d0eb71b292cd7a90c8cbbcf77dfc1d48f7b11123ab5da04fc9209ce018c23888f2e968a877528d02d6b835e32ec

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
97KB

MD5
a721559b4d14cf3729e91b7f943817bc

SHA1
f164ab156b74c3acb625ecde47d7e7d236a5a511

SHA256
b57ab3afd4770dae2dc9476bf5b49c05e7915b7b71e762d7d5d3a6ca5befdd43

SHA512
64cd34bf5d23db4ac96cfeeb914b68c011b7baf751d7d1ece2d17d59e586f9cf386ddc1491bb25839e7f2ae9488662ae6c0b49f6ad2ca3e83ee69223d820f4f5

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
99KB

MD5
1b6e5b293d755e707644e7194a898077

SHA1
53f5e024d31ba2d3c4d6bec0c819951dfd9de0d5

SHA256
e8470bfdc47e097dff72d854476a05b715faf3b4b52208d0cbe1d69cf213c587

SHA512
28a013c858d5ec5d0fe49e4e3e2c840691f01e5357f747e38ac2b298c1b7c3f7f4cc0ae034822a1a8227929b2aea20a2786fdb296f1ba961adb28534508b5727

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
91KB

MD5
650ded359fc2ec3ecf6d1562b3137fc7

SHA1
f6f0c558b778d3f72670d26226c5704f1d8644fd

SHA256
d69349b7f3ea3bc98fb3be556ed27db09dfa1850af1d39011c061ae02d7fd88a

SHA512
c8fffa304156329038d42e7d0363238d94debc33861a1c471314e2ea7cad0d108e44734dec8fe68dae50ec51febcd13ac66f63408acf97d86e4c8cd026d25517

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
102KB

MD5
89d3b4f801b1302c0236f0627b34da5d

SHA1
313aabe358fe41d50b91ae8c462553d358aaecfd

SHA256
4ea0c176501982caf04df25dd398a61b692e519fecdc29b2ec17fae9ff2b6130

SHA512
4972a34d53af61d4ee0acbe42d6cb335717e7f87e422f3686c4eb27bafbd1425d0f68a5fc20a2641f3679a4d8e0bc5532d82f8a94f9651faf158490e5b52c2bf

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
104KB

MD5
06b8939f74eb9b067da47279c25e98cd

SHA1
b69eb4c673d6aa9cb2742a97e7bb83ae50f91659

SHA256
2a0ee7621e72c7715e83b50fa2048023b3d8d5eee2ba8b6cd6ed3f68abfced63

SHA512
f523743203d8177787c82c5d19f2a181323f5df9ef9fe124bbb5d26ea594f9a94769e68a3393a5d5a7857ae230b7d4d7d87d348bccf87ac44c661de1ea0420bb

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
95KB

MD5
a4c64f004b2169dac1caceee0ac12d8a

SHA1
c5681e6c83eac9a790937bef2a0b26d60d4a7ae5

SHA256
c989c879bdec51b8259c6f0f7df78d400f2d95289aba184ce3b8992cb29be655

SHA512
9f05cfbcced2ead24736c83819a09533f0296807b07950efd689c03f3e38700ecd5153e3049c9709d9da8dc731a92cda65edd917515556e4c433ae8d2cfdf768

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
95KB

MD5
99cfc099dab2857c01ca72726bf39207

SHA1
0aa718cbf3c0f2ba50215445b0f2e8554af9f089

SHA256
09379acefef01edabe05f7b25de2eef8435a51198d57a9be0a02f9231eb6adea

SHA512
779987afab3816200d132f2e0591d8fff1c837099c5207b283b5731c4658a8feeb52b45340fdbdf3e028bc9ce49f0b7595ad273d3024c953358c86dfc8d66a53

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
98KB

MD5
6d6a3d047d2210329d88bca911760e25

SHA1
1bf9ce37764cb6a0cccff8ced17065bfd5d3a40e

SHA256
8fd30ca35219365707679c20b08f521b02d3a0e70a98721d12b3256444a45484

SHA512
e754b6ceb64e530273c15427b5ee7e3e7fdfb870338df1df591f8dd30695a9690d60d7ec17092620ae510d91f432f416ff18cbcafe0cdd4af2906ff7b7d7b7f2

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
106KB

MD5
eebf42d5e237b37798c39f46251c984c

SHA1
3706be44d31c7caaa9576d146415d10957d28639

SHA256
f07b3a662924111752c12d4ebf0878ed53af8ee9453dfac6cb9f723b07bf4faf

SHA512
69f9a083bfc20b562134751b1313f8b3b8e81196937cedb64743324aec237f9751e1d3f924583f145bee992fc3d5cf4e044bb2e40811f6c723cad6a279b48f1d

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
97KB

MD5
35a5025917526c527bac077597bba181

SHA1
54a73e9936d9a95df4d1f4d7a934690983d4fd79

SHA256
e58bf7e7c7ab461a2393793e4b19089d8fa00e6ece301f76183097699b5fa652

SHA512
4a6cf8294d68e5508f288ac32cfbfa00af16cd895f0e5002faef49973eb43903ef53879132f98c867b27cb431af39b1ac54b12e5eac456f3ab64817e10a02ba2

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
86KB

MD5
6cb581c8253a0f438cccee88946aecb9

SHA1
213fa6ff2eaa29585304ecde5c65f0ec1ce389c1

SHA256
c309c78815634de93dd3be8b3a42f44aee396c93f62f6869593919957e4068b3

SHA512
f4e4dfd9b6d1fd3241d0a5a585b18d0854c358fb2f6465404cef5a8ca57bdd35145be5688c011c84fc9c30134fda4dbb4d139375468e0dcde8e42676777b92e8

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
98KB

MD5
94cc0ab44a5645d05c3ff59f714b01d3

SHA1
a2c77ebe5fc69553301cb2002c0977c7ccc9a671

SHA256
d1eeafbee863b38cf8e7978e65b2812f255129692b5860a80983ad4501a5648f

SHA512
f2966ced35812b9d1441ca22a730fd4f973a3260adea6aba0114dd87a55150cc1a73c998797be379cfba76ddd880d2f205be75d162ac45ebeeb378fdd834e3f9

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
103KB

MD5
dacf5b465f3173d44f88d2deaa0757a2

SHA1
469e5c5a3cd593845379499a58d29cad52b69118

SHA256
413f84ed026e858184e5335eab388ccb3835cdde5abbef138f83840b5995d92d

SHA512
696c982de238599f847e7768508244402fe2265d38349cffe52ba16f6ad503c7e3db6a4f1b3576b267a169d75fbf1553228bd03a503d531b2614c1d155c6f639

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
98KB

MD5
e61d1a722df8898570c929a759c67224

SHA1
6f2bd6f7e6b23946833e8778e61b7f7bc38e914f

SHA256
f572134c5b81890ae4d5094f2e98f12952ee9b8e5587eda31e1d96a8611b99ec

SHA512
b9c433ae6a84b3abc347a9a06e100268899453af61bb2b25004f8afae4ad76df394ba25d1b8fb1bece4a4a174520168bc7a96b285f3dbdfe3c80417cedb5608a

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
99KB

MD5
1e2fb5559ae143e1f43c798e08d12db9

SHA1
268b55f4efb47dea976fb8333fc1f5a7465ce931

SHA256
b3a494938c60a34b199d1f7828e5eba437b57f1bae8b7668dc802d5f02a20214

SHA512
7c784f3a99583ddaf62451a121284a790972326540c804d24733f1afd769bfc074dcc1837a15ea694ba44eb02c766c6a84c0a74792e4b8060a10af36a67bfd6f

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
96KB

MD5
d87cf12dac4a5b584d79495119c5ab9e

SHA1
a284deec60750a2792de5b2433441e8f34d61b31

SHA256
d6565563add4e640ce0e5d0b81a9e2d15973419e12d30b3b26960dea0dcd093e

SHA512
4045fdcece88451bf6ad8cfca053c9f33712a30b92d26ba9a3bc87f0945a521ec5f3df5415ce8336c782cd5b99e6c6446d720eb794eb3fed37a35b5368843c51

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
99KB

MD5
5bc16b298ac7f7d7dcf2df9e0fa23536

SHA1
8ae37ee594d242b779c9db585dd730d57817022e

SHA256
7a598ef9cf017ec8d47057420167e5ad0338df06433aaf1c3f2bb960a42c73be

SHA512
46a43c0d6098d7ec2e7e2fa9c48f701d2093e868184c0ea2564af01a9f0cbd955f45fb59ef0dbd2ed6bdf2b18e475aa1a2876b731ee78693cc4ad4c784a4c436

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
107KB

MD5
7aaca5c947d089b52520acd508b78e4a

SHA1
9514a081201ac10eb277549c816a421928fe7ddd

SHA256
41928d3e1bfa1d7d71aa10f4b54ba6d689f045b067d5cd658f6d1c3a8c2e9f50

SHA512
c29cfdf00805b139f0db83765b8642f75f557fad7b5c3f4869dbbedaa1bf7ca1dd4e5fb0962ee9bbb5d7b442b0f01210717bcd4dda7b95ea5dcc6e529143a20d

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
107KB

MD5
d02df1c123832ff73d68df7e3e5173ed

SHA1
6a81432c69ae81c1e565df4c6970b0378154b979

SHA256
a94db4dfe63b8b2ab877155fac081c661fb2d7dbf3ebe03f685414532a9157ee

SHA512
d81aec8b966eac069086408796ccb48451f88c844ff18a448a655b150cefabcb8350a0ae3e6a15f60d1d64d92e883c09aac7337700f72ed90229d90af6492783

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
98KB

MD5
9500490978a932b3ecd1b4ab9c77c80b

SHA1
26a6fa4b447fd6ccc68614c6232cc7f9ba252d5d

SHA256
41dbc8b398051bd22ed44d61a6b02d5f80178ab20456eda4648f7eaac5cbbd98

SHA512
856c3da3f8d52b7b6f9bf8a0ad2a7dc58738d12888dcddbabeb6aa97733bda9cd047a6f678954eba59fd24d17da277e553eafb1751a6d52ccd7b6ee524762ad3

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
99KB

MD5
2b4b14709944e6ad9535f3d94f09e40d

SHA1
61cbcecea472fdfa2340399c31d263897415c0b9

SHA256
a90a44f0b29a5fc8826dca0d7d15eac89be50399d0a0ee36149535ba723f0aae

SHA512
44e89c3f3664281786d243021878fde309817b98696365d5900d0dbf76ca6ac94fb432ae2df64daa7107c6ea0507bb98aa01658432ca565913f6143b91cc6e32

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
98KB

MD5
249cb0f2ea6c92bdf9f0654b711adb04

SHA1
4224c8ee9086f183355e24c52ea2e7624f817a97

SHA256
81b864f6177f7e99307046210cf1f4202d43a13cbb62eb9423ec1f469345b7ba

SHA512
256580a62df148827384da20bc2c5ab880d00316ef8d52e89224223ec99b65e3457c0798e4b0db2962a5a848964aee033dbf79aed07f6045a8c0f69d6528c6ad

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
99KB

MD5
c33d1e55be3a4b5f106fedddbfcc710c

SHA1
e1a9b609693da6f500a85b04b60f6b6fa13dd999

SHA256
eabb72fd7617e4db48bc5bf7a14dccc6d564777650444a04843e83c4e7400819

SHA512
977ca1f2594393947fb018be20777f0c5c9eb67168a4459727affa03190c67bd44022621ae9536f7fe08ee134dadf8049f81c49440d74d045b597fcad92f0702

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
98KB

MD5
78e0e69eb3cb75e70dec127727686921

SHA1
fd4e159797733f98556d2d34e03d349af9814943

SHA256
89d88fa1c31ae5d6abee1736211809c38bd80651433b87041e90e862275964aa

SHA512
4487eaa09c3537982d6ff7c6c55131ba9ac4ac0860708d0aa54a6cc6a1e7f0875d4c7b7dc57b5cb8e2d16189c8a0f4218db7f815ed0e3f9c36a6f4087a2bde48

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
100KB

MD5
57caaeecaa5df31923592b3365ec68de

SHA1
9a3637794ae4031acbf1713588a03786dd5b7603

SHA256
989d73e97e7151662488479d8e0da8f129e7d390620133c7f9799b40d7cfae4d

SHA512
33d89da035353d47be5ba6ad3bc7de57a566600fc5b2592604fd8ced9c56149d87b259c6bd048dac4f7d5e9b5748c52d7a65e081228936214a1dedb26bdf6145

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
96KB

MD5
4a2ae620cc12aa0da5f0a5d8fd92d4da

SHA1
0beca5df3f45a55ccc32597fc7ac6bb690b40ef6

SHA256
1c4d2707d82f8a3352fc07c4ee20508096a1853d3a67b1e79847790b5b363995

SHA512
bc0d5d1b1861349944db07e81163520da6ad0c95ef46cdf4ec1be1708d50313564d674b89963ee4f48bce77c2e881a36ef0f961469761edff6ac4092ede1f33f

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
98KB

MD5
97f31b38593adf285e7cc153f5be3152

SHA1
e1417b13bde039990df4f7c388e9c8c4030ea0be

SHA256
883eaeff72256405d65721ec5fb4b48c2039f79842f438cd62015263d58173da

SHA512
eb7afd7b53d342291b752edfc022e9ec1fee7190aab7d25d6c394ef463fd12186fd4fcdd2fbefcbbb12ad9330fcf882564459cc9863074b0558d59e0c04baa5a

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
92KB

MD5
ec1ac551cea77dfff24e80a3666b9fac

SHA1
2052b822a117f43e917abf15a031e50f7ba94cab

SHA256
7d583c41a3b55686bdae452732a7a2741cb181a6847ef294a23e69db16fdbf7a

SHA512
13bc1dfd00748a3ba796ed6d6c1a3a3ff0feea79b069b81d29ce299b4030878674ae910f745f576ebf41cd822668e2892348c7a6737a13c2db4fe919554bd6ea

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
94KB

MD5
dced97af4b078e1ef106c85f511981dd

SHA1
b8e7967e59f624fbdec0bccd3de3e41e7e2adf68

SHA256
f90ccc12d6f5a4eb3383b03476d18425deb2fa6c63fd3ab52354f56806d23860

SHA512
be2b7e2cd51b18a345f2a40492ba49626520ecd50daaf3872b3c71c984b063dd8ea7206f50780ae01acfdf4ffd3f73181235cf7b087d171879fe357eabf06f7f

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
91KB

MD5
fc1b84be8bb53b59c031d22863fc2483

SHA1
bb411e2028b366444926ffedf7ef11209356de19

SHA256
8a0ad10e39bf0a8928d19e90b326b88cd2953cadd6c6077a46f5f825f2abab83

SHA512
03173121be81cf76393da62a86998669b2fb51532fac631fa37303a133fee5d889632fde23ebca08d263962fdfe24481198808f0dd9a45195a7ddf162ddbfe0b

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
94KB

MD5
0f6d7d2ee84f12444a9f1b3242a55f9b

SHA1
9d6b96f1e9e5375bfb3b8a8cc6dc76316153f287

SHA256
6262273ebd21b3584ae3e52f93fbd701004def95492d621c8ebf5d8ff61fbb7b

SHA512
5f47f8baf9d67cc6318a4046ed6f6524cf54ad6e9457c416d503c945592687f599f368a8441807aad4e31aeafc8f8723d9f94b250243f43a1be1caa9dbffe7aa

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
109KB

MD5
51775e4230da8bfc9b14f3e81c4bb43d

SHA1
eba9f0f456831ca0cc8e23346299733287979be3

SHA256
963ef65ef0bbba455a7f04bca7a32af1e152d0cb4e6577de1072e76f6b74dc82

SHA512
c5ec3bcf12aa381e611314a115108c8bb5154fd248ea342ad155bd853022dc859b61c08b88967d0fb86c506baf331ec6730c0f51e3529e9fa774a0e82926057c

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
100KB

MD5
034efb48596e0a28f7fa022f09e3c31f

SHA1
8b6810d30ca9a61fa24d7315f54f838aff054c26

SHA256
d2983b801e0ce21c99ddf370e6068bb06ff2aca7b0fbf39f9696a34627bca54d

SHA512
b67123ade786528624f0a605ea1c62756e64d397d4ddcd22dd76d3e06520145e705eba10bc130ac327f0e506c11db5d1a2207c43e269c28d925aaf359545681a

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
95KB

MD5
9e1674632a47032bf853ecef05768dfc

SHA1
6c7fa4e1c0f57bde4005e3cf12d298c7c2ac07bd

SHA256
c51b018b42f39e033e0699d96e4f9ae24a7cfaad244494510ef2413fec38bb13

SHA512
a754301e730e7e45448dd121bbbd065ccc82586c2636bf501f1326300b70ac0fb17528c27df9bd8f3606f12c3f105a637d137c41465be0dd4b119669b5f15d0d

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
95KB

MD5
6a8c61d231e7e561e360e03bdbef9f9b

SHA1
539e40ee902c3c10bf4b422b766ff765f2180199

SHA256
47a19ed312fa05686c8dd0c646d3a9080edf88b6247ed585a4380f9624e0bf16

SHA512
986b188770ffa66b5280a34d3c9f3d7061b4864444ac068f0069d24935d6c8810e7b415f6a4f845eba9cf7204c15520af76f1f8809379c65eb92a13011126b1b

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
103KB

MD5
c4e4fd4fa294b7a74bf7881141b49e6f

SHA1
7f35f2b293c936940f6424f74712e4ece1990cf7

SHA256
192515833d6e5801b5d98fc4e81562d886877b4e5256f0a54f948c284e055594

SHA512
e22aa194ddd85ce2949a8d8f8d291a2a9f321849d549afb7b2049e81ff30e4ee40cfadb26a7c698f315ce6db9ac2446eb013a6173fe9cae7be3732efba6cc37b

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
99KB

MD5
fff053ef6c703138c4c43ddd94146e21

SHA1
4de2cc54847b92930a30c0c6392c2c38e74b8352

SHA256
835adaea9eb3d1fa09ae29530408fb4ec5ae72d98f7e98a3d58a249e917d894a

SHA512
467f24d9b966aa1878c14975963f35e2f7c470722b797b7d3da05d20bd6d4d59ac82b8ee4cae9151c61ffc6c822fb676f51a37a2c3108eecbc611cea5cafb38c

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
95KB

MD5
a5ba3f1cbb26daf57f6e6f249ef844e6

SHA1
d78266678225159d30641f1236403d2939c37008

SHA256
006114e721ee592dc42942cb353e2101af31c25b96032e2b8c544f5f86983420

SHA512
2506a4272e9f17a4e52a648288452c7beb92242d8a5110e1c76eac91b0745243976c47664046d715dc3ddeb48de60bca51d34de5b5dc56a2f4817555510351a0

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
90KB

MD5
7ea9dee7ced594094d061737be381407

SHA1
440fe14550e07df2f390f913f3ae057902b6f1e1

SHA256
95e61a4cf054967515b52b416c6c5df2e58f39013c496e0807f877566aa0dec9

SHA512
41fa5fe7e9a91691692c97b23a90a09dc2a3e21fcde0cd268dc47e5ceb2f220adf7f5d3970c0f34fff86d2ee7534dd824dd178622c217d52414660b8d2bc3e63

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Annotations.dll.tmp

Filesize
280KB

MD5
fb56074d3a9eee06fff8f7361bd1ad62

SHA1
7dc67d102581f0eba58bb6803518708409b6b843

SHA256
7bb87e11de45307f46ae45f47f0c72f448b4d2f2cb5ffa53b7f13ebb734aaae1

SHA512
45e506897ac545868bf376f4145ae22c3d243da014bd83160c11d3e2d62295c53e8d7fe4ab4651d9c2d8733cd1cbbe3117f6e3c315f2da249508c909c50d9ada

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Get-VisualStudioInstallerHealth.ps1.exe

Filesize
89KB

MD5
f396830738c7b9c866cf67f24e0cc597

SHA1
f02f02d1f115e4fadfa0704c587b5bc68369c4ca

SHA256
840d8754ea7d25ebb5e029337ff089735d745ee61c68fad556ab3296b212400e

SHA512
e2f297ee47efbffb4ccec7be7db7d98b3ba553efa5f6f0b01907029fd97e8207a53a5a6cc886b96b3af50c7a9f39e3192abcf790aae0263e46143182014554f5

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
86KB

MD5
bcdceec3c60463de27664ccfed13d4f5

SHA1
8bb59fca052ccae3da023d4b76a4f7f301ee9a2f

SHA256
4c103682d16a11dfb2bb8569e520098eeb63f49acf4f81cfa0677639c867dc10

SHA512
e3f6294468f657d910365ab0ad8be2a21d2b1f61c7eb6dfe88052566404c014cad09447a55a15c0cfd6caf6538b2d6bfea65518586af3dd1a394d52cd3f084c9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads