461011cc091e7a140486adbdc3a8df1d224c0ee0fb4134187fbc4f63cdef27d0

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49e0d2d7c992985c2ffed0f8fe93a4f0.exe
Size

163KB
MD5

49e0d2d7c992985c2ffed0f8fe93a4f0
SHA1

ca78be4724004c8c5f99b8cc77425ef831d1a997
SHA256

461011cc091e7a140486adbdc3a8df1d224c0ee0fb4134187fbc4f63cdef27d0
SHA512

eb960ee1cbb44a978936fd5e933b7eb6408908c6fde13f6aa24336ca62755573e02efa88e5c7f77c91ea69c45daf24194c8ff45e87e4f9a069dc5756005f7560
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyB2:PqFF2Ie+egsqFF2Ie+egU

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5093) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3216	Zombie.exe
4324	_.files.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	49e0d2d7c992985c2ffed0f8fe93a4f0.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	49e0d2d7c992985c2ffed0f8fe93a4f0.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\manifest.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.AccessControl.dll.tmp	_.files.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\otkloadr_x64.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	_.files.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Csp.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp	_.files.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp	_.files.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.ProtectedData.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp	_.files.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\el.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.stats.json.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClient.resources.dll.tmp	_.files.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 420 wrote to memory of 3216	420	49e0d2d7c992985c2ffed0f8fe93a4f0.exe	89
PID 420 wrote to memory of 3216	420	49e0d2d7c992985c2ffed0f8fe93a4f0.exe	89
PID 420 wrote to memory of 3216	420	49e0d2d7c992985c2ffed0f8fe93a4f0.exe	89
PID 420 wrote to memory of 4324	420	49e0d2d7c992985c2ffed0f8fe93a4f0.exe	91
PID 420 wrote to memory of 4324	420	49e0d2d7c992985c2ffed0f8fe93a4f0.exe	91
PID 420 wrote to memory of 4324	420	49e0d2d7c992985c2ffed0f8fe93a4f0.exe	91

C:\Users\Admin\AppData\Local\Temp\49e0d2d7c992985c2ffed0f8fe93a4f0.exe
"C:\Users\Admin\AppData\Local\Temp\49e0d2d7c992985c2ffed0f8fe93a4f0.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:420
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3216
- C:\Users\Admin\AppData\Local\Temp\_.files.exe
  "_.files.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4276,i,384704133665252524,7723904513810765818,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
1⤵
PID:4676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-661257284-3186977026-4220467887-1000\desktop.ini.tmp

Filesize
83KB

MD5
4f32b5dfb8e1630e8243706162876a19

SHA1
e12c7dd7f38d900fee0a2db30c1f45b2dd6d35bb

SHA256
915df6022ea4c2b94b3e14c379f37ab31426cbf1fe22f96ba9aac565fccdcdf8

SHA512
99110aa38a60999e2e2b879980ed235e7dafbce54f129340d716fffb4f42123ea7b75e498714446c5fc73980199635610eb41632de86b67156f736797f4f0052

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
196KB

MD5
e96326aed411ffa280376f6a5fbfeb7e

SHA1
6571084923ea4834ec1974a3e8fe54c61d2e12ef

SHA256
ea9b7615d3fea14a3a27b5173c3477fe8041dc853b8e6e9e57af06498789a470

SHA512
344638347387d037f8edfa811ebb28e881e68b100267e43260e994203837197e646c584ac4f3ea1f49196f75bdef9d44a201b7875eb150c701b233a1d1e6b65f

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
148KB

MD5
c2e615d7aa6c9d6eb4bb74579c85689f

SHA1
95c896466c63e9b46a1d241d6a25339c9c59d8dd

SHA256
7fd4a01566e4384e84007144ff7f8bc01473766e19ec818b4d99f283f1f10bce

SHA512
3c318f34d3d7cad87d94312bbdd5a79e7442170801a6a38804efb5265dcc26a443a024e442719bfe1a152d0c83738077d6f85146e6718221c9d37e73451dbc8b

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
8e7337503bc00e6601960dfb5482d117

SHA1
3f7e15b139c2f33a28fe1fa93609273cb900788b

SHA256
540f893eae69d76ea3f4e1a232db15bda75bbad2f1e0e3e5ca0dfba782feec5c

SHA512
9edb6369cf1b7c227d004c91187153369ead225c946184ce09cf06bfe8cb5a2e9ff00336671477ad1f6441738153322b2faf7a960d50585aa1345fd649ed47e7

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
627KB

MD5
05ef75f987885399b55405812dd15730

SHA1
ee90b44df6445b6723157278e56ec9bafbdebcdc

SHA256
a21d718fcded6820a1801ff3ef131639ff1ba2e4ffdb134d55e701d0c309d188

SHA512
07d3efec001a6f5780bf2830f0928a5cdc38a3f0e2ca40b25c8c2fd1b6a122b5c5b038746dc7aa0bc76ed0194a3a4ecd0384587ab6f06d9969ce9edbc5c63e8d

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
293KB

MD5
66605d84b32579e8452d84245751fe92

SHA1
7b052cd432bbf17949b1918512cf9e16ce319a9a

SHA256
f131d8d2323d302160d642bd5aa68d92d89c12381cfa758b9f3fd45cfeb8653a

SHA512
9fb2fb1d8d4dac26b7440750e880190c9d1c54215e4992b5a7da8e7c335107795148adba8a92d832e35fa9295752047e8d998924c0b6645fd287523b33aa0906

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
272KB

MD5
e7ee41cf3337a8eeb28752d133bf99da

SHA1
7b7227a778e0ef1c2d3d77c0672b020b41a2d3ab

SHA256
2584a1e80a7bb6b0af138110eec79657f3269ca337778e309850e7440bff2447

SHA512
3b4599d2e380de6278220adac5ef0bad25db430b68b75993d8ba14e55292707ad3081c65ff81defcbce841791a6d4a4a4922775056e47e60343e1ad039cc1142

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
168KB

MD5
3441357076440b8978d9c33fc9765f8c

SHA1
d27532869566885c7c5686a6d0cba4c298315764

SHA256
fe0d71a0859fed4e69ba3bc2c0e14ec553709edee8968cc2754627384a5653a3

SHA512
54e98d81be9fd2848399f0c20f5a031427c67ad9f3094547d08d45be1ae31bd0cfa15377714e1f7647dd2ca8a0d1aa914b9e26c3a11423923d8397ad9838b75d

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1014KB

MD5
97164f2fc91e5d0b31da4b3554acd2cf

SHA1
41f23387f437fb32b0c7ad522df60086f4eb7f71

SHA256
215d3c8d0187adb78d281cdb631361923387ddbd879d267d74b2ab81311652a6

SHA512
f0a5047257781fab6d328f11d90c11470ffc8f8563ede9c41e6c8a406a8818680acc6236c778aa12f58895f5865afe095af1750d4dc0c1003b1f4d31eabb084e

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
767KB

MD5
784bed5f4f732aa15d6f5242e7ea2adf

SHA1
07cb00eb4ce3152dd89ad904d4179d282c021c5e

SHA256
4bdec46c001081755b55a3d66f436d6578c8f4a32af89751ed623bc138a949a2

SHA512
e41c4293d6255a317de552e91048a8a877192941ae49cdaa69a4b38939d1c1145f834a9979ad64c4d28b7215a0c06e3cde60a348c4cd42ec6861460259f6dc20

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
90KB

MD5
96723862758296f43e869036ac6121a0

SHA1
f43eaa1649bfeae1fa8fedce00966ecc620ec90b

SHA256
6f76792b10e14ed65271f430c8273ddb35005f1d84a8491a0b1662fcbc208ec4

SHA512
7bdd8d8f2791266f7c1a600336e4f7a6f567f4731480692c2dd6773da2c1d57e4ea977d15e1359cc30c018ff55f33b7a276b7d4f751c242f82d23196e78c9e9b

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
87KB

MD5
9361426fc2a93805bbed3327899af6ea

SHA1
01cb47242e9c90b3172fa38ec22a675f82be42be

SHA256
c151b798bf332de851f8aff380be47e67c4efce4c6040b9218f999cf33cb158b

SHA512
bf6a085a077166360e0cb6e960b007e3fee438a183ee2758b5bd9f4976b6d08ec510ba0e58cdee8ad647c3cc8b1328c1a0330064ffe7226f5defec77d2f7c46c

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
95KB

MD5
a8245c181f02867b391eb7421777c9fd

SHA1
0169ef68bfec2426ef7226702cdb86abe5d28170

SHA256
5dcd5cf8990bee78515290cc19b43f5c74cef7dbdcfec275cb0059a51dcbc838

SHA512
107c1dc25a7ec5486f4250513d407a696e9ed37d2d26bf5b13dd1bd31f231b2efb75eea4e4de5dadee1329ca8fec712b13f5806a42ca06834db7e2146c3f9698

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
96KB

MD5
f2a3d1d3dd4bfb30278d07862d356aca

SHA1
5bf458508af76988fdb4ef6b6a778a52c5d8961f

SHA256
7668292b1477b82d34c2f6bdcad0fbcb32f092f156cec1ff77ddbbb3399906f7

SHA512
d96e611d83dd3db2fd7ed489387694a04b5889512ab971182491cce2de966c0dbc45d915cfae02f1263025a7abc843c85294f4db8327c509a8450be1f38b7965

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
98KB

MD5
b73e7f608f74872e5d93de79a82d200f

SHA1
ac472371d863818fdbf2cf8a300a2dd8fd12e30e

SHA256
7b7c2b9a5c68bba822f9e2a88aa90dabf81186717e32652ded625a9b2e711f31

SHA512
b4d02cdc120ddcc8b89ac11953d89be69391ab06c145343773f4cb9eb4a1eab8faae5d58d8082c2d66c8e471c21b4d9ba764f43f83437bd96ec781adbd1c6571

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
89KB

MD5
b0d5791512e819b552067cc2251991dd

SHA1
6cea9b26e1b296fd7a84a7d09c9a042f2256651f

SHA256
f04ea75d421bcc871bf369a69d59e6cab8be31038d2554f8ecf697b6e89f44a9

SHA512
05481f259494848bf851aab392234ddd39f6404cd6b9368ccf1f0dd12a8006c91a7f78978c41f1be3bf216f833fbd6c753328ce616e929096825f7ca4e86d034

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
91KB

MD5
e3be90e089055ad6742f763fbf13937b

SHA1
5677a9c83bddf72f4f6fec257246c75007dcfc5e

SHA256
7f34039d0b015c9820c897c79d747a8f5c15a3bebd4cfc0be1d57fe9a5b326a7

SHA512
85d5543e5e84f6841a6c42cdda29d8201ecf8d8d5417ab5e60d36ec79b870348f20348b6d3d5e264b790419f92d89a1d21f02cfdce33e0268432e2ad72223e3f

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
89KB

MD5
f51018940fd193c4f51d8d30cf74dc81

SHA1
dd1d5bf25d4001035d0e3522163d39d22c433a74

SHA256
14c939209facec361c7f06d66559e7ea23dc67d6a2bb4d146c0652dee99c846a

SHA512
2436617f36f0580b01e953983e5938db0f64210d683581f6b04bd040ddaf6f585f249da3ddbabe0efaeec6c4f72cb7f3691a354885c7db7084d5e18c40364c76

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
87KB

MD5
add91429fb833e3ac2db42e19f600731

SHA1
1d05192ffe6ba8f836607cc36e29c4a147a58e19

SHA256
8a5db044ff942439bf975530399d1e6d5bdfb8c44d99fd615d673c5c7f0bea7e

SHA512
7ee5b080f3d68cae31080efa55a558cf387389f4478c2088fba43b7bded5dab5f087a47a17d2928ece84f260809cdf1536b8b28a78ca621f11153906117e6902

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
85KB

MD5
2f850bed70ef9933159e7834baf47c4a

SHA1
d9e3a92928c4f23a8d83689e5943f87cd8bec2ad

SHA256
ae1492ca5a908549214ae1b9b7a772b08b6fe3ca8989f7672c69116c790e4c74

SHA512
2ce2d234ff46a0940b025f14f06ab3c51da4718e827a480cdf2a06ab6548b5a6d054b58368e672915aa36d5f4f1e54952312c405bc03c7da51d6abe15ab21437

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
90KB

MD5
56b9b0e19b10ec708f4a11ba5e1b6167

SHA1
1fabceca48c66b3c1ff76c10e0453175bb154e67

SHA256
9c20c055a2906068c0043048108c44a21790f7dcf86cbb8d74756ff7cc0b58ab

SHA512
7472ea80bba3b80b5dacc326bbef75eab01f1fbe0de23c6451d4542a04d13f42828fc4af921e3068eb9f07d9ac2df501e47a02e7699fc34a5ca2fbe5c70d0a44

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
88KB

MD5
2148ea72133d5552de8ac5ef1184468f

SHA1
509fa1db62bb6bd78d43496b3abd0c6782a9dd90

SHA256
f68126fab155ebeca4fad9f9bc670d77bfb4099190457009685ddd141d376471

SHA512
0d4e73812e8778fc2d667e85512e0c270e85d2ae0895215ea0dca058494121c07c166fee868a8b09842bd47c75b10ae98e9d7e1fc0555a5270482da074639383

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
83KB

MD5
d77e17ac4b5fdc74c5617859c04d69e4

SHA1
eecd9007ff2238997086013fa47e1843b4177b41

SHA256
bf9cd924cfac05d21cc0cfdfb0e56c3e7f9846f6ff8650b0575a8289258bd60b

SHA512
3c10b29500492b7fad6ebb1a43de70ca0ccf562bef563621bb4548a0a2d62a06fded99421fb0bd3ceafbc1a84dcb4040473c3aef33ed6c45bb9b08ea4a53e199

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
92KB

MD5
b19af3747e1ece3048a095fd228826fc

SHA1
a605ad607ef689eb8391ac9253cfcb9d7cecc6d6

SHA256
07438ac69b0fe15969710e79114a8d8f7f196d6c110397d018af9253a95404ba

SHA512
7347f5c4919abd95071bec10362c957883ad5bde5cfb96d7879ac567a7fe8579bf926089550ef55c2fa67124a2fa22dee40d92924ef4f04bd27cc1e0845517f5

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
91KB

MD5
aa4d99d0686f2630020f670797658fde

SHA1
76c256eb497f75ddd61b5f17ed433de67fc94e09

SHA256
3827f2bbd4b0be098e79eaa45b1c8dcd316692d1edc19102346b1c98bfa937e7

SHA512
d1811b81aea72319272a3adbf96e5781af69483e7ce11e4b0a83382c3c7b36a7e16dfe948949455f51ab6cc829a7c40b2e305e04d080ae8f37255c6ffab5e911

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
90KB

MD5
af5cd51a038bfdb8a12dbfa807485c8c

SHA1
0c6c2faf2c2319dd2568605f58197ae94cabae41

SHA256
d3898b54cee8265b0040cd2faee2e28a33bd024dd6a8cc7db03b935445996e35

SHA512
762e1d92c27c34ce91ea4d904f9a8a39f8c73f140d0b1b2f4c74f2751ef57f9912a89bde474f990c3f6ef3486c85ccd3407144078a3e51140f646944f44fc8b6

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
91KB

MD5
21a56595a0a20b5b3460b83e161665c6

SHA1
75d41117089dc039c8c6566c34f585921f9ad266

SHA256
b1800fe3a2af01cbc6376f3df95cf910f12252a23daae3eee03c9b5467ff554a

SHA512
438498b03f7f4df3188ec8a39e9767886f49cca79eeae6a430f5971c8f5ba5fa8b72c5690108c518c8aa2d42671dfa6e01387b4aadf53ed476f10b0791e0a213

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
93KB

MD5
f1c3ff6ec8cacee36a5268dfff1c0b2e

SHA1
e1d501c7f6a501db66d41e170125149a1dfaddec

SHA256
95b6b4bf20fbe8538b71fccc6794d80923a7cf66591e55f67eaa73dd34d97946

SHA512
5bf664e6d78fd71536740ecd425147c515a55b20670e00379520155468b0860e1de0f62031210cb0dc1a8825a718fbbce8fed1762b78c1e50317ec9c8960433f

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
97KB

MD5
d566b3fdfea9a0f3731e6fd1d6fb345a

SHA1
1f721198079cd9141c14a20d533220a142ee62cf

SHA256
3b501d99f8edb131927b885d468aaff427599cee7c773245fea9050c7286d991

SHA512
28d6457411708b58120fc650ceab5a63b2e395b4febc289b64a95c04cc71d6d93d48ff4bf61391acffdb4116317dec72e51e84c6ed6b1ba118be86a7b4f5e57a

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
91KB

MD5
ee64389a8887f7f45394dfaa195c6947

SHA1
5cb92eb85e8bc327804fd9e9287950424a68deca

SHA256
6d3bfb4b42ef66d91ef94700b95f101e8f187d81dfe1e518962e38e014318288

SHA512
af41a26f0f9dba89c8ab1c81d95c655f5646589f93a96c96912d86315132b19907f5fb8f66e34b0bce6215be205aced118550beab384b33999d77edf22483da0

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
101KB

MD5
3e3efa371113e8ac855387c32ea74c48

SHA1
2391cc3682d6c525dd3e3d6e6d36b61ca9cb7a91

SHA256
61a99e9b5b103fc57ff49e37fd78a4126336b12ceff573c306021dfaaaced6ac

SHA512
e0e860e549627466054ee7d6b71de3d283c0e3b40cafa454cc7a3ebf381da1d4035b4d1fe70f410961eb391b3fc6360d7383ba60c406ff1cdccbcb06deb5ff60

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
92KB

MD5
91bb898884b1bfc359f2d0cfc183910b

SHA1
48e2a07be736ac9ac5f14c0c97df9cc5235808ff

SHA256
6c5e58d6ac547e662773e7077d0ecdcff7a428cf3d34f5359ff7686af0da16e2

SHA512
8b8dcdd52d4106e554959ae48998378380ada604fae43f4be7aba7b1f5ce9b25d72f7972e7ecc774537bfe719e4ca58437ef5db98497c4bcf39dc145dc19b7e7

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
92KB

MD5
e6841f99a839b6591beaf8b4569ab0f2

SHA1
589b12604773e988d6df28cb2a5c4f4f79c8fbc6

SHA256
6ea21544ead5fa761433a6bff23ab84ee899005279f5a4ecdef24f362d9a00cc

SHA512
fad9778f400e958c1283078782289010094dc0e350e7ac2ef0afdaa6f08ce550c921ce3d77f04ce8d73e62cbf087ba64c604df99df4df6ee206e5a03e644ccfc

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
92KB

MD5
ff901a74b4db4d572173d2cb7b358cff

SHA1
861826b63fb6bc26e84cb9c92d745b1aa5e73660

SHA256
13b464efcfda4bfc6a0554ea154d04531ca8aca677062e499ed3f83944824907

SHA512
4c2814a9c07c8fc9280ddb99f4b06be3b1c972f5ec7aad993ad495911b70a24e8d70e935f2477ee55df8ec9be30e0e6720ac2370b539053ecf4aca73ef9f079c

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
93KB

MD5
9d822febbab58e55d4f372d16f0b2ed0

SHA1
36fe0c65bd18408542df6aeb61603dd38279413a

SHA256
2b66f876f164c129fe3abd2d840755be1eed03bf1fc0ef46d5b99cc16c4c262b

SHA512
ac2ab3a8139bfc5a599cd4fee7685269fb33d6c22a828c61f238a4fbcc2aef11580dcaaf5e28590d4e98b6a110801c6207b3e812ec06ab584a9f5174dea561dd

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
95KB

MD5
a921cd8cf44582dda1e607f10f305844

SHA1
fa96ff43fb6c60612345e7641cae77c7ef998b61

SHA256
3ce0df0ada19d8c7791f5f4cba85b8d3eabd2b3c5ee399c9f9a6d0f57809304c

SHA512
e7b4a19367aacd571ef96d54a1f2d1afcea11be386618f54ea15f9c2bdf9af31e75db83c8b2c1f658c5d9b346492e278b403557668ca05e6c9384c396029698a

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
101KB

MD5
ab880de04f9468ad588879af7cabe32a

SHA1
30ce86b1bd3258bba5dc26252fa06d3b2914cb96

SHA256
23689518300162a8f9a2a84fe04c5f9b2ae7da152530893ac1fbe94b631fb624

SHA512
7a72a1c68b6d8038efb709fa4e8e5ec667e86c564bc3ce44bba31a611fc7d5edc62a6bdce787fed6a25e6d1a99a82a476bdddc3af2a2c74240edd949acf9c51d

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
92KB

MD5
ca1f6c0642e4007a92a793a1dda65b89

SHA1
5284fbd545bce307c47d9fe8b3e7843f362eb28c

SHA256
4857e3839c4c6e9835f08dbbf40b69dc733dc2370464bcb74ea147d4e6563b38

SHA512
cdbf18075324f0232c3438ea5bc98ad850a06994492575361173f32a1adb5c6f097f0396ce88162a64e1c38f3ff36fcd2a835aa7110946b72f180b12df71e86b

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
93KB

MD5
9c0e3844b4340c07a63aa0c069e57a32

SHA1
d6051e637f1ef3efb71bc9c42045e6de08aad2a9

SHA256
1f60660b11856cf09212342f470b47dc3f46a68d9909ba9404de1410faa9084c

SHA512
dd8d53a573e32024d9d927bd2ce4a41b790394529997029ab3e92f50f235f544df99e384729b0b3dde0f86497482aa466c5680f73ecf635aeddb6986cba8778d

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
83KB

MD5
095c8eeedc69ceef9626bee9d9457deb

SHA1
da7eecb4f160810f39e970d135f43166a8abd3de

SHA256
83e458689f011aa2e7fca8ffae65a2b50efb4c23036fed03227befd0da8e595c

SHA512
561d2921c5f021295e98a8657ec2ee24377bbf3f0d79c69314fa6020b342cb41714b6ae32a75829702d88a2a0cb927225cbf7f6fec603ee088589138c15cfca8

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
95KB

MD5
d4658ed7dfbfec8415f52050a9300795

SHA1
9627dcd8240ce07aae7f38467e67e1b5d6517e83

SHA256
b362e8b868c0897880ffaedf0a67f77d856077d6d789a81a98bccd5fa7ac9ba3

SHA512
d96ac172b922cde7502a00863535a02282db4b0914dbd71b3446fbca48182b42de55c36b3c884980054dc82dbaf68b643b0db6052322b834659c02725600e5ac

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
99KB

MD5
c571ec4dd321f460e7422667933a9975

SHA1
2d54bff70e4770b8869f3d36797b6ab4e2e7c16f

SHA256
747cfd0c575fe39519890e248207415d376b14752c0009dd68c28b517b469484

SHA512
0dbca8a456ba4283f50a84f6f2aa1c8838ec103a5ae8a7a74b96884516f4a175061e86728c62d2a27d2099df5ade72d6cdf7296f95b2d71fb4ec809e4fd85d0a

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
101KB

MD5
69604ae462385b2ed22492d4ccdd875d

SHA1
dd0d807a7f7561b9e34bcad1d7216621df28835b

SHA256
0ac6b9ae7521c00f41cb9ae6156d10cded39f49087cd93f8da1f0ace4710729c

SHA512
44e12aa41d9d4e6f973616a644e5652177144756775913ff1c71a7ef669b5fd24cf2ba7f97203b9f9861425dec526b07b2147e2c373f45de930aad2de9b18255

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
94KB

MD5
92f1137259e812a59c6e2f7c7b210f5a

SHA1
481d85684a54aa18ac265832d3f0002eb1171dad

SHA256
cf2dc53ac7fa22d32a2cad579dba804aef914d29b72e6a70a992e5c77568f221

SHA512
14006ac0bdc6cbce90dc299c6da537e9ef12f38dc753ab89cee3fab82b8bdddb41e8bc46b1aa5d8975d0c2e30f7bdfdedec910dc0b80136a573f97b911511e0b

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
85KB

MD5
4ebb8af6e1a71e0bd290a431ee084ce0

SHA1
567c34c2e616b26fbdfd834c832b133b6bf1d85e

SHA256
9905cddfa3d87f414152fe32f488bfb0eef7a74bbdf0bd6084a362aedde9acb8

SHA512
3838fb715ec6b5c2c999043475437eca1cf11478287b93ecaaf0bddd6dee7220d35626c4ec0e5807b197a7b56ce9237bef1f7143b0556555f831ebc44b61b401

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
93KB

MD5
e3d5e550de8efdcd59bd46f99be52cc9

SHA1
dd2e29d884f7aecc85781f4125eb9547673f6f4e

SHA256
d7d9f3cb02f0c3880eab576a2a50b6056579a637d9835793982346fbc5062fcb

SHA512
ba371b6532103051c381b87a89dde3a57801ad5afdb7309319cbdbe3732bd905555172407ba118019b020f402d8f7a2fe1435d364e3d63107ba5f1eaff8869a7

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
93KB

MD5
288020c8ae1168d472acc74946156d73

SHA1
9a94549a95621783df1bcd8e0a134ec91265a19f

SHA256
eb82bfcd6ccbf6305207cc7d49fcab804d09c67d2727151d626a7809cc0ddc95

SHA512
db5890deeb60562e3dc640c1943a9f28c438c43cb369005f91ea24805906849318fb7404835aee47365b464672cf73f2df2676e381fa1fb4a009ab9ab4389eff

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
80KB

MD5
15bdd45e85d13963d994b02fb8368733

SHA1
406523fd32bcba0837bbb92fd272042eae565723

SHA256
5d6581e6365ce2bf42db75239d6dc58f893629e54644a0c82108f9230d00a884

SHA512
0eda8cd2c78939823d0650bbd42abd1407b901160593a429c116654b9f893f8b5582e2fdcf6912c09a28de0d14222ec6eef2c777c8e694dd8b94cb1c642076a8

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
98KB

MD5
89f1a15c2676794c6be9a424ad0420b1

SHA1
10fb591d418f6aeb1c377868c93214e4efff90f7

SHA256
1ce24d4f98e566e5825f3a5729a88f8ce8a1ee8876c2b43f80e35f29fa3b001d

SHA512
c777d0693950a80e1c5d94f820eb0a051fb74ed972719e814597a8c7bb7050cd470c7defbdeeabbecf32dd2c45786f5d84d9229c2328ab66ec5ef6d47ac0eaf9

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
93KB

MD5
ccc36ec4ad322c30b85465e7dae26eef

SHA1
841c13a597b4723b505dc3b318ffbf823f10b569

SHA256
b52328d446d232ea6b915319d0899a0757cd97722d7c873f41ff47cb1e558224

SHA512
c3d5fe96c8cecf92f370d804af7b5fbf500e9e7093f098ba0e0c7a03b4168c75e629d9c071a1e5c3475e69a28edd57d6a911d2372b64e00560dd8383403a0083

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
92KB

MD5
91325bfc1ae888bb01f0dfadaa2fc9f5

SHA1
d25a355f09f12876dc83ba88c5e54bc612fdcfbd

SHA256
6fbdf0106f37979f8c0b5006fccdb3cfb9eaf8fc5f05f1b26ec63368762bbbaa

SHA512
478085044b07a330777d8076dda4927fe12a3d3f2afd12ba0e6f3934fd1cca69600338c98b9caee2b45e4e94144ff9d64bccefaa4e7f1d63b01f738878160c0b

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
93KB

MD5
8f6fcb014435865bededb9d5fbf71778

SHA1
a81bfa6008021f915e12b4f9e553078e5732f9e3

SHA256
2c09819a38dd4fd01193fe6606e48614ec228a3c8a70ea3d8665d7e188bbdde7

SHA512
b277aa1c1e6980750ebed28156f1de55858fef2fee96c3161b0160f673563a7526867d0bf7434ddd14983636fd8ffaa326cb83a0642dab0c6748eda04e0f3aed

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
93KB

MD5
4ea28ce1d2e5e51cc88e6a734c9e54fc

SHA1
6802ca5a07c5cbfd701227b164f58f5a1a88d305

SHA256
76b7b7005f3dbf380321058cfb95237d305ddd3733a13e713b377edf525695d7

SHA512
d243527023e198d71f85812bf3f7c55c208c9a13844c641ed732e6566936fae191c52cda98b6d64295e74e25ff2077ffd88b71d7b3f392131f4b8607de18f5db

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
98KB

MD5
d3ee79a9b4ae1c5213f2d26c434057be

SHA1
7013a3f5ff60f1eaebc7ac4a4be8c89038afea62

SHA256
947b08eeae964a09075f9182f6770d7d9ec381aba000f2d9c3eb095499c129e6

SHA512
3972891283e01a5a0f02a99f32e1d63002dc6682785f1fb3ff6010c1906aa6c36f762a2662ad6f73739efb99e5d3f420ba537eab599e2f8641bb4bcbb8c7327e

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
102KB

MD5
3e1f98514b0d859eb881ad1ea1918ddc

SHA1
424b432efe22592ba29c223b627d2bf73565cbc5

SHA256
e7c90de4ca27c45a92396ab10956f1ea652fbd152d2d3fd1289d4866e65ff18f

SHA512
ba53a81527c2728d8b199da6d7c040e165aa7ff1ba7fd4fdfefd914f71662f812ecdca9fa042275b333d5c28090abaadb736677b2fedca1961d07f1bf13ba1b8

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
102KB

MD5
7b1f47c9fbb557060d9af4447a27c32a

SHA1
981ff813a10d8c0a8c1a3958cd5e220771d6e8cc

SHA256
d2379eb78d19ee89b5e69baf60de10c5ae2ff802f167e07594fa10ba77865f50

SHA512
63afac77fa065545e824afb2d14bf5204c4f6dd01b306933939c3abd006a97b5f0ef00890413ae7a6760e5120874e31929937fb7c23db6f4ac00857e65cec9a7

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
83KB

MD5
351477d5fe1b1a9a1e441ade2ae69fc3

SHA1
7969dab0702b311637327d630bd9fd3cf9c28bdb

SHA256
faf51285085c90d89288871da0061067fd464131c5475a07a32ec9ce8bebbd64

SHA512
b2378a99d99dfc3cc0ceddcb69ebc350997254b08a6896ebec302b2778f78b886e3b04901a57d7468c631531fe14aee61e3e5bdc3785274618c533ff3b0cd92e

Download Submit
C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp

Filesize
89KB

MD5
48db7596373f360039eb0b33c9f5eb78

SHA1
23b8d0469b878001645a9d6e95f2eab0216375d8

SHA256
2685f12cba6c6745cf8c975dfe4bb8d2f05535a9f8a23f416cf085cb913236ca

SHA512
0659f41b808f13e190323cb364c1eb05d817c2590252513690c602a5e07da970ebeb52ede1fff13d2305f39730f62512f39269f75a333408aa8ab5eab1c7e5b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_.files.exe

Filesize
83KB

MD5
077a8e75ca02c18ab5a5a1b268861534

SHA1
e3825b60611700899fe99a094836f5aa5f0f8f07

SHA256
6ba1e99a25e34b0ae2296a75862f743d87a88257a826a85da5a4d949f6ed4a22

SHA512
69ce862956d256c182e1d545ffbc02e67e0646fc78850b981ed1700d538b247cb6cf9e8f74a10d27e6f47812becc5cf430231d3848f1d4849a5859cffbc1cc1e

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
80KB

MD5
cee3d3936b76117281699bcef8345216

SHA1
8bb1aaf10c93a02b0340c9b57487635ff4a5a623

SHA256
51a4f37d183ef2d73f15442c5d6ad4e607b438ac970264470a7c8fd85c455962

SHA512
cb3f9b21d7e588c3edc37423f1a93b4e9ed43d859ac1cef3a62e4b9833438dc1694ae44532f235e328dedfa6a089f2c9829ab966da823790d574e22c3132bf9c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads