20c6ad3b1b38868001d703e5877b73c943ccd4d2e2e6af5ad5d3dece4a1d4e6c

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20c6ad3b1b38868001d703e5877b73c943ccd4d2e2e6af5ad5d3dece4a1d4e6c.exe
Size

192KB
MD5

d28e0eb64e46389d951ea516407a3d7c
SHA1

9ab8ead7ceb8d2ffdb75738de4129e5806087bec
SHA256

20c6ad3b1b38868001d703e5877b73c943ccd4d2e2e6af5ad5d3dece4a1d4e6c
SHA512

795fd7e864f78f1162e8f1fbc4ebe5cda199027acbb41504f5796f467ef1bbf814d509322ba651e46a9533fe4c2983383ab8934b86fa8e85fce1a5f8a4ed897c
SSDEEP

6144:RqKvb0CYJ973e+eKZ/B+qKvb0CYJ973e+eKZ/BU:vvbxYX7Z/B2vbxYX7Z/BU

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4862) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4304	Zombie.exe
3524	_chocolateyUninstall.ps1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	20c6ad3b1b38868001d703e5877b73c943ccd4d2e2e6af5ad5d3dece4a1d4e6c.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	20c6ad3b1b38868001d703e5877b73c943ccd4d2e2e6af5ad5d3dece4a1d4e6c.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp	_chocolateyUninstall.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.tmp	_chocolateyUninstall.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	_chocolateyUninstall.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONMAIN.DLL.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	_chocolateyUninstall.ps1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sunmscapi.dll.tmp	_chocolateyUninstall.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png.tmp	_chocolateyUninstall.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp	_chocolateyUninstall.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp	_chocolateyUninstall.ps1.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\he.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp	_chocolateyUninstall.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuuc58_64.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp	_chocolateyUninstall.ps1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClient.resources.dll.tmp	_chocolateyUninstall.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp	_chocolateyUninstall.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	_chocolateyUninstall.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll.tmp	_chocolateyUninstall.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp	_chocolateyUninstall.ps1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationUI.resources.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 4304	2416	20c6ad3b1b38868001d703e5877b73c943ccd4d2e2e6af5ad5d3dece4a1d4e6c.exe	83
PID 2416 wrote to memory of 4304	2416	20c6ad3b1b38868001d703e5877b73c943ccd4d2e2e6af5ad5d3dece4a1d4e6c.exe	83
PID 2416 wrote to memory of 4304	2416	20c6ad3b1b38868001d703e5877b73c943ccd4d2e2e6af5ad5d3dece4a1d4e6c.exe	83
PID 2416 wrote to memory of 3524	2416	20c6ad3b1b38868001d703e5877b73c943ccd4d2e2e6af5ad5d3dece4a1d4e6c.exe	84
PID 2416 wrote to memory of 3524	2416	20c6ad3b1b38868001d703e5877b73c943ccd4d2e2e6af5ad5d3dece4a1d4e6c.exe	84
PID 2416 wrote to memory of 3524	2416	20c6ad3b1b38868001d703e5877b73c943ccd4d2e2e6af5ad5d3dece4a1d4e6c.exe	84

C:\Users\Admin\AppData\Local\Temp\20c6ad3b1b38868001d703e5877b73c943ccd4d2e2e6af5ad5d3dece4a1d4e6c.exe
"C:\Users\Admin\AppData\Local\Temp\20c6ad3b1b38868001d703e5877b73c943ccd4d2e2e6af5ad5d3dece4a1d4e6c.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4304
- C:\Users\Admin\AppData\Local\Temp\_chocolateyUninstall.ps1.exe
  "_chocolateyUninstall.ps1.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-701583114-2636601053-947405450-1000\desktop.ini.exe.tmp

Filesize
192KB

MD5
3adea6e0b4d35fcdd2b6df3c9426b999

SHA1
7f308c4d1083c2f6fda670d2d0e13e9b646562ef

SHA256
ba61f4e0ab88f0a5cc8d8393c4d7119d8efbf174f0976d91f00e95103a006d0e

SHA512
40c220847fc28ab0a8848b6042838b4e3a8e68ee5e3a5fd4a0941ab4f5682c53706470541763e7b745cbdae641938106019ab4dd2828f0879d4cc731b4c56f72

Download Submit
C:\$Recycle.Bin\S-1-5-21-701583114-2636601053-947405450-1000\desktop.ini.tmp

Filesize
96KB

MD5
fd061b094c37ba586df720cf0c09d342

SHA1
f16da69a5f3df10a476f5ecb21a96bd609020e06

SHA256
af82b184242fd480bd2fdf10e5531ee25e68e1a81a5288c920da3bdd18b30cfa

SHA512
a40381b1ca1f7f9aa4c8fec98579c73390571779ec9ab1c840c4c4a04c9aa99c66f0cc3ee8689ac4d4cd99f33f53b37081fee089ffb1de77339b05f128975951

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
208KB

MD5
310ddedcf9c77a13bc5bd5c75950411a

SHA1
fa8354245cf13d537ba505d2eb56c3dde6890e46

SHA256
47e927d904f88d1fe5bc866926798a80f6db6ca6a93bbc329fa861ac227808dc

SHA512
6bff564e75f62b98242ddeae6fdbf05abf1f1d6fa9094cf36f7dfc8f4e1916e8e5a792c48f3f8f04a4c3907a346d422d56c3c4df150eec295b8aceb256bf2be6

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
161KB

MD5
c8ad4ad2898613ba8824475f3b145a06

SHA1
5d45abd9f4b1146e432c75ed942aa89ea5dd1f35

SHA256
d346499b66a9da0f3fd66f169a7140e1ca6fc92cff19550763a4223740e3b55c

SHA512
027ab6ce3eeb344ba6f00f4c23fb7bf25fd128332ed443958d531bdbcb14a02aefce57d0228cb782c7f35c19698f4d18a35fc96e73512a78e88e30beb8bb1da6

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
220KB

MD5
e39942099104e6ffa2f93dd53b6c55ae

SHA1
d03f3aa9859ce49a40a5cf13a78c7c9d8ac57f31

SHA256
a0b815f2462ec2dfc480aab4ef7d238a97d0b09cfc7c8a17ba4fcfc61978d3c4

SHA512
3d850abf880a0e58723a718dfd4f1279db376b1854dad442b908f5a037eb667f1f92b27fcfa31c0fdf9184dd1a37667769b28f12f864a65be3276df07294e081

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
640KB

MD5
458b204ba8e1554d6c2ff2446d615c9b

SHA1
0c8fce3e723ba938e09870b5e4ae31c3989b9156

SHA256
8906e5c49e9e5f52c707080bba7720a11aee28081a7371d1acde99176aca2b60

SHA512
ce62a806b88859d7522ca58bfb10c0c041bbdfef32769f2cdc165a89ed90c82bbac3ab3bd3593b4ea0d29fda450fd08dd5ff1b6934a249a47bef3bec8af48648

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
305KB

MD5
218f59c4b07ab94156889cee228c33bb

SHA1
b30d0a56ad63c126e0389aead984de635eb6d0f7

SHA256
35b6269e467315d1ea8245293d399f36e9e64f9f16bad5a840a019c60b24b6aa

SHA512
9e3c84a0bed068d0d4ef0b41358c935c72af4df72c310c2ab3b46d8d08a7ccf71bc899d1cb9c4a4cc282cf3eea0544e995f63e25e5bd120ebd90792acd94d308

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
284KB

MD5
ee12600bb97d0acd660ea694261130a2

SHA1
ff1550f86dfd80b0f0beaac993e6f13105a16409

SHA256
ecaecb09260c11d374f37821b8f47474bbea05e9604d04ce17ed2a8785b80b16

SHA512
07f0cbe49cc1e02fc3ce37e2baa376ba9c1553022290047b441cfe3731a8e860a5d30fa4c7b21507b8a891575f58ad5c291fb9d7608a850d13a3f54ee74b9af6

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
758e0dacfac93e12b0d8ccf9b9cff60b

SHA1
a35ef807746ef86d0fdf7e717c01b86d4833809b

SHA256
c72a20225ed6136c7d942c2591d7177a863e03d1a3a2432685cef79ff303f270

SHA512
6dd5df60099ae8ee083fdec340577ee40a2a71c58a22b19af2da5eb5e21b9c0257947606dc980e5f2e439b4a6ac9009f24cf9ea8edc83bbc00fb805d961006e4

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
780KB

MD5
e532ff7ae48118e92776ad77ecbeddd6

SHA1
3e77a2998fd35e0ebc0ab230dfb7c6f608e5c822

SHA256
ff7b93a64514a47c99488d74454d04d2b7a90c97b0f0f211917431022b41694d

SHA512
99b9cef07440dc6cb08a399d962c49cf86157d7857f993ac55546b9f6edeb60f3b2e94c795331e5afa126297e56f1e9e0d8ffd23521367503c70bcad84cbbe6d

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
105KB

MD5
c939f02de9e6d43a62a202933c727d02

SHA1
9cf8359d31aa855b5c57410b2172878774d495ce

SHA256
bbf063ac50045bcb8fca6e32d7accb860e406644efe9b1869e947a1fb4353583

SHA512
23e4229bb6b5cb0b57cdd2272f8bda4d67288524306967d15c591e790acfcd1df9004ec21cd6cdd3cb7a7a6cbb3f3ba144cf1297d37846a0f2837bb95c803cb4

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
107KB

MD5
0a6663c40a0910b7b5176eeba883f3aa

SHA1
4fbbfc0d98c277d767eef76169b09cb8c98f495f

SHA256
f67cfbf30c933c6496413f2bf1b612da1e06b8dbb6031ee2edfb35666712136d

SHA512
7eaade25fc6b5e974a4828f8538bb9c31340c50b81bc42fac5e702ac36e6dcbf61d08de6bfd514403c6dd18d4d9bedc0130355516ae519540b1366e2d27a243f

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
111KB

MD5
aff3393f5087be93c95bc6792ac4a292

SHA1
0574bf85514972df40240264ce77aa95b192261e

SHA256
42c95cd478568bb09f1b1da3c96f67c486eda335d4a7d88d1a371552e2564c16

SHA512
af333ffc4331c79faf6da21be4cd322eece0a6cc1c5a9dea8e123938815d07a4900114981ec1a16831272bee3a2ac001f6b423d95f1d40533ec445b3493a4f4d

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
101KB

MD5
601c7b137095eb8ae95125469dcae4f6

SHA1
8e8aa18a394c0c3c02c9b0a24c72e0b7ff1ae993

SHA256
ad69e25b03c2edfa49cca554d0ef8c3ab5a0403095368f516ecd43ca0d4a85ad

SHA512
cf251f103a6053fcd9c00b0140ac541e2abcddc7f5f51d05b0c22a2bc77caddc86e3a2736454677ce921c24733ef036f76fb187df34853ac516eb8f977088915

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
105KB

MD5
8741fc849f8ca8e04841a47fd553edba

SHA1
164cd7ec88f166adc823901c3fb9c69157722c10

SHA256
8eb95ef5ca20b20afbe60a83c71c3fd7e018dde91f1e948d3268370935699702

SHA512
97398fb9ec5ed1eb16734e1a90ef053bcc122a58b4c7195bd5f4be6eef31bf25f79100c9b2b9e74c380543c1acf33033d3ee7d6b1c8472220454d31b6c79c79e

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
107KB

MD5
8f40ecf3a0d80fc750db44950059237c

SHA1
a05ea1ff1459eecedda09e1cb24bfccd5e95ff2f

SHA256
e8c7a9ce1c603c525eeddc60aa3e1533d091a9693abfe2926870d377b7c685ac

SHA512
3d85a990cf5ce7e361ef8054ff9e3e939cd13bfb423366ea326f07b084f15695e77ad5147102deb85057d25350d147b10543875ab0f74542d2f184a1c1b36935

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
105KB

MD5
9a43669497a993d7e1b1503459ac096f

SHA1
80f2af0b6b95c9e8be3dde5468c51e09eb7a6405

SHA256
b433c17fcebfb84f26286264f6b3ff6b352043734d1fc3cd4ab271ac287d791e

SHA512
93971237bf472a682e5dbdd295fb1791e4f0fe656b5468b249c31214b621e722e365bcb996e3fe87aae66df08bcb81689e5b9d93ca31bd0a30493fd45b567518

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
112KB

MD5
664d2ae8cde0c57476c5aad65331cc6a

SHA1
8e9a848fc2183d646f6d608b39c7a3f606f214dd

SHA256
15c220c7059f654af98c35783231dba95a4a1b249ce65ac309493a4bd9d49109

SHA512
8a2c3b7df5f4171959cf25f23dc14ac71af34d95f247cde08c0a809ce25d86b9a99a780e22a03d2833be2169e4c4ca67a882b64e54083be2509d3b6cc1dee16c

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
101KB

MD5
447e66cdadcd4baca9577147d7688dbd

SHA1
b67a6d6f9a51258495fe392f14d36743c244d642

SHA256
41fe9a28ffd28e39b3990264a9617c14a2673c10453354441c30d4a3026c6609

SHA512
d6fc5c0b7d6e842dac451c0bc1d9184a57de2a4f819906974c4a97781d3a3e72d45dcdf3808be626091f1a6fd5c9c50dc614aa4a56a2442f03c5b669f0e928e0

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
106KB

MD5
b45f8d2f8b243ec1d882cb0d00dc2a70

SHA1
66cc778aa1bfc7b6f5d927eb022049ee3b144d09

SHA256
6170c6d8645d62a29f07604e5a20ed0b9f4760e59feeff236c0463a6dfd7882a

SHA512
df06a2accd766973490bf7bf477734462f78edca10e5c39c3ea6c6abbe4095f59d1282214c047d11bf0beb0c2bf3a78fcbbd90b50e6087e5e6ff69b81bfb042b

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
103KB

MD5
7174c27fe3a2c3c568027a4ed7f09384

SHA1
d191d236529de03607cfebf889a04ccbaa9e6383

SHA256
f181e1575767cbf74a202cdc46fbe5ade94445d10b01fdfd39b35278b9adf7ba

SHA512
3566551cbfb4db9c73d5a08948b13edb88b295b4695600c4b67966a09ad5b1a54452ed3462fbc779142022f46da7dc5fd460a70a6c44d1410182e3dadcefd1c1

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
109KB

MD5
6067eb3a45cbfe241ec479967b26cad1

SHA1
0fe990e4831a1c485e6e36c32e63a308ebe242a6

SHA256
8249b3f693bd593ba3d4a07a5ec404dfb3efa980efd082c00c4a6d013835447e

SHA512
07fe4205e8c81ada26ee7c61d704ccaeeaf21413d0d8b202e4b7145d63397dc14a45aaa4223a7c836c91549281c51ff221a93486e24c98b4acb37d1a51a4c6c2

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
103KB

MD5
39e3b95e80dc95860eed101c883e378b

SHA1
5c4ffe53fc3502aebfedf3437d24bc59b7100904

SHA256
ce6db9cd9f501e19bfe0fce185af54718a6793bcdc4a560150b6ae7c6bb39b64

SHA512
f53c0b8c63b56f80afa770fe8a298e21c761b161a06324359fd6df6796032aa62008609c2f0ee8facdca82f03094c41311683e5467690900a4b37116b1eef1d0

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
104KB

MD5
cf06fcdb79eb4e14498200237b8bb0bf

SHA1
1075df7558defb9e35153110e98da3b38e43028b

SHA256
0156ac3be677ccf17bc050f344f8c33bce177a0bcac5b618e76fa75677674836

SHA512
b65daef9ef164d279cd918feba0fde75ab393c6dc530b9e7c1018d1ea842eef7e68ff8c2be3accc62e28f140fcd3bbf35db3bb2754815e2d6155733c7a12d456

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
105KB

MD5
d24ddf4553b5d392eb92792eedcabbd2

SHA1
b30349a3b2226aded5a239917fe653fe1623959e

SHA256
407244021925f2c8f6946eaf90d552f74cea1fec48b3539da0bbdfee31f84460

SHA512
d60b0ecb04cf191f43d36f170e6b5d27a1cde67c577aa7f781bd1c6ac0b301f273006bf02a712e7546a2eaf5aa31b4c51f8badd5dc65d21d699ec4c0b8b9130f

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
113KB

MD5
e2800fad8dd36988ba54b12d2a40a9a5

SHA1
0149f69abe766c679523a26596ba8697f011adb7

SHA256
f6b848e920d76dce09aa461788c5e4f305a14028a380831f09c8e43282ab45be

SHA512
61de43ab754b92a9524a254feae07e4f28959e435a243660e1726eb47334e60964bfa3fcd8271ae7cbafbd80315795e5f9116ce5d7ef352297106bfda7e3a5da

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
107KB

MD5
43d355383e813d8a871bef66991eb21d

SHA1
278dbc150959ac6846625b95cca23e14568fccf4

SHA256
c03d2694d660c29dc5686f21cc8f7a3b9df1d54671ca6cba021afad9d773df0c

SHA512
0d5363f12cde325051084471e956e38ebc4cb49dd1724071ed8e617b433f9a7d6168f2d0514cea4a17a520d59cfbfb252a678ce7b4f78ed362cf0858412808a5

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
113KB

MD5
a344b8eed0c3e97fbbfe4e0076743480

SHA1
403c4048057d8927224810846a0bfc5b81d7600e

SHA256
02a1e516af1a655c4545fceed457cb3dd5b4fd6995c927a389b812bba92b3b87

SHA512
6e06f49e034d342b23d0547cec827deadc1e54b30635fb4b6da9e1e4ed77fe65c64d1da7eb2aabbd7ffada718e1d1dccaeeaaa5a11c9304f758e6559f1c22454

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
104KB

MD5
58bcf075dad28dc322c06822254c735a

SHA1
0fff061b35f5a2522c8d04a217f8d6706259ca99

SHA256
e220395bf58064647114b94cd53df071f46e28a92862398a38b8bf9929a6a7d6

SHA512
610b71f00812f3003d9ceef0e784cf7981d84fd9f83597d40201a044ad1e00081cb3fee08d2af0a42ab33ec053f0678e9288c43f53dd16d588d5cd6aaab8d4ed

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
106KB

MD5
fd2c01e0af70cdb8964bbdc2b500d743

SHA1
c1163d84cf0cf05ae1e79a4c70e4451a754aa74a

SHA256
0f33f3bf3191c39c84c5704e4b1681de99f9781a1fe23abdfd1ef254421fc9ae

SHA512
f3df4814297cc56cfb47d0209564b8b4c129934e3e0b5351f7ce397f2a0b398ba378e6b41f30626c9dd82df87f43e765752f8f89d1b85466a28fce38e7549d5b

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
110KB

MD5
a28ef37093c6e8aab79509bf6f578ae5

SHA1
38252965d5c034d810e367ad7be84829d266e13d

SHA256
a8400327e924c271495b193fc48f24f10302866028c36f3e529615446c5f8413

SHA512
619d692b6679cc588c491a1e9e994db7a647578f82fb8a8ddb7d3738581da85235a1eb07012ec97933fae13c380e683adaba2102dda3ba3532b85347b55a7a54

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
104KB

MD5
87c87c99785de226fc5a1dcc1f055a2d

SHA1
76aea9d0d44e138763d0feab5097cf08808dcea3

SHA256
85f47ae2bfff4fa11a484fe2029f898fec027a8c74e8207b4949c1d2e95522b1

SHA512
e6341e5afc7c83f6b85dc332a2b1d2c0ab662f543210b53be58afad8ee687c3b84732d7a97a1b435bd4ef5af5c3099bf1d0d749d9c7440a6531dc09ae30b3e88

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
106KB

MD5
2024b1c92cc0ed1e8c2402e09da9d852

SHA1
d5c28a9d4c10a5d4cb7666079dbe139d9b695204

SHA256
551f0005a2a4e22ef01301127da4d1d9c9e4191411300258486f98870aabbbd2

SHA512
d2e8b3f42a76809b8fb1270bc135294be78e4f4885b70ebe3bfce5ba6557c493e1d72dac8dbbb77e3ef5e07b167b123b00a1496d94ac440cef908ffcadfe5d82

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
104KB

MD5
fbbfc7070df354ab59237c4ff18112cb

SHA1
5b2c56ca3e65e9aa266d6622f1c5461a4df054f6

SHA256
0c7001d0311afcd935a102644c55de45e90f760641ddccbdea37c39fb7b7fb08

SHA512
5fe0d26528795293d75ce697c2941e5bc17683565d260ca65ef3525fa6c891e0ca3dcf350bc3edbd740147eb5e037a998308eae548cbc5e8567d0498ea05be4b

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
107KB

MD5
e0c215a30e3c189531ab9edeebb59268

SHA1
f1bf595a2a602eea8b6e72086c2062089d231967

SHA256
48b581120084d0de91e772df3d35bb068d08de37f743941ae6e91f3465005b84

SHA512
f41212ba1c72275e6588204ad8b79786d6342e7ae72b70cd9e4d564e2989b18db8aaf9428408e9df3d40c3b188b84497117531dae50cdd64e870fff5b6f45395

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
113KB

MD5
6e526173837b6851b5d0e42b1f2df9f1

SHA1
79b8bd89d6c72efb4ab432c409bc4ee87ccecb73

SHA256
1e818618c8ac23900a6d4f31cb73fc2e3bec83eda7bb9b19283e3102e3fdd5b9

SHA512
e27d59060eaec65d4e468b40ab1ddb134b900c1516cc055aa35acf8295e6b647ff334f34d30bc045d3b967d51a550df8d93f8899a8c4db1faa284e573f0945ee

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
104KB

MD5
534ad5bcb993e8737d24eb945bf7cee7

SHA1
a3b6947e825b405a4ef90613deca47f463b6fa84

SHA256
7cbcc6c23d196a4d6aafde4d36f1f034b24817faf4e7e99764c75ff8f6f9ad95

SHA512
559da3408d379e15cd3a9371ad5560d919e1d56c066001419183c137e576e2a671cd9b63d18cbe85d7ce391e511f0279bcfc4d4111442be3f383eff7c1850246

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
106KB

MD5
4e1c97a6650c2da17c5314abfd69950d

SHA1
7ad32027fe4dfd3351281129cefbb5b494249ab6

SHA256
c965fc488bf83eec8c39b4bf7500edbb2d453717030884aecebdc30afd99550e

SHA512
8fcfff484344d26d044f4211179cf447b13a0bfffe92b1191c79cc85d26e6e49a0b181c252e55e7b409d3ec51383d91f57fa238c0791f8c7d1bb794de8498727

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
102KB

MD5
57c0441a7199cc8dba355fa802bf010c

SHA1
db55a38aa4422401289676e67f9ac8bc0c268c8e

SHA256
7d4f5f718556251d70926520fa0280419fcd535e3f68514000d87edb10ba64a6

SHA512
0b84b47b733c65ddc2c0ac1578a97a831cdbef0bfa0bfaff44c3507de6ddfcb1481332c3f053b63e98541af94d47a427b477ad6fa56e190588e586a30b62bbca

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
96KB

MD5
d8d17bc6eb49f7f9b05b8d2e1c118fb5

SHA1
f778a47057811214d45f8c5667c21e42bb50cff3

SHA256
ec127fae5f86de944f13d00cde01c393a460eed19c97065d7f36066115ed6517

SHA512
a94be21d14d2df33903d522cc7710f835a654869ff687597e3e500ef1aa4c3a7346be627b204f074d76e40ea0b7447c6393c1caab26b5794cceb5ea4f633cd4c

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
104KB

MD5
4e310e93b5105cda93a3a5f33c6ba732

SHA1
d243cc9aa12b76951413e571ca2ea6d7a767a88d

SHA256
019b0e57d32e216e7f8570379e5939aa968326e24c84a48ea911f55baaa2f240

SHA512
f02516df69ad20ed5e19ff06a221fda66ae739a77c90156c52dbd8f2d5ce9e807301e35ca6e3876cfdc2086a43401027b109c9f2f9b8f4f8e92f831cf238152e

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
105KB

MD5
d81f2572c7257e1064efc7559a27d75d

SHA1
2daccf31f19dacc25b2ed7b794e60b83ef22789d

SHA256
baa3697169d77304b4f3be8d4ddb853bac3c52600706e2d95522629c1647b80f

SHA512
30546ae401a9d2302603fa4ded9e8425a50bd2fdae946ad4996d80b76a7d1dda392727ad704929cd826c82ebb9964efcb88db6ed25ca0d65de07cfe7caaccfbd

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
101KB

MD5
52339cdf5c54a83cbdf10f8303baa8e4

SHA1
ee291fbd8ff1c7d3c7e0d84a5bc2ce4aad5ee770

SHA256
128b7d4267762a69371f538e3ef6fa514b4ffcfada9c9760d578d620643b13aa

SHA512
21c8cc6164d632d1c5790d26de16ad008a154f5a0a8039c08d34775968de19bb994b1127fc5ba78f5a7b2aac86b0c18c500ab90c8064ded1ba91f81cb0149da4

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
36KB

MD5
217c765b63c27175db881366ddd39ae7

SHA1
4b3a5a288132b5fdc54f243e33c23005ce1bbe81

SHA256
56a98b344109a695cfa6f224c2165792033d2d441bc35bd95ab11f7244369836

SHA512
0d86dde9326f0152f68aebb39dcf7c01cb67e80fb20d0be68017cf6e50b9676b777262ff7dcd9ec3720c52ec01ab326b223746ec1aae773cf47b6f40c6b7ba06

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
104KB

MD5
4da19a46078ba8e6788e6ad7e2f9fefd

SHA1
2715838d9d76de08a7f6b8b89973bbc966aedd51

SHA256
bfcb2f04dfced827da37a848e85978d4563dce07cac37758e12ae2b914f2a719

SHA512
584f74e3393ddcd9db8306f67d1ba104b0d9b350ab061598edf9308c7b68bc8125bcc7ae916663ae502fefb1d4d7378a6cf8b17b843f34d7d0abc0012760c8a6

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
115KB

MD5
537d4a1cb77455a8d646c4c47448907c

SHA1
6296845da6a25dfa62ae52404c52c0b84c0cfbf4

SHA256
1ca65f97e467d7149b8dbf117e1bbea99e2dfdd0f0cddf74b8aeffe9a0968bfe

SHA512
049b8989ed84f70dcc485e85cc96840fb6846edcdd6656f48136594355f307f5347f3a70137d55d9cd282bdf58a5cf59e12fb70748dfd3a7194da9a871b9a554

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
117KB

MD5
d02d745a0485101ead4f4c56488fade9

SHA1
7f6f6554f6d93da5dacedb3cd1169c8630b83079

SHA256
4ac2a614362ef084deacc8b6d051e4be20e1ba3d35af1e780690048339763d30

SHA512
14fbab67c9ba2f6145e945ce4bd2326d8b4cf845f16de32a2208ff78e91ca36524312d4099c3fe7bafd240223f1174e175f75adf7d85d90657baf891c0f12ca5

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
106KB

MD5
47da1cdfece2b55bbf2fe4dbc6d825e5

SHA1
03b5e40bc9b815590c3e468b68821672f798b385

SHA256
31a3b206b0d05116fe512454a1559e66b38af0f2d406a975f8edc571414d2271

SHA512
0de52694449949ec02d38a81e32f4560088fe6c0af836baf39431a2c35e848222092c96661fb47fa7ebdb079485c7c0f601da13467c181b4012971a3fd466570

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
101KB

MD5
43e63db268b19ba8c14c79019b4b21c8

SHA1
0b3e0c1267362b4440e1286cf1bddec671cd4c1a

SHA256
5ca65e5d04652551bcc3d24fa794880e2072efcd0b2a4701896cbe5b4c8b1f54

SHA512
e08a03732e92dded6fa738971d7a01169150501979b30d2821e708b23e557f259e48c84293e165418eba980e30f36d69315398fefab20d6c8c0309ca80bd35de

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
101KB

MD5
797f2f05ff465dfff9a2bf5e5f2cb558

SHA1
9250c94325748bbdd696768783d9040876f46d91

SHA256
d72e44583e74fc91eb693c7166e219a071a6fd3828ce8649b9e8d64874a516ff

SHA512
c23cf417b1f064aa5d54306d3ae46c4d1baec50d77b6bf19610a2f360559465903e05d6cfdf7a7f8e556865c53a302dcf8851e2409caec407eba63ada41f4b09

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
105KB

MD5
b5a281591c49a8b775b3727eb394d2c8

SHA1
1eb15ad4072061ecb3d1c04a49e225930ba00696

SHA256
dfb03e84b0ef2840837ab4f9ca2ae4b48d1fd211535b480c0cab251f8569abd3

SHA512
9cfa60bc6ebfdd1ae3aa63e313cee4cc455df5a9c9d2d81c139ee39ae562de3b3e40207748a69ee7a35f24c3b386a73f334fbc1b6fa020299c60b8ce535239ab

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
101KB

MD5
778f8692f55fc58e934c96273563d3fd

SHA1
a6392092669033a6a0cf55d4f50f67fd53396c80

SHA256
a37f9082736806b87d121e1266fad103a433a12364bfb5b6737a97b8e158e078

SHA512
12fd9f497219683082459c1facb879a3e2446dc336a28e205607e0cb5dbe6c15506114260b7d623caf57b16faefadd03ab3ecc587256a1e2b8a2e2243f97f61e

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
96KB

MD5
80c6510450a119c8b2e8c33fe7469480

SHA1
bf0187f4161f6c6caeb1185d99423b18727bedaa

SHA256
36825e978ab796ed5c2751b880ab906dbc01bfa0bf6092fd36edd5fe1b5cf4f1

SHA512
1338fed47136c746eb5695dc960dbd0ffcc113fe2ede32995bdd7da40dc974b0dabcc4050b442ac27e80fa5aa660add70b79f14b5198ec20159d445d90111334

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
96KB

MD5
00503482ebb9bc464d7312b85f524020

SHA1
ec6b2a959b43daa03a7f11b90d477e6bbe7c9879

SHA256
ad85522a800f9de7112144639b89619b49d2587e64b09e18961d2d904a85d424

SHA512
962e931e006eddc48a5926b570076edad6bbff56e081a1214b342977a085ae64ad481d3c6f6306055d4ccc2607eac2371eb7b086ff15e0277fbdebeea081f595

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp

Filesize
111KB

MD5
b16b45cacea897538ac49588dd3a1262

SHA1
c0ca866462ed80389ae186f3017a33463d548e96

SHA256
243e90690ae4a2679d49c290e9e4c87ded30828228b8d8d9049ac8f41c37c10d

SHA512
537111a52db0b9e73967d0f2726f7cb05189ae8a3d83a062e17733d73aa31b9c05e5c5e0242e0669cbce4830786d5fea7767b940582d9f13b43cb2235b7e13d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_chocolateyUninstall.ps1.exe

Filesize
96KB

MD5
762554ac9f3fee7f95a4e7d92df43256

SHA1
a8137348ad914ee5f3d3502a7e2cbae690a07fe2

SHA256
f6f2f7b4c39544d72b9b9448739d4ef968794c4c25b275498a89271effd20fe2

SHA512
a1cdcf99a0763cfbb7246dffe99f0b29c2baa736542d64e6990804ac5d9055ce93b9b4ac18caf05dc9c9cefb86fb9a2a0bf6dc07ecc75643b700f6241b9b2cd3

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
96KB

MD5
65de9e659ef024f82fa8fc16912c36cc

SHA1
1050c5b0833ec83f6c7aa725c206e36e3be40eb9

SHA256
b75e2c0927c41920077ce431f234dae8934a721f4eb9b48fc5b79cef3def17b5

SHA512
1408bd9881388bd3e0a24172543301606808b1401359e7a0e1855b751cdfcdfd9549f438ced33447e9e953a7522faeb178575aa8e1b0e97ac70f784fb67168f9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads