8e4abb37be1f3de6176ed8dd6d574a63cc7b1dbb63a2c193f4149ae803847280

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de70366f6da574ad135f3a0543b7d1f0N.exe
Size

112KB
MD5

de70366f6da574ad135f3a0543b7d1f0
SHA1

df4f52bd73353c0534215bdf7264177fbabb5b69
SHA256

8e4abb37be1f3de6176ed8dd6d574a63cc7b1dbb63a2c193f4149ae803847280
SHA512

764694443b1e63a964e3d4884de157678e93ee7d28a0446fa62b6260ca4d3097710a3bd354139ab2bf8cf672828531ef44c368d3e7c9f50a9142a57e1b208883
SSDEEP

1536:W7ZNLpApCZuvIYXJSpXeXA7ZNLpApCZuvIYXJSpXeXECl:6NLWpCZLYZSpuwNLWpCZLYZSpuUCl

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4275) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3416	_Get-AvailableDriveLetter.ps1.exe
3224	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	de70366f6da574ad135f3a0543b7d1f0N.exe
File created	C:\Windows\SysWOW64\Zombie.exe	de70366f6da574ad135f3a0543b7d1f0N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	_Get-AvailableDriveLetter.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	_Get-AvailableDriveLetter.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.MemoryMappedFiles.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	_Get-AvailableDriveLetter.ps1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.exe.tmp	_Get-AvailableDriveLetter.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll.tmp	_Get-AvailableDriveLetter.ps1.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\SmallLogoBeta.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.exe.tmp	_Get-AvailableDriveLetter.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp	_Get-AvailableDriveLetter.ps1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp	_Get-AvailableDriveLetter.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp	_Get-AvailableDriveLetter.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	_Get-AvailableDriveLetter.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	_Get-AvailableDriveLetter.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	_Get-AvailableDriveLetter.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp	_Get-AvailableDriveLetter.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp	_Get-AvailableDriveLetter.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\License.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe.tmp	_Get-AvailableDriveLetter.ps1.exe
File created	C:\Program Files\Java\jre-1.8\lib\accessibility.properties.exe.tmp	_Get-AvailableDriveLetter.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	_Get-AvailableDriveLetter.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp	_Get-AvailableDriveLetter.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp	_Get-AvailableDriveLetter.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\PresentationUI.resources.dll.tmp	_Get-AvailableDriveLetter.ps1.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	_Get-AvailableDriveLetter.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-environment-l1-1-0.dll.tmp	_Get-AvailableDriveLetter.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 3416	4416	de70366f6da574ad135f3a0543b7d1f0N.exe	83
PID 4416 wrote to memory of 3416	4416	de70366f6da574ad135f3a0543b7d1f0N.exe	83
PID 4416 wrote to memory of 3416	4416	de70366f6da574ad135f3a0543b7d1f0N.exe	83
PID 4416 wrote to memory of 3224	4416	de70366f6da574ad135f3a0543b7d1f0N.exe	84
PID 4416 wrote to memory of 3224	4416	de70366f6da574ad135f3a0543b7d1f0N.exe	84
PID 4416 wrote to memory of 3224	4416	de70366f6da574ad135f3a0543b7d1f0N.exe	84

C:\Users\Admin\AppData\Local\Temp\de70366f6da574ad135f3a0543b7d1f0N.exe
"C:\Users\Admin\AppData\Local\Temp\de70366f6da574ad135f3a0543b7d1f0N.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Users\Admin\AppData\Local\Temp\_Get-AvailableDriveLetter.ps1.exe
  "_Get-AvailableDriveLetter.ps1.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3416
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
58KB

MD5
a35f1a90b985cbe9c07e526bc0284d7c

SHA1
855b197373602550b51ef59af59e57368e29c4ca

SHA256
c8b1c9850d54dd4f716227fcf432466d463e89214515ccc075c3b51c99ea0ea7

SHA512
8f121112cbfcd25091e4bff4b8302c789c08c8917851c7aa4a4721e47bb0a1b4e9319fe53dabdc8866a5f1820a28504a30b84cb0ad23f2e1cddb5525f289f010

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
170KB

MD5
6239b4e1baf9c40c3036f77e69814b5f

SHA1
b84b6e89d18fe6f7df18f6aba77ca872061caf84

SHA256
3551ad8a648ce09a9faaeecfd7a670ba732bdd1384f32bcbec9084ae88a2c26e

SHA512
8afc477eb872741ba1cc4ffa801d3fe9e898ed4316711b764c78384c3bba7a5fc69ca23c530f3f0097a6e3ab3a2c720c2eaca960e5997e6e6e4ade3b2d98393a

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
122KB

MD5
7ee74bb4dc3ac208e3dfa09ed44ef11b

SHA1
344b60dd1522e34b7571958f2a2a1334e8d9dc51

SHA256
02cd0cc7e36a9524b7749d1c485adac755b3cc9837b86806d411f7eb15cdacff

SHA512
652ce9248cd49a63510ed0b0c504608e93c8937712b0d69a798cd5b51ae3b0a117600cb512a615af03a5e8f26f85e3ac517c72da116e9920921e08cc48a5b180

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
c68420eee644714b8885704141e4d855

SHA1
e090f842cfd74845bc9e0147a1e8709508505369

SHA256
f5bb6650273abcb9eec8ef2c4eef7e9e69b0be18b76fee85abfd455b6dc540bb

SHA512
43eeb29e3f369a03521e2dadf9ee6e2876883c39793175846c0150a27e936cb236f0675ecb7de5d03c8c62a89e3a78cbf903b05c6502130a2be7b4ea67d92193

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
267KB

MD5
81aaec9a978bd3e7b7893ddf076cf970

SHA1
4af9c3dfbbca1b7438b7c25fb2357ac74cc5ef55

SHA256
850575a29e5866dfb591c869d42200c07204372edee29c0ef46d429b143753ac

SHA512
63319e7dce48bb64e8e53c4d350a6dbb950a380895400e396e12bc2f24277389a409d1dc4193aeb8bb59ae797687616fd46485ebf2e6595c38f8f96eb52f031a

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
246KB

MD5
c4823188e03533d1f0473df92a592c5e

SHA1
998c63d3082ebdf79985493371ca8648bc0983f6

SHA256
30bdb135e70d64a793f4bf1a9a23c833ace6e933696d3255896b0bfafeed784c

SHA512
d06dde63008718b3cdc40b81a53c9891e2a374455ea9a4ba0758c96fcc3f8992e8c1f054efc4b1a10fed5ac5556a1800411a3539166a928d3700a1c8b4537cc0

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
988KB

MD5
ec60be19a8bd829211bd1cc9fbbe268c

SHA1
fd82f750b2d19b4ff787c8576c71f9703d3520d7

SHA256
92432df5b397eca5c92bdc7e350198c30eb1c837203b4d09aeb5f5ac44e91ec8

SHA512
16e2f4199a1ec31ff18f192505676c62edbb0f342225cf6fb6355aad1c4e5ead5f59844cdf9336b8c7b201ccdf10179697f64a9b5f9eb07bf92b2e1bdc21f7d3

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
741KB

MD5
1d0e23e803864110e5edcd121cc0f4b1

SHA1
2ab7ed54530ee8572893f08e6902f74981a8a92c

SHA256
ca7a619e8f1ba04bb5fd791f2921470526d9292354da9dde2a9e34eee9877d8a

SHA512
60ca2dc206b665b86c3e69566e9eb284530e6892fae6ab487e41413fa5186ef6feafcbe554eecf53a3d54cd3a42be09e2bf0b7c411be896b8d1c1c908ed5b2c9

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
67KB

MD5
43b1350090472afa9522949f30fdd3fd

SHA1
1f91d0eb237a6c9c35792f153e36771d9ba01f3c

SHA256
c3555886e238177298a984c966b7a9bdd1bca0441a3000756e8e8f6df1a2cb3e

SHA512
2f2ed59760766ab6ff345e57a19ab7213b05158f607eabaf6ca1f77b6cea21fc7d771cc5160d25cb22a38e2638cb35d18d8f1de3a5c507f2dac4d06720e2319b

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
62KB

MD5
d0b49223c8835e6b7112948f80184563

SHA1
79db599a9663305437d18a8e5a3419c8b41598fc

SHA256
af4cb0bcb70843da9283da5b1546d702e1b44b0ad0ba3d4a4c6c7ea083a297ad

SHA512
d5ab9e13b3455ca3fe59f49bbdc387015c8c6829513fab1b4a62621a45c504678dbd7b3c4fe5e6ebd09207ebf980e13ece5bbd7b10d2f5f8c5aa967aef51d29a

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
67KB

MD5
969d1e15fe0afe31b9bced1279cf1be3

SHA1
cd6c8cda4bfeb5a29aabfb8524247ce035b17643

SHA256
fd1072a88c60553ce4d23824b83c395dee6e021687be0f468ca52855802a85de

SHA512
8932defbcfd2674328248090723d373b9bdb5df49e9071e055841a5dc4c7110f5a49a5a89b61901bcad785fd51910d0232a05a5022d29d1e7f0bb86e95061f53

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
60KB

MD5
d1dd1e7479e18342daff5acbfcbbfd22

SHA1
0b267995fd50edef40e861f7d5d8c727859ac673

SHA256
91cfdf1ebef560ec1b3e549365c139e103050dacf6448ea6289ea35d0e6c2864

SHA512
d4c557d5185fbd9c5b4f4f55b0ac8ccbd328f7d476b5fdbd168cf1601e382232bcc0a738763db81a34085abd2c78e6e3a1fc8c261d624359b6a10465b3d4ab65

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
69KB

MD5
57e7f23095cdfd58383d7e81ab251dfd

SHA1
69a5e148a08b26d00b22a4844ca030b32c7b2eef

SHA256
704a6b2dd09c22d3b9a3d84d8f7a289f35bbb79967b3a9ad42351892800f4419

SHA512
95d69057f78fde9010cc95ac06b257669e8ddad615439d3ab7c0c923bc00037ff52c386107df4ac51dbe3934e89287391a6c877d131c8c8c16ff5404680660a7

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
66KB

MD5
d1e55a02b3a8ccef93553e5a6005165c

SHA1
50add3e3d1224864059999ab58f519df764714af

SHA256
005bd82293340e040e287c1aaf82d97462657873bbaf65fb5035ed560a063be4

SHA512
b4215caf2621caa71dea6aeff0c699191bed8cf1691166f621a87a017f1c646350f12706bfca61ccc3b06886a06328f78663d9307fce65ff3a5c8c735fcdbceb

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
74KB

MD5
23884acfdde66713956042a4eaa124ba

SHA1
58933a2d479072dc8ab33de22fb4bb40a7169459

SHA256
5c3d83d42cc3796e1499d72ef4ea7837d4af07193bf4fee4df3d89c409b3a345

SHA512
07979611d55dd2d2606c5dab14a4a2390acfaf60eb2bdbfc0243a23753739ad6526b398d9fff908af30a69fb8375785851647a7edaf6ee2a8f314b4752d5cb0e

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
68KB

MD5
007a41a26382706e8ab1d7e95d371b76

SHA1
cfc9bd16e17b2c109ced19eb352204074c7a8e28

SHA256
62f4a5029fb6508ba5b559a232a3d8c876911292b1fff7025fea9c472414a1fd

SHA512
08e01fbfc984626b2e7f3a6051c3a06412e39d415987315f1aab2d1cb779be9ecc19b4146ac857ea9bcded0d392e5edf75d94c7ebe778944cd3367c698d93cb3

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
67KB

MD5
bfee8adac915873307804ebc1367eb85

SHA1
1b4336f79a95a3f8cfc6ecbe13231697045d45b0

SHA256
0594dc845f0f1acb103a7e19d9d0159cdf02201526f7bc7ce31adba0ce5a1243

SHA512
7f4f7b2e997beea1b330f681cd666ebde2d6486c3a7df0350b52ccafd919aa1b4fd867d2bcff603f62cf7b9c091a2429f83733e7c68eb3dd21c0d84db3d1b3a7

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
66KB

MD5
bb56e6ac04a94cdec1bc263fea7cf8ac

SHA1
3100bc8023482ee2eaf5998b079a2c8ae6a93fa6

SHA256
2247a6f893cdd9e0a7666c1cc778d8a1755b3ab8a3b3d2c534a35700fc235764

SHA512
f2a2a20ad43fa6cb2cc9d0056a38d252e6586eec79cfd58ef541b7237c102c19f86827b1baa9f0aeee41ec1bd3fc400d19d35cc8253fda8352341796b0e077b3

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
67KB

MD5
eb8940fb88cd375fcb2522d0366eb9e9

SHA1
015ee9495a96565385b0898b65c0e7a5b1d5fb1d

SHA256
3bca99e4a3f72530e11d6fa07dd632a0ee6ee34281b5b701454b373288d1d71d

SHA512
045aad76a0a23531e8e7ac32a35827dc8fe29cd37555bdd5ddb1ebcc57d3a599cc17e40075b80bc0b5c8401d1b5e60f0cbd4fa5eb772ae0900c84fbb6cb57e01

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
69KB

MD5
f17c031d59c7943704cf322574c47eca

SHA1
14117fbb4b754b6ca0be6310536a556c3b2158f0

SHA256
9ee91a91b381f043aa38a58e421ccfe1fb8f3963d6ad50b711c967cbacd3bc1b

SHA512
061a8369b4684ce620b897f7e860e84563837b51b2fdd2f14faa9503ebb844985f6c46c6c9aadeba887127626b7bd3a8cc97e7a918f2256ea125281f145581eb

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
73KB

MD5
5cec97d3558639bb2de821ec46d11f11

SHA1
8c138288d8c2b39a7e0a3999e1eaf8962f82d82e

SHA256
43a88d8d60a42b9d0dd2ad1e9f278fe228a9fb9dedc71e1ea5a6110781bf9720

SHA512
0fc9d432ce2d9da9ad18de2b23fbf7a8a6b3feb75e8b58c3a474a16cce4d15534db678fc219afff940debae78262607f8e81b741035e8f9ea43e8e5100119eda

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
65KB

MD5
8059c5db535c27013a1540feca18bed6

SHA1
d5af61221e7ccc6c8b048d18c1be7e25674c5d9f

SHA256
3c15c7dbea370ebda0337564faa9c1ccb7cc18276c62a7bdf1f032e5574ebef6

SHA512
cb52994fbf1b9ae66b7404f606657baf95fc4d409fe1ae0085551ad57113dbbce52202686a4b3ee66ab0fba11d55df48f250e2a676e02b475e791ce79134cd3d

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
63KB

MD5
60e23ad4e35128338627810390435ca2

SHA1
1cb6a0220e1c94a752e09c0059477a3380122ebe

SHA256
7df08f6d8aae301489f1ce9656edd092a02880793ce5a50918757765943fac79

SHA512
730fbc5430ce47bb6851be9c0b4cd96198dd7e2b98a4f695704dba7b5e88782e83471615e4d435d67a4d0b22bebea322b90f802b53a8ed3f9c3c2ef52547da66

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
68KB

MD5
61f780adde96dbbc8cf156ef24119163

SHA1
7b561e89ac4833744344955c034b8c685b59c331

SHA256
95fbe62e6a846404369194270fa1a778f27c8075ea808792cfb993f3fe9cbf49

SHA512
467c5274d685ce1d8dc32475f4f974d41bed0cbb765eb454f2becb2f3dfc895fb63a7c3c22e42c1406924112823d4d6962e3e18e9d5ba160b566ebc91f85d4c8

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
67KB

MD5
fbb2b8168f58ea4e148ca3fe53aa84a0

SHA1
25c7fae81d274436ee20b9f65059de9736fffd27

SHA256
fcfba4496eb4cd9575296ebc155b21187e5d95662fd32f85bd4a5cd26d808a87

SHA512
e9890d7bae177fa2d8651a393d343a86f46b9ae712c0083e2908d7e413a8557b1c992801a8cb9477db12b91be885d288ed00689a3d9bacca655b33caff00e13f

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
69KB

MD5
50529b90fcda91e691c3b2eb1d2ac1ff

SHA1
0ef77b64645abf067746580fe4f542df63210f58

SHA256
47a4609191838651dd29e171eef3c8162f1a7cad79beb744d2c6ca726ed8837d

SHA512
3d7f722938d1bf03ac391d3b424529a71bbd26879c355a748713cc24cd5d9fe2ac3418669082c4ab1e81197d41f3abff07c587252adfae4bf2208134d2d0f417

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
55KB

MD5
52df2390955f28d050d2be5e6baea8b3

SHA1
1584d1981410b4dc114fc4a2a1ccce171446c3cc

SHA256
3727de1fa9fdfa39b960da5def4dec9e565a77665e94ae0212fb7b4701f39363

SHA512
c2636bcf9d3902cf398368aeab4378191be143a371314200973dfdbc42ada74f10ec7da39255a37cf0fca10b340da2c4d955e9d083cc1ef394e39e40a49192ad

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
69KB

MD5
916ca7afe083010292fcfd9ac41d6d4e

SHA1
d6e415677b16def8cc49016f9eecf5b63ea6d9eb

SHA256
e8f289039e0956dd3152d33744509ef11b2f6971dcf35385a88e29d03d72a812

SHA512
b873f39246abbdd619575859d25688c6e5192e2654cd5eea578f3e919cd1b824676ed3e9c0f44e4a909bf0e1c45e65adc2bce4939e20357c83a316dfc7916ccb

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
65KB

MD5
959b719bbd03ffedb3c53074948b79c4

SHA1
d03e3e5e2b4ab7637d67505f34759830dec11735

SHA256
48175ed38a67ffbb8e5905fcdf489b8c90f8f64527c6d5065a91df7ad4550716

SHA512
85fba7b35802da937b7c95b9eaeb2a53d3018c2a241f7a79c97aad41d0f31d4914b75246a13085d5b4ecfbd97cbe55f78c925f2fd756c98f03c12a694b80993e

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
67KB

MD5
789e28e62f4712fbe50048121258c29c

SHA1
e295dc17d976b2930d339f682d0145e6ea2e4871

SHA256
0d7d81097e2afb690ae233c5d347a4e93d3ae71ec9f5bcaec536e50f5e40fab2

SHA512
a031297cefbdc0ee2074b482428f0b8f9c31beb9f61f9d890af72b526493b129fc64483de7736a7f44f856dd5fc6edcebe24721fc02e78c01a004ae0bc71f5fe

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
66KB

MD5
17206498c79cb1b6d773f4db804ab1df

SHA1
a1efcb03ed9db80c50961f5106180eff43863ec5

SHA256
b994ab9b99eeabe44bb3964b1b32a59b7188b0d951a0910a12545c5978e9d278

SHA512
de6419f81c00c68f4a6c0577dfa1ec55aac6b23b04d9d924d33aca581115c37ba078f7f0c49bac23f046ade392852c6f15dfbcfcdb553b9e3635427f238101b8

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
66KB

MD5
75065e05e65a960e242917169edc8fa0

SHA1
3e8a7c18bcfe72cd56158219571df6f06701b783

SHA256
c5a9bbcd6f6efd5e12584b6fa1a742da1929ecf32403dcdb2cd16c996ab7bef4

SHA512
2de0f1276367742f406a8b7e79d063f7ece5c140731f20aa74adfde1bb060b77f48d7529f3165b77008fa3530975eff8579a5ad6535e8820bf67c19890b0f9ba

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
77KB

MD5
92bc22bb7715de5a303ee76de4df6472

SHA1
02179303a6423cab8f4350f995734d232328190e

SHA256
b52456014c19c1c49962e33220fa66847920281337ac2c31ff6df55a4b6ddfed

SHA512
7f67a2b200b8b3c763c7abaddaa63477ce42d66346bf37769781b747886ca707e043ecb1939dd9fdf1a80c19af096f9a2dab7ade5b4b84c139d4ff133334153c

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
76KB

MD5
80207b8c31aa679c8e7e0111282eeae1

SHA1
b09dd4c6f02deb83310e948f7e5a794e4a785fca

SHA256
a17785d97f34d027622eef3c56629781b5616db5af811621d7794806aee14577

SHA512
a2e961007d7b9bde4c47ad584875885dca08a0292bc6138ad21cd7a99e4d20deba0ab0d58bcd5ccffdc02083553a4e8e50bd46325e2c9624d550e63179ba58e2

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
68KB

MD5
52636809bd66fb5329e955819486d57a

SHA1
bd4c0956a99585ec8acbe4a1a6aa8591a9336273

SHA256
20fbe806313e6e39958f14de948dbf043c09a02fd8fef458678994eccc9d0b2c

SHA512
519dfabcd536b68f2a70ce1cb8a8e15ded0dd0be5f52ee6ef821283576967ae70d6023c34ffbc16655b990ea57a450301e71104d0b3a2ca0ed7334657cefbaaf

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
62KB

MD5
b502e76b2746e259e8ba9cd543bef84b

SHA1
639d399959c7ccd5d4214c99c4978271935da852

SHA256
756e1eb61496c617079114aef6616b09d00fe2248bf0b8e0bee2a428a69114b8

SHA512
8392b10506203ef60840ac616bb61b988c9df91a65636f6bfa72e6f6d4fef87c757140e8b6bfe72de568ef67fd7415a5ea324bf6af04cc7ab2a44a2af86fffa9

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
63KB

MD5
d6d0dd889742cbdf2441ff746dafd00b

SHA1
0bed54bd57ed9a2b2eb16a60bafc18552ef428bf

SHA256
7eaac797408d25187ba889a2bf8d42348128ed0ddeaa7ac56d76d2403e67b9cd

SHA512
6e769923756ad09f6b2585e2ffb0e0ccc3677cf31b20750b843262ad63162e110bb2e8c8d907b75a2683472f26523ed12ad94975a4c33c945c9a2851f1756e90

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
63KB

MD5
65863742b10b905a2c11a010421e8d65

SHA1
e90748d56da09a955c32950a257b1390c027dbb9

SHA256
9049aad7fc4de884bf76335f02c7828310262d18cb2f00237e272fd8dbc5990b

SHA512
7772b6308ea2b110233616a1bcd347c166014509c378e8f6f4c176e119acd70d6253335170cfca0fa9114fad6b070df02d9cd0afca60cd4254608dce4aaf39f2

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
72KB

MD5
bf0753b15e309c86d00e56cce8aa38d1

SHA1
c33f3da2d2839dd5761f530155e16ddc64be8b0d

SHA256
936561018e27ec6a788bcc52d5221333167208044da94f1a01af4585991cfa94

SHA512
becda2b1378ff93c6733d4d75dfc7894d9f0705b9c937bd19f351200a310e03194d0291c6df7f58db09ab4911d46a3209c8acda11210c1f064ee5ca2ff50d3b4

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
63KB

MD5
d0ada87d39a1993bfc9797ebb49ae048

SHA1
4438ce8f8c37dd331221fcd6e7b40374d91fd00c

SHA256
50a33a0534239652f4d7231a21dcb001e323075e530695de3d873de7050cc158

SHA512
5a219a64b34b2d2bf48da05591521764b59c978fd4d90f0861d4cc19e54eea672c8f8a6643906451c49d26c2c58d1761425ee7979a8790618423244b5445ff1f

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
64KB

MD5
609be21e488b278f02b1554de7c800e8

SHA1
57075cda0535cb83b29ff2357c0188bb1f495085

SHA256
9c549e53c30208ae3274d5b2cf8ad6058a708df7cd8775237c3f9add7355d38d

SHA512
4990f94d24ee044a296d21a6d8d5e59172c78dbf2ab1019e160d343fb8689bf030388e63146b270e1add872a877870576842980b7f1f75cccd9c95798d18f860

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
62KB

MD5
718744361d78b896d9dece1e053c0515

SHA1
19bcf5143258f67d55bc2b4819deb17aa5b89dc4

SHA256
6a40924be5af3de145cf6d9d02a98e6e259fe4a245953f3e5a822b51021164a3

SHA512
de4b78a98cf56ba0883ed52f3c134662965c187f21deeae776623f4d16ab5367ff73796de645ce0949b01513a086dc63f503895213343b9ebd5ff3c38c37f020

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
72KB

MD5
7ccb96248d0ee7e2786e699b7e19e7de

SHA1
a230722d9fd8fad105708ea0407da0a47a4efa1e

SHA256
e83369ae8453f93530e138ef07aca1eba15381bd8292638cbe621474dd7dc0e4

SHA512
21b3ad5493dd3df1b89b2c425c5fcf575687b0cb11d7079473cd54702adf22226cf328aecffa0dd62de86c6923f52859378e2b430c1c5c9a45de56e2b9d5627a

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
76KB

MD5
51cbcc6e63f52ba32edf18fee117c74b

SHA1
eebeb1623dcf0b976acd4eaa74e97935deb6ffa0

SHA256
cd8659eca98f11ffaff02f416c88298bb31497c7a68034c5330c31bf48f5423c

SHA512
19935e56b3a6ef27a4d2c4b0646924ad33fcad280559fc7e0a8c8037edb0987e94bcaaccc40e11a6a2f5b21e0c656c887b7cd06da25199ee29a8fd39a17f2402

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
73KB

MD5
ff3436ce490a0296e66e7d042b9796cc

SHA1
00cd1a072fe6f3caffe0a33dbe0236486e9b4e99

SHA256
d04800ad239e58543bc7f975f4d0f77e1653f64b0f74da042a1844f2757b4484

SHA512
033adf27c843929c8fea786f1a08bfe22bf630e21c3c2345321060e140472b0610a933c32b415b7549e18ad30016bbcd1f236689e53f14ad72e4a5d3ff4b0181

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
64KB

MD5
422478519359db20990c11657f9bc287

SHA1
021c58a240cb4529582eb466963b725f4ea4efaa

SHA256
34d5b1af6d8574f917f78747c4898645a2231dd878ddebce8266b3b4f3573c4f

SHA512
9e7b6daf2c5807d696fd21b3d5b3e5a5b89864484c2f96c4e1adbc4f6c4ffdc37341039a150287be8dda64e3ee6a9b8364cf3ddb3fb98d67c3fa9db2442e2b9a

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
63KB

MD5
1ed75eece6d3daeabda79fbcf21d9862

SHA1
b156efaaae870c92f73c7694ba109cb00436b720

SHA256
4811c64278f4ec59fc2333a9058d5fa93474156aca27851dd66c91d61d05ce0c

SHA512
61bfb2b08705eb812a01ba5c72c9e20678fa4ff0f04a00af11838f357994a0add0b11bd323e551881fbab6e3ae8c60a82a1bceaaad63fc58037bf846269ac686

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp

Filesize
65KB

MD5
dacaaf19f301f7a114b1219df7a9e121

SHA1
b2e6695bda31f551e5844b9566238b5e34b6946f

SHA256
59657c3fdd296a66341448c1aba64dbcd721d200c52ad2a6fcbea8242a684b67

SHA512
35ce3261888b48818a4f447f80b09f56f7ce9f29b63f83bb32a54d5c124787fa5e799d6fafb539ccdfed057f908d2f9b3c8b29f2861cc7c18b30881edaa4b258

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Get-AvailableDriveLetter.ps1.exe

Filesize
57KB

MD5
041005deff13704312491606a3a7db7b

SHA1
18c6b732a150242796d5a1c003b9248d047f376d

SHA256
4862550f588673b8f887cd25365bb2daef38dc77bbe15431beea5cfe1d102a78

SHA512
caf37c876f7c746f708ab9a0ed774ab023af7dcfb7dc88f945adf6e4520d4df597c73e198eda74bf067010d7ca499937f39c4a1837cdf028df02f9d48638780e

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
55KB

MD5
9d1c931606dc831cf7a2795e8f2b565d

SHA1
06b64b7027bf000de7a2e7e129a936d0623fb530

SHA256
ed81e2e33e9059b9a0dde9f64d9dc85a690e11217c21274893544c4a39453385

SHA512
201e3d6e63f5bfdba95f376c7806d3a89cabc570cc40e000bd0f035e3fc643c94cf39cdf0d1dee3b7371d7841190ff0e091320140cb21f46693d888c743353cf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads