58405d47c7fba714d17f22beccd0c00fec8c669b82c60cfedd9d92b2df735c39

Analysis

max time kernel
120s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e2fd78cd670c898e93aa6c148015470N.exe
Size

193KB
MD5

1e2fd78cd670c898e93aa6c148015470
SHA1

ab81efb9504bb8e2ca75837c0dcf08912494a704
SHA256

58405d47c7fba714d17f22beccd0c00fec8c669b82c60cfedd9d92b2df735c39
SHA512

6e47e53bc91d5e6b058a51485ac3490ed4e3833e1b5b27f4582de5ca5bf7b2fbe5728e919d99abbfb493e509f1f43a49391e656382b0ee1d7995e0056e53221e
SSDEEP

6144:RqKvb0CYJ973e+eKZOf7fjqKvb0CYJ973e+eKZOf7fD:vvbxYX7ZqvbxYX7ZI

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4392) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
5032	Zombie.exe
5092	_Performance Monitor.lnk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	1e2fd78cd670c898e93aa6c148015470N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	1e2fd78cd670c898e93aa6c148015470N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.dll.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationUI.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\dxcompiler.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\af.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\wsdetect.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-oob.xrm-ms.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	_Performance Monitor.lnk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 5032	3652	1e2fd78cd670c898e93aa6c148015470N.exe	85
PID 3652 wrote to memory of 5032	3652	1e2fd78cd670c898e93aa6c148015470N.exe	85
PID 3652 wrote to memory of 5032	3652	1e2fd78cd670c898e93aa6c148015470N.exe	85
PID 3652 wrote to memory of 5092	3652	1e2fd78cd670c898e93aa6c148015470N.exe	84
PID 3652 wrote to memory of 5092	3652	1e2fd78cd670c898e93aa6c148015470N.exe	84
PID 3652 wrote to memory of 5092	3652	1e2fd78cd670c898e93aa6c148015470N.exe	84

C:\Users\Admin\AppData\Local\Temp\1e2fd78cd670c898e93aa6c148015470N.exe
"C:\Users\Admin\AppData\Local\Temp\1e2fd78cd670c898e93aa6c148015470N.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Users\Admin\AppData\Local\Temp\_Performance Monitor.lnk.exe
  "_Performance Monitor.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:5092
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:5032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2990742725-2267136959-192470804-1000\desktop.ini.tmp

Filesize
97KB

MD5
fca1b9b9c19e87f1b817c2d88938e73f

SHA1
9c2b37e412cc48da209bd521014c2434b75e56d3

SHA256
7bdb670c421ed0df1b00cb5fe06c2fd1cb4e0ef5a9dddc8787d2f083f9e70438

SHA512
e328b10ddf11c3d999a908f39f5d93f473d00f7d69559d917ac9352c3369aceb26d8440c70183e28e3cc28a4071262770704d10cadf2dfaa4db10c7d32971dd4

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
208KB

MD5
e6dcfcecd14d0741706e6b802ef994f1

SHA1
a66a94594e3c2ba1035b5da798aad7f3466d01a2

SHA256
f323b2ee9c9d913827e762d9ec6ec97d8b5dc9d494f680c6af3aa6949d5d3feb

SHA512
29c0a70ccb7990901feb9a68533fad1420dd52a1f8e56ab0c93a96bbd0fc603632f0801569fae389db55970f76183ac5f6e671e0d9c15dd3389ed367bdbcec7a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
196KB

MD5
ddaca0c017614229d20c75fc998d6d47

SHA1
aec463dce7f5e669fd64d3d3d63b7bf6de408bf6

SHA256
5dfc8c81f2e55cd154c91501b0bcc1f2ecfeb3ca5c3000abf1ea0f6f9980b1e7

SHA512
49b1e1b15fee3db7babc97f5d196fdff6d69183f2f3a93bc08ef547cc406cfe3cc39b2b1b8552996e638f83140cd7a81b2381be468e7c96fa2a3810e55a1c119

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.1MB

MD5
2b6ae7b5f20a04beef5ccbcf28d5b5f9

SHA1
1158f32481ef4aeaf54379e12f6f53692ae4a674

SHA256
f00e401720a1274097fd4c0f097bf8aa0f26647716124d9bc161ebb9ce910173

SHA512
bc95fda9e3108092e4dc400a5d383d9903c72a975426e66944d65902ef11995da0c43de292e882c5ef5e59967537dbaaccbabcf68d213fc7a351db86dcd350c2

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
9de1444682d3bc6b30db8442d3a559c3

SHA1
c02ecad8d3ecc7bdd7d1896db28f3a26abbb341a

SHA256
b038de7cc952fc60cf3866c6053aaa067ee285da5cf5617d3840522dfb611802

SHA512
5aae0d01be19d935b66ebbf153de6c0c387af5d643598c716cfe1d604ef189787db28d9766761f905ad6e80cd8dce57a6446107eaa48a3b6ff2383feafdb8870

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
641KB

MD5
64b5eb6a7c93d65dcce434a4b4b9804b

SHA1
28fbd5d0abc9920e6353f2a32cee55bc8703949b

SHA256
311d3a458111da79e9e0fca32fe48b49362a7f2516adb9e168802873bde04eed

SHA512
06de4867d7fd4b11b279315f77f03923d8fc9048b09331e61d30456a7ef531df27edc4198b4ec485469b8ae0af277f2aabddc90c1068c117b2ef64663ee33710

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
307KB

MD5
8913882e7b9846cc178be526257399b2

SHA1
a3fe73c548e9120182d6e82118ca4b201902330e

SHA256
b2f4134b491b11623c8f3dd19428403c1a93308a96e2724e23f7def177a80258

SHA512
7e6eb59b0d350e1ea8398c3dcab0c830e2565ba202d7c6042c8a4bc187486d2b38182019ea53db02bb55a6c9c986b1bc75e8b29d4c7637ee9f9f9f3c94922091

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
284KB

MD5
b694f6036ace24e601674ada85e4a17c

SHA1
43ecdfb23823dcf64f5860d619b76b308969721b

SHA256
164756272dfa55043c88d4d0db83d8771ba3090c8ec87f8f8721a4103cb1f659

SHA512
6ed4b01bc8a92ed568147b3f57a0f6d77ef560d385bd0374100e441d9b42f1eaa91b1a578096d0fb1f2f6b95f3e356a53d3d73df2aaad7ff2f6a05df16c99d51

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
781KB

MD5
8f718d455e0a0708bfde6f5fbc702003

SHA1
e3854a7f9dbe0da34df2b18be2dad75ab88c7a71

SHA256
c03c8b34a0b3158416de04ed629070eaf91466abef413a97cdbce5a5fc35bc70

SHA512
74f45a8ba508cb2edf942cfdc3887b8abf93540db0ad598af6fecdc897cf236f9933a41246ef8bd8c20af4787153e6f5e547d8c039baf744212abbd61aeb25bf

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
107KB

MD5
0b99a58c88fba9b8db1e0d706bf829a7

SHA1
0d59841ee9ea530f7a42e0355588f4993439219e

SHA256
abce15f7d3dc4e8a4ffd9aafd933dd6813785ac7cf4aee48669f37a61fb3f0a7

SHA512
56d12becf4c52a60f11cee00e2e7208add745008c2e249cc721a64a9e122e5ee602f0a657dfca7c4bf550b4dfc304028517e3e3de964c2eb5f43a1adf327a279

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
105KB

MD5
10a2d860c5932e9ac0475b88168d4f1b

SHA1
f0087e248e99786577e9469af2aabc8408478700

SHA256
65b57c2d6fbb24deec8cf65f6e08c9d82ef40c6f5ba8fabc6b93e799ff4cb292

SHA512
0e49cfecca9422903a1309651e7c4a78dd653d91d6cbf47a6e668b85229f55f08eda34812ff43602dc5684e8e8296d8423ce894fe98270dbd579a72926e52a2e

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
110KB

MD5
12c99ddd757fca99a0b52a637f7bee1a

SHA1
021547ee7af9d5a4f081746750895dd45cecc25f

SHA256
92111b1f20ccb6dfb82c22a92058b432a09f1cce926a84986fe16dabe01b24c1

SHA512
f7883c99a9ea9bdb5c2169a50da2827eea34f8c882932ed7d8a75206f8c3bc5c5210e69a497e31bee9287a7e35b0863f7dee33bfafcdbf64a2810645b8d283c7

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
103KB

MD5
d572f3b1074d2e7a38887a8cbd2cd0f4

SHA1
c83e92e21c360d6112762b759aec7032b5ce4a18

SHA256
ecdf4eb54bcac1123fc87a64c7ece30baff3c7e5ba205933745f7b9e8d3c6c7c

SHA512
d433e31920df3a6172fff68a2ff4fdd1ecdfae3970e5cef77e12e3d9de1351bdd5121d2991e822fb72860fccd7526853ec47f32d476f2a4c0fd3c9e484cf52c6

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
107KB

MD5
b95697bdd56b61472cdc16673cdac0cf

SHA1
4d1862440d6523fe080ebfc174b3c86b8a04f157

SHA256
6186f47de87e72928a12bcec4fd351d19d939a4467a605dfc38c3cc4d38c6266

SHA512
7faf6cfad460ce6846778b01bd2e090a6581ce825f4cbd84bbe72f96beae30347e13fb649f5c236d05a5d45393f103984b2297791803a3a4c2e660feb855cb1e

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
110KB

MD5
f3deafdafee8584a62849b388cc7cc93

SHA1
cc28c7aed7f97a707633eb20240aa5091235341a

SHA256
46d9b75e4772386a0399601c1db8d2763f708189c4e22225929c784e23ddd030

SHA512
1abe08d723fecabf6c60d75ddf21f9a1b92ef3e6d81d5b7601f55ad951898916609dd06afed6b1fa43b969a03493386329a160f2d88430154dab0fcd590c4846

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
110KB

MD5
57e5ef133f6323b73b0e4091a2e63142

SHA1
75d39540277dbf17a8e2c67ff151a48eeb8bf2a9

SHA256
59c8ffb9a738e1e4055bffdc75111353e4a73909d2bf1dce9286d62ec88adada

SHA512
29bf53ec2708691cc4854a6bdb5efecf7127dfb1797c98570f02cbfcfeca14505af05fdeef469272fc5c664f1dac2469b96a73787ecc74cbeec52b23dcfb55ae

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
104KB

MD5
1b9fd4af6657f9355138e50db726969f

SHA1
cb5695ed0b8092a6f165552727258bd3985d4631

SHA256
7e9d095406621dabf3497dfa7241c38dca97f52fcd79d16c734ad22d4096f626

SHA512
f479eb145769dfdbdc88dc60a88cb474087399f887ba9ae97dda1253684b4b09807ab5e3a427433c5c2c0b6e33cb3c69927e1fd76b0608289552a879da86a3f3

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
104KB

MD5
ab2d61a9114dd0464b4c0c2761ec1098

SHA1
80268e9c61004d2c75d4c82c129a5df58c844e68

SHA256
5a511f243a0e5bc4d80ae06eb9fba070a0ee000c1580cc342dfbd4636a00c6a7

SHA512
a6779db3a34a33792e423fcdc4eff3e0bc5dc56b5ac50f2b05569d36a9bc183c67a1f5afa01cd90a59dc19cb8742e6e8bafb2da9628768cc44d15d93d4787c0e

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
105KB

MD5
33bbf1a55bc981230e37b7bf1c40bd13

SHA1
9a3fbceeefa2ce8410b11916fefde8d506b7fd4a

SHA256
28464f7c5d7a4f2d5a5a2ad2151009d4fde2f7dbfce426f1fd10125c35f277a2

SHA512
c4aee24172345f42cc3e3c01d9058ffd9fec63a05853ee680f976a2320e7dcd095223d9ad704ff4ee43096454622b1ab5c20b1835ae0b1ab2147b5b243cadf99

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
112KB

MD5
a3c68922cbad5eccebefd0d4ba82577b

SHA1
f9d935ee33c1d545d76231614aa5626a6a72e1e7

SHA256
282f847d99277fbe50cc654801b431aa6dc77f41ece0bc00be75ac92e6ea6a27

SHA512
fb1565f4aa19add8d383c90b13148f4ae3ba842e003fc194a3df1cc7b94f22dc84be6ff911ea8f87e0f63a461e22d6e89a85b7bea3ecd2e84e1bd49c455e5003

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
103KB

MD5
3a1e504b2b8cff97bec16901e8d34dce

SHA1
223159c3401261457e28a141379c12378c4dd161

SHA256
ada6a1c1900fdacddcf0af9008a3f88cefb64e48e2550e76515f5d938dca7251

SHA512
e00e383abe7ea756f04d3c1b02f0b4067231cc25ec04a366eb87ecdea68b4ff0f3d2783519f41af7aa6805855fd4648bccdbcc9c40033208ea7f2ab36c4ddb27

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
103KB

MD5
87913efc7e419e4cf464a331e154df80

SHA1
08b1449dfe5ac2c7e35d3f2de20b4a4e1b0d57e0

SHA256
2cfa8ce8d84f5fe6f34c524eb200bc2fe6e8c09e88a4535d4385a572bc24a848

SHA512
bf1e754f613590e95145ae7dcae45b17ee0dd9beb20a2e9e09ef7816e16d78652a79f7d563b5a84352f5cdfb6a7f1feea8914c418f3a2546eb37325889f8cc45

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
107KB

MD5
c7e1e11e08c9e3aeed69c20ad8277c1e

SHA1
09d1d4f5f7bc859b47c4fca75f17780af8760dcf

SHA256
8bace842a56a0f7ae5d9a768b748ba06b8fb09a3837ed3254128971b1cf9f2e7

SHA512
32a49d04e41dcede07348f6e1c72081914b05283ee897ef73c41dd29e448801474110cbf44d7dffc209615ad2cda4c4027d24c2f1e9e52fa8725d4306866dbd7

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
95KB

MD5
eb497ad1ad81f01f66b02dc14b875b06

SHA1
db27aec2625daa8bf980446a7b74bf084bb11ae9

SHA256
ef73a6946f374dc555bb17f9901a58738352035585d60e42de8bf10bfb547dba

SHA512
1f7497af2f5a1ad72baeac8e79d97fcb9a9589bb72fb9ed4fc29c70fc052346976d1bc91a750f1333505125daeac43f7b59200aba798378913c9ade11f942f6d

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
106KB

MD5
c3fb853dd7f34e4a590f33c4c1a2f326

SHA1
1248b9f8e019a76f1a87fbe3c107d83facc4a649

SHA256
c4ebce255abbc66477e21b9cfa5a05fd36202a47f4493c3fac51b8cb859452a4

SHA512
9e867fb613ce2b054bc3440562abb5c8472d332e31a9556f8a5f35f7f46bae66bdbb45ef0f05e98ef4af2cfc5c43ae75246d50de7bc4bb6045b6814dc4e8c369

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
111KB

MD5
e3df14170396b7576834b2b2b7874767

SHA1
941108c9cf297471fc301dea782f8bd9e8d5e23d

SHA256
ee4bed835b23550db2faec8817f03b1d3b16a4300b967af3171b71be5cb2876a

SHA512
70bb2aa2321b89c547d4c7e941b8dde1a03b5587efb3a7f371bec10585432aea859dcb0c187f592f12d007705d81c2e04926cbf3285fa09f1a70b7726de6e5bf

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
106KB

MD5
00611af2ad71bf3c701808a503140369

SHA1
c555d52c9db14f1639c6da8b628fd4fdf34702f9

SHA256
e7dc572cb957a43a50d62e180b113e7955bf26c431508be10774d13ee2904fe7

SHA512
86fd276ed4cefa5856a41e77ee117e97425a6360fe88f2f21c7222a84dd683e008c4bfbdb7a8b8f220cbcb9051de6a42ff0549fdcf0944d4afdb06c40d599f72

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
104KB

MD5
dc1b0030a39e88af62c2ccd32fc0fae6

SHA1
0fd2ad44ef6874e4bb3c2377cf87728b355a9c32

SHA256
a1f30f6f5f6f5d8ee6e61a3fb99ebc162dbe573aab1f2c8edbbbe91167b64cba

SHA512
a3b2e959e94e6073bb42b75d5112c39ba2e7776d5cb79a55b325ed7409340c567477beec007aad646712014a45a303131c3289b1e4066e16d5439404bd7fe1e7

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
106KB

MD5
fdfb890c157a79a21d730d271d3ebdad

SHA1
7e12f674a75182b627f257f14f574d479f5d150a

SHA256
27ce1845028f9381b831aa255aacac1b000b0bd5e444fb287a5956265fd46ebb

SHA512
b86a3d4a70ffc10e71d5eb102cf70b9091bb5faf9d9cd9f140bb47106dfb3619afad18feec8c023f79efd0608af6f1d2ac14ffaed4d3cb97fa4bf8e53d0465f9

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
107KB

MD5
e8cd25e3c3923f8a3b289e0911ace7b7

SHA1
fdaf0dedc3203ba92fb0311311b1adc2dd776920

SHA256
c4fb2b3ef844f17fd5996dc3669a443519a73ad08469760066976cd3d51b078c

SHA512
fd9169afcb2be6558f75306e8f7fc7b038869c9ad06d47778fc3feddd651f1a473c33f766882b435691bb3ddf624cc6cba35a0393a734ff25d5f944bd9738f7d

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
115KB

MD5
9142faf1b859c2e86fb0314717b4cb16

SHA1
55d22090accd991d5310a958e9133b4faf8b2f30

SHA256
6276e33da6cf299424de9749a1b04a4f129d7138790ca70e1c650239d29db398

SHA512
344b0a5cf1b522f902a493e9ed1d34ce3ba4219d1793174d4a48eb12df865b6c002e98d03aa51a5f0bb67ccc11bdc95f338cd55d0a065c900974e9ddf5bbac2e

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
104KB

MD5
57fc0cdaa5c0754906678f8fb55b32b3

SHA1
a184e79ab8fbd19a7e372fd517fa09c59d2ae560

SHA256
4c396afeffe281a21867ff4fa4cd5a7c290821cbee714396b4544c4379dc6c14

SHA512
5acc010fbbdc0b4186129519fe708d909da948c06bc365047d1ad43f6c530c4881b7a10fe74c999ef787f34ee248898f2f1796e69ed5c0dfbfc3d86b96eab1e2

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
105KB

MD5
98b1959823253869074ff844b245d772

SHA1
052a1f2a998982d4ca649bd1a9fd59c8bbe58226

SHA256
194871d8e5affde06fa35b6d4f858ee33b58ea912957191a0a5c0992f4760d4f

SHA512
04f00f80415ef1fa02d055399cd7f0848c28308746c8ce2b60943f165279a3b6afbc6e574222bd220896e311c230d98e7ee1ffaed6d8976298978f70fb5d9567

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
109KB

MD5
198c105b3e689f85c2a0e3aba7e38a69

SHA1
631ebf737bc8af97279370cb873e6288d69a263c

SHA256
c5d08e0b3bf80b6c3e513af875c6e9db4f7c9eef5108a6ff2bbb70e3ac9a3a5f

SHA512
4eca57958002c437c33443596319e1e35f6e2e00ac8f659b36f2540e16dfe322f0c3662cbeab8f3042bd7ea005b898fe3f7f3327c03e5d1a99fffed7aa582b93

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
107KB

MD5
4066bbea2ffea5aa09ae31f54d4e482a

SHA1
d45277dca19bbc0ea153a2084592462dd6269f2a

SHA256
685eeb94f7cc8326bcae27757407b734efc400e75d47d8d91cc81a7655f5e933

SHA512
6d653ac36bc5ac11dfeffee947e5d4997daf9dadbcedaa8f959646a5162870af0e203a3023448076537889c305902ab3ee7c545cb049e26693220170a1bd87fb

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
109KB

MD5
05b05660e145ab9b228445dcf42ecc4b

SHA1
96c0ab2bed91a979e679fea65ecb5ee6629e7372

SHA256
c4f4fc91c220b3738c2dfee90e3674385de5bacc1db934e90d73b247a4c2796d

SHA512
963c6ac528e6fe9d138f3f19543ccb143d67df26b4e3b6a61294bc90da4efa1365946090b576e8b3241fa7757d4d0d212a29dd75477bca6252cef856701e4467

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
115KB

MD5
8ee9ba9dba99b5341d51a5c54aa002ae

SHA1
ba990cc7de8391f6c42d852813192aa854c7b459

SHA256
80cddfb174d607183fa70af5ad11cb913b55597de7e5bf3ab4d53bf21637267d

SHA512
c92eec117b3b60e396906affe478b1037204d2d5c047cd9ad74e6fa21d05de61b0ec8adfdd1f9fdd70ba2cc64f4de3070de6b5347d357f62f31005836380092e

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
105KB

MD5
48dd4fb45db8fab88d1a41d0743bf653

SHA1
285f3354de2733c0258465e082f10c4cd3b2ae4f

SHA256
0105e69ed4fff8a21fcb9d449f1772fd7f48104f2ba9c785c2b7106feb907a51

SHA512
01f94c2e7b2c19a8541c41730b62412c0fc47284a56069ed3e3db338057bcfb04ee700aeb8eb0be47c851fd0b8f4264b2512b7bae7b3c9a83273e9b108b20a92

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
106KB

MD5
3917a3475db23f5468c1cf93916da767

SHA1
986542e46f64d366694fd2ba7c185b58a3dfdef5

SHA256
aa9e851bcd4837e7e256051b54e744474b868d7756884a7827236a15962535b0

SHA512
95b27bb829af73a08eb949934e6d4da517afaea4434dfbf87122df2bf54155ea657df8f23c9f497bec56f092192342aa31572b99f9d0ecc107905bf998cc58d6

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
107KB

MD5
057902f3ed07a0db2df1173a8457941b

SHA1
2908765352189bbbdce2171c0084ed577a3c65d0

SHA256
c275983f33ff0f1ce9a1e0093172b2d745584c6db72259ed6d829ecf7601d504

SHA512
3aee59ea3d1f66d45deaa94c9273e438092cdf118018ad05814a774e845601b631d527418480962dafa4ac5f0f9b6af0925cedf09d809c0ea94d8c1b4e3c9448

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
109KB

MD5
e7d778cb3e7600de78e64d51dfaaf4a6

SHA1
d7d710006afc0f753c83023318bf612badbd23a8

SHA256
0aaeb064a57fe9dbb5cc06a1686589f20fb32bea82e563e8f74e09c4ed8b342e

SHA512
12beba218104c126876265bb8265b43f130da216902356d1c294223529e9675b9fc96444b89248b7977786180d098e674fabf64c70b4d5e443e668bffd29bc8a

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
110KB

MD5
6ace3288cbc4ac2130277f15a15cf0df

SHA1
9687ba8716f69f22a6feba9451b70b9d4f09c52b

SHA256
8fd62c845b038ce5bb79847af7bcff2f5f20ed2801eee60e9570dcb7d4f0a16f

SHA512
bd63e8d73b10eadf3ef096a4e99b752bc6d4404f57afe9a760d291fc83dd7468e74ae36d05af7913cce90ab38d7d0fb1a744ef26587ec6bf51f2f9ea219dc93f

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
107KB

MD5
88c4d90b8d120672ebf4a90338315249

SHA1
9e7c3166068e21b19159137db437afdd9e05e4e7

SHA256
4118612a173ff4660f2ad2ffe7a25d4c2a50416a0b1ff8180a8d296623764cd5

SHA512
3524cd91f090af54e801882693b7ffc8509b35d3b32ac29f2f511afda6917619b66c23b0bbbbd7f56c9d8d8261de73d18601c2555c02eeb299f5dee1d7558286

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
106KB

MD5
f70df8c108cb4c653148504a1e8136ca

SHA1
d1cc4156b017fa6f3633d0bc9924cb133032e1f2

SHA256
b4041566d0326a5304566f9d360749859e945a0195167287aad1ca1738698ed6

SHA512
9f345b78c37bf3b0e34cb7948b96a9c98391ca948adb2917caa0aec6766c7d701842fefbce860d7fbe0b2c8b811d4ce93b1f29251fec5d7eb158435a5880c04b

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
96KB

MD5
4eebc12a20c42d81514868f28b1c00a5

SHA1
a6394186c4b8749f48cb28761b24b84cb9c63864

SHA256
10ea20697d5f559c015a02efaa9b4c277856339f63491bc114d67835a8baef10

SHA512
60e201b6c6ef41cde6533f20651d69589e0d8bf6af0111ce372d719d7c53b9152343091ddf64d474730ac54eb97d52fbdf8c390b8260b0e1ce0d09b793d76936

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
117KB

MD5
b5147e04e6e48edcf86fba928cabd41a

SHA1
3974a4971d12392292f010b4eaa922d89b97738a

SHA256
a336838e50e47c8d152d3d04c47fd44522951daea37300ee4f499b35ca4ab46a

SHA512
60841013d55263f71984c1e98c41278b6375bbca024f4a29b1fb2155d9145c8d6ee532854cf871698bf139ce503c1701fea6aeb2cf17eb9ebdaaf8850dd9e82e

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
118KB

MD5
b93caba94c9c2b32cb4136d7a4b57e04

SHA1
2ae6c7088b47b3f258097bed59ca7870f1fd2f2e

SHA256
5bac85e70427246a7d2b1f2a6573337bfef1981af27ec7a202b8a824dd1866ac

SHA512
bad4473f960bd3ac8ca507cbca871ca8af1e726e69bbce2be99b7bce82bab3dda761ed115825047908e2295f5b39c866f84276872fbab59633263feb040fec05

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
108KB

MD5
aa19c903663d387e9289b475198caca4

SHA1
d5a4999cc69820b6da8dfc4ed2219dcb19745681

SHA256
b5bb510f5b65e2c5986e01aa0ac1fef949f5e489e070ef4a2794c6851b7aa3a4

SHA512
c8f3b85aad5f871cef4e066664bff0e2e41feff2cab9924fe9c95ae43a1ce687d7b040a22541400fac6bfa87f9e7b3024565bc65f54ceabf46aeb0a380b3c0c5

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
95KB

MD5
41a11fe717ed96b4410571377b1199e0

SHA1
8e13f016bf3ea6bbed7e2728d14c7633240c9758

SHA256
2cee224f467b2ba0c7fcc3558fd77fce0cb01cb4e8b78a3a8c6864bd63d4034b

SHA512
7e7d362505f052e5a02e1d144128fa2da6591009330dd823304e08e8a0d5a43bffe4793ce3efcb785aab83f6deef7a52a5e6cd45bcbfdcdbd35ee30ac3637133

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
95KB

MD5
ee6273403a171f18739b550d966ba2c9

SHA1
8b64ff2b3f46b4277f2da7a67724da394f60c1ca

SHA256
d4b6f2750dbb00db326e462485e7437c6ad9ab24c01eb09670fcda0d55178bbb

SHA512
d201b3230859bd3cb9de90fa71977b88a854e9621d314e43cfd4ca7d6979198343b0c0326415bc5fcd42e5b4f947bae6c62ef2da84a3731da75fbf2ecbee27c7

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
108KB

MD5
fa905445fd1b805f1058d1c0f4e836df

SHA1
8610c0ded484dd876f1f16765b33ecd9e97662a4

SHA256
ca9fd6c642b26f3f34490187f9b9cc87aa3212ae23c9fc1b2af35d72375acc50

SHA512
bdbfc3c65f3ff9fbc6f0e65e18d1542fb41762211d5f10984f94dc91fae29cc70cbdb6dc3e6fad489efbaadd8d8e16e3440dfa2a60eabdd2c6dfbfc0af1078f1

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
101KB

MD5
692783fc176b48b3effed7fc7bfc8e2c

SHA1
bb2678bc989c33795828b624790b592dbb4a3bdd

SHA256
71bf329c4e780c6685afab3d4df937a2e241cbee7970ff6092ab6d84454a1067

SHA512
4539fc4a60a3f0d5202c192a31716c75d992eb1aff9aec48c4613b2c6fe10e7d2c16b9d384e0be3c50df36b63d156c0d6478ade86a16701cf54bf5d01cb59073

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
110KB

MD5
a68639161a74211387a08b0d7e0953b3

SHA1
48e7171fd8748a9fed88b63b793a3ccfa58e2d25

SHA256
51aa6b5415c100fc9a29644f9382ea53570c8c64ee3cb0cb6541bb1ffbf61e2c

SHA512
e2030aa62db0b8abef9f40cc29402a461b2765c3f90c42a0bc686a4b2e4072c90b5448bd27d252b86ec8195e41a1b6ee8c23f36478de0936c8d8b864c1d23a6f

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
104KB

MD5
d9c43cc6a21e83e49b8572acf7f902a2

SHA1
72504846081391cadd770c86a519a380df1e75b9

SHA256
13fc6e998f85b3c7df97811ab0b4d04e75871ba2db630d5114ae26729f2da520

SHA512
a186006784f93108b2ec2094b69e812e8a5a9e6ebb8dd4544bbe8bf5a412ecb8c1b822cf98d69605e0f29f4aaa94a502facd80aaa546991bc7cbe6527ea744c2

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
105KB

MD5
1c7314870d41baa8c7eeb1fc802572d8

SHA1
2fd8749d1f1c83ee098024a932c6c161af28007f

SHA256
02fee32d082bf38d4d8ddefd821956ae70de51756105879425f349861363907c

SHA512
3bb1cb72f069eac27ddc3861c937963c939021ec5c008db28d4f65d87be1ade416ab75065aac63853b78b0bf22d2477b6c84d7ba2c1f78f30e763bc0899e9ac0

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
105KB

MD5
3d024574014308c43334b69ee1df5c18

SHA1
4e7dff990ede87ce3c878afc023ea82144363c21

SHA256
05d05e1655e0acd80000de6aa9db0f41838bfa7d90075613fd2393274d3ca919

SHA512
c35342ae36dfcaf7b1b26764853d1ceb4c758434bacb5153d4b3b14603eee057646881fef63ea5b802ef1e01d68899080309f1fd0f865bd05069eb96de3be25a

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
110KB

MD5
13c21ed157c4ca52a259a7dcff4573be

SHA1
f0a9f3f0ab3e04e378889c406085b7fe365eea9d

SHA256
df23dde3b17a12a1e5edc9b8896e3d5574b0bb4472685e9cb14f9dd3ee68d9c6

SHA512
fbfdf3b508e964d8e48aa904124f61e830c51cfa2920f6b149b87335adfea09287285dd37fd2e4c5aa560b0cd16f8666287ace91a450c5b14551c078bd449171

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
98KB

MD5
bd6f5c4f31359704c45e556d54e9c2c2

SHA1
e3d83e867f4dd62745072132c0f533b6452ba866

SHA256
d769aca0a5e4024e4c1583d2fdf97a3bd9ce5f9f85ae54540dbdacddd86e78ad

SHA512
d31d0a0650c3079c69efdfcdd8bc9f5c0698a950f5eb8aca1e4746c6e1f3d08f91a0abfbec71aa90fb01f6e7177c349492df1d7a70c01fbd35c46195507016ce

Download Submit
C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp

Filesize
103KB

MD5
9f85af4686d1e8c375cc90bf0a47b047

SHA1
172befbdca47b8e3a595ea8e0516b262b994b499

SHA256
7844692ddfa814f9e6978e2b93463c058f5604841069a47d7ace3eb222c65100

SHA512
93a2bb8c186819aca16377a7890bde687d514a5f1ba5e16b5356f640f330dd220d6716f269d4c0078f289bc7e7d330235a80dc5cff7574c5719f399d6e956dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Performance Monitor.lnk.exe

Filesize
97KB

MD5
fe8c6d1260685a4fd161bee6c189e59f

SHA1
349fd818ff6ada0dfb372c50fd7b8d969fd87742

SHA256
1ce6f693c8658077e868bcbb52ba7835be287ce1ca461046e637e6fd92453b2c

SHA512
c0efd469c4a18fd13a3ee99446822d2817f348f100768a8fe31283d91b4e8f13aa2df82f0aa364f0bbb780cbf58acb518d030d25336265b495a8b701de2cc784

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
95KB

MD5
cc8f5f16db20158771feb7786e90ecc0

SHA1
8a2f4eae66d95dc86a85d71b1cee684b8fc3916d

SHA256
12f9debe68826ceba8fe2fc995b50ace3d37d66464608aa4ac119a6cc862549e

SHA512
ff6312d39343dce8d19348a4b9c332e3a754ef7ea70982f713f56c9c806bc3679bce72a83e79a6303d227d26017e903e7bd1ce50a6fefbc7acd4d464aecf2635

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads