c5a08e71ca4014085921d95e22a33fedb36bb4d3c68f72000bd4c4814e708af3

Analysis

max time kernel
119s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

515b81f00ffb64aaf410d1b54f31ac10N.exe
Size

95KB
MD5

515b81f00ffb64aaf410d1b54f31ac10
SHA1

3c5fc6904d959a72de3eb00b3ea7387f933c125d
SHA256

c5a08e71ca4014085921d95e22a33fedb36bb4d3c68f72000bd4c4814e708af3
SHA512

44892774d8145af2314a63096d740b466d7c45e9feff747374dd82b70a6ac5285a0e388b73d4516926532da23d6956d3ca8a831f80548cf063ae354af5a9cee0
SSDEEP

768:W7BlphA7pARFbhvOsTKnKqtkYP7BlphA7pARFbhvOsTKnKqtkYt7Y4:W7ZhA7pApvOsOKO7ZhA7pApvOsOKc7/

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4692) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3724	_01 - File Explorer.lnk.exe
1196	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	515b81f00ffb64aaf410d1b54f31ac10N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	515b81f00ffb64aaf410d1b54f31ac10N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\hr.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Parallel.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLEX.DAT.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 3724	4716	515b81f00ffb64aaf410d1b54f31ac10N.exe	87
PID 4716 wrote to memory of 3724	4716	515b81f00ffb64aaf410d1b54f31ac10N.exe	87
PID 4716 wrote to memory of 3724	4716	515b81f00ffb64aaf410d1b54f31ac10N.exe	87
PID 4716 wrote to memory of 1196	4716	515b81f00ffb64aaf410d1b54f31ac10N.exe	86
PID 4716 wrote to memory of 1196	4716	515b81f00ffb64aaf410d1b54f31ac10N.exe	86
PID 4716 wrote to memory of 1196	4716	515b81f00ffb64aaf410d1b54f31ac10N.exe	86

C:\Users\Admin\AppData\Local\Temp\515b81f00ffb64aaf410d1b54f31ac10N.exe
"C:\Users\Admin\AppData\Local\Temp\515b81f00ffb64aaf410d1b54f31ac10N.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1196
- C:\Users\Admin\AppData\Local\Temp\_01 - File Explorer.lnk.exe
  "_01 - File Explorer.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini.exe.tmp

Filesize
96KB

MD5
a596ee5d6800c2d00c1502cd8d52b51b

SHA1
06eb6af98c2e5808453afa1ef697cc52e0fd6690

SHA256
843b9606e7e042c0d39f20a0718a6d3866e80560e500d44a98f3719bf13e7d08

SHA512
b335c7a2f5363c6134c81075a6c187762525c2e1595bfe3abac5d6dad907a13ef5e9c9817f7b0da9c9a850d4fd4a0f9014f474391b78a8e7c8203545fec9daae

Download Submit
C:\$Recycle.Bin\S-1-5-21-3419463127-3903270268-2580331543-1000\desktop.ini.tmp

Filesize
46KB

MD5
ac2d0532d6e73115fd1efab276aaaed9

SHA1
b5efb6ac75ddbb627abe4fde0d5f7e87009613af

SHA256
c68ea6335632e14b24723b982f3521b9e563d76254f76bc7c06c801a9e394b21

SHA512
5538be29fcdcbc9c5a48b894c5213e2b4d27d060d4f2cbed3f7771c20cc6a22fa6e12b9718cf8c292544fbe6da959a36f8d6c9ce9ab75eaeeb9a804d95b2243d

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
159KB

MD5
417677297f5d1a8ad1ed5b7de6b0f4f4

SHA1
a8c715909d1aa44cbcc269f2a7e3adb49eb207f1

SHA256
42700985c80291afb5b2e74ab3021e03867edf3021a9fddaf7d0441302731951

SHA512
37a6525cc0060b6153c163b2ea32d480a0e23feeceb164ee38614f04f760b08266478ae2c113132256a7c496f187a1fbf603d37da89105680d0e728d299e8dc4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
145KB

MD5
cb20b1cfefc12b8a825413cccd27a712

SHA1
f4196b62741af9f57104b5e6b3d93d3bd82c72ec

SHA256
b1b08ab77ae921f72c7b0a54a0a7016c8dcc2695adf85a0c9a84dfa7617f8217

SHA512
515316aa311bd0b6f3660fbde2dc261e4324669f073b8ebad6e5bc14f9c24b73f9b5aeeb582ed6c794e9d02355847b2180a1dac48ec0b527138966c86569e9f4

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
50aba9259b7e918a927ee0f4a524e816

SHA1
5edca732b423089ad5997d80cde4fdd80aed0913

SHA256
c753c1da59d79228d1d5ceefa8c4dbedbce3530334805705bec264d56fea8d04

SHA512
7a6ad2bb954553276fb497d6ede6467b034bbb13a3537e7990507858fff20cc6b3b9451eb3ad71bfdfca4ec9487883fa117d39116c4fade5658c8fe7c283ee1f

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
9bd3f5ad0a7d7f408ced9137f65039e7

SHA1
edeaf1759255bea371cbf48e49fa2b61c93b9b66

SHA256
f331488edb895d89a1cef0f6df146c297d4c209c27da26d803cb28066db52c6b

SHA512
e66a5974ef1e2330c4abd709df170f9c62821385b4ec50b3ef0cfc1d4eefb31e6c17e04fff3a734f49f0515d24732aef6e18a51ec8bed54f2a596c604ba8ad2f

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
593KB

MD5
6a1181c378d77af47aaa6e21a3c7ace9

SHA1
3336f7fa89e12a1509c965edb6a7c7df80df8b30

SHA256
1957a185ca4ca516a6b8bbc68d76d5df974dadfdc11add0da22e4c958fcd344a

SHA512
f44e03a04782b637fd5df54bc61851665c7c2bb5afbcdb3e409ad1fc21a158feec97ca19c5eae32cca5611a3116630f835bf3a1614c9cddd9157b3c9515d27c0

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
258KB

MD5
101419c5a220339212bd223f52b4b172

SHA1
a1c3be8548d981a0ee9eba058a2383ba9ca1f88a

SHA256
06789de921a24939254b89eee850c426c922e555c46394298504b110b1a2cde9

SHA512
334fd2efc4e24471886040e748c940fedf7d96f38f4b29762676e362a14a1fd337cb3b47ead68a1065977d8366757b17e6aca0f36105a99be500f484925408cb

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
237KB

MD5
6b92464c882c49dc9e51f2f593952b72

SHA1
4323f30eb8c429894d0db9c198fc802001f74565

SHA256
450a1b8e4400b2091c57a9db4468b2e931122d97db36e4671d282a1242c92a91

SHA512
315441a88f952897a5e4263de19e792d04bebfa20b09e222e902684c417800a9668400bf477b68fc6bcdd351de85c25707719a88e2b5ef45660a68fc8cd1d9d3

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
733KB

MD5
7ffd06b29568d77cd097f8d80ab61b83

SHA1
b72258e86446626e64706d2f34757e33b6c60bfd

SHA256
b48fc6b0ac90baf88161585424e758d2b17c2a8377c14272dc318d5e40372948

SHA512
b677077eee247bca82b6a689d3bdecc106207070801faf050c3886ca980699ffcaed7caa447fc18ad9e424eeba9a574d2b7beb34b9cb55761a0461178f53dd9c

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
58KB

MD5
d3f0c998e1e92747a33f1129732f7709

SHA1
75c9a4fd2f1db1fae4a5c1ab913ed6af89dd3ddc

SHA256
d8b8ce5058cb55712986f0a7239f6b117f9212dc76e724b9cc99581b0b6281eb

SHA512
3bbcdfd73472017537ee320dabd09d430ffb953f3dd6f4a2f360343632749591b4c9a5b804d99ced3fb2cbbc5265ebd6077d3386e62d350a568bd1c243164a99

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
56KB

MD5
f3a664144a02dd8f8b5beebf1faa2e7e

SHA1
5f1a5d49bf44875b59773314db624af839edd037

SHA256
9695c018dfd09ae696cd7b2d7f071e354c5e46bdbb321ba77004b98ba639a45d

SHA512
676ccd1658a49fab1fd1be0ec5be7a16e292a57841cd3a0d56334647a7c1f05dd0f4757e2a406b4b23fc1ba7177b1eccfe299308e5366df5d542188d6c5b8edb

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
56KB

MD5
cb4032e9a0bc31903fdf8303a6d4b4d7

SHA1
28cd297ab88886cbbcb130e3693f3d43a6d7cce9

SHA256
5d6d4a1a9ce8d83cf2aa088f2d0c20bbf961def030ee7190ffd1707e294485f3

SHA512
7ede7d81a3e6c064a3b1fa6807e691f950e2a3bb9b9d0d8ac60cfe4603d4af6230bfb6dd02b8f37bc7a48388ddb721509d19f5d55913c32c50dc12df8eda8719

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
61KB

MD5
ffbc6cf506c66210ee6a6cdd081d6099

SHA1
7394f812a0cbd12007f2529a2f7a4129d97041a9

SHA256
6c380bcf4267e5a3157a8e7ac6eb3f701b53366f1c0e6999ff72b5fe88d76c42

SHA512
e77854fc108f60ab60e4d0d232c79ab42f89fed965dcde4715b419bd85156ccb59839873f672caa9489ced7396a42d46fbdda8647f4271e3c25e31d31942f225

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
54KB

MD5
7fa40212f2b929ff862151fb32ebd0cf

SHA1
08b1e34a7c1adc9f1b8c267d2a46e7424018cfe3

SHA256
902b06c746c07175bcf93b744dcd7db40f7c5c7ca12209ef95273d4abcfae876

SHA512
49eb3b7480b9f26876660ebddb7320052a61f310d12c527426eaeec31fb256e8422a8fc950da45d4b76f5e7ad8c3b748543e53c4ee341e2f9f77021c78354d56

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
60KB

MD5
771fbbac766fbf48ce5f8b44200bf61d

SHA1
b401c667307e013160595ceee10ceeb8876d5e59

SHA256
6977f983600dd4482b08f30331d3e063a805a6459a65116895385b05cddca25e

SHA512
beceb32517b8d298a5ab1363d258ff8f5f25091445c25d5e7ebe6f003cc487cac6d06c3b646356e915d837f7e099d194d9654603f2d5900246e3788dfbb8dd3a

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
60KB

MD5
c4a91f8682885e2e233ecd047d34030b

SHA1
4368eb56ab859b31d2591f089fe818ec660cfc16

SHA256
6b80608c0dfa54c964d0c0c245c6f4274a8f290e821886c630f7cb377bc2540b

SHA512
48bd59aedeb32a06f8817a2cc4a5529b921f3e6e026cfff5a8ba4bb1b0203e687ccfcb0a8cd09a834f721df54811d91c45fbdc414554ad586dca00ca9902756e

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
46KB

MD5
feb45bb7079422035055c1ecf74490ff

SHA1
f409062c0fe785a23b8dabec9f565a7514a30ac1

SHA256
991eb473254cbb2db0f928684e79038e48c6408664e43f8f2ceed717dde7be86

SHA512
39d89535c49057b425a8d97671fa1b30780221699672bd708303ea2c5143fea8e9867a778c793de9d9417acdfa074d6b0c882a946df27f4c518cb4a8fd85b0a4

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
54KB

MD5
925e0b75b3a1f7d1753d1aac2d61d6f0

SHA1
7a0ca18f8d6a86d0629866722871f01f021d4666

SHA256
50d56929e1955b7b5d2817c6f00e5afc084e7b5d37dc72a81c718b936f6a3149

SHA512
c5997030323bc6b541331c9e8cb445f0af6fc9a649d70b25d9148f69b44860b11189033c671f887dcf9dda47efa98b584ec13359398a2a0bdd3364ab6600ba15

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
59KB

MD5
316048e315eb0158822b82933fad02d8

SHA1
a6d6b7e94200692193478b83c2ee4bb8ee342dfe

SHA256
0df8935b76b9b99fb249b31b65b94a175368b2cbb18f2cd73a07926b260e1f3d

SHA512
3056744c1ebca9086a4e0f28cc25f04575b284abe7c6e295b5432cd12df45bd3be2727a8b25b9ec976e3d447b1ea742c5d7c7a8be8b368e178bed87e6df31469

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
54KB

MD5
19b853e5b182dc08feb34f693b090fbe

SHA1
a7bc1fc9754be594343b4043669ee87e8e40529f

SHA256
2f585df0994a0ffeb37cb60a9f20086c9716f8d7c6b84f7881b7420dd4372c05

SHA512
049c0de07d129f101da3afe8e7ba16a6fb5b17420b44465168b0480cc64ee6dc327776c81ba32c46e99c6cde1d32dbbada090ea02faad0b732b5827db8074817

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
57KB

MD5
c6969cc506bdeaed39fd61f1ef948efd

SHA1
dfbae4f09d73a6f59b05d47be83713bca100ed61

SHA256
10cc4ddc7061680285e534994651e7909beaffabbbfe3938bee57330fdf33aea

SHA512
79ea0914a5a1e255fa87013aecadab55e29436b6c47a1453915649515c11e87b92765457b59ed21eee6421d7aa75d6f63c52f5b1ebcc349681ab921d5e557810

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
56KB

MD5
ed10fdf30385582c2593b5022790e122

SHA1
4622852f53c7e32079d003ec82105e8caa146213

SHA256
64243a36c3851ee0d888a13c8f80abd46cf32d327b630ea8a2f78acafe7b4e70

SHA512
2e9e6cd510af413f86ba152a9de54e9f917c614f443def238d47c65327fbede3572df87dfb20995eed270c2a48deef31dc4547c837911851d897b967c833aba3

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
57KB

MD5
11144fe731be7130fc274c516fff92d0

SHA1
175585002c1fc16650153489eaf3c7ca721f8858

SHA256
89290ceab2d6811cf966215764c0b28964c289dd5571cf803727a9eeb695c8a8

SHA512
1f379ef25845938359c8403e54c35ac026495631b30f3e10839a699c2580e226d84edd3b1f28c341900809cf46efc340ca78a8a981c731ceeafc617ec854f901

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
56KB

MD5
f31ad9e808a2fa9058daeb531c2017a7

SHA1
517e46f722146104bbf6a8f9353a0dc956a4c6d1

SHA256
4ad70ee9eaf6fd615143810f0af62d28c3330e663192e318affa4c2755ed5561

SHA512
de7d98fabd97cb13b9e9571b16af738aac209afa67509dfd5196635582d31f0a17c76661670c180a28b11cca50b2e81affd0dc8bb02afca1b3991a17d1e3d556

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
57KB

MD5
e0181f7d847bfc1e8d1e7c41ee9dcfeb

SHA1
4ee0bf011acbc1e0eee7897db6988a8e67c3ef96

SHA256
c6e58808d74c9269bdbc921a168cf6f38339920b2a223d880b4405fc61271ed8

SHA512
f65ef4b1a8046b50c4798d5277c18b14140354839542f28fd5fc0a1145e309ec032b8f1e812881e842a8afdd6f5c0ae6b3e38eb167daaf231b03e6e2994d53f2

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
66KB

MD5
67a44f78bc57d4fdc3d9e6d70f9fbd9e

SHA1
46867033bb13775f90641708c2806af29f03797a

SHA256
a66d2d01421acc22d08ef2b07599a6e57f4172586dc1dd712ba88519984e3055

SHA512
bd6c710ba3cf4ffbe56a63a8b36518453549e7edfa125f84ba65feb8f156f13e33f71b4c70cd91009b1a818de725dabfd1f7077bd1527b9bdade12568d1ad51d

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
60KB

MD5
09c9aa1deead1966d497f5bc54befbce

SHA1
de7b67fedc910ba201f694750aeb02523022eee3

SHA256
37bd9308a735424f4d99ecb7179cd58337a94ebaacae16a99ace1bcc40e26757

SHA512
86b54e98216b01051d1d71331fb630746da6e3213fc4b11a9da9f66e332b5ea00accabc5c0cfcc74aa68b8be38f41e5b625f96acabbc9880f420c4dbb982ede1

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
66KB

MD5
15ad0d2e13540488cdf9a158c856b088

SHA1
be302f023b64a6aaa19123bb27579353d66a4929

SHA256
0726a360fa749d0f8b0f0f47a10dc3f3e9437048fd062921d78be12f012c1770

SHA512
e3333533a3448efde1c798f657a3a53c8ab4423a49af5790a31db4a2921249fd5be9ad7deb1cc4b0ec3716e0e5ef2b43c754f1cbdc4f90287fdd026087f192cd

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
57KB

MD5
97b96137d7e8e7e4a8ce5489dc84194a

SHA1
ecb900da08141b4c3fa0701b6d075384a5772886

SHA256
37146e115e023dcf8bf219254659d9403566a705b27d0c8845c05a9cf07a982b

SHA512
b19ed63ae3c9362f28465a47faf6bc716b8d41c6396c29cd128b4268afc22b25cf9e19c407cafbc79bb78136ee0463c2bcb9073dad9dc2ff30c333504fb5b473

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
58KB

MD5
b66791199cc51750bc9a97eeae089849

SHA1
b38fd1dfaa0416bb65dd2395e2fa44427bbc5fab

SHA256
5933d5b1a2defde6150fcb1dbc4e1eafaddbe2e5aa09c5a4688ab245625214f6

SHA512
479b1a5f9d37782c84562ce594809a77432d24e8090e02d84fdbaa6d7e91d57db01c4e4d2b4befd97753e0ae77f855a3d411a8a85a2210db87b36570363437a2

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
58KB

MD5
cc6f991275c15aeee6e7e55ee39251e1

SHA1
03dfae9e16bb1a6a58caee4a50e05e1937e27ba9

SHA256
9b84748366a640a06d75122e39fe58ab8db94efe931498ffcbf69c9204ff0998

SHA512
c5830483a7de8406817ed47d2c1689478df58c92c41c146d9e33b66af72c72202f83e07275b3da932506cbfe0fd54a29f15f167fe8331fc8403d70ef2c6b9af3

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
66KB

MD5
6b5ff0ee4e6083cb162834e1a223f17f

SHA1
8946e414faf37cf145b053c7855b3a1fdf0414e7

SHA256
7eb7388d33a13d54b09912cfbc11626c6150e3639437612f61fc91d1623c74b2

SHA512
3e226c3bef8885c3849155c10951a6017e768d41ca3f8473f8c5501f599144bb9583d0450dbff48601b39c791c408d807c67eabac9f64b885530bfb215e88886

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
57KB

MD5
d8508122fddf2e8053af125075e67aa8

SHA1
a42bc95ac097bf50ac011e1a7c2564ed8a4685fb

SHA256
a1d50ca1adc4bd44e0ebc3ccd411b0792c1502f173fab0b14b649ea0a04254c6

SHA512
050799c476de8c7ebfdbe63a333d512dc8e1ea2717f3c52de9454dc963b495018f2cd819d4d01119829ea1d62fb12d897ecd5cc7d0db2b45a42ee2e9703a75d3

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
59KB

MD5
46e9cb760a379101fff5a96b0ba9ce2f

SHA1
d3356255a2c93e53415129495016ad671eb8103a

SHA256
7f4d826655b0313008a658beea240d4aa6df1ca88501f5681f0f416e7ad3333c

SHA512
cdd493f539fca8a4e35c8d28560311e3715dcefd97ca1dc6d1f27a2ec530c9d989f19e285904b8ac3414ece6aff530f090005de7c06a60049b09c533dbfe00cd

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
59KB

MD5
bc26e61faed76b7b72ddc9f801f2916b

SHA1
512b6b3332ccd65e8e4d3674a011b32e0a908e55

SHA256
2908189f4eeeeaddf41f5c537e36b9bb1945b0a831a084ecda3d00ee625c5bb1

SHA512
d40c23286459b65077c117f2585e9e9a54e7adfb77fb3568964c4e8e527dfbffd274f143697246f51e711ba16c4d340e6ba00abc671b783797922a529039059d

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
61KB

MD5
3056ee04c2ffa080e6c44e0ee9e43157

SHA1
c1d7e5b02f7e8d2030c0a8860ef3e55513261b4a

SHA256
650b5763ca9e4d43a5b8b889fdb39b7f8a1ab8cfa13d9b363e35d3dd8f887ea5

SHA512
f5794c44a546ec6a518c8f4950b54231bf72cdfe86b7f5c908a4296ce4a91839eec32e1ef73b2a33d9c0e88a581808adb0d95ba67c866a00e5398dad74c887e9

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
61KB

MD5
24c93662ca9ee90407cc96f0dd792a0c

SHA1
9f0d7e6d4f3946850b17acb29e96b995ba8ce7ee

SHA256
7722519a1f12e760730f8931aae505edca19e5f8d810572707684055403b4e9c

SHA512
d3df148cbc4befb2886aa73e8a283150f285474817cec65f889a8e019ed514173d7703261d2c2e2eda3b79e726d37dfd28943943eeb9dd1031d44cf782508366

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
56KB

MD5
3b6afbcfbfed8c0d08430872e79a0bb0

SHA1
8bf4581eb46ca7e6eea886db0dc14054b14cd23d

SHA256
01791db406e2d3f18d9575e80d6a570802521a9a47fc82a56058e14887af3556

SHA512
dca746bb7dd57ed6b5c88403868e18944c0348636466f34eba2c2842e15fa79e835c7fb59078693efc6525bfcc5f5c9418d8727e64f869811f926cae0aa1abcc

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
46KB

MD5
3bfaaa49421a60c9deaaf771c1e0c191

SHA1
cf4e15b0c04d83d81d108f4991b5f2147c8cbb24

SHA256
f45fdb27dd295a64e6242bad901d4fc6fe005a5737afc1230872402809517a1b

SHA512
2484b552ea498d14e2bce86230a7856d95ec21021cbd1ac1f1e3a78b705c13d1c3bcc73852fee5af86dd9d5960012e6759276dc37e34a5459b96fdf725d713d4

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
54KB

MD5
2fcd6261f068f809fd6b0b2aeeb6a528

SHA1
351daffe825fb06ba40995863b0e1c2813c70823

SHA256
0223df12985dc5b17fce128503f70c0acb945f5c9f656aa3931c23db0ffc29c0

SHA512
5608984f37752f313133293274a92b1e1db1ed8ac617c41a39685047eedb948d57094074120595abb927f4bcb150f58d6eea41feba9339129ee7d92ce7a45f42

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
57KB

MD5
d013089a9bdb73ab0d3cdfe14bcadacc

SHA1
aad6bac58c6cd512abf8ae77089a6fb2f13a7b8e

SHA256
8c1204e7f4651c2d7e052543356cedc79e5c5da8ba84e1f804ffca6216d62be9

SHA512
b527e5a852ad8e584f838bd8e791564911c99135e7b1df4a2218e6c907fc411ac1c5fbd8357520b5b623b074c16cbd8165579744a7197937ae8628584f825bf7

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
57KB

MD5
929a24f4de01d9f5a8b9b8f0c74daa65

SHA1
fc49ea386f8b220e8eacc968e01e967e63533869

SHA256
cde293a84cb7ed683ff56e19c8d92d07a4ae4a1d67fe21fc82497388a281ea75

SHA512
e96df9c082a5ead734d7b7e2749f2e5ff03e8904c356ba0eb9e6d1eb05f06fa330fca3fc38700545f15c24865f8e90fa06e4c449f0f147101127ac75e3e0828f

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
68KB

MD5
a8441900c628733fcadcde678b225b31

SHA1
af44549998c8ec0f63ad11351ae9cd3297adf8ac

SHA256
27a30d35bd496d52a733d22e4fa1d05c91893dad4bcb54eb1bd5f2f10e8f9550

SHA512
3e00545357a0acbb4df9e55c2341f4d9958768db479f61c2418bf21af6134ce6e0237ee0b733678d38d122e69fe6eb6a33ae564d11728c178cf2bc0f56580ae6

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
51KB

MD5
8f055064f8f50d57bae185fcdd707bcc

SHA1
d03b2d22d70687b3cd60ffb1e10be464482492ff

SHA256
4c82ec74beae517934b9e678f6c96a31416a7763c38e1f145042c320191bc9ad

SHA512
a17ade30913c8a73ae009903f4c2448d8a190905e82ee2553081888f994c943752a89e98cf00024904381c000e6b9de20a61f55fcbcb976e63d6232275a117a2

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
54KB

MD5
4768179c39d3093d27782e5af3281be5

SHA1
a30f281053c42added0781dd43f38c3fcf0b2d9e

SHA256
a08ed27569efbf85b2024206b6b1ca565cb42be5d3fbcf3533bda83b71238b54

SHA512
0e04984302507edc01a496cfbaf3b978f22fcdb5b2ac3b26909c60079fe660826dca2d7da0a54d9bc292d55e8c488d3948ef5afba3b7e4ccb1057a618d8f53ba

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
59KB

MD5
5ac1e7f3898c852ae48e82b41a0d54fe

SHA1
b02995befb03d4cbe49657eebc977e6d4f6fae44

SHA256
0b012b50bdb0205dd9ce1da5e87ee510b8560594e6be31ea83298afd680e19c8

SHA512
c06ac6215b67afbfd1deb497ede9d7d53dc3ed5d6257cb84cb00263f5579cb70106d69bd8aa6e6c2d8b45b9eb2ae34117a44b605a019595feb2267d95b137f3a

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
58KB

MD5
208be01003e9291989a115fbe9bdda65

SHA1
fcbd6b0fd0f49ba99b8472a183c0d91ac271cb2a

SHA256
68f9b5a03807ffd65677d4153748d0215b23e33e7fcb34b01eb611c2c91eb573

SHA512
0526f649f023a3183e5e113c3a0d6f6c14a30da6c641893f965da647eb0ffb0b403f9005ab844e6ddae2dd093a1b69956868332a0098784269f7048033f420b8

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
57KB

MD5
95af9a6e46a49d03ed5282ffc6021b6a

SHA1
f975360400fe7ea0956ed5bbae71bf9236686938

SHA256
36199039762d00dc3cc8e1643a85d1b6a21cd22a9ed9135b42c90bb4028a30d1

SHA512
98f70fc601726ba5b7b37f042f48fc0f6c30c141d84fd00d8a05236af544e79275e8eaa8bf893eb3a3301981a938b42207ee404df254dadd0a513dec7353f962

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
58KB

MD5
9b1c6424023158788e73d8aa49d098f7

SHA1
1fcfe316b53a24a162d02f48f378c2dac2c68b45

SHA256
ae57234f223119cf0a2f4559d9011541cdea444a83f8f38c9033751f1f40f94a

SHA512
0c5a5c029ab724744f3d045d6b4ad9fa100d674a71b54f9ebf661d22fb26dea3dd0481e65667aa401807c1e424134abd4eb58b18c8797feebbc53dd640909550

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
46KB

MD5
41ad9b4d5dc76bc1adcadf95a337c20b

SHA1
9f9f7d8949f398105b9412be027ba4db3e956881

SHA256
7f5b64b9f0bcb50f272b80965ebc45454cc8a1a04492c204a26b553945bc674e

SHA512
e4db2d062baf6458a303d5a39890eda8aec139576367ffe0b9cb9a409a3fdd1d21ac02ff1c9271f7c527184876ce74ba3c684a28d067399133122c9edf6ae755

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
64KB

MD5
79c21122b1152515c6fbf9963a82102d

SHA1
408fc788210baac2de2f0c79156347db572b6da9

SHA256
eb49f47a4e8a07e4e5726278d58ed9de0bfca18226d482d1b21092428cd9227d

SHA512
1f67cfc978031c25ee411a32682694d9d1f3b374704126f17126e600df188e401c8f8137552449ef48a5bc9c25cba04388780dc4b855be21ceed00d017b021a4

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
67KB

MD5
84d017d297dea47a41d5712592f72653

SHA1
95c7225436ca5b442236b57a3ed8acf795c93290

SHA256
50e2fa536a2b5d6447f99ca922cec26edc4b3ead0a09ed71415afd3831c81ac4

SHA512
456984f602066e3e36cc77fda4bbe156198f19d83e19983b60f8edff6477062fdcee79308854a051ffad1cf86ef13250c5e237c48dec1e9d7dd78d9dca8c756b

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp

Filesize
450KB

MD5
2c2d7ecb1402a93ccab603f3e5e27be8

SHA1
44b5731dbbd8fd73d9d0d4dea1d8fe825da2dee3

SHA256
77daf52cd41538ec9dc52a1d5ae4a26dd7f8abf1e7d691eac2622b60151a6d82

SHA512
cdf24c6f2860d522bed5c44132bef1552c9ae9e4b08fa3e13b7b70dd6aa12ce9785794a1083000092143e965788f32815a74e024f627862f402570d4b980be5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_01 - File Explorer.lnk.exe

Filesize
48KB

MD5
f307e7bcbb1a55acabc045bf39496fd1

SHA1
258bab75ad61a6cb9ce5b3566042b431b6e51193

SHA256
78dfb6fad131c599177a5908d89cf05e6c4b3234561f411ead9eefc6ae533038

SHA512
e5bf2cff507d5977b8aee99e7626db8449f1fe638a5309e52c1c4f3c211ca40c39157b19974a23d14b3ca6c1863f643bab2310a4fb90243aac901538ed78b7c9

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
46KB

MD5
8705fb39365089b5237e39cbe34ffcaf

SHA1
3016cfe639b6081de458859a13c265b920b6be52

SHA256
1b923a4bd841416b5464c93b22b9b7085c146824017c6a3d8ed390fa2247c5fd

SHA512
c4c149cc660275d810601be58ca568163a2fd6677eae1ac36eb5bad83d27ad95c0dfce30203cfb74121fd48bfd6077eee1840b48d4a66714b1ea19bc8b8a444e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads