ryuk | d992871dd45a6302916f809eb54639a656c9e619451c10a03704735c424be0d9

Resubmissions

21-07-2024 15:03

240721-se4c2awdnp 10

21-07-2024 15:00

240721-sdg4eatfqg 10

Analysis

max time kernel
70s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21-07-2024 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe
Size

384KB
MD5

5ac0f050f93f86e69026faea1fbb4450
SHA1

9709774fde9ec740ad6fed8ed79903296ca9d571
SHA256

23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2
SHA512

b554487c4e26a85ec5179cdcc1d25b5bc494e8821a8899fbbf868c3cf41f70cc72db107613b3f6655d3ab70f4db94cce2589066bb354b1ed955098d3911b844d
SSDEEP

6144:f5yaXtrA/WSo1rl3ALrlHQpn0BwK3SBDmhYfFQC:fTX6WSofcZ+KCIGD

Score

10^/10

ryuk persistence ransomware

Malware Config

Extracted

Path

F:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe

Emails

[email protected]

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exeZISVh.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	ZISVh.exe

Deletes itself 1 IoCs

Processes:

ZISVh.exe

pid process

1612 ZISVh.exe
Executes dropped EXE 1 IoCs

Processes:

ZISVh.exe

pid process

1612 ZISVh.exe

pid	process
1612	ZISVh.exe

pid	process
1612	ZISVh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\users\\Public\\ZISVh.exe"	reg.exe

Drops file in Program Files directory 64 IoCs

Processes:

sihost.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\VBE6EXT.OLB	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\wordvisi.ttf	sihost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Stamp.aapp	sihost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_joined.gif	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxl	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\GIFIMP32.FLT	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\PIXEL.INF	sihost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo	sihost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluEmptyStateDCFiles_280x192.svg	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_output\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Certificates_R.aapp	sihost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\spectrum_spinner.svg	sihost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms	sihost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\NEWS.txt	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png	sihost.exe
File opened for modification	C:\Program Files (x86)\Adobe\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Measure.aapp	sihost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MYSL.ICO	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.EXCEL.16.1033.hxn	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_invite_24.svg	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SAMPLES\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.LEX	sihost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ja\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_es.dub	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ta\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac	sihost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-80.png	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\THMBNAIL.PNG	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.boot.tree.dat	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\osm.x-none.msi.16.x-none.vreg.dat	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml	sihost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\SONORA.INF	sihost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

sihost.exeStartMenuExperienceHost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\WasEverActivated = "1"	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ZISVh.exe

pid process

1612 ZISVh.exe
1612 ZISVh.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ZISVh.exe

description pid process

Token: SeDebugPrivilege 1612 ZISVh.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

sihost.exe

pid process

23472 sihost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

StartMenuExperienceHost.exe

pid process

8100 StartMenuExperienceHost.exe

pid	process
1612	ZISVh.exe
1612	ZISVh.exe

description	pid	process
Token: SeDebugPrivilege	1612	ZISVh.exe

pid	process
23472	sihost.exe

pid	process
8100	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exeZISVh.execmd.exe

description	pid	process	target process
PID 3712 wrote to memory of 1612	3712	23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe	ZISVh.exe
PID 3712 wrote to memory of 1612	3712	23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe	ZISVh.exe
PID 1612 wrote to memory of 4876	1612	ZISVh.exe	cmd.exe
PID 1612 wrote to memory of 4876	1612	ZISVh.exe	cmd.exe
PID 1612 wrote to memory of 2956	1612	ZISVh.exe	sihost.exe
PID 1612 wrote to memory of 3044	1612	ZISVh.exe	svchost.exe
PID 4876 wrote to memory of 2896	4876	cmd.exe	reg.exe
PID 4876 wrote to memory of 2896	4876	cmd.exe	reg.exe
PID 1612 wrote to memory of 2780	1612	ZISVh.exe	taskhostw.exe
PID 1612 wrote to memory of 3612	1612	ZISVh.exe	svchost.exe
PID 1612 wrote to memory of 3792	1612	ZISVh.exe	DllHost.exe
PID 1612 wrote to memory of 3884	1612	ZISVh.exe	StartMenuExperienceHost.exe
PID 1612 wrote to memory of 3948	1612	ZISVh.exe	RuntimeBroker.exe
PID 1612 wrote to memory of 4028	1612	ZISVh.exe	SearchApp.exe
PID 1612 wrote to memory of 3188	1612	ZISVh.exe	RuntimeBroker.exe
PID 1612 wrote to memory of 4260	1612	ZISVh.exe	RuntimeBroker.exe
PID 1612 wrote to memory of 676	1612	ZISVh.exe	TextInputHost.exe
PID 1612 wrote to memory of 1632	1612	ZISVh.exe	backgroundTaskHost.exe
PID 1612 wrote to memory of 1352	1612	ZISVh.exe	RuntimeBroker.exe
PID 1612 wrote to memory of 4328	1612	ZISVh.exe	RuntimeBroker.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Drops file in Program Files directory
- Modifies registry class
PID:2956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3044

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3612

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3792

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3884

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3948

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4028

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3188

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4260

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:676

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:1632

C:\Users\Admin\AppData\Local\Temp\23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe
"C:\Users\Admin\AppData\Local\Temp\23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3712

C:\users\Public\ZISVh.exe
"C:\users\Public\ZISVh.exe" C:\Users\Admin\AppData\Local\Temp\23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe
2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\users\Public\ZISVh.exe" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:4876

C:\Windows\system32\reg.exe
REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\users\Public\ZISVh.exe" /f
4⤵
- Adds Run key to start application
PID:2896

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1352

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4328

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8100

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:23472

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
2⤵
PID:24044

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:19144

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:24620

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3516

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5532

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:7540

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ConfirmFind.jpg" /ForceBootstrapPaint3D
2⤵
PID:8096

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:25900

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:8908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.chm

Filesize
112KB

MD5
82c98ac62a2f1f4df6ed001fe24f7bda

SHA1
7847bd45e2262a5be64ab29585caa9537cc501a8

SHA256
01107b699f7ba496923980a711edd349b9c3b43c74ef574fad41ee69a812d760

SHA512
d4f7205d722e1299daa720893f4fdadbd457a55610b8526b6a0608a28aa458a6a2785536114f2c9662b58385971bfdbbe5c9f61582b62b04e8ec32dd530cab09

Download Submit
C:\Program Files\7-Zip\7z.sfx

Filesize
209KB

MD5
be2da515351c987c99fe9dfc216391e6

SHA1
868c455eb8ca75d2b64dbdf889e1f555ad8f68b7

SHA256
7b8022d07706a0e042bb5a8540f760daf9007ba1762afa0cb55af4817d1312d5

SHA512
514c572e8d8a65562c8c6300ffbc28ca5bd879f041ebd9d97074d2d3321b674d3ed7b4a185afb7742dd2db110d89d1e85ba69b3ef198cc9fa43148152e0bce95

Download Submit
C:\Program Files\7-Zip\7zCon.sfx

Filesize
188KB

MD5
b3c297572dc90084553c2c43e375dc1d

SHA1
901a162e9e27b14aa73fb40a4bc207fd6909dd74

SHA256
63b06f177a2709e738abcca6d7e9db5a389dcd672199668c4fd92bbbcd6c9ec8

SHA512
60579a126ec0a2af1077c96f56951f0c66c88e8393c67613522257778e510a08b5afadc61e36893ecdf3bc92259ab85a622db42ecbe1142deff2e89f364c90e2

Download Submit
C:\Program Files\7-Zip\History.txt

Filesize
57KB

MD5
7bb495bce62c014404020fa54745066a

SHA1
f3f3ada31dfa6dc375b2568f106f738d995333a7

SHA256
e8842df39425d16c0dc87f9b0d28909221fa771ae995d3509770e986f3bd3aac

SHA512
531e7e49bc3c6b61003d4b257310cad20dbffb7b8fd10781ae0b148ef0f2ab88ad91fe3ec64d345353124c44d22850d81fb220b3112a682e56b4fbd63fa15cfd

Download Submit
C:\Program Files\7-Zip\Lang\af.txt

Filesize
5KB

MD5
bc5361f71fabef6a877938c3c5c989af

SHA1
135a5b488efe3598e9d770418213a3fd83a40c17

SHA256
082fe7869092d7068ceba330381d95a1a013873abfa6c551dc6232f0f3a1e0fd

SHA512
b8016a9afe0e4f2abc29c21a56a8490a613ea808ecb130095dea9230aebee69eca8786f50d1ebba200a1d75ca6d356d2157456f2d621a5a0eb65bcd92bb3145d

Download Submit
C:\Program Files\7-Zip\Lang\an.txt

Filesize
7KB

MD5
30580ff3fa8169504aafd3ab2b247c8b

SHA1
ea1a16758e073d22fb7617f5f4932b95f56c1e78

SHA256
574865440dc7cd61b097c6806b928c041442d91ee9502b9021b136ec8f861a92

SHA512
26d9293697cda125895b72f5ecaa7cacc255d1055cc3b20717b525b4f31b1d3d41f8bb8f9061ad1a39d6b61c6120d5ee73922bd63dc210d1033453114acae423

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt

Filesize
12KB

MD5
bd7118fcef9510d8b07541226d977c08

SHA1
71b647f6286992b80f56a780ff2447597d37e5ba

SHA256
f12e83a8a44f9da7ef94a7c7f829566f8f34a49af73bd44ecd6cdf3e05eaafe4

SHA512
93afd1693dd36585baedf41c903e6bec9b983e85503fd9f124e7454a9959af47d37bd4a66db980cfd4b8525ec5a0beca98042638fcca513ac7423faaa19c9fe4

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt

Filesize
5KB

MD5
01b5a55b4e371f47385ade4a6d33c9a3

SHA1
919083cca3e17be6ae06f7bd8ce146b420d0812f

SHA256
3eb4c2878e9ada9b989767c26b8a49994d38061de6d0147dc2aa229e930aa3f4

SHA512
4962ba9d96efe39ea1d852f64198db670387a669003b29f8a7286a24fa9d19ca6341a645f59cf38e4a4c6c9b84733f0098e937508018badc5858adda75c01cbe

Download Submit
C:\Program Files\7-Zip\Lang\az.txt

Filesize
9KB

MD5
0712cf5ad5e8c8dbe4ecdafa38f841f3

SHA1
a84d58cdcc3f3eeb1201128fadb85ddfc0e467d2

SHA256
dda3eb5c0e9f6d1057829ed559f2232b59990e89c365a166be90372dbd2f9e34

SHA512
43f1377d8490d4f4d62b98e0a2cf334984970205bd4cb3c680e3084ed6af40d8c741fd1539e86438410fad2af3d289ab8402900770f9083c26cec5ea3cee382f

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt

Filesize
11KB

MD5
bbfa2c7ebd59223a43209eaf5c40aaa2

SHA1
1989d387f4cc9da5c23da9017c89fe51947e5fca

SHA256
eb8eaf111b0480a5806e159c34371dc9f0b0a433eb43a55445506cad97a80cfd

SHA512
8499e05e74f71e0e660f8b4abd2b517dd71c8155f297a8b7b5bb24760d46a2626c02121103def6a4c7991d4484d874e02db588d1127ecaa68cb7c0e9765dea35

Download Submit
C:\Program Files\7-Zip\Lang\be.txt

Filesize
11KB

MD5
54deba649467f5c588bd53e0a03b5955

SHA1
39088f0b076c9065291f970f54d752962872e941

SHA256
921088088c55cc02cc0abcba3b80c726518e7f1c50f2b5beca624ae52631fc7c

SHA512
1b20a5c004a5b9f8646ff2cb504a24f2eb3c8e2f98682475a7d48a83691f4e19956c6ae7ec0fe5de2e7e8e5b84706b3aceb7adf1ad2a51f9aead51f02fbd2238

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt

Filesize
13KB

MD5
160d7e6c4b664ae44365c964c4f3bc90

SHA1
b60b48a5cd17fcd726410c8519f91618a6a30f2b

SHA256
79817a9d5665855dcc876c0e542b25f7e4f97556e7e63857be6efdc52740f463

SHA512
c5cd28f9982265c91fb16ee9503579f0947f72ad9a539b8b0825b2bc986e60b8dd503066cb7e86fa06c5f6f9e6304259f102e9da2ea51053e50e99aa65e16407

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt

Filesize
14KB

MD5
095bf480c4bcf5f4928e80c2a21f594c

SHA1
4d018251fd2259224ec63ffde7319d24fd325439

SHA256
78c32350cd740165d391697e698e29c0be0222f0a6babdb5831a5fc4771752c9

SHA512
dc3ad3671f001c5cc0d493dfd9bc2410f31e977909b3a8a0aa27dad26e3c0cb6c65a6e0885deec30c4b135a2c49c6b0ccbe98c8e4726bfc9dc0a4c23e41454ce

Download Submit
C:\Program Files\7-Zip\Lang\br.txt

Filesize
5KB

MD5
f9d1b061af5b572e1bd58c4119895a65

SHA1
6c7de62347363b89bda39a4e62c1eb6c3c543184

SHA256
38fe30b20d2d77167a64a45c0bc135aa62ed5ee6aa04ba1c826cf1bd6b89f952

SHA512
b0fe5f617b9816975158ec5acd81fd49adff245a842a8d41e0ffa168b126ca95a02fcf749f5abdb352dcc0cca4c06f24a1a027d5d26234d06d917a1a00e73f88

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt

Filesize
9KB

MD5
9715a2e09a62279309306190e9c333ae

SHA1
e73c1d0269554eda0d625fec8a6d87471d437086

SHA256
e82aacc8502f7f170d1277e7ac0fd415942b70e64e24c70ada8f4c654888d244

SHA512
bcb107bccd0ff3bbb76865eb81252a1a82d3a952b9d43e98861086c9477a3647c6584160bd29bf6fcc3a023b9c73b85ff3b661654f0f724d27d6d62ace5edab7

Download Submit
C:\Program Files\7-Zip\Lang\co.txt

Filesize
10KB

MD5
643c7d3eb6aad9d08839466764ab8f96

SHA1
76536ef71def8f7bf4a6a091ce30edd30cc6fe15

SHA256
9547d8bd0b5cf295728003d29039304ed6e7ec7f67a34e8fdcacfc9872e0f907

SHA512
a04c49a7dc832fe472b22d0198917cde3f25ae2c166bf2cd7a8d376ab4ebfdcced650bc1b2088d793e970bb718997098299a0c89ae2211ce5734e04eb918229e

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt

Filesize
9KB

MD5
7bdd06bfc33ecb7a2e62b7f79b5e036d

SHA1
88c0e8e898e330b93631585f3acd548bc2de1a86

SHA256
9ea1494eda763ff9e3a76b07ce54554b3dafcc03d9b58509dad0b78882eba18c

SHA512
d651dbd1aa337979cedf2764790c56f44eb4f365ba56d5c8db14367611071ad696a99ae0d3dd16d2eeff52c1c9e589f1a0a1fd4fbf75a269178c7486bedfd51b

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt

Filesize
5KB

MD5
e9afbcea6e8f70e61101c470e49a88a6

SHA1
a02013a067a90f184a3b1e71cf5bd6a84df2e637

SHA256
7b56172330f0a1badabb0fa640252ba6a20a2e42b9f1929f63b0713358d962f9

SHA512
46a441b04f3fbacc753c5c173a18d9091a5e83d744159ae1fb05c34b400abf2a9b73e8e6a4597be96c02ab92f31166d74a8982b4c137508910a368f88e43b8b7

Download Submit
C:\Program Files\7-Zip\Lang\da.txt

Filesize
8KB

MD5
7b3c042acf8032f978e0badce66130f8

SHA1
5a033be81b0495a15ce5f1ba3bb79ff016f009d8

SHA256
e0e50d8f75ee58f8f88aa618154e436741b13e33b8c6abd22b9261cd1601530a

SHA512
eb874f0f99892917012480c24d070e21ae6fa6cc69930f7a7c4a746cb9b9fa71172c06c3bc54453e6d3acf1359f0df9c32d95c5d895d97ed0424e2fe47672df2

Download Submit
C:\Program Files\7-Zip\Lang\de.txt

Filesize
9KB

MD5
f428c541c0cc8f06cb46b76babe59ea2

SHA1
c756a8b75ffc2a19a5fee1c9f6a8845ff81ab979

SHA256
7c891d8a6f46711ab563b3b68fc35177a596d4fabd3e0690788bb714f4c5b0a2

SHA512
09a4401a50ed38bc8211e97658ed6bdc8d424996c4edf2954c46261527006ff02d76d2ec0500e7ebadbd3e846c9d4d149b83c87a9c4baa578a89bcdd17f42255

Download Submit
C:\Program Files\7-Zip\Lang\el.txt

Filesize
16KB

MD5
bb72b262b46c0a3b2d69449e85431c7a

SHA1
8f8478f96b2922fdb7523f7c05b48ea1f83730a8

SHA256
e18fe40ae0dba539e62c018f9d2fd609128ab0d9e7da4d0d93c5394024b7ed92

SHA512
3a600bf9809d95477ea2e00567b15c27f147c62db0ef6b247ff2a485b1a1ee44f3d668afb4cd6ded62e1911a95fd5e778d6b0f6be95da20fa7b7777e1aa2a15b

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt

Filesize
8KB

MD5
783d632ffb9bed186912ed5c12e2b491

SHA1
66c3829e672a8fbdf3aacf5c518c692cf3a04817

SHA256
743da5514d2d06d92db8affe09e3417d1664deea2d692f749b0552733e51287d

SHA512
d9fc189fb4b1a45052d81285a80b68ce904d8d752b7d2f3fa7bae16224e8e525c23d8a169893803df24f64e5390d53e7f1ec8ac1d502ff0762b49052afa611a6

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt

Filesize
5KB

MD5
a3b0dbc734a8faa2aeaaf1595ee20ade

SHA1
eda95dc239062e944b4e1119248b28b3a8bde4c1

SHA256
b41c7d99f0bb253ff920267db4661494458c73e0dc72912ea4b98f407a8f5704

SHA512
8d3adc3ce13d7dd9cbd9f026fb809e00cbf9d6ffc1d63e27800a6044ad604e599c04485bec246acc015ba4e914cb03dd245e27c0982c41ff48e966217f5e3d49

Download Submit
C:\Program Files\7-Zip\Lang\es.txt

Filesize
10KB

MD5
87dadb6d4fa99d70245b27eff5fc3baf

SHA1
aa448d2e719520629dd0c1f281c5201d3d50e801

SHA256
67945083dbf396564068dd50315b6d9f9de85830b8e0f8b99458500538b8c267

SHA512
91482fec305070684aa618fedf4e7c69097441318c5b1f492a1ba8cbb09568dcdcb742c7bb553740be21cb813c93c9ec35135bc460908e90fffe2cf5b07d4b5a

Download Submit
C:\Program Files\7-Zip\Lang\et.txt

Filesize
7KB

MD5
4c43e3d7e1b935d444e3293dc2ff499b

SHA1
454cb6a2434b0b69e557167db80e746ca5a2e6c5

SHA256
976c245430a4ca8671d528b7ac9ce230ad8cdf547f3ce58ab386ee4d3e4aef24

SHA512
11459aa6147ca75893312636da1e94878397f4631db5f1a96d4836748f6405692a1ea09a9160da560cbf803732d768bd5c2b3f5762a85e2473c2cbb56d232a6a

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt

Filesize
8KB

MD5
7d0eace3bb2c783e2807aa032eb43aa0

SHA1
89e5b1d65ece825b877e4108f132a2f45b39fc1e

SHA256
0d635e0d9ddf2e310246e3b4a3efd0a9de0479dee938c41c9b8ffb1173fa764a

SHA512
a6769c46a0e081d4c18c71f62e8d50e06a18656358c071d7e85df751a5a64f6e8c0442338f4e07d6aecb412d867e0a08abb721d098271fb2d2f673d0c682aff0

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt

Filesize
7KB

MD5
5619d1549c56d393784a34f536815fb1

SHA1
f4e15bdec5b0eb23477d378ac228931a352169f0

SHA256
b71ebb5b52738f3357081281b2e503022eeaa954237537bd1c192162677bcab0

SHA512
783f4efa3399978544bd27ae23de9182a4e9f6f05f445eb2f299be883c2f09b3e87f14507db6d4b601523eda3c2822c5a874a711b0f162f2768bfc3b4cefb605

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt

Filesize
13KB

MD5
8588b40ad0af05f2325885229a41e2ce

SHA1
1b16a4f55ad000b8b5ae58e178407ff362b6ece2

SHA256
a6a23426533029fdfc92401c621d6073814ea7d0c3db9e6949807c26c2b72dd0

SHA512
7458d66f53baa9c9c7bbe666741172b253634aa7f9a90575c3d779997a1b85a9e767a13cd5e196c5741043c9e38e5edb0c63693bd56d86ae39cba09f0d10fa7d

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt

Filesize
9KB

MD5
097d7e1975f5b2f36d3c3b71ad190166

SHA1
0ba015731a6928d247feb63414b12d6454bc9d25

SHA256
a489010a3071ecbcea7deb43d2d83b485b6905062ba95cd345b812b1de1d272a

SHA512
da4ad46541bf2f4341b9865b4d2574fa321c4b8772e4cf3f3a2657a2aab94f42431e79efa8e2089efb64ba82455db56a33dba984d05af310dccf04675f7db861

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt

Filesize
9KB

MD5
3c6980e5c4ebcef784cdde16ed961e7f

SHA1
560461192a1ebfe365bda365632df1341fa73597

SHA256
901be14a205d245122f9b5759e4e084fc8820e4d22bdb4e2e876b7ee152b42ed

SHA512
cd6c5b3b6ad60d8a2ff94aef20b02d79ca997020da725804d149f5e41e55f00d060f8341466bd962ce94260de65242c9338b24c8aa97f292c8e72ecafed89342

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt

Filesize
7KB

MD5
b032b8ca0f14e36ff5755a0f202f75de

SHA1
6bfdb33d4fe41f99bbb3d67ee7431f051158085d

SHA256
53f97fe5e252791cfe6b21ca4b36384ee31ece8a613bc75e260dc3c757cc2bc4

SHA512
7891592d51e609da9abd17f4b187ea9abeb105931e78b4f76ad64dcdf8c86b1e4e53d4ee116d812757f870811b451b7697581a0a8de2948db8bf145e28957f87

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt

Filesize
6KB

MD5
1a32e80ab2def595ab519e4f10e5ebe0

SHA1
35e3644e16242ae66b10921d16bebd4b538d6e18

SHA256
38f3160438083684a486d9389388b7388e7434203b05c1aeae159b65ff01e9c2

SHA512
3a63d9f46440a6c6e2b6e2c2df14f18e16614f5de315c5abb2fdacdbef72cb3bd418d7b8c1d5c51a2811e84010c10706367a123572d567d66117a4199547de1e

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt

Filesize
8KB

MD5
4b7085fb7f219025ddf82399993d57a2

SHA1
d5aa6a6fc2065597685577f42469299e1537929d

SHA256
e53e3618cefac01e9486d704e67553251412b0416e2dc6f67dc9a21bc5ebb7bd

SHA512
350e1c9ef49bf10050f409da9e1614312df75f6336d7c1eddc5186c35b04cb38f3dd60c003958042804c62335f8b04e7fe55ad0d6518c880a5d7e1a6139c99e7

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt

Filesize
9KB

MD5
3cc9edd655374443fc5a48c4895ce3b7

SHA1
94ac5c2472ce31a4d3f89a70d8c89570f8b4ba4b

SHA256
b6fe32f0032effb7587b19e6a56c13bc356f00bc5d1bc57ac76cf984ef3177dc

SHA512
6643bcecadb19ad2ba202c0c385ee6614fd160114428ffa0180abebab6b14886e6e51ab05202971370764cfa16a3032ae44806404802720cd374175d3dda08e2

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt

Filesize
17KB

MD5
4530f5117000971b3b59f47a18f0644b

SHA1
f8ff09880f5c6d3bc6e3c667492e335e3a2384d5

SHA256
a1dbc1b4b2bb902583e2ae1314ecd60245a8155b54845216dd1730b08e35d1f7

SHA512
a9eaa4d9df6f70bc56226fd7d02862af733209300947662008e9dec073d0005d459687d61faa508a16844d1d3e42ef74b0e3bd976f342ef3787648031cd6f7f2

Download Submit
C:\Program Files\7-Zip\Lang\he.txt

Filesize
11KB

MD5
8b9d396457c62f9300a8e34efef5679a

SHA1
388fc8c0b04d8340b8601b8659792fd103b32608

SHA256
23f061ce0b4c3e7149015d8d7e9ef35608eaae9a829f438e248fabc56b5c4fb1

SHA512
59aa7110263c7aa687004c29b325196bd9ad992998594ee16362e6571960c3f495b26142d9b75e2171bc388d76e229133b611e4f7ca6d22735c7421743f7d47f

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt

Filesize
17KB

MD5
277807f83272444a378faa563732d093

SHA1
2f80295e5876115a049f784b7e1740b9728886cf

SHA256
132a46bfd28c43e0efcdd2f658bcec844d8e6205ce137f1d7d5d792a33f09a02

SHA512
2b19cc367be8befbb4894285a82134fba742dbb1e7a9c01a1f8b5e451530963dc8f9102a35491f16e8198167029842f42cfbe0acafde610cfab342cbbd14c6a3

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt

Filesize
8KB

MD5
c903ca3623e01b6dd35b1a0b5de2995a

SHA1
6cb22560b6e8a68134963882af13fda6f08a45e1

SHA256
4c337e7c6bff7a93d7bf27d71675e135c9be16e1160e8602dd9c4a4dd2316c1e

SHA512
d6eac001e9a02adbb6d8adf7d201fa283c94130c4afdd23f04b8652e3a49baa7b746933354cdf4d3a4a3e1410e5cb45bf79be0a084918454b6b26729b31454b5

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt

Filesize
10KB

MD5
708de336f7f7fb2e5fe2e10d08549f75

SHA1
6cf3105e1f402aebeb9553f3197e4d8b93a4b4b5

SHA256
af83cfa91747f3c51e6d7045589ae517f6f5f021941f03870fe19641df921edf

SHA512
cab7c6cdfaf659347829858b5f7c58aa37c6d82268f0cd6e0161dc0bbac5066fac0915423b42190fa8dfe9098841908d7a9efa90f6f1626acc98d756c0b899a9

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt

Filesize
14KB

MD5
25a4966c6c8a5f96a1edf9c8ee160246

SHA1
6ca7c4e645d3dbe8f950cb85032e51dde8aa37e4

SHA256
3618d672c02bc4f22e57b2d7214846c26b644893495f6ceebdde4b37faf67eee

SHA512
ac04d41789765c00e9940b4df6103aede25ae5a2bdcc853611a66e3f778563a3a7d8664dce8d2cc43223c419484c9c1e36e474d258552e99e6ce32ad9ff15698

Download Submit
C:\Program Files\7-Zip\Lang\id.txt

Filesize
8KB

MD5
ea5649914273e03d5840831396ef10fd

SHA1
2c84ef4ba54c0599d5472f7d4462b99b8941d90f

SHA256
8c428773e188cd0f525c6e34969bedc9760e1e9a974cd5cbe42c3ee0da4b3b4f

SHA512
0fc9a3966086588a3b73dca1fce3b159e2386a3c1710f560e425076575cb1eb59f9e17a69c5acd1894178e2ffa4b145b5816f576d671a95212fb7b3f10694601

Download Submit
C:\Program Files\7-Zip\Lang\io.txt

Filesize
5KB

MD5
d391ae2ab2b4ff087f4b026a53c0469f

SHA1
be960e9bfbe042809ad77c49929a1d4f9e23bafc

SHA256
c21ee40f0e89ec03a49012c4e43045785f7b29be6bbe9d3d363cbd5d90c1f116

SHA512
5caf1b2f0c4cef4d1231162a316a7bd06b036f514ae771cfb089c7d21b8b45ebb341ed44b35a0d0881668dec5a9c245e6f6edacf1b3bea1fdf5c58884d09252e

Download Submit
C:\Program Files\7-Zip\Lang\is.txt

Filesize
8KB

MD5
437560c369a5e7748a7dc01330237c17

SHA1
0aa40dcd5bd8da16c8531741294ca5467f191287

SHA256
50ab7ca07f6de0016570a19fb18dead2c6f63729a148ddd7e44181f88e7ca6c6

SHA512
4101b558f18de2788ad1a1b0ede5df48797a2f2e4c817b290714f8487281b79a46dcd859bb14bc02d56b880d3f9104de52b7fa2183e8a751827ba442c9d8421f

Download Submit
C:\Program Files\7-Zip\Lang\it.txt

Filesize
9KB

MD5
6e27e6152ca1c0b93a5d4ba31e6c4573

SHA1
d669b53a3ab0e28aabf3216dc72c45a7713908fc

SHA256
b8b45314ef81aea6144f0af893192ed24f98c58c8ae171d0d5539918f1ea53fd

SHA512
b48ab9c4d4ce641dd55935c41414184ee4ce21293f2e194c67c8328bd2ee0f5b6756bc497c7289118d57a998d1a23f0ba1f28d240505bdbfb83900742d309dcd

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt

Filesize
12KB

MD5
6a8f64f8d83deff40508422169679b06

SHA1
51808ab6ea86660e137c21f20baaee62f72f41dd

SHA256
8a1c6c6bd1ce8d0cfb750e559e093c810d9d10de068d2d32c8ed06266c8d5ad7

SHA512
ab330d95d5ee02ae10e8e8ea1b8312b454bf9ba24e2a69213f7dba2cacc1c7529450eb7818af16c59561f5a93ba1f5d1cd4a74fa0717ec61f5da11ab1b322745

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt

Filesize
18KB

MD5
3f31b871d3c20507c40843f03525310b

SHA1
5dd5d115a725a697b95d9da774ae3d8ae1e29a36

SHA256
c5102f9943380a716e60fdf0b13be0b7485bf31dfe472000854e4d8ec8c5653a

SHA512
945484d33972baa717e950dfd7c07f9d5197e5129ea009b6a268207c446ee8588d97065308ab72bca83ad44f6de2887c16e0103990f576d8de3ffddaf2f9f56f

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt

Filesize
8KB

MD5
e305b575d542c81560c916e9e54c4752

SHA1
31c37d6c0d438b12217c8a290e26b619e5fb209b

SHA256
4865f5c598e7dcdc106c28e4ea8060c515ebc89634ee5d6e11b980457c2dc77f

SHA512
687ec5cf3a157916a050d7400f63c5ef063571173d7faef2fce1c29d6696a7feca47d5a90aa6eae91b28426c1f6c71f194225f820ed0665568317dad0d881a5e

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt

Filesize
8KB

MD5
6fa7601573002d9352b5aec4fa7086ae

SHA1
2fe4bdd62cd44d557fa6b0eae65ce11a17f58b69

SHA256
f5d6c8a94cd41ea2fa163971c8ec3f54e4943de64e2613f3ee0ca2d6291cc2bc

SHA512
05ff2029897a475083ade270b289c5b831b47ff4522ff9b8493100e1e54e69b2d706ca6455afebeeda695a91ce166600b116bbfaf22a8068edc7ab7cebe81e2d

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt

Filesize
10KB

MD5
c76fbf643d888bf5c7928fa3174f80fe

SHA1
f3354c6712ee78f078b0376c6e5a1c598ddcaf76

SHA256
3fe49d66a63289266a1ba6fa4aa2ba22385ae0da1985d740c8d025d674282dcb

SHA512
a5ebaa9ad6cb023956be1c45a0c62b0fd256528571d5c97a249fa831db590d43ffd21b8d374ddc43a881b2a7352dd8151fcac5a1efd236d80dd7513627ae6b64

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt

Filesize
10KB

MD5
9b2cf5f09a3ea71d183a06232affd436

SHA1
4efd0287441d9bddfc70c92142ba996ce3cd4952

SHA256
4ddf3e08c7232b34c6e5b22676666e56a877ff2202565d5b89b2fe794bb98241

SHA512
830b76ee73bc120ad64f394d7708ecfac2c082c064a4bed6ff411933b2b067f62b58a50be80d36acf26a54f03d684512a2890afcd5434013c079df7452f6ddd0

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt

Filesize
12KB

MD5
d032ff82dd3d59c9117749fa23d9d79b

SHA1
801f1b1d7169a920a42c525bd7625e2cf9de3b1a

SHA256
489bd44f2f547a3e8f6ddccdeef8cac78ddd679a497504037ffdc11373c07b38

SHA512
4d134fe1971e5d04274be5bcb333671e2d24d89bbfce7a3748cce74da4aea6c9a43e74a94aff742deaab3311376a2a76b582cba6dcf8d3a2a8d11b644c1aa9e5

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt

Filesize
5KB

MD5
85fc9c2bb10bb33b4dadfb740e7003ff

SHA1
78d475a56faf3ba65a26740b69f957566b2a80ca

SHA256
33b3355666fa4d35949de5c43071adae306659b6cd8d7df331e759758019ebef

SHA512
b9f4e3e94275dca726eb9877e435cb0abb579b8808c06eb1a323d2b3201987a556e0c92f1eae138de3e82c4caf819ec35565fa2e97ac14c0c68ed74f3f4b2b75

Download Submit
C:\Program Files\7-Zip\descript.ion

Filesize
642B

MD5
5ff58ab7bd9af26d2a54cec03aa7f424

SHA1
fdf00c6cc0cfadaece4a20dc31f2cc97397f4dd6

SHA256
7369e6cb576a46d233d2c3a1392082420ebc708c9c9759684cf76b20ad77a913

SHA512
8aafb1f011552e646f0bb2889472f33b014933c6572b019daf6a1db2ed73f20533129deab7337b3c5aa5bc951a8af237a24cd3834f1b5c8df52a1f78b3921a67

Download Submit
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_9370e86d-1eb3-453f-8ea4-ee21ada11d8d

Filesize
52B

MD5
93a5aadeec082ffc1bca5aa27af70f52

SHA1
47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

SHA256
a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

SHA512
df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V0100003.log

Filesize
512KB

MD5
834d3102e171c34953c6763a0bafc12e

SHA1
0166387dbe3e77cc5416f08cfa8706c709f1675a

SHA256
318d4c95a74fca7f74b94ed4b2e4970bd3bddff20c207a33181ffa964d5e5d7f

SHA512
24dbca2c242e210f29db370babe52dd7517bf7ebbaceb57556ca3c3fb0a9ac295f91501510bda77b7f1f7581bb89af7c672f2e0b97f1b8ee83f88500396c796c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133660477361840384.txt

Filesize
75KB

MD5
830fffc63d251254e437259d082ceae1

SHA1
103d90468981f06ba093b0042127ae7c0e7f6337

SHA256
fb60deb8948dcb9b27c793ffa82d912e48d1c14eb0c0d8988b0a00008172c4a0

SHA512
ed9437ff921bde65cadd57fe3e362e4a4a55a84b871691434ca56a811037e283897dd8e77593c672a03d6a11ffde3d45e7d4407f0a31667a37651545879fce9f

Download Submit
C:\Users\Public\ZISVh.exe

Filesize
170KB

MD5
31bd0f224e7e74eee2847f43aae23974

SHA1
92e331e1e8ad30538f38dd7ba31386afafa14a58

SHA256
8b0a5fb13309623c3518473551cb1f55d38d8450129d4a3c16b476f7b2867d7d

SHA512
a13f05a12b084ef425f542ff4be824bbccb5dbdfe085af8b7e19d81a6bcba4b8c1debcc38f6b57bc9265a4db21eed70852ece8cc62b3ef14c47fca3035a55249

Download Submit
F:\RyukReadMe.txt

Filesize
804B

MD5
cd99cba6153cbc0b14b7a849e4d0180f

SHA1
375961866404a705916cbc6cd4915de7d9778923

SHA256
74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

SHA512
0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

Download Submit
memory/2956-89-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-77-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-50-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-68-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-13200-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-38-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-32-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-47-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-37-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-70-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-73-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-71-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-66-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-75-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-39-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-40-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-41-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-45-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-46-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-48-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-49-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-74-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-52-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-54-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-76-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-69-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-81-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-83-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-85-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-87-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-91-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-93-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-79-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-99-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-100-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-101-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-102-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-103-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-108-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-106-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-96-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-78-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-60-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-43-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-29-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-58-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-9-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-56-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-8-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-62-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download
memory/2956-64-0x00007FF7D0030000-0x00007FF7D03BE000-memory.dmp

Filesize
3.6MB

Download