55a0964623a6bea824f665a4bf8c542b0a7794f6393516f2b75fdb80b11bb350

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31b712e8f2aabe527ae5a02cd8e05590N.exe
Size

110KB
MD5

31b712e8f2aabe527ae5a02cd8e05590
SHA1

4019ea20731bf21ff83b629ef0e92efe2a12919f
SHA256

55a0964623a6bea824f665a4bf8c542b0a7794f6393516f2b75fdb80b11bb350
SHA512

7c0a2907a4fd34f58e540a42872750e02ddb80497b18605454de07719c3d57301c784c7b984b03a93f3af6acb8c97e8e2ce48001ac062572bd72d03eade06366
SSDEEP

1536:W7ZppApBULcfpHLcfpX2/Nw/NwmxR7ZppApBULcfpHLcfpX2/Nw/Nwmx8:6pWpBwchcV2Wx7pWpBwchcV2Wx8

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4852) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3464	_.arguments.exe
2132	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	31b712e8f2aabe527ae5a02cd8e05590N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	31b712e8f2aabe527ae5a02cd8e05590N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.exe.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp	_.arguments.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.exe.tmp	_.arguments.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	_.arguments.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	_.arguments.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp	_.arguments.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	_.arguments.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	_.arguments.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	_.arguments.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp	_.arguments.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.exe.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	_.arguments.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	_.arguments.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp	_.arguments.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 3464	4256	31b712e8f2aabe527ae5a02cd8e05590N.exe	86
PID 4256 wrote to memory of 3464	4256	31b712e8f2aabe527ae5a02cd8e05590N.exe	86
PID 4256 wrote to memory of 3464	4256	31b712e8f2aabe527ae5a02cd8e05590N.exe	86
PID 4256 wrote to memory of 2132	4256	31b712e8f2aabe527ae5a02cd8e05590N.exe	87
PID 4256 wrote to memory of 2132	4256	31b712e8f2aabe527ae5a02cd8e05590N.exe	87
PID 4256 wrote to memory of 2132	4256	31b712e8f2aabe527ae5a02cd8e05590N.exe	87

C:\Users\Admin\AppData\Local\Temp\31b712e8f2aabe527ae5a02cd8e05590N.exe
"C:\Users\Admin\AppData\Local\Temp\31b712e8f2aabe527ae5a02cd8e05590N.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Local\Temp\_.arguments.exe
  "_.arguments.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3464
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1750093773-264148664-1320403265-1000\desktop.ini.exe.tmp

Filesize
111KB

MD5
be90cde8fd27c50ada8ca28ce0a043ad

SHA1
1c7aa0e2a9748b700243f77a39b9ab9b3a756227

SHA256
07ab6c35f904d4aeaf81993ea257bf9d869fdd2d79ddbc8e895d775991e95f1e

SHA512
b21deff3728c20ab9d693f2c39a8a00a3ebb6ca03e286e9c465cc46dd5e693ce9f48b447429493b9a63879e8cfac6be8217e8b3498bd8543206f2c62970bd5da

Download Submit
C:\$Recycle.Bin\S-1-5-21-1750093773-264148664-1320403265-1000\desktop.ini.tmp

Filesize
56KB

MD5
4a22a66c7d70de6770461ee8888904c2

SHA1
19cc80e29f2240254b7354b9a4d7d369e4c7d65c

SHA256
eed0e96565d9aacb2bb5b07ec5d8accfc7db8d835714577216b55420ff7a1d96

SHA512
d771b8462c899e834000b9f0de841b93e34477e884367fec4cfc33486ee7b2acdd32e0c309831a532bb29cea6fd1c27c1d2025ce7afdec005fe7671f1a2bfc21

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
154KB

MD5
f4e763ae927138dc5cba9734e94630af

SHA1
68a4f1d0a51059c77375522645ae21e26a0a16f6

SHA256
03c2a8858c4399c760edd26c473fbd4a99271ddd0eb9d8b96e41a01bbd500dfa

SHA512
095d9ad697aa789d79b84c3a8cb66d9e56c76ea0296cee8d0fdb32a747c2e00f87041fe1b5be0e3342146aaee5f78563a173423e6c3700673cc74d825b9f02ef

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
120KB

MD5
172bd2054a017a1456ee74930f2c14ef

SHA1
2c94c7ad4712444955ea0c0d822b15a038fa8be5

SHA256
ac98a167687e7fd818c7a600d21a03d7d41ad5a3b8f5a170ca5a4783f6e50aa8

SHA512
353604330dd2eb1ca2b11c1f5d72c966e5f746f122ec2097775250099faa8da9e9d44027af441f98fa58960a6ff49b50561bfc3617624075e75228c77973a3b1

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
a3024a0b7fa89ee6741251a15900e986

SHA1
4d2efed2a2570c44b8236ec02de7d600fdf8f234

SHA256
b2802cf5ac59040019fd7333b91fe1778e78c7791b9e249293af60c823e43e7b

SHA512
cf20e580ff0b4a7b2a4dc8c57a8a51455af6fb302d141b86636577e92f3ec5aa58e357fb04677d369e262bcc5b722047fbe943e01de81540ed7a7ae01fce7b40

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
599KB

MD5
a2a6d7934888671688c98b96524ae0f9

SHA1
5a89b131b7d4a35b186d97e05fab583905631cd0

SHA256
d54532e34e5adff8b2520442b5ca30c45cbf12c8dcbce1e35b6568e8857d4b76

SHA512
4f10ae16488eac87760be3b40db98c8eac778c94f73ab47505e96a1bd46051bfed10cca27a339037e3f2162c88c8983d5aedca83ce90bf4ea503d7275ce86a0e

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
265KB

MD5
8da9c3c58193ac2d96dc0e54d1eef597

SHA1
c9a851960d95f78fd3abaa3a03655c49b88bc98f

SHA256
5afabf8ed97fa3b39db54508bdede45316437601022af225027930e6be31b48b

SHA512
56cb04d9678003077118e0e215bcf282313d64bc19a497fbae55b6222bbd40b6f03283aed7adddb298cfe1c0045a73a1e4beefc87b0617ee140462a1c5b6f9f8

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
244KB

MD5
894fd1e54fd943a6a2a26f59a32d08ef

SHA1
53c6d4702097fa050d958b91a27e85898be778a8

SHA256
50ac7e388b016b6942e80242761991e99afb2c06822bc365b226742f978c0693

SHA512
4b25a4cc84a3af362f0d582d5c91be3abafd191d7c26648deb6bb458e84f09392ed6f07acbfa1a84b8366c860638a480df85499c3ff5adc2faccfc0511aac734

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
738KB

MD5
62af119f37a6007c1b53bb43b9034dcb

SHA1
c824c652f04b5d26d15e3eca72941c3152e65031

SHA256
52dddb3ef7bb84931b583b1455604d43d0331e8922aea1995cc2a19f9a914f7b

SHA512
1bcac299981ef49da1009c388bce4f66f41721aef44f84266562b3d13cecf278d4854db2ba023d6c6662ff9cffa7119e163b263402cef877f529c4eca74aab8c

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
64KB

MD5
8fbadde402ac74183e7ba79b65e12715

SHA1
1d88d5fa55844b7f0893e56e4e7b7a24706eb980

SHA256
d1b8b0b7d7534d42de8609d4e993687e7522aabf07c230bd3a7b542628fb76c4

SHA512
67f543e88d6dc78a581d96d28cb2fb76637b55d6b072d43f5796a29555570463714b65315ec499c176f7d7387c6e9c0b2a27cb45a930faf988bd9082d1fa06fe

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
62KB

MD5
cf38cf84e04c1b8f0939c4fc4e7ceaa9

SHA1
776b9bbc9873ae3df41084d840debcb6cb1366e7

SHA256
7dd2e4a8ff756d5d77d992236eb84abb74ba8afb5db5b2dd10038c63f5fd738d

SHA512
b0868c7a007e71facd6639e20292ea2557207cc47e49d389e629c6a85384314ccabb5926931db3496f5c90e0b3bd921341ec8829233a523d07d03bedcb78a5e7

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.exe

Filesize
67KB

MD5
739cdb8f28f7924800461a880c71a5a5

SHA1
02781349c6e5068d422a9c52c076663c9065eb96

SHA256
44336e501d54607ac540d5e7e8b5c1c4eae1c45af7a7d5d7f382d54b369b1e70

SHA512
b30e56a5abc419c51619c47bc72a4c069dfac38ff554fad904fc7448f92e15019f77a3f34f7b0d45f5e0ad711f6b6d51216c2b0b26c89770fa51b56ca0c6be70

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
65KB

MD5
016cecda4fe4895085cd00c1e79a6613

SHA1
c9ab76f921b6807a73d897dd3b6cb42ab8abcea6

SHA256
8fe1be9a9f5ec05b8729c0f2f5b54fd6d5d439955ebd2b6e93b2545833fed16c

SHA512
cb72a2c58818a126896e1ff87f95476445a3eee43934ffd6099e00dcb5fde2ce0c7e10b1cc7d4489c35dc5cc6cf1d1619cf87457ba4291916318494a9210db61

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
71KB

MD5
116695e887f94c8665a2f29b39d82d9d

SHA1
e4cf606aac208ab7db9dcf51bca4dbdce52d643f

SHA256
60d1d252c7df7e9b1398c2822b83fc367cf5d521b000b9d76169cf19b7059e7e

SHA512
db23a879d72e8fa4dbdc3638a5615aff41d6847376e73fd635932507d878fd842d9fe75e2e97f982589ba0fac620dcdbedc0e23e69dc460f845e2013260147f3

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
60KB

MD5
2c4d5dec0ea382afc464de8048ed2d3c

SHA1
b3aa55d907f81090e9afe033a6014ddda524d5ae

SHA256
8f10f75145257dc6eb9831a240efc0de65e87d3e793c1988498a5bcff2ceb9f5

SHA512
a92cec4772ad22cb62f9f0e812c4e04e2a49f262d6e98ff4eb20d0ac9ddebf7f32e765350b25e86a38d0aafeab760d6090a0c3d3d8be696e9ddb95cce4b7a43e

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
64KB

MD5
875d74408b6aa9b39a9582668e6f3236

SHA1
fa979ca1d506ee9eb60e2cbb6cf52569a08f0cef

SHA256
476e1f775633a8f69b37f49261aa0070860b916428d4c6187acf0a4f0cc41b37

SHA512
3223a1c87310e8ac47db21bf3e985ae0a4a8576202012a6d8d2c9be0ce27cff3ce771c76c5e620ac24bbabaf6ebb6b0ac4e798c690b4bc1ca6d88c06f0f4f5ca

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
61KB

MD5
712100ae16c5ab419b3715691d4a9e28

SHA1
210c7726b21e69188c93a41c56b981115d7ac736

SHA256
a0f0572639bbb0347521487f0713c2778e7d8cb9c96d416cf9d1dfbafe02966b

SHA512
a672d94b90a2d70353e038f0573fb4af5e54cbbc390a65f6aeb90324cd7b049de713a06d2f0492ae1bd0f6a1afefe4817c35af10a0810f3c076d343dc5f3a3f6

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
63KB

MD5
78e25d3c7da60a458edf2f71572ccf85

SHA1
6b138057b8f2e7ce4de8f8b862faf80b997fcedf

SHA256
f6ff4900563e361432ce08d95d75f6e5213abe590415354caaa61a91f87312ee

SHA512
d7fda6376f6a3ea34533b21cf257ea1502c951a119a0c592eb4da4d1eaee556f0be699906295a12c20856baa35723120f6e42830bb7fe3f1587e10d1010c4b22

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
63KB

MD5
1241a1e4257f9b92cb3dd548fa3de986

SHA1
bcfcbb8436016fc04f366070ca0741a70f004277

SHA256
833a0b629092cf137404624d06772440222d691de13eb097f47799f185434a9c

SHA512
5133b157101e9326565c0493a6a2dd737a3dfe5fabd14ab5f567f3f0209b915fd0ad8425b257eaf86f720c8c1e90847298a02ca93e53eacaa6da087cd7ac512d

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
65KB

MD5
579754791063515729100e83cc387831

SHA1
05b4cc56029546498ecc7eece9a59755ad304c2f

SHA256
773a166e6cafde61f8ec2535b082e2062ba1a0731ea7f492102af93669d8c2f4

SHA512
b624fa9c76fba2cc7ca5903c00aebce994b66ad6cc30b4dc2b0a570989f2c3bff3ca019abde430182f93dd9240216d7dc25f8de4746e6fc8d525812eeede2ff1

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
55KB

MD5
3544d893ed99daab36091cbb947b02cb

SHA1
ca3536455a9d5c086ed80c98f505df69f2733ca7

SHA256
809301ee50054de833997d62991b761ff479bd7de9d266bc5510f66d233e5e43

SHA512
21da621b1e48ebf57b2bde714eaae0a0dbdb3e0477108919d907933c1708e9ec36650abfa087e53ca657775de9e383571711fb08ad4d312c9dae0c7f8bea3d1d

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
63KB

MD5
5eddb06629f67bceec9dbe655d39430d

SHA1
ea5c24f4eafedd5779b796069d14891ec52e276b

SHA256
55f863760242258b36006deda122355cc39b5a58bcbcd8f889ac05117209b1cd

SHA512
7558e461fe865c895e49aa3898794a11b78b4a459c2c3c58034c8fc37dd46d8675ff36e9568734d557c99ef24cde4877aec9b747f0571b94883833ba470e07c1

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
64KB

MD5
906a2237cb4b31ec2f8112ddee1ab0af

SHA1
b4a33b164eecaa367d4d8c83e397f068dd30a590

SHA256
95d1d7f2ac868e3975d31499e9337f46f8ac50777dde7753d08da53f3efb31ce

SHA512
440b35274550431f923fb2a966399cadf0577381044176e5add81b4a10daa24aa0032300e63a74b2e21712e3922f16fdbe911bce93b722a43dc2243f4638e5db

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
72KB

MD5
b84614d74287981eac66ce6098f824bf

SHA1
ca535ccc028883c2a96a66215664c820d168fcac

SHA256
f54c612ac3e3513c40db60538e681c1c5041f6767019275fcf676f51f0b63728

SHA512
95a8178d0fe795cb3652d3247d48f7428a20bca806d764a22dce8b85244e79c8cb2d4e54d5c7f700aa8c58243430295fca9708461264a50dccf09e3d79de783b

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
66KB

MD5
1a6aa7c57ee37aa5d5a2058120359704

SHA1
56805e3327ad05ae7dd44cdecc7ccbd66231bf70

SHA256
c4ce0d7ccbb9ab3b8924db33df66318ccdd4cd067549754bedacc86141bb9363

SHA512
daa33517e5b41cf9a77dbee32f3c3837d1824229a7f9a88b97b8e2b38630351ab204988a7aef509b539154ddf4d08e1c25d116252e27baf93e462363976fbba5

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
64KB

MD5
2076115b038704e452108280b22dc62e

SHA1
62305fd985ca9581803d8d9cee22eef89463645e

SHA256
ac876c17cc7ab5bdfd6c035361ae08072a133a234ef14596e4ff746bad10de91

SHA512
2217bb1ff15de53f9ca9b131f98f64b66eb0ae91afc22bc833ad370459e77682fb99f8d564447f5b17d2d82db026f85bbba7af75eb9846d9d72820b127d0efef

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
69KB

MD5
405a57357f316e77e710519ce391b9f8

SHA1
c1f561435e101168520f28763f7d9cf2e74f0f14

SHA256
9dda7b09256a96b081b41de9f8a20851a6c6e8aa0262dee8f01e3466b30f9a66

SHA512
f6b18be8622e2ba9aa2e83caadf69d9bbd493dac572db380535d5e35222c0ea789e87dd2925952d53bdecb3788cab19b1c0af919f41664363244ff5cccb943ad

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
64KB

MD5
e99ad4d51bd349edcba728f596e7bdaf

SHA1
e8610e1ac55e0ead562140c7eb94694c42c7c34d

SHA256
8383ef82d8caafe695a5eb78f085e1bb152ab944b3a3f4f0699413561a5f19c2

SHA512
9685ed4304d8a3bbf997d0cd0876c07933e45a4b6aba23e6236ac65e85285bfbc817bfefc9409ed54609bc7215c1fe8a2967f00543ac813dff19603cc37f6cbe

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
65KB

MD5
57d3e07a3c2ade4ce0369f5e6e8832d9

SHA1
310fb403f77bfe70d63bb52192c4f3cb9ae9d3a4

SHA256
bbda0d2956b694afc065c196419b626643675b1003d0961dbfd83985a5619661

SHA512
c6f863fb5f1d01727913980141960fc53f61302e5b8cb32a6085943996cc756a2900111fc4709e75d953a2e3ee6fe47a06dea80c13d456664f4e4afb6e385d20

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
64KB

MD5
b00fdc72fcfc991e1ded5c8b4dead3d0

SHA1
74add62391b27ef0bbd83572e73c1e00a6a81b79

SHA256
a350e3493859350f6aaddfa3d2113900778636c75cb332d5a95484082763491f

SHA512
1adf13a9c3ccaf2ae16b13472e7249668848ff9e408a320f1b0ee1b9a80fae585cbd3974d79245b9524b537f0fd62bc831dfd9be730d8ec1ce60ada6132ab49a

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
65KB

MD5
d2666e00952e317c9542ab0a5b96c602

SHA1
8ada8ac61a06c9800451dd127f9a6594b531c870

SHA256
ae883738dedbf6210d7f356e0226c72075484c265a71949ced9fd4bff4a9b1df

SHA512
2916cf7fdd0228cbe2d420f580db2a3e72e64503fa78a641b955276cbda9959f096d83ca410109a69b543d13f93f662d692d2be28399098b040bb4cdfb57121d

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
67KB

MD5
7267dac8d87453bdbeb1f7a0b40ec971

SHA1
dde50a7bb20b8d81ca6f36fb288308307fc0f507

SHA256
d6dc3984e940524412e6361275801ef4ac2f9e2a0ebed4dddd4d9ed7b2c8b660

SHA512
907e70a23611b1430cf925cb9714e8f1b8dbd892ec4326592bef555392ed70a656293077f587f133f5de9c0f4a6aa384b986253ace3b0dd2d094b973842fb25f

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
72KB

MD5
eb8a3110771a9473d48d1310077d0d52

SHA1
5be3c2a56e549027dba0a2cb06e585037e368a95

SHA256
dbc192deb75f132749a4d57a5a620cc88ecb8d61bc785e7b6f2a26dd89743fd5

SHA512
5ad5f2cfbd55a8844371e6bc3e969f3250c949a802785f59c60139e69a97a187f3b969f6934c9c7262f0df999928d6f8f234390b86c4a871b9a2476bbc396db9

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
62KB

MD5
0e00704f295e0e7ee4d7274f93cdb3b1

SHA1
18170c673e3faba40ee6adc31690466fb75d5a56

SHA256
9549dbc80dc3b7ef031dae9b30b87ac31f91f146306fc7ec01ec6de7cbdf898c

SHA512
74fc6897aba7b5883208098978c5c399b9c283a71c82bfbae16198bc2fccbdfa2a94f2be8bc7c86c836bffeb3d9ec8832631bdfa2f639f9314c759fd82bb62a8

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
65KB

MD5
3703bf1da80906022dd75f969f5e6ef0

SHA1
ee8a1a90d30dbbc612b18e5ec83f860398541321

SHA256
3603a5d22c9137fed86e98868bf1fcd6d3808727605a4396f1639c909fe9c249

SHA512
72b64b20e4e3bf5e000c9e519ae523d841abe9d580c13a4343243417cf76f72d6ccde378f3cd236c29fc2a4d4add63abc6fee326f9740dcafd1101d55b554d97

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
65KB

MD5
5712a8d56aca9bc9afd75284f942c90e

SHA1
c857234d6df7b678dc3be1af22e700e7d840aa59

SHA256
4efd4023f4f53b4b787fba10b08b41fd2a37aba5a41ff66ade38930d1a070370

SHA512
b8754429a53db3e73012370d2646dcb8009500894c0909be44f984dac6b3c1d987496c8def9dc098012a9aa04d78f01fb7768e1008a8e6738ae0e101b08406b9

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
67KB

MD5
5ef1531f609d1ea2d7e4df7f3aa368e2

SHA1
a87471e6fb3cc1bef72bff031c085da8877f6b31

SHA256
ba76e5f5ffebb2658e66fb34d08279c802239f121f1a6b943634d8b35b528555

SHA512
42a6b8e1683ef943e6b27705a63dfedd6fb8f3553b8cb54d6c2dc5573f756078f618ee628efd40e2cb23cceceb745fd544f330aeb58b88c18adf92e83061d38e

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
61KB

MD5
140260838aae7e758b317eb3fcb184b7

SHA1
49b1fc2cc8053b9851be6dd5550c50085ef73538

SHA256
b69b51612411e7a786836b877889dd8c8349e770bcb3cd481410a64dfb1c635c

SHA512
453343c4ae8d8cb5d1662b93d025a576893f2f82ed88ccac08a1bbc0716ec0da58c393de1a16de66af6e23a76d3e2b1e86599146efd5c7842ccf58337ff5e7ed

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
67KB

MD5
2d98664e2caae5fbb8d8282731755391

SHA1
e6bb0b501c9764b42a3e62358b5a119ad872e10c

SHA256
20a02686b753798c70fe0006042275ef5bd594ebc526c6765d4cc41581955869

SHA512
496f6dd45bb8f784134a65ebd92e42f16a5c21ff14d83535fd05aba77c646c51ffaf293fa82c0246bb3eff4dfd3b3bf7c11096d03c5022750b557bb462b9cf86

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
65KB

MD5
d7c458d0b084a370f223d7f10d15c649

SHA1
ffa3c8f0fa39271496dda27fc263c05942b70b03

SHA256
ebba0b01d949183358b8b1ace149bb0012d5a7bca1b5ace5f669a0b5cc293865

SHA512
8813f07143563ab41811730646ed441bc764a4bf5f7b5d0ba8277e372e9af35d242c78634649dfa97faf9181200add9f1d13285e6d28ec18e1fb8cc77661ee11

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
60KB

MD5
4b93b4f43e0d86c19e7da2f5a75eb61a

SHA1
5f730276cbdf98176efd6b77d3127f90d828b16d

SHA256
ef9a3db0b54c5b85e6d1ce1d21c1584d10575a3b74347e84f19fd9e22b6ab1f2

SHA512
4c3e314488900761fa3bcdf886836e87778556da9be1124495373c5dd2780c70c824179ef764b92e264948a99b178496455721f49fef8c02a2737f8580279bdc

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
63KB

MD5
7f9a86e5dfcb7d0c32318294f2915003

SHA1
3bb3441b3a8b341173cc692c24f780b8e8d82474

SHA256
08fde429edecd0e2b26e55d13bf294f33478e717863ca833e0d46bbd726b5cd7

SHA512
13d1acb2285227f8284b663b1f02119a385e37d54a8283cf853aa3902a97ea68b9fb66b64584f714aa11ef4fabd786945294fd15a391aa33aa0989be86b4df29

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
64KB

MD5
59c2acd98c2959ff02fdccfe1b6fd2aa

SHA1
a9c7e24230a6599be59f57317b02fcf6bed86598

SHA256
c60192b6ab88b74bc5ba1f724f3dc2c32d8783350f2de3c0f649df49549332f8

SHA512
0b9e8b9cda096ab0eeeaf6a61fd2eaa64f36b102c02e137284a3c04ac08c70d70eb2c0d59a9e5effca3d8ec6f9a3431e6349b5b5a9d579b9a8df9415ab11c1ee

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
75KB

MD5
d9ea797a9334843a19b80208e70c8a73

SHA1
d9bc3a2e60ac54c6c5402b5f2d7ab6276d025c8d

SHA256
758e95ae984e75bdc5217f755119acde890a0226d2edde587f170f3aecf279f5

SHA512
141e6f371179762c869786f8508b4d8468ba30fd394cf2d6e6b17fcf53d403b1c9fd032ff028aae3a88bc7f4ec2986121d3bfeeeee813abfb1bfa3b1293b2a14

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
76KB

MD5
b2e708a2101f4008eb3e52c5bcb9184f

SHA1
5a774d3ef24f412650871041858924bf4c127eb0

SHA256
cc9365ec31b9b0695929c3f906715205eb0b3aad811459cc6653b2c5cbf9bdb3

SHA512
1631a5c75f1171a70f38ccbeca6c32728c5475f86754cc7e5ce9070a3829d922436b30b49de2328ba72ef76a1d886ec22476ad8249e528dc46807fe4b539e2a3

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
66KB

MD5
8d11ea45a5a0bdb9341e1c5b7f634930

SHA1
590f1fb17c21cb589d5d19a248148844973895e8

SHA256
dc4635ce0134368d79538e3fbc631127c8174fe1056a1bc4b5d03a997005bbe1

SHA512
08411a28007a795b09fdd77406b604f5ad0f1690456a0809cf95b163d936110c42dbe5f843ec0ed0951bdb5bc3673a679c8f128fca99d2497f1203a9d4e4dcfa

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
60KB

MD5
9aa50a4319adaa33e6924721ffd217a9

SHA1
cd80cb76c252ad4976d9513f05fd0e1084c56c7e

SHA256
127461d068b46be92aaf9ab5319327221869ac163fe4961ea57ba1232c761e2b

SHA512
1ba6719bd121c9785db939512662aaaa8ec945669b930c75c91596182e13b7a767792cb2dc60b43b552969fa284919a939913d60b2663781ffc5240406b50c5e

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
55KB

MD5
014336d85854dd2666a76cc536aaed40

SHA1
62d9d63eae636d3ea0849908504387ad1e0846fa

SHA256
7b6ddc3180467dca696bd16cf68b5fd291427fbbf611d0ce185b7f784df048c4

SHA512
6990b4dac50a2b7bedf291cf4b65aa58b7ce052eb53b41cfb74a8d8ad27d6fb14bca353f952eab531a0eb492e4be2de2439728c8a0ac11fb50cb0d8f5db84e1d

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
65KB

MD5
587ce251c3af969777340834b7e6c980

SHA1
5c1b1aad3e8ec95e97c3f2b6052b415ae884e873

SHA256
cf90587aa2b2e0822cc1300d18150b67a6a831292dd2dbccb90bb8a66b085104

SHA512
60099ac0ee781d110c19cf1624d19d03469a5ffe0825fbf9b125e35c499c555f9ac4e56d71601a2b1d4addabde6d3092cab838d26497f3e7bb212169fea974b5

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
64KB

MD5
ca591a8e898fbd7e2f59edf7507cfe0a

SHA1
abfb54ac24772d3fe40abf508ee1a9f62d9608c3

SHA256
18475429cf3e84dd63df40afc44e010bdd35cdc44304cc873e866e285442d4a9

SHA512
88e716176bcd4cc82ab55e1e411d25100d300edbcdd5ba9429a3f85931a676394ec292abd80b3be812c1a368b80bebb947846486c4eece92f61ef27b59df064f

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
65KB

MD5
508c2c3abd2524aa808f392c411f24ad

SHA1
cb70209c8360a8b42b63836f7dc828678fa7bcae

SHA256
d06f3d0e4f5b7596f6d70af13250391c08b40fada4aec77b049ee0dc91b74f03

SHA512
1a26b3c60d0d51a4f63c33ef49356e069fd9e61df3ee3fef2b7def9f4b4d2bd9c4caa2c83a10f48b242a9659078759fda322896fc3f86671b833976d292af71d

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
62KB

MD5
2ffb3b09d94587774c1e44ab5052c0bc

SHA1
f0bae6f7063c29383e980ae7ea7f389e7131529d

SHA256
3c02765b4fd38cfced5b229914abc94f24915f12e18a5bd73d3c72c0f8c08ad8

SHA512
9f0761cc4c72a7affa9d74c4460a295b245590aff3201ca902f6d4a6a839d510ad088f0ef4c341e8f7b10796ccac564391b888d1647a41b4218cc2dee1250807

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
69KB

MD5
bec2bfd9e8647d43a875bf6479f71134

SHA1
2f3964b312545feea527fab2938f1c5ed2ba201e

SHA256
09a4da31727c7fbaec2344b073776ec00d755b05d0262a45702fc91ff4bbac95

SHA512
841e460f9c72d2fdd63c2f019d440c6c0ddc3e31f14ee0ec2c0bf9876974cb234fd50ad16b980caeb8b2906d7f4782c47bd6ee580f0a812703523126e20ce1ea

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp

Filesize
70KB

MD5
e0621694f80aefd0b9b8cf7fef2f54b6

SHA1
282c165377357ffcd606d152d1c47126f63d0d83

SHA256
836bdef377427ac50dff49f73178fca0125e68a8eec43694b6ce3732d7d115b7

SHA512
3ce7716fefbfdeef2e65ed6cc630f049e351e65cf02bc62f5d8bebf9c233fa5db6de961875b40a6d343588ebd0559ac9abb2537e2f517dd19f362e8e21fb1264

Download Submit
C:\Users\Admin\AppData\Local\Temp\_.arguments.exe

Filesize
55KB

MD5
ae1b94c27e5bc1c6d00d27fcecfb385f

SHA1
a19886c8f0425f8631642860358be5d370617d9b

SHA256
91e6fde787befc34fe233c47a2038d34e2b35baed4f7f8129dfa4c79da20d869

SHA512
2b5464e5a3a38e2fb695312835703505ca690b3a7ca4f8c1f8da6230a5de22f9c20929e18a3635951342ddf4ae85fde99fc7613c8864fc38db05df6934ee0430

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
54KB

MD5
0899c7e2da0983aed44dd3c6611e116a

SHA1
e756525c4f947f5979f20fa197f648f5fced070e

SHA256
2f9d961990d64ad7bc01442fb4d860f4e4372bcc3ad69fa99fd1c24fe8aaf2f6

SHA512
e75598451abf65cb69ce02552927e989427d83a0ba7fc6a3374e60edf68dbf4946ada30bcb4ac8ec5f58b0050c317fb119f30e75c8b18fc2b6d7ddc37bb49928

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads