0236095f943167d95b1ad874b02fa3dc58229c705833ee3a57afb7c4520628fc

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b79369dbb77422f83eaa9416f8729cb0N.exe
Size

80KB
MD5

b79369dbb77422f83eaa9416f8729cb0
SHA1

89497858e2ca8781eef718429ce454c71cb17760
SHA256

0236095f943167d95b1ad874b02fa3dc58229c705833ee3a57afb7c4520628fc
SHA512

6e0eda96348f09d45ab248ec551cd567aca8c1f293e47c290bc89c713d1e1bb0d436008a103598a72cf6744a5721f6fc2bcdfa91e6ec1196b27699ea27c0a352
SSDEEP

768:W7BlpppARFbhknrzzA8JQ2AdJCzA8JQ2AdJWX0kXX0k97BlpppARFbhknrzzA8J+:W7ZppApkGpY7ZppApkGphPG0PGg

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4422) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1380	_desktop.ini.exe
3256	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	b79369dbb77422f83eaa9416f8729cb0N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	b79369dbb77422f83eaa9416f8729cb0N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Algorithms.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Windows.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.exe.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\af.pak.tmp	_desktop.ini.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 1380	4780	b79369dbb77422f83eaa9416f8729cb0N.exe	84
PID 4780 wrote to memory of 1380	4780	b79369dbb77422f83eaa9416f8729cb0N.exe	84
PID 4780 wrote to memory of 1380	4780	b79369dbb77422f83eaa9416f8729cb0N.exe	84
PID 4780 wrote to memory of 3256	4780	b79369dbb77422f83eaa9416f8729cb0N.exe	85
PID 4780 wrote to memory of 3256	4780	b79369dbb77422f83eaa9416f8729cb0N.exe	85
PID 4780 wrote to memory of 3256	4780	b79369dbb77422f83eaa9416f8729cb0N.exe	85

C:\Users\Admin\AppData\Local\Temp\b79369dbb77422f83eaa9416f8729cb0N.exe
"C:\Users\Admin\AppData\Local\Temp\b79369dbb77422f83eaa9416f8729cb0N.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1380
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-464762018-485119342-1613148473-1000\desktop.ini.exe.tmp

Filesize
80KB

MD5
1c6f8965a735d2451c97fe5bd661867b

SHA1
b9735f20e9b2e38422c89c456a3b3f18679e3cb3

SHA256
c4ebfa0116ccdf68d4b01cae93f42fb25a857ff91784ab6ccff7f6a3eb53c11f

SHA512
a427e368bb346a58ad868d11c89b1c10b81ad5b1fecf2025fcce91dfaf3e5b3bb78a4cfb1c938aa298153483dca9d0bde3562de70690ca894908e9e2a59dde95

Download Submit
C:\$Recycle.Bin\S-1-5-21-464762018-485119342-1613148473-1000\desktop.ini.tmp

Filesize
40KB

MD5
b46e8d4f6602bd6727aec36a7309f142

SHA1
251bc889039957212e87509550d0bbc3c2a7e1f5

SHA256
4e9d64fe1ca8a76b559a2ea6dc5b59f6b8faadbeda4d81b5f8f36d448935b205

SHA512
d6fae2a46ef643d7fb5355a51e71bb6151ffe9e2b321f23ba7230e5026e3df3fcf6954822ebbc5be14d627c38f1b71786aef54c1075eeca235e83441f73ae6ae

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
153KB

MD5
b71eb8989f5b7323047f699703dcf0c7

SHA1
dfd7d667d11092a68c3ddd55c764dfb7f95a1653

SHA256
3bc9aa3c0af0683068b35f626792ffac93166c979f183fe0523919b00f5079e2

SHA512
ef3a8e30f8637219dd4cdc7dfe73c0977286970df8f89660942efb42dd7b494ff229127d0749559404f4bf7d8db121298c35973b60c9dd28980f2beb089fc3d3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
139KB

MD5
c9b4d9560c568ce91a31b7d146c21b7b

SHA1
4a482e11ac1b1dbe5b4b9c6ce875f720ee9752b9

SHA256
d908f9a7787b5d0f2528923331483b5a1f3bf50eb7b42ae725706a2fce0845c5

SHA512
8f6d5da0fda6e6989048377860e58f23cf62a83dea3cde296abfbe031e63b4c21bd049af8832164b4efd6ca80a7c69aafff956317ccec193c17a9be16330061c

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
105KB

MD5
33e3f1d569e457fbbca5ffe5da5bf07f

SHA1
f64a26f8806097eb0870022417777fc6de359d98

SHA256
e4390f1457e73ac8d9a3f27111d57c15085f337cff2783c650db6726971ff152

SHA512
ea71a1f44594b90e97699fc6fb5bc9f5e0853b706825b8a021fb81e7b41abbbf69d857ab39cc69f257343bd87365ab971ab3a0b666cef8a361fe0d7545d3d613

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
584KB

MD5
95cd2a3f9e75a459084d6d63b0747346

SHA1
8b8dc9e2f17525ed8dfcab08381002f392df606e

SHA256
eab2b73fe9bbf554d81e932399aaacc1dc538ee2ccb7fef27e9d4efae68a3a19

SHA512
60eb0dbf996b294fb14c6dc856c22e9907a14e377f6b08044015069eb6651c6966974de3f5674afba94fb2d4f285796465c46ed3e8227567f418a01e4bc3c618

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
250KB

MD5
b285d01fc61345c57ee7ab483131a5b8

SHA1
8072391bdc2d59f16ef0217ee9a80c18d994db88

SHA256
10685fcae6c830e0c67c5e5da89722b04a8be20bd4f0005a37c591bcefd87a34

SHA512
4665fa26803412a46b456d7eca2e50a49fcb724f8a5d839deb36a84b6027f85286e1a3f17acf4c8a8ffd37878c32f3080a2dc823ff75fbf5699e1e144ec26cba

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
229KB

MD5
71e91de298a1e6623125dafbc2fa70a6

SHA1
480e592bb377da5135cbaeb88d08630aa336b055

SHA256
93c2ad040ef608b098d6690356af66856e0ea496d14991e6b0e54b5523a8f6b3

SHA512
1b4ab461355deab66ff73df6015ce7c38bd9b830517d1d8e99f0c36a7c9ec9ff9169f648c3348cf7db3d5c1257f1eb4a05fa2bd9420a678454c21286be43cade

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
971KB

MD5
49f06fa956e72a1f40ca3c341f823cfe

SHA1
09843d471e9add1fb6e3b84a8a101505c943df57

SHA256
7e93a3ac7e05e4361cac8d4f88678050e82052b821da3e9ae3852925fcfe09d4

SHA512
02aaf2ae6ebff7aaf344db10d6696f587b16209b63d669922746aba56a3fb6712bb960b991f028c2b4d8838c6a0f9ee4b77c8c94ceb8b3e65fbc6ecc1a03acea

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
971KB

MD5
ddcd063c4ba08f0da88fa81553c678f3

SHA1
ae0aa6affa0b073e1ed5615f9b93c4adf47a890a

SHA256
0b9dbabf81de23075d1aaad17ba49883bd9fc1bc1943cd4239812ef45a24732f

SHA512
3a7ddee5eaef9622aded5ff6bcaf54889652e4ea319240d203ba9f667d5da3bdb3805b79377798bec5eea749f92b861267a138d84dff70f9da4fe421a9543b5a

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
50KB

MD5
87423d9dde913e9da534e72da8bc848c

SHA1
c85c87fbf2b9baa2d9b72be06280b9ce143489a5

SHA256
9a5251afcf4e8e6089cdd4d7421dea77f44f216f54de27c6d1f668dc667366f6

SHA512
ed5c681f7ceabd0a7f0e15f6d4adb5b34bf99fb7d4aeb63d8c6085b6b7406043f41dedec09284ff8fce0d3290071706546f35baa2af48b3d52f2205d975963b3

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
39KB

MD5
fa8f5d36c1a8ceb58ec56468aa3a75e1

SHA1
84b817561172aceecc7ea77314c86cde3c525c9f

SHA256
ab583d925444139a929003d7e20e029dc9c9c81572160487dd03939d800c120a

SHA512
bc21be395e98a2a858fb5c75903979bba12e84553f4bc7157180c263dbefc0ee19c7c5708b52963e2b8df5fe73a0295d551a93ba80273dcc500fabf5a19fbf29

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
53KB

MD5
47cbe2947a611fead4f4e84c5982e255

SHA1
d998e3352fe88d04370bc07e2bd76f9c824fdd88

SHA256
890ac3cc40e35c7f632250cfb134ce8024d9e94f37e5d7a6fe8da8e1627e10d8

SHA512
b332bb3c51d5b8c0eeabcca151ab820e63a89450314802d7cb7004488be184a895423df2d601e53e51774e5245690ee5df40fadea48f868c2c45ac8f92b81469

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
45KB

MD5
db93d76cff58504bd9bcf40e862d0aa1

SHA1
3b35e34e51a27787a4053e8ef4de02526ce07163

SHA256
e8207e18c5fde50b714b0b339415bb68b63f21baa3100323aa9c2328c6231e14

SHA512
eda96b47d5d48ac073d50bee23feb93559ca142360a54fdae7f061bc8c543c52bc0208e3946d3ebbe49be521f382e36d95268eb2484518afeedf2068033c6c69

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
47KB

MD5
5ca8655bde1a8773657e2a1049239d97

SHA1
06b1d48cfbdd4dea9a1d226d4b06fc8d695ecbb5

SHA256
fb4b218a9e9d613a36cbdb457b04d1c52a377fe8f3a3b59e84ea0d071ff3cd7f

SHA512
9b34b2c6ddfe70a831d840c7fcefbe0591ed6d9c362c760c79f11b5684a95d1fb8fc56efb68bc32c6fb451f5f0e5dc6784c360ff26da622fd26849c70a7ae4df

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
48KB

MD5
5040a099aa1353eb9c674e63d8450acb

SHA1
4965840954a8ecb352cb0a9986e76f4c1bde87c2

SHA256
caeaa5664532deedc310a3feb1222f3bbfdb5c69ebc5b7d9fb1ed219d5e4259f

SHA512
238ad7ae8aa6e1f441e4f5b8cd90f2341ee83664ddcd0e6d4f9fdb51f2020cb709864323c6c2e4d302c51c10c3d5548bf48b36d926176648da934698520118f7

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
48KB

MD5
8268691bf0a3be58630536f0567d7eaa

SHA1
3c5e79cf15a18c972a149e02cf07d04a7b1d1b51

SHA256
a65aeb7b73c51be80dcf1c8f67281a8cf277a62ba0df53049ee35925104a0359

SHA512
f4ce5586fe114f2129fd9d9f01cc0a2c4f644236d818c6b5f731804c1edbd186bac1c200af80dd4b71146574eaea1a190521719366fb53f403631ba475a3b80c

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
49KB

MD5
b1c589d7dfa1d94726dc41c2766e542f

SHA1
2a8303bdb60861c67d0decd41d3fa9d2e0c88a46

SHA256
d3d10502fc5f47829e80dc268c925ca23cde4dc7bbee33d4ce1542a2441d2820

SHA512
03f9977b1cb2f4d5eb803a66ddc20e7b59967b2a456d185e08831957387a71a34bb2cb2662a331704ab073c6e9dd7a27144d825bbd5768a9ebe9ccfac6073eef

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
47KB

MD5
33d50f2ec2ded47bccd5b7d3756cbd59

SHA1
cdaeb2ae1b51004438d51b70d0543d710a21ff58

SHA256
4cbc09296d4877ff85ea19a870c615b94d7a1d598727ff6e77352e67fd91b446

SHA512
c5bb4070cc143e52567d2c61c0d8394653ce4f97231930af462ace58a6af41ac562f9ca0ca663d28b3ae12303925086bdb91320e08dfdd608371e2bebb0db174

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
49KB

MD5
55077f6dfe24b57e43040a235558d446

SHA1
0886d24c21a3ab29377f38ad67247bd6d01b8000

SHA256
1f0d7737f62932bc6beceb23834ef95030a7ac5636346d65f58fb8e3db42e0c2

SHA512
105d8dbf779bc0e0fa85ea3b6bb58faa5a8665b966de951fb8b515a0b2dd3a14d6c111e6bca8232e193afe2aaef55d257cc5fbc12441595e0edcdaf3507b58d7

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
48KB

MD5
28b04f1165ddb5f9fc169e9d3a678636

SHA1
6ff902b7572b864f0e31a260b7bc92157c863cec

SHA256
2f8d6343a20696535818dfa2bc650eb741579faa3db483e07905354d504d2e90

SHA512
015a8dc05c6c3825ed2b05f53ea498daad8d8ceee80a4b9d206b519244e85f1a23f61fcddcbeeed60144b6b1b41d50c49888f803f39d54ee197497559266816a

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
53KB

MD5
62e78222e1334a85902c18473c4bb469

SHA1
b49a3c67789e50cb501b865d0764fd4563b67252

SHA256
1eeabbe1282818f73e664e5d838c62c72d947b5a92b5f4db209ad9f91653d766

SHA512
58fa12a7a25f7efa1b1876c83d82c94e225a6103992e6ef422180362b861bcbe8ead1b0ec298dbfd0a89f412e99c3134cee5245da0cb8e366e28b2c0296bd6f2

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
40KB

MD5
cc2b3c45cf5dff2046ed249ec51764dc

SHA1
f362f15a12a18d44f1145aaee442e1c80511db28

SHA256
86c0883cee3214416918313bd793d2c0fb4eea868b10c407d08f6437ad011a3d

SHA512
9515f69bf8b8231fd0553290deae6219f7d7cc39bf9560931427724ae62e14008e630890feb89908e009ae72703cb3948f43d2f137ab22ca9fa862d9008a4dee

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
40KB

MD5
b336176e166a8ce11a0ef47101a759f5

SHA1
7f6018a223fcc0b375cae7fc4328182a3dab6fb8

SHA256
3e1e1163879be87ec8f97f60a404fa1a8de6d768c2a9b257565e61f995a0ff67

SHA512
c105c03f353ad059078b07fb06cb434897bc6d59dd2a2676106e1da6eec7c735ede64010afa3391512db524ea00dd56364a5887affea10cdb6a1aa82608601a2

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
47KB

MD5
5942ba4716f3b6c5c3b788803ca5943b

SHA1
07f2c7b37b4d89fdabc6ba4863f33f70e930177f

SHA256
f52e666b58ad630a101e7b8a69b1e0ce0a94ec2cf593a2a8d35b0e307bbbbef4

SHA512
50bd21c7d6daafc2c165da4e5a294e81bd8e5969c9f70b524a094cf6d915264e06a6a9dffd3e14be36b674fa4cdea19ae48c9a3c8c50e2bfaedac7d8aaa61d31

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
48KB

MD5
5e49c5bb8bc5108bb8d2b5532a75d86f

SHA1
74efe603613ce47c69aadd835116c0e88683bf53

SHA256
3b725a6aa92edc3f66eb8d7f84f2be0607845c55437565efe47adb4953c9cc15

SHA512
8fa7ea4abbf7280f95bb730040c7e2c15e2e501e1c6dc6b363c2fbe4398b02e2f272dc03b0de9a94a45dd55057a3bc2b187422c7ded88d7a39976e1cc3e05c40

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
56KB

MD5
f53fe28e6774f74352de50c436068895

SHA1
52a12763496fcf40d200a0d9112a71aa4fe99854

SHA256
c7366bfe8b3270e74b72ca0e7d74615299c4cb48279279179d95a10fe996b62c

SHA512
ed04a99e566a54238bb4cedea6217da9eab378dce40cef0b03837fded087cbbf11b9b68fcf8287073d9bafebd760659f55a1a92fbceb55863a5143bf029f596f

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
51KB

MD5
41966cde7b7986b523374d71168e2375

SHA1
bd97661f14d51020fe677975be5cf17911a1601e

SHA256
8bcdcf14f64377f6ccfad935eec1c674a16fc94afd57dc99f28786c2f773ebe1

SHA512
3998fe4d0c95a386d14c0505c17ae4a769dadb93f405a0d5d31a855a5ad74c8df4e02ccb2a8170de46ab627dbaf676dd3fc3321f6439b796480b168795650624

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
56KB

MD5
901d276f4f418769c4e19ef4f3d5bb2b

SHA1
edbe5d934b5731e56fae8ebbfa447c31c327e31a

SHA256
524bf494bfd7e3966d4c4a2884f5eb4cb1d05f5186e372ecaa5a15dd6fd6203a

SHA512
129d701d2aceb14bc7e9340ec0bbb998efbfc8b0ba028be24183654c47abb1f2f5b5558a7b6d70f66fbe5c668563a69b626dec665ee8682ab8a65daf3d970708

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
47KB

MD5
692f632c09abae4b92ba02ff0590a5b8

SHA1
598801f038b4fec9072cc37daa99156c0067dd5e

SHA256
c0dc981a6cabf165fe68cac88eabc20f54e9915ea259040c83c6cd8bc346b450

SHA512
9122a78ac32a2379a964271c160861a0970a53f0757a4036c896d76cee59b6403d8611adde9f2dca6d5fe87605a87c2cbc7d9c7c4520365a884be111e2c8889b

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
50KB

MD5
a853f61a30c12cccdec5db4205b7a626

SHA1
f8c46fff0317de817bd31c5c2b1c1c6fb984335d

SHA256
4bfa805a8943baa4f5f5702e9ec621417816ca126b24809fd3d216ed461e1f00

SHA512
c0fd5376aa459be4be974ed39e0aecd7ba57874e9317627df07239000574ad5648d6841f3674eb2893a9e8c7f8980ae2b7fb85fb08a7c50137d02c4c80013516

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
54KB

MD5
bc6928c179b4041447e0d26c5dd5dfa1

SHA1
69e8036219eeb10a38be5c08c9a532bc486ad4e0

SHA256
253c2359b6c00dba196b0cfcdcb7600816925b6130671b5f4f49938e91e329f3

SHA512
0cf0a19111868e84e1f0f35a60c6f652ca0d8bc8ab3d93bee9699b03689af234e261c8e487a77fc5b99090ba74dbecf20f7cdafdda7744733e1710e1d4d0365d

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
39KB

MD5
f0a2b62031c7cf0811d542d553444768

SHA1
e311318d78eafa0045482382e2a6db12d6d21f4c

SHA256
f969d332bb88615dbc4b5351a0712c7b015aec7779d2e9da3ac4468e7154b650

SHA512
e747791d502e035b452e9959a49524bdf6374a70013be8d64056e0ef53fcc6eaba191d4a10e0ec534966a64c7c76a772bb5e1259137fbd8081b93d608c5ccfed

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
50KB

MD5
a34188753e5b87694cdd60e4486b7289

SHA1
c5cc428647f2e314f87a8dc2262f8af0609b14aa

SHA256
81b042d07686fb4179b91b54ad7ac27f21ceb72c4d266026b0f8ebd28a1a4006

SHA512
a65e424c02008272b9cb4d7d917e442be1c86d5ff28f34cbdbd84866b008198310036d7ac1f357c4e8b4b92071c258e7bdd6697449282a33e4f95b35943ce1a3

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
49KB

MD5
b7d50beb26b3e1b82f131d8643f9afac

SHA1
6a9fa49ab84dc02363443d9214533afc4ea1657d

SHA256
7ba66d83a1208c3a86d7b70090f7216f09ab9d1e87a468a9dfe892551f100c76

SHA512
a041fdeed50668e0e7fe00e36607aa895fa6b363388653bc27d47c11fe05865add2a6193bf7536ff7f4305813dfa9c0691bde3b2731040f916ed112941c349d3

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
50KB

MD5
afa8b23ae7595e118494f2964830b19f

SHA1
dc6658472cfc36f06da1e0f491090b14e7147010

SHA256
5d421e873b8d1c561e6b48104a0efd9777e30777e94bd23609439c92f6c5deb7

SHA512
a3aba6b79ca8306946d2588b82ba250179b52731ec3d685619791381869d3d6378e821e94cdf6a838215943e37ef99b80164f24a248c018eef6c9b9c29ab2357

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
46KB

MD5
30b85635983d21b7a42a648933f87e36

SHA1
d8086381fb06ed0e952e654e18a523ab2f925980

SHA256
fff69c854ab7fb16a0aa2a8926f3206fffad9755878d0c0d98aa43b3e94eac9c

SHA512
74397544e380e879f3b2def4b955c83464bfa8351c6bfffbc478b1a852d1f6f434ae5d0e2cc5590448bda972a22f437147b4d11f1e09c616b75610becdadfcf9

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
52KB

MD5
8bbe71d0d3da84172d08ba12a1523155

SHA1
a4990de5e613979170a9c39ee160e8f99d7e0b46

SHA256
ac102a17b652ffaba9c76641fd0db885ab8ee23a0e8aa2a64f6d89883bb331d9

SHA512
61d3c8029690a96b85108c45208b1e50b9284050ae9061662a7cb5c1a5da9f2eea092c019fca7def1c0ed960c9b52dd79279cdb1df0a26ad0fee34cf3026aa2a

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
48KB

MD5
aace92955bad4459d24ebe2557e421dc

SHA1
debb1fc2b01f863c1aa2a68518f4c7a4912a489f

SHA256
75bf789f7b1ffe54352e6532d8a43a2636729d657f02161556c5127fe38a07d7

SHA512
924b1268029457f3923dff7e99ec0f8d83f901f64aa5b46530382254d7f9b7f8b2e5dd1b3c63cec4efbf06f768ad5b84b155e8af5c330e18e2616e7128043813

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
49KB

MD5
84f0643127ff6e3fa72399930dbf4fce

SHA1
34673ed4bc9e2685d8452a75c777dacbb2e8872a

SHA256
5e04490582b8c3d738e7e025efc2d60968d931769257e3200d73b65b5261a390

SHA512
f948936f2db0de3eeea74eca6c800d8159188585a2b4c0883e96038891243e07738aa8023d9bd798cc0eab08ead886f0333ee905b45c0ed90df9d4ed86d04740

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
39KB

MD5
36a533b0e7d59a913b758f61ed791498

SHA1
3b672040c067da06eac41be0412ecfcf01fc606b

SHA256
bb5e4c7df2301dfbe0c02e3277f1e8faafaf4e32e80595d821cccb0ae491c48e

SHA512
950a373f713d043fbda8003d712fbfb037db71902a636b53b27fe78e7a37e9545ca584ed040263ac3c8f4a560a036ee66c5bb5fcc699c1d454a15a213ce7e8ca

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
48KB

MD5
2dd96d9f4be9e60888c47cfb0ef7a82b

SHA1
611767eb73d7d4658712783462bd50b4df77493e

SHA256
28c5b114e77d300f812385eac22281ef8cdf4c0fb6e98aebf62b08e5fc22977a

SHA512
32d846b43dce61248b84ea5e7728f2904055a85821ae5b9ed6a30b45d3f3b9b3737550020ecfbe48d18dff81aa1d9132ee81cf7b6a378dff019d1067db7a1008

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
60KB

MD5
7aa68a407d9b7d2e7cc035cfccd7cc5a

SHA1
38769ffa2a3c3b1bbab02355f18e29c1b03bae07

SHA256
d00bcaa9d6a3854a8a6f2d579a2ad4d807c78dc200e539dbe61684147a164dfc

SHA512
ed3b32ab55a1476e2380d6c7fbcbfd53841300ec94c92fb175af7434ca3355626a82ac1c48ace125745b18f2d72d71edb9b6e605855b03dfd4bc48c2a9a1cbb5

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
61KB

MD5
2d0b12e5dfecf9d8cc5a92029228a414

SHA1
c54a56ac1a21ed7316733dccb9dc42782ee9732e

SHA256
ce9e0a511c8430de47346bd6b15c432dc3958911c988b4e58579da6e5e053740

SHA512
fc8eb39200e6e9ed30ba886bd549bc875d12ba49db7bfab383e0e3cc30fb37ea00c1284a76d534af543cd8252bd36c4ec53367de15d9500f9185f7b38f29a340

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
44KB

MD5
cac0f4c04abd03b9da3899f8e01e4aa0

SHA1
867d9eb3cfea5abfd9aa6b6b42ff5061113de722

SHA256
7667d7509d5f53722362b7f1843544377d8f579066b7c63aa98d2447036e3f27

SHA512
ffcb707f816598b7983ee226c4718cef72b33cd82f2672a145754deb82064444718a9d8dff292c58bd67fc414e2a0ab1a2bd8555e4900c02471ef99ef8aa78e8

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
45KB

MD5
138032b1e3a0c658e63adf11e94cccda

SHA1
13e45ddb2d0e585eea4d71be9a561aab900b8db8

SHA256
2bb52ce1b16eed99aea6b23fd064136be3ccd5deb87771cdac8588b21ad9ff56

SHA512
b772e5438f5da1628821c7d30872f63ce4a1303c1f27ae882861209b5307c2ae11b38a024b24da3ef84806dc842643a6292ad540a15f8bcd8c0bbca7404155d0

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
53KB

MD5
228d1339f4c98871ff99d405bb725f5e

SHA1
f9c29441f6843056374daf91814a0bb16fa4394e

SHA256
60e9284acd8e3f8df162aae5c9c9403fd0ff7b4f6bf466568adde99b0e1524f0

SHA512
8583e8f40d11086bcacafeee728be06909defd2129f06687195e5dbe06e84e4a86ab248a6c9899b189cc60c81dd5fc38992fff15aaa9943b06b4ee7fe9f47e5e

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
48KB

MD5
49ceb28d60d31e8bcb40533168864337

SHA1
0858eff6aee13ee93b175d3417ed5bce3b799b19

SHA256
eda9d66ee97957b55e0334eff33a20a79c452dbe8d185c6e3180a8a31f80ef5a

SHA512
3dc1b7d8dd0e689ebcfff7da709258530cd00578e2ccd31f18d67938a71135cb2e6a71a9426edf859d2cff21cfd3abfa80265af36051c8fb696b075ede2a4979

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
45KB

MD5
9326311567522ef66676df8e7f1d59ca

SHA1
be4065847b56af70e8d9b2ac9ae8de8cf7483e55

SHA256
7ed074c36b3410fce20cf33bae484353e693c1c02822a2a9541f6fcedb4a6e21

SHA512
c90a1aff66389979503412a4a6955c96f972c8fdf7ccfc741137a2c21fcf9657907736102325ce0f48ed1e456330fc076c8e43c8828aaa6b6e703c9a3d04cb1e

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
49KB

MD5
c541a2a7b2a10e1718efbcfa6d2f4edc

SHA1
693d218df99cc4838bc525a79b58ef38f3b35057

SHA256
11ddf256c2af56fd7bb937db2a95ebd0071c4bf7db08936751198e23a219284a

SHA512
85d64a472b0cff7c5c538a2ddee8ac4894a55f93f33e59372f0df0380ab8737a57d6349c8950108b7e2d5b52432e3c057cf6f8dc29c604bf9e23f52012bb2d0b

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
40KB

MD5
5c8a739489bd73435125c50448606326

SHA1
3efd24083b9178c11c7041b9e1bbd53380dea3ef

SHA256
dc9005005e732d48c3ad7c7ac57795c830229ff0403ed7b7cc1e35246fefbb47

SHA512
b6a5b553b76ca90eef41b4996cc8e1c71596d8a06befa0faff3b952ac6272bb54d98b4806637c3bb3c338746b26f60d1386231e3406d40a18eaaec16d742c5cc

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
50KB

MD5
0c6681ae3a5fcc845bb5a6140a3535c3

SHA1
4cd3e73c3f29a205f8df818cab0514db7653b07e

SHA256
8ac7c491acc555591cbe7322041030d7e4791ac15c6218b9ffe1355f23c0fef7

SHA512
235b23b16e93e5ef542509de6462a338d26d31718146cbdf1bea37c9b8f1474e45e001a3b3b617b6d2cf32dc71aebd5987f4fa921f38644a2b141ca36113d4a7

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
48KB

MD5
f2a6e154c4c8ee681ea0c34901ddd36d

SHA1
4dcc1ffb9082e0a213ce4db20ac49c054cc852c8

SHA256
30e64e6b775798718e063050ff56e70f7134487111a422382940d5ff6489da8f

SHA512
b0d40c3f1b9e15e30a1569f0204875320e58825887bd49050d9afccb2e97eda1eace0aff03185919cbb32f52533640fffa65c2b35e27c762ef35faf6360da755

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
48KB

MD5
f11eaaf0cdbb72c4910d5a978da13ca1

SHA1
3c56881945a066c75ea931b5a676b8ca49e8b8c4

SHA256
f2fa2ffa2ec7629581e875b15ff9e23aeb15c9c86add0e4a781a074f6d188507

SHA512
da5d5a841d1211b36c94cceac77ac39ce6fdc74bcbb2e93a66a4a4fd7094dc9bd40df9107f450788d73bb8da931b4fce4c6e737f128cba7464eea04726e2a0a5

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
49KB

MD5
89dd7f5f010b83910c66422261960868

SHA1
b1a156724a19718e4ee838feb0651373dd1cc397

SHA256
56373753d75da906174035214226626f7eab486a760218cd2bb51c27b1782890

SHA512
1188b84ac415cd10d13e2e5703c9c3b667fae959b2d1e208da9b1dcc1452b30958f89b52d34e8204a444e46971ad6666822c7ce981d86d8bdbf911ca4bee3663

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationProvider.resources.dll.tmp

Filesize
55KB

MD5
5c3c5929c21ff173e23b0e19918f8ee2

SHA1
1b9275b36962bdab8ab163693f57dd161f6f528d

SHA256
38c85a48b5b1bf72942337a735db87afd5a5ba6f6cd508e7e6c804fa64756532

SHA512
56dd2016e687a410b1a4ad32f51f1a905148be888012a9a2b93577b2b8bdeb8dacbaa56b65ed3d9485d53e6cc0bb16d193aa97bf3d4336a6d5fe2d6c3da19d20

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
40KB

MD5
1c5141b10fdfb3ce4b0809e6b4464755

SHA1
c34b368c1181c0aaf119052321e370ec0c614adb

SHA256
b3fc3796374424ff006a96d70d2591d89f2bee973fcfce098d0aeb5cac358a0e

SHA512
7bd94c5df1d2307bbd07370ffeda678ec760e805d5cecf00174ba9dd573daab71d8ceeba66f3f526fba28f6b4f5a3b74b40b7cc75a7f3da4841ee0b200d4057a

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
39KB

MD5
a9b84aecd6a82492a0cd5d9ab6a69b38

SHA1
c32c74f7f59260cdcad069a623e59c9604401585

SHA256
86c722bd19719c92c4e44e5d533ccfa924cdc4067b2f3e2639d5e8341cd9d14f

SHA512
c013953706570b3fc6dbf462057032a3162f4899f026f9a5d8f7c7602c0793860dd7f4de3c1a51bf81781d86b4326e18edd9f20169e99acd18ce1114f19e6be3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads