5fb9c6111070da5e44babc9249785ec6903700fc33d02303475af3a9217326e0

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fb9c6111070da5e44babc9249785ec6903700fc33d02303475af3a9217326e0.exe
Size

178KB
MD5

20f95d790629e7aad21758d12d83d956
SHA1

e7645597a5f56e7604bb7cfa59eccbc9b7679cc0
SHA256

5fb9c6111070da5e44babc9249785ec6903700fc33d02303475af3a9217326e0
SHA512

fe090daec60f5c48759c7664d9bdbf03030d493630f3224c5a9410a9a684b6ea6dc1828bbbda49600db8c608afb8675b0d5c164491aae304bfed04f1d24f0bfa
SSDEEP

3072:6rWpcOPxPke+e3fFpsJOfFpsJbgEvrWpcOPxPke+e3fFpsJOfFpsJbgE5:tFPxPke+eISFPxPke+eI5

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4994) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1224	Zombie.exe
3124	_MS.EXCEL.DEV.12.1033.hxn.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	5fb9c6111070da5e44babc9249785ec6903700fc33d02303475af3a9217326e0.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	5fb9c6111070da5e44babc9249785ec6903700fc33d02303475af3a9217326e0.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl64.dlla.manifest.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\external_extensions.json.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jni.h.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\msipc.dll.mui.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwnumbered.dotx.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Primitives.dll.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.White.png.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp	_MS.EXCEL.DEV.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1224	1696	5fb9c6111070da5e44babc9249785ec6903700fc33d02303475af3a9217326e0.exe	84
PID 1696 wrote to memory of 1224	1696	5fb9c6111070da5e44babc9249785ec6903700fc33d02303475af3a9217326e0.exe	84
PID 1696 wrote to memory of 1224	1696	5fb9c6111070da5e44babc9249785ec6903700fc33d02303475af3a9217326e0.exe	84
PID 1696 wrote to memory of 3124	1696	5fb9c6111070da5e44babc9249785ec6903700fc33d02303475af3a9217326e0.exe	85
PID 1696 wrote to memory of 3124	1696	5fb9c6111070da5e44babc9249785ec6903700fc33d02303475af3a9217326e0.exe	85
PID 1696 wrote to memory of 3124	1696	5fb9c6111070da5e44babc9249785ec6903700fc33d02303475af3a9217326e0.exe	85

C:\Users\Admin\AppData\Local\Temp\5fb9c6111070da5e44babc9249785ec6903700fc33d02303475af3a9217326e0.exe
"C:\Users\Admin\AppData\Local\Temp\5fb9c6111070da5e44babc9249785ec6903700fc33d02303475af3a9217326e0.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1224
- C:\Users\Admin\AppData\Local\Temp\_MS.EXCEL.DEV.12.1033.hxn.exe
  "_MS.EXCEL.DEV.12.1033.hxn.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

Filesize
89KB

MD5
851c8b403bf7066bdbbe1a26822014f9

SHA1
4a8c395ac6a60fcc151e25a1cbb3bf7d94261f91

SHA256
11ffb237e47f0a1f17fa67a1ff13bfd5915a6b833a63a8a55f0033d30106b53a

SHA512
477abf1e641d625e9ca621b735a3dafa024f48e536bce959e5e8e4db0182fd544c28c4df60bcd740c522d9152876001a67413686daf5971c68c9b4f250b6cc10

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
202KB

MD5
2e3a3a33d4dfb96f9f4b8ebab046afff

SHA1
6fca3dc19f48a9229821160b52132ea697a81ff6

SHA256
21c14918736ea34e6e61df2db9684dc0cd6fd7a98b56917983dc7e4db3f3de0e

SHA512
57daca5fc058f9be5c9db25deae5332a7720f2bde4c2b12aa3e2e48df23ce3f96f3cd67c58d826650fe2ec52571b9e8281ae6e9b2c1b76f40e9cf44975505176

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
188KB

MD5
3c280da851282218c962a4daf7e31226

SHA1
e9cbe9dd64fdb5eedd2f3849d720b6672f5a52c4

SHA256
4f0aa172137719c702a750df7813f626f4b584584c8ba00cd9297e41fca2694d

SHA512
2cdf16bcbd43b898d0a18542d99c1d4e175fa7d4c22c6985572a249398b02ac86ee920751b04239e6eaf3a0eab886622e6dae885f11ee88d03824ef254cb6a86

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
154KB

MD5
699fab016f2f1e078a2e642def4f5faf

SHA1
f129af00b883d670159064f468d7f9a8a5997cdf

SHA256
1f2eec8f348ada29fd2f033cc19838921ad600f7397e42b8cd784988e835d459

SHA512
ec8d12d6c45f8c276ff7ab347e5a95dbbc37162d74cda9b3c827777200a3a28f43c8de0304404e31570e1db6942bd75e3c039f7d26f2b67bb41946d40ff93e6e

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
7d19a0e83c70557293e2fed75582960f

SHA1
da19431435aa6ae89b657157eb72e275a0d1cca8

SHA256
c28a93d998b84b78b1d32b165367f374041d14747a3135110eeb2df1f436c0d8

SHA512
caa47727ed4fba81a309b089b8e40c1f63f725aeaf82d1049fa960bf04d250cb6f5ce7134db4ff6bdb9a552a8914c7fefe35431ce4de5678ce5f5b128c1182fb

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
633KB

MD5
8ac2f29bbc42124ea5435d004ca9831f

SHA1
15684f1ba3e66a179fc2cc7434c36a5919112bca

SHA256
cce3a2da319a50ebe9ba3bfcddda155d8e86a99d781a0e25ed683d613971797d

SHA512
c4859532e2a2dfa68daf30aa8197cd58f52c725ab304c90258b8ecdaec3778447e44f62c402b6dd6ab84c4ca586750a3ba81935ce65c45e30eacce1509fc7f77

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1020KB

MD5
7a4e9cc227923b4ea630361011bdc024

SHA1
29ef4ae692d8c30a69af1f20fba210c2e2d0b1a1

SHA256
6bb77baaebb0a854f3bdc9e3783c494239e78a2b81535fcfb46306254568cc66

SHA512
1984c9bb591bf6795184899e062570619782443fe2b8fb7585e4ff9954bc110b7c59b019cf49e675e7af2e2239571d07a1cb85e601a9650d7910522374a61f1e

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
773KB

MD5
3535cdb8e51fbc1addc7cb3b5454ce59

SHA1
d4ddee7a495cf9ea655cdda1b14bfcdc9b85cfbf

SHA256
ba202bf895a0eec2ddd0a80294e3650a9cae20012371f6cce98cdd157e61d10a

SHA512
53e03c5cfd87d8bea62c5465ac080364dbd1759d850b406f962ec0ba42ae013f6087f70fd700b4c6d0f449670e23a234bfd194e41943597a10d41feedc9f7419

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
99KB

MD5
1891fd30e6d9abddb12c611d3ccca924

SHA1
07117754f2b4ec129545d50b2eaad867502aae11

SHA256
7ef4ef5454a84cbddce80f6d9081317ed8b35e68a116372486ad420483b77993

SHA512
329003380e1cdf791996c03b28facbc37fad59309607ae7b571159fa6993efd72f1e8d0d0e7c2b2ac7c9f68e7149ba4795f47751fa6d09272699a6e3e6f6cab1

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
97KB

MD5
6da9b2d79f6b70cb5630de5b6d1e299b

SHA1
438bf3444a8ee9c030126600c2ca681ff8fba94f

SHA256
4e4d09049540ab26530d8243c0318ea4e875996c401735d6a135469025102f6c

SHA512
a076aa97d8f9fd121a10a2ad0081dac81b443ca6e66408de4ad8853c46a10bf9d8ee6f3bbd8d115690f94797a4832282ada3015ca9fa4d133945f2be4e10f178

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
104KB

MD5
b5030427a61ff78edc3353ba79eca462

SHA1
aef32c52c31921912b4bc0887b9b400135798beb

SHA256
60e7e424bafc01c4e34ac8816edb7ed4d1560c64d8b2599704d682f42b00ca8e

SHA512
1b0f76e539f6ddeaa7bb315836f37db8348c5cc615a0b427b55be80508fad5eb413aa831c00f8f6b0e6d894bbabe54e91b72c2fcce7ae13e6fe6c04c30756e1b

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
94KB

MD5
7ea62742958832fc46a55645dfd329fd

SHA1
c463db4a2c8c412990b452042f67304f4f17ace1

SHA256
db32657872a21348d2764de3ec877117ac779a298674576f33c706696c32e163

SHA512
18343520142de09961b398ea76a4ca625c007cafe941f80c3b4bbeeef085f9de81079e72ad69dcf8bd89097183fff158c7f9408ffaaaef7ea3054b943e249b24

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
98KB

MD5
96614bb1ee59c421af237bd700f1255a

SHA1
c2dfb7bb457d42dd246994f100ea73e9d1ba4166

SHA256
361618c4829bf5851f9ec4bddb77bf119778dc999b90c94b1020dd8a621e0cf5

SHA512
f16577a2bc067b181697562501765b41d8b148677253fefcf70737eb31b3b8a1affd0b79273c1add15cf6c81aae8caf6f8ff607b3df3108e3641637809a0d816

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
100KB

MD5
fcd21a1f0308b5ec97857a49f70e47ac

SHA1
7e92149329d994afecc0c3d62a98e50b5b4a3bd8

SHA256
d863aa60efb256ec8691869649c6f9af3fd33d3bd70cd1cd37a2fde7ea1de43b

SHA512
0ad8d1297a915b43a567288ad7879384375af56fafe17c986b5e2637750416e073c8a6df20edcc9801d55cf7fa6af6242384e0e1e0b66b4f493f737fcb1f2912

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
98KB

MD5
31a96a02819e1259d4d06dc6a5ff49fe

SHA1
f63207ef5777e607c74d54ea4a2552cbb1b29f7e

SHA256
e80f2a5b7289293ef522b895063450706d52aaf226d2626158feb653d0ce8324

SHA512
647c0f8368fb902b4c33249af71d5088057acb7a0feb6988f3713c0b98a5cdc4221c091fc4f058a3ca6ad24d310ea5f708ce492a0b468794a2ceac1047802c15

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
106KB

MD5
a19ec8e4b25430a0d9a406d4988ab076

SHA1
1b65e9ee83996c060c91eab66d822cf060488be3

SHA256
9bda1c83d9cd1e6d210edfd03ca73e6d21d433807376e4f88d92821a7d149704

SHA512
e1f8e5f3865ba04fb252b7246c1c4351919c7cdf25500aef71834574d48ab3823023ea48252aecc2a1468c0214d182cfa337185b0cef0d01eb759404dcfddc92

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
88KB

MD5
81d9a3aa1fbf2256271faf8bb53995f4

SHA1
bad04528f8a1af6034a0e6ed263aa3d0b52166d9

SHA256
1ffebf7249f7794ba436812003da268822687a86841fcdf2520a80dda59964d9

SHA512
4bd2a8cebf1a0a97b55ee194c4b1762df1e912c16c5703583e7eb46398464c66b5f18ff4b96700b54132652a430b67c9f5e911b7167af4964fe0d99993949580

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
88KB

MD5
b77612e865be9e52b3703b7d9b35a00f

SHA1
b8b7c6857ab5abed73d174a0a715c68d15b0e366

SHA256
3c0c76b2ce3f0857eeff916aaa40a09462ef45971ebe98b4951182b131b56657

SHA512
20f81b30332cf59a8e5a17390c036a24e2c223a8b8167c6bd33a29ccc8c531bcf3d011e7fd95cb83f80899a43f1fc2c70437a2ef12f901cd4c824b2521f8b893

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
98KB

MD5
d718f979a37e39a614ca7d92d1799db9

SHA1
d6a9b5611ee49442f160f9c25e6973aaa08636f2

SHA256
d803905cc95b2e1c506e402b6bc8609b62b325c5c69c57770d369feceb61885b

SHA512
f469c12923b98543831ebc374539cd814605d5c770ea9e5e186a995b9aa4b72ea3627b3148a80bd48fce176406206a1a8ed639b1470fac27a737bdebfe2e3c56

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
97KB

MD5
421fdeb5e5439748537f1e64b138da89

SHA1
17db367808bf35e6e9857e2c11f16ff9934a706d

SHA256
e93d1709b0e603615dd6eafa493eb03dba91db682f00d6e3a5f1e83dbfa470ee

SHA512
9aabe3c6829c13e16d7cc2cba553957cf9b2d99e369d9653b461da54fff8d213b7d898a0cfa24fabfdef89b5fd80bace66fa322a0cf6ea7cc15e5b0ad11d3161

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
102KB

MD5
7b5decf032d3cdae838d931cb41a45f3

SHA1
618650bede7cd89348d9fe231914dc85cc55143b

SHA256
c053470f93efc187f050d9ceba0cf1bd64cf3fd003595cde0c1036288cefdbf6

SHA512
4d215ec2b60efc8847352d916c1d020e1e6f85949141e1cbe91b4aabedff1ad424479a8eadb98b500a78b163421227303a5ebe6be1e92b89e776333e592c67ac

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
97KB

MD5
1172742ff2ccdf9cfcc7bd482d56b810

SHA1
9aaa40e6c6d1792faf4c3835d11394f5c041688f

SHA256
ad74fde2d42246a29ab4eb4971048fe88845b7245f936cabb969fd96a9b49485

SHA512
5d71b6af861672918cb68bed15923ef4d33f69f29ce8dc3c45551c48cf3ec7f165c7c9b4cbe44431394f07608b98cb06149c16b448c8c12490aaece5bf014ae2

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
98KB

MD5
2fbe0b4d5a1bac5b2086986930f7512f

SHA1
46c6b705c401c7eb9650ff4dc1fb99dcde312c81

SHA256
3519a2517319ccfeaadb47ca30ab8f52096881c122b228d1c32e3701ff180e17

SHA512
f62e319a521a0bfd49b29247fc8747e2db422250ffa5cbc0c6a0e6bad375fc5f8be8988ccdb247847f309de3daabbb2d36756416b5d366993789ea7b8fa76fbb

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
89KB

MD5
7c9d19d490f461058fd0b18afc170de7

SHA1
03711cf81e09620c4c2bae353c8985cd6e68d95a

SHA256
1a137156e1771fa553e1b8e6a46dedd79fcf31713f9be00e0bb81efae831ec7e

SHA512
a203c27c2651f9de517d774aca2316f69bf57e9d5d57d70eb4df65292558937ef8dc4b7d4a21fb4b7080a62ebb3f3ae66246fc6ab2945e3f0052822b017baa33

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
98KB

MD5
8bcfa5f4102abb837005417c916fd5dc

SHA1
d2fa64212d570586eb142fcc93a6cee98d40c1f0

SHA256
cb73884b5058f87909dc20cd1543764a9aa590b30421f9bea04a40c805e7e5f4

SHA512
920cd7483bffec523bc48e26b7871f487f90a70c692c9ce2643cda3ff0993f04cc5742d6bb3ec1ed6c18869373ce4bdce63e289c495de7f6772c75288c9abe6f

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
107KB

MD5
3ab0e5a771d27633b5a2f7036ce1f799

SHA1
4e0e29fa413ce208b46a33d256e5b60015503221

SHA256
5bed4edfc3ca38fd89064507b7185df7b1218487805c58d2eb61e2dbeef421ba

SHA512
c042c527d8f522580856ef17447d0aa3faeb264158862fb84e2853d83ce558a233fbf435d2385e2352e5c6e62bfa1e71eeaad3a9d58c66eda7bf4b17f0756f4c

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
98KB

MD5
ec442fbefabf3a91359a8bd4e465581a

SHA1
0f338a78115d271e3d3976aeb0b2bb44e175866e

SHA256
1cf7b10ea16b347e5567e61ac1f08013b84422afc2f0e26765e72dd3f18686e3

SHA512
4e25916660f21060d2c695b6ed6f324f6e8f715e0b9843571e4c57dda29e18a9f1eb64345d3ea9b124a9907601eda65bd4ccb7cc86e03bfde1e0cbc42cd5aedc

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
98KB

MD5
840615d03d4958f2e0e2e1bcf5d7ef17

SHA1
8df14c9ccc54d5a41607727b626320ee3c6a8a6f

SHA256
c6538dce82c7ad804791eafaceb5ce4f82a733a2c213b18b8846ffb762635c46

SHA512
33fb2bd86c3c7ba0a42e21094f8bdeb35c4ab0f50b6ebda0ff44eba9bf2cf6ad899ec5f4f84a93f8530456682b2b4f3035aceb13d2034534a1ce027cebce1528

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
97KB

MD5
e2adbae867238248178fe2fbc8aa68e2

SHA1
c910aa5e153566c47d472964594b5991e529265d

SHA256
bdb50f1967ea7530e70d59ee2aa23e218f43196c4a6f6d42e3e1a1c92deb0c08

SHA512
371ee47d31f296ce23f302a3ed81afea9464a1784e1313a1e1657686474e5c481adcf058a99829cf6d94af728b4d3160566603cb1397188ab84e86384a2232fe

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
98KB

MD5
e06ce7431780d155de10eb0848887def

SHA1
1767fc84640d88a9aa6691ff65d332df12659f61

SHA256
8c3e4be24585613612a0730017392c037af46c9a42ed0fff66b039bcb90134a5

SHA512
3b131284b155d91377f6d638ce5634af91cef2173d1d7b7b45937b3fd8bdac789ca9fee4700d73cf0516c603efbf6917ce4110722f37cb86f50c0c34f8fe2cb6

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
106KB

MD5
d324d2ef1dd0ae43572f80c6453bb2c4

SHA1
7df65c173430213de27be544c65a5f659d63f7d9

SHA256
35d3e89ecbb1489419abc008209daaac1e1335808720657eec8090d38890b8dc

SHA512
731228494f6f75c71e62f6fc673ccddfab5465d515de0f1fba6449955e8e8c771ad6a7a5112dc2f0cd848ab7a05290488847db940d9a3d2b4ff989cc358fd1a1

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
98KB

MD5
87ce7266a5285c0c8ddb390649253916

SHA1
c8acedfb70d6804805a82adc48e6e73e1f8ab050

SHA256
1b6ee9160936c4adec390cc003f4b41f3786290d09859b28cbecd93b34e029b8

SHA512
e70b68eaab51da47030e5256437ec6fef03e01a3aaf69539ae810cd254466cbbf6ce78b3ab5a0374fef4e6f70742b0cc5b22237dd9bffc822b8a6858ec1993ee

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
88KB

MD5
4b0734f7e11ba15b9799229cb8509bea

SHA1
6f21b330bb57b96d0d25361a210008fa2eeb74fa

SHA256
e32c3a241e218bc6491f3f0a621d6ecd1b7a8a2f0f3bd942d268109fe0e32caa

SHA512
1c35a7d443f6e8c0b49e138751c51ee477f0e12d4ca6835b8ff5fc252e6b8441da32d690c0740edec5a85c1ae120b5a0c521fccd874103eae32f161514903876

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
99KB

MD5
fdec5d31bf3974e5264c1860f7588b3b

SHA1
393fab61beebbe10ea205e9a6c00b1fa77ed0e08

SHA256
71955c1e131c69a0a5a5d5a0e058861bac5eed5ab56e612979ec1e68acd557b3

SHA512
9e19bd150ce1b1e3ddd8a47e534e277cea54ba397993fccd50079f1c806d85d6c7785fa5383147ec707afb78dfb9063a53975c5dae387c0d49cacb89c4c920d6

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
101KB

MD5
888d9ccb42148eb5b3b158226667a57f

SHA1
f75d5b0db390aeac373c4f23470afe55a958fb96

SHA256
f896f479991c7651e0ad31c901ed9fbd7afe086c919c92281de9144a41132005

SHA512
593213361dd1aa993784aa5d13cbfc75ee0662262c64cc76e08e36d099dc112a968f062b837aa64411d655acb62a83fbf28183531638fe0eb5a0392fdafc3ccd

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
94KB

MD5
ca2c9166fa812aa70b3716a3cac096a9

SHA1
f846b7eba6052c57d182ea61f8bf7dfdd508c8a8

SHA256
e2bc710cac31c91074e58dd4f334fe97e6186430ae7260f577c55cfca18d91f2

SHA512
dd608067876605c9a1e1a1b32870c6fece83cac462af2d34889fc751d1fef21840156c8b53b03b2f481be1fe48f962eed90de2a8967fbd10b225dcbcd1c4f87f

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
98KB

MD5
dd4cdcf3ce3e69e73f60aeea4d81c73f

SHA1
0fe5cffca57497c0f465687b33f486d7f30c986d

SHA256
b9954978a0fcac187b5a585bf5ff1817ab1b7c6081b2bfd30f385a025ddc66e3

SHA512
5e1108bd01ba10a29304c939558b539471c9db0de1026dc9cef8ed35d3f74c926392efebac7e4323ec5da36016c7e5bef5887064395a07325a73157e721383d3

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
94KB

MD5
60ac520c4372eb1402cd338d70dd6de7

SHA1
7a3116d03baec479935bb560229ca22112f9125e

SHA256
ed1098498dc6c9570754cf718937d2fb8e87bf0f412362236cfa2736c0c86fab

SHA512
19c2837d92aa5327043ff915152eb8188b412028818931cc6cfe64f489e2188b52bdc811e3f6ae777d06e3cb8bface61b357acce94dcbbb0eb3eca2b1238d58e

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
97KB

MD5
f45cd7eb79b83d3e7eec636f1f58c7da

SHA1
736ccf43806c5be0f24dc1c3b5e8efd0b9040880

SHA256
1b6c111abc95a0befe3bcd75aad567b740adf0bf4faf14a28ec15cf8b9f55101

SHA512
1146d7683ba47b3b2f0bea89e7ecfcb4ec6a5c654a5f42c57f8e9a82f760d8a51405b24664694b20d2747f603de385493cb76ffd8e4091eeb2c953d56e37e5cc

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
108KB

MD5
f17c57049e88affb7f59822c79b5db5d

SHA1
fcce51b6ddd6d4127631a5dd1a0c41480782723e

SHA256
873fc0782e539057a86a4d01a63730d43248fb9eee46fcb5c1a3a6a3fcad83eb

SHA512
3809d4dc5af080738085a578271cda096dccbd7e8a06d5decfb09332d2f79856e4b0cbd5f0cf07bee5d7ea3b5dde834893830b815cdbd4fce0b7183f94be5443

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
110KB

MD5
57e63de09aa462106fcd77f804e705ad

SHA1
4f72984c2763f14c07d00d4805cb7aabc6331a60

SHA256
287e5c818bdcb68fe53140973410a80d75d265ef4079038652411bba99fd4ebe

SHA512
fa954a01413bd9d3b6d2a26063bbcfc2448f018af56b0588a773eb4e8700e0bd9394fb7c2e675eca7f4a5d314095b833b2cc785ec25a0f34d2e0a9aaedd013f2

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
99KB

MD5
2290f67e8cb50e708e81d7cabb3b0d69

SHA1
dc10bda70e0f373f417eea4fa8c0dd08712350c5

SHA256
4c170f96c206a6f7919c093f8aa42acc7e8de007037df62f550693792c0e0c10

SHA512
407e11115e2324c1051222bd5635a9fd0d32bd2d8ea6f24fe42f93ef8cde7cf585c136e8bddc30cd06d3a337560265ba0be355ffa96943af3bc162dffc6a9d72

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
95KB

MD5
306822bdffd3fc91da029f35e7504e84

SHA1
8b4b7b10a88866ec1dad88a435acdc58801d4038

SHA256
6bf2c28d8436368dd7a55db65fc5496a19bd3ad7afd9e92d2aa6e0bd3a79a6f5

SHA512
32e573fb380ebdad1160bd879b9635a68be4b50c8d6adae78d298a34b49154d985cc9a9eb279c62b1ded6554ac66cf67a02a85307dd4aecfdcc1e79df32c726b

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
102KB

MD5
5f416f6816add7a22f3c6dd9f6e4edf6

SHA1
c0985fa8d5d1ef901ab2ac459feb5d81a799338e

SHA256
c5259412894355ccb81ebb5e5d8264b6b96a30b696e99f4e60da6d9a9fbe7740

SHA512
9fe3a8d1caac682436549c3dc012fac74cfded79d01d4f28c4c7ec0d5135f2a11858a8e3fcd7813c356ded61b59f750946e1450eb8329199920f9bb9cf23f021

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
104KB

MD5
051791369cb70fd260cc7ba5cfcf6f91

SHA1
f6008d106a0863ed818aaf2c264a6eb9b83dee99

SHA256
4bbd57a5bfb8bdc7a443bd51ae376e20d65ce2d0bd402521ee4ded65126e7885

SHA512
103ff391b4c92397afbb7e65107aa317e8a673c782d77e60ea7221d5cee6c661eecfc340f7ff81dbbbade5e7de9258447c3b0bd38c0129d7eb799ef23b4deeda

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
99KB

MD5
7361bf9c7dc0614b3f65cf75bb8ac467

SHA1
f3d0e6d7808a3ba3035f2e602ce6e3e00e9eab05

SHA256
2f1fda765c98373365831268adc68df9d5990391f22d6c3f7cb9dae22a866c6c

SHA512
aa56d5e62627bf70232643d090a63493838c7a05ca19610b7f42ab2d9f58a7d56bcb93e203f676d902f3124c6aa66d43b7cd48e7e730cf827ad2a8ba78d7b576

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
97KB

MD5
d751286f1255d7f71322c130fcfd07c2

SHA1
35d92f204b0031951ec9a45bc723355da4e460b0

SHA256
e1af3623342850f8262421f359f38290f1732fd7759273923026ac30fe072f91

SHA512
3158c4e53ee244437024771c9659c89d1343babb60dedc1ec4bdc30df045a664f2ce163be66b8d4f917e6f998c251d1a647b2dbc8003d500731a4b78bb364c9c

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
104KB

MD5
81dc71b359474dd8f384c8ab8a0d0653

SHA1
696505d4649cf8f399e3eec8070ad70a2faef5b2

SHA256
742710f38856050759c34be036bd9442ce41b90c309f03f32f09ce86b24a8dcd

SHA512
2cb9e63ab3db59901e4764f450bc357ee40b75adfd8b140a5b26563a4bb76acbd457cb97536fcb4bc6032c330f0e2ea31d43f57510d5024dbe25da6ea56b1d86

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
108KB

MD5
e41015e41b7f6439483948bac6cdabc7

SHA1
5e827886644a015808e247396f16caf48a1ba95c

SHA256
ef4263911c1f9db5616b19f00dc74c66e3831fb9d142fb0cf106d432d2403da1

SHA512
ce3f7c90ab8f4de551c983937aa504a93b5bf6152aed2ad711d6339fd202e9873f7ba7bc654c2fa420a8dd2a94ff2a2705b63d4c21c5d8d7f89577e40867855f

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
68KB

MD5
88188e57f40987320be2a216df044700

SHA1
94a85971320fa0097b39cd0657fc76470df931b2

SHA256
e6e9ae3fe2ab903595452d8141ea3e4ef0d0c683d31fcac671e2a16c1314eaf8

SHA512
e3548cb0f43c90e73b66a5114da4ed6928ca07d011b638e42cc86905bf28f82e431ab360070b8c65ba13434ec905cbaf9fcc16aea0d52b3fb11661ce8839c907

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
98KB

MD5
bac91d6caac7a55d8be4723d6dd3bacf

SHA1
d6e42fc113a7ad5e7a028cc1134c50bbaeb84f1f

SHA256
a65c436a63519ca75befdc47fff9165daf31c52667fcd939bf1a08639a395249

SHA512
0c2856b1726ee610116a5bc3c3e98d1725011a2413aa3f3bcc51f6bf0193bba73afe797c2e63e030e8828d54c37b4b3da86ba14697d3c78e26d3e3400453c6a2

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
95KB

MD5
06eef7fdc5d4a78a0a5dde78e38d4406

SHA1
1dbc5b207efe3779847429d998ea69276737db38

SHA256
3c730e1c51414de51b9eb2ad2721a03af32ca4d519c589a082f3a3a74055014c

SHA512
96e38cdd59c62489ff4883533dcbb20efbe150516d556badf9378cc2e882ee7a166407475e87dcc3c6ced0976038748d45b5f23c82b77bfa1a0e4ca380895b61

Download Submit
C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

Filesize
96KB

MD5
c93a0677dc2698ad870a620806b65770

SHA1
117a184a8a4116149cfd5b6842ae10f7caff7ef4

SHA256
25e131109aa314ee7e1e54e702cdb572e55a046f6a88f63fe44985728a349ab8

SHA512
fd1c39c0c5eae8f6259a7b08c1c31d1bc85b764d6b725e1255f4009b098ec4f1f7b79b74285ba403ed5bc164377250956755a9caa36f0b9fb10c56b8a5d955e4

Download Submit
C:\Program Files\7-Zip\Lang\tg.txt.tmp

Filesize
103KB

MD5
d884a8ffc8d8e70b11d7c253920169b6

SHA1
89ce35b31b4b629eecc8be4e7384ec0b772f7329

SHA256
787d5622af9de674d52f8d1e63f3ef2f637e18ea94a3ff3aa9774a21449d6b2a

SHA512
ca5b170702648ea924423092d2e0f35122d9ada7548f8a69ea87e84af4d1184872e29c7bd4d65bae029150ab7bcf3708fb9cecac0c73b541f342ba0c91daae23

Download Submit
C:\Program Files\7-Zip\Lang\th.txt.tmp

Filesize
104KB

MD5
dbd4a1817dddd1836c8bd697e84a8ec1

SHA1
08e08dd5d29af0af67b1f877fc93968798f16cbb

SHA256
09ecd481d6fdd39f1fc4c88f8481b5aa64a3fa00d307425fad0e7b450f9c78cc

SHA512
9605db1b748a6bba2184ed7dae1644e73335cf658143c4166f70a61144fead2f56bc5d96675695789e26e75fc3afc33712433f35499e8cd0335db3ddfcdd6853

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp

Filesize
93KB

MD5
dc4340478ab13eab16cbc2c5810dd741

SHA1
93d54937383d2876274ecbc15a241d0ce89ab632

SHA256
e1dd128fa7365cb74fffdd8dfb3ea62db7e1ce5c589b0dc6f90c9102386e552b

SHA512
c352189bb30d9f1f55a7a4242f445d6164f83d3094c1f88edb86222d9e3f4cdad12c02c78d79f64ed972c9ce7e228637442397a3b8b7174854fc197043c70c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MS.EXCEL.DEV.12.1033.hxn.exe

Filesize
89KB

MD5
d4d09101a0f596d89343d29d6ee89dda

SHA1
ddd520c07356a0ed9de1df397b726fd4552d4edf

SHA256
2214c4321c8b21a6bf2ff3e47c8cb9cfc15a411699e121099230158d732821af

SHA512
563793fe522d73d54daee9f8e6cb88130fc4b0affc330cca25c166b8e7bdede5627cedebd739b43909d0f9ae63a2987afb0d5609881062923b2f4dd7a11a6815

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
88KB

MD5
a5382ecf883a4e547d85fe5ed1d56b22

SHA1
9b2a9041553687fbccefe0d8f9733622ffb8f71e

SHA256
32e2d7bad0c93ccaa7cea0d3d463f61222bcc63fd9d595a6cd951b588f734cd9

SHA512
e260ddec5d6b6d8cce8a6cf486544314291fd66c3b979f2b6bff285fb4876ce127b79a14edfa02d8f0eb06db27f037f645403fa81bb8defa8d03bad6520ac8c4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads