729bf3688eb923eb555d1662207f88d18cd06ae85a70e1cf38879817d529c358

Analysis

max time kernel
150s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

729bf3688eb923eb555d1662207f88d18cd06ae85a70e1cf38879817d529c358.exe
Size

161KB
MD5

56a23be1388f663e2d22faa6b6e76cb7
SHA1

ea0f4b7ecfc74801a638f3bbcaae2a68147e137a
SHA256

729bf3688eb923eb555d1662207f88d18cd06ae85a70e1cf38879817d529c358
SHA512

e30cb6ccedb7f866adb993e126fa8a69984514b3c87259dd58ba3faffb1abd1f231418111e84fdc134e146654fe62d14c9aa455a6897f209269acb99d223ace4
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKd7Z9pApQESOHepOHe8G+6E65dyGdq:69WpQE0z+9WpQE0z0

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5161) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2440	_.files.exe
3476	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	729bf3688eb923eb555d1662207f88d18cd06ae85a70e1cf38879817d529c358.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	729bf3688eb923eb555d1662207f88d18cd06ae85a70e1cf38879817d529c358.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\LoanAmortization.xltx.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp	_.files.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp	_.files.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	_.files.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\manifest.xml.tmp	_.files.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	_.files.exe
File created	C:\Program Files\InvokeMove.htm.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.tmp	_.files.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8en.dub.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp	_.files.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	_.files.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	_.files.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationNative_cor3.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md.tmp	_.files.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp	_.files.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 3476	2788	729bf3688eb923eb555d1662207f88d18cd06ae85a70e1cf38879817d529c358.exe	91
PID 2788 wrote to memory of 3476	2788	729bf3688eb923eb555d1662207f88d18cd06ae85a70e1cf38879817d529c358.exe	91
PID 2788 wrote to memory of 3476	2788	729bf3688eb923eb555d1662207f88d18cd06ae85a70e1cf38879817d529c358.exe	91
PID 2788 wrote to memory of 2440	2788	729bf3688eb923eb555d1662207f88d18cd06ae85a70e1cf38879817d529c358.exe	90
PID 2788 wrote to memory of 2440	2788	729bf3688eb923eb555d1662207f88d18cd06ae85a70e1cf38879817d529c358.exe	90
PID 2788 wrote to memory of 2440	2788	729bf3688eb923eb555d1662207f88d18cd06ae85a70e1cf38879817d529c358.exe	90

C:\Users\Admin\AppData\Local\Temp\729bf3688eb923eb555d1662207f88d18cd06ae85a70e1cf38879817d529c358.exe
"C:\Users\Admin\AppData\Local\Temp\729bf3688eb923eb555d1662207f88d18cd06ae85a70e1cf38879817d529c358.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\_.files.exe
  "_.files.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2440
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4364,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
1⤵
PID:5004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.exe

Filesize
81KB

MD5
6b6db88c74421d580e51b027b271f664

SHA1
028a6d27253ac60f193c7cb98c59ed1c425249d9

SHA256
0d2efe735424d9d0dc093623d0eab5ca5e40137fa04ee2a65a3f87891e1074eb

SHA512
571e3d771a474613ce9ed0b68c90317e4421681017eeaa3fa0c099bdab01d2eea3f9208c97f7ac28125f65c7f11394eb91af867bbf4d9bda24d2e23bb856e298

Download Submit
C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.exe.tmp

Filesize
161KB

MD5
f9a61f7beb555c6b095feb8d15b69436

SHA1
a89244143e772245256bbed2a66801e11f20712e

SHA256
f6b7f27c29b0056251cceafcfadd32305365f8ccea5ec2c84168cfb8e630bb0d

SHA512
d47e1acea733dc939b58356fbb593da12bb66f822307df9560f5a1d18bc141c1f8f4266eb3ffc12c46c41c95da864e088ab1ec35869f260d04c4015221a99863

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
3b5b194a5e383aa36a2776b6b23ce219

SHA1
036e683e0c674554a58e49a4793dc6fc18d7e776

SHA256
52e845782c472d5599d21106bcfbf715fa2002f529fd3c0a5fd87dd0c4d81c7f

SHA512
a96444155e23701488711d15e894dcc9f81c4b5684f06a13eabb09591dbf3e7246abef757c6ee8bf896ec0454125daa55a2709888bb0bf5b432b44aa2583d282

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
625KB

MD5
f38d23ab0b4dac19de3898ebf603284f

SHA1
1e7e514a6fd203e56b8ecc10dcb6b7b84214c121

SHA256
ad922484779b144a40943eada3392bdd2ada961f6b488e6a769f7be4a3b750c7

SHA512
d202bfe46cb031fa2eb0eafd35365a43a13fac826277b4fcb94f64d6e6257518a1378cbcb6c42f84d4056463fea1e01da615ddd31290b9f3859fdb285c159be1

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
268KB

MD5
a46d6041b8f59f659a3ad886266dec3f

SHA1
9fb482050b5cd8ece937e1b1608aa0ab49c1e97d

SHA256
9e0fec4cf494283da32449f0c52bfb82ac50c1d3112105714637c809bbedb9ba

SHA512
b0782cc8b1d390d2ac70ae71300ee87fd778e70eeb2b4b813316a6fa5642d02d82be36f598de620346a71f1d68f1b0ec90781c0622bb56169e0e60479d1a3b09

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1011KB

MD5
c45247e46a88a7153ce91027452cf551

SHA1
58acfa3547eebe69e01db28d320a0326d4d8e2b3

SHA256
d9305bca44801d3158e6a1fd2c1cce6c11f87c349d8a826404a4bf1c8c8bb3bb

SHA512
0b794a5a78e1cda174059a3c69dcfa97438b5de8308dc6bb5a9220e491f33920884e8140af7a8233f72982d2a4eb42bf896eab630425be2e5d2763d3669ed52f

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
138KB

MD5
1e852a15c0a3a66963b77d4a01d07fa9

SHA1
6dd978c1c208960805911eb339f46e3f1434bc20

SHA256
e98174f3c859478df43b75432383724a0240eead32428117d6f8b14b5c8c9c19

SHA512
fa9b27c464542a96ca391c9c19908426a5aa10b9be04dfa261d966a417b63d0543287029135042b7ddb66c8de5f98ee5ce282ef40c68f6ba13747be332f2b6a3

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
88KB

MD5
da766f9e5962ceaaddcd295ba56c742b

SHA1
99b110f4203113d2ba5743fc3d979a81de7f46cb

SHA256
05abaec7551a0871f794c39a9b104aa95947c45da51b2b276f3abb8847a4fc82

SHA512
83ed139abfa2ddc1da16320fcd24a51bda2ddebb888ff8dc0030931dc60bc5bcfbb58627c38abf67052effd36e90d6fec4352c9465cb1954f5d6f828cca217e2

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
81KB

MD5
d8de89b05c98df15597dc82f11fdb943

SHA1
0e8d1449acb6644c1c6d2f2346ae59d04b1e6e9d

SHA256
ff96cd317f5f902e22609e773562dfc7f614ef17f6be06b9c77a2bc7f0f67c83

SHA512
50138b544f3d1c3e668886655dbd5c5f244ed77805ceef1d19f8f6d314cb15b4fd0140496461b3a0131a7dc6595c2b84562f7a146be51f5eebd099ef36194792

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
85KB

MD5
86e21337e80d211d2d24aeb2603b0597

SHA1
84f525a084bd79921fb20bc722ba5a0488f946c7

SHA256
0bba35462ebc3e3f8f898271e418ae5643c417b5eedd6b8a4577567c88414cfc

SHA512
a132d52dd47a85a05a7a9cd786911133ad711e79459c100b2582e35e48e95a4afbe8bc0fbf0744bcbc255f3f000beb65adb1632b7ac071b367e7128d39a35804

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
92KB

MD5
d5b972b97dd9418d6250be6705d49255

SHA1
99b4c9f8d1172a553a3bb28511f3629eb46c9340

SHA256
a347704ff39a3e4c6b60980f58f781472ddff081d76722ccc1027dcf1c435af1

SHA512
fb05c4f9f4d3ac0f7a3b00f1096ce88415c3e23255d2e8531faff2dbe9586c90f8c90e6280ffd3c735bc0fede8f0e06b8ecc8e8234186ba5160cf2780302a43f

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
92KB

MD5
9681ebb0717bbc414a629a155edb25ad

SHA1
c923f31b11bc1897b0fdda8f000c0fa6243c0728

SHA256
9b137add9199ffe2f10efd2fc12832c515d1e5612df489d357870ebf51ef5141

SHA512
0214da67916b09231bcdfe0538d455ca09498d59a80b3409e28c3e9088c087b95904a04bbb19a67accef275ff0805b29773a84ef80de81e0af418855d6cece3d

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
95KB

MD5
9a116000d7e9826d6650f01d94b8f97f

SHA1
058e64e3608d1515f6e3e30b6415e5077c8d19da

SHA256
eb2219761ae39b9cbf6e0ced6eedb59507d4f9a0ed3ddfa4cd4e2353f7522f35

SHA512
8d41aa5c102f3a5e796a2e359aecc823ca6c6df0fe3b9be6f1adcc42bf5f604cd4935d75666b0809e5ea478d0b695d0826d7a6d1a51b4f20f4cd323cc56bafd8

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
90KB

MD5
072b6cac8def7974d7d5928884058c64

SHA1
0d0a4953f76f515eb777764adf9a385da18082fe

SHA256
ae8707065d553a429f31075051ebcb5990f71921b9d9395479f2600f12fe967f

SHA512
78cad97c7b4014cf92e65d3a1038b436c493a7bf8ca302e3c3fba66da6c7de3758316fb45501284f4d5f5158ac2768df9eb1d496d84c382cd1ed9f6a914493d8

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
88KB

MD5
71d097753a8461ce6f7ac1985f7a285d

SHA1
ad55c91f91eabe69aae075f9de15484ce8953872

SHA256
d95e58f2bfadb2d08479f25dcb518033f28b97d6e001d363622dd5f6a107bd2b

SHA512
17ec12c3d3e90b53f5f76dcaeef62ed4eafbc504a00612cfe47b8bb507899e11318556d5b49cd086999ca3c66cb358f711bd4b471f53f2eab1bef0488dab8d60

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
80KB

MD5
884a7d1b4d87f281351d2c1b1c020e22

SHA1
55690f2a10cc0a14afba8717640c8f13620e259c

SHA256
57927da28d220ee190539007c8b7723b04f2ccb3d6daa014c41b2ee6fb47667b

SHA512
d78c5e6bc6d54ca362e747ac0cc5fad2f9a42b8162d2fdb31bfb1e99f6adba13aaff63dda872fb4cee43c727dbbaaddef16c04a3c9fddc42dc17afc38cd80d6a

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
89KB

MD5
e65ee1a9aa727a7021a82e23874bbd64

SHA1
c4d1197440efc7c1569daea06ce39f45b33191c5

SHA256
a9cdd2090317874ee3d65017763c780d6b46a06ce102eb73fe83e12a9cd2540f

SHA512
55871580abf2a1a1a4fd5cd5a5bc4ac180804f926b9d3b5b2fab52d580d07fb768629761fa40206813346f53c43fc327e38ca2618fd9a8ec148f0cf4be15abfd

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
88KB

MD5
b38331850745d97efcfcfdc130bd8741

SHA1
f113f51de2e486680e395d13431dd01d5b962c8c

SHA256
4bb367a8b485bc4c8f991494fd61c87a66da89bb9687be2b9e5184b0a609c688

SHA512
d855d8d749d247af36ec1a8c85f79b6588dd3e14997ce5a9fbc7692753180fa6bfa306ea3fa9a7846742446ce24c29ea7791e5ec6a978f40c29fb86984d7480c

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
90KB

MD5
4938c4828004dbb7647006cb75192442

SHA1
aeafaa0b26325929e4808058b57ce120f6ca91ee

SHA256
51d2e8f55ca077de295d6938275a635c7b78b5cea585d7933339ff5440d2db23

SHA512
89b32b7515c0a7c98371985ce3e15492bd24b051881b21e20c82dfe2fcbc8e7120e7ecc8a73892fb49e7d3ea27815cd7ac963bffc18a1b3f61f3e04f6cb0a324

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
89KB

MD5
2a04280fef33217701f1c15fc843fb5d

SHA1
0b2c2d42aaca02dcac6fb37658d1a3e5d89753a0

SHA256
a9302c18ed6dc71f5dc6890cb4934ef86959d5ccc94b37d0c62742479300f71d

SHA512
ba855c082dcb7280790aa6eaad660b13df62a44b13fac7be7936af81c77d1356df90e3fa934e59423c041cc992092cef761041278a5d76c8b0e69f8212ab4f4a

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
87KB

MD5
fd3d74cef8a25207956f996ffe194075

SHA1
c5857498b16d767f07eeed23c7767d00b2012ae2

SHA256
dbe21e29662744d3d12ecf78d3aa42ab6769ae61c1548c084723e5b2e3984ff9

SHA512
a7593672a0ec2eb4dc49f03784a8b744f9d85e3bc85326fcd955f44c8d5b2212072eaeacf9ab9c2ec69e4579561fbbb8da1fc324bccae9d545f4a4562cd82422

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
89KB

MD5
d8242f7b9d1f0fd85863e0920a32bc86

SHA1
b0d6d1e7118a73f9dc07cd0fb0e2b3995f921031

SHA256
a17e1aeef1654af90ed8c7050b844522fcdf5bdbb198a39f52edced6cd6e6be3

SHA512
b89d8ddcec455ebba41122451cf0fe2fb2e3d6b93d6d01ce4e3b9e798e4242c6df43a672a36e5a2cd15f4d2a9b2b8f4908f90bfac4420a482b2219a91d3fa6f5

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
90KB

MD5
9fa1ae4e2fd8720a0c8418e24d466ca8

SHA1
21ce296f090472dca3b28d9103cfe44898db9b6a

SHA256
8275789b4e6d22932e3e4188b2d258ae4bd353b70937f0f9182ad2acd567e169

SHA512
8fa3ca7437c9daf4e9f2a46a4cad27987f5d0c361b6e0b585872ac516d9a5fbb12d2c8e9f50eab85606ae02985fef860bcd6b003bc631a3581dbe52458f6905a

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
98KB

MD5
7f5fc8541013f05705e718cf7bf17c6b

SHA1
6005226b15dd6485581676b0d861c938ab851349

SHA256
c771c2900ffe66cdf8d2565a5f0c33434015d339d5903314b4f724eb80bc8376

SHA512
8324ae029397c496154d100f64307a9fe02a3da6bde8d3d691768bd0894afe097bb5d2a844c9eca6838d4bd64944b5bf9a8da1672df5e3841571aaefe5408ff5

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
98KB

MD5
34b551082496a5ea5e96281cb9a40872

SHA1
ada4ab7f6669dd9f4f7909b4a615ab9d3ac5c869

SHA256
6dac4f769b1a7a4f246427a0054e8731cd317a0b885be742d4f0c42d25cb44e7

SHA512
4f5b460e65d1967ca704268a0af4919fdcc4f9e945cdcc22dee40936605f38257e17293586a4b72e135db3992f3efcfec576e7b0f25fdd7dd5ab298490a3c00b

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
89KB

MD5
dba6a0a98859e38a27d22609358f2d09

SHA1
cf8820a6e72e85c11d13f7318dc2da2803fa11ef

SHA256
3be8b3d48198721eb830120e05d78ec0e7737b81c07dd13f5aa4b6697205775e

SHA512
346b592a5cb34c159d1a795335464d52cc856682b6c8761e0af453aabf41a94df83ff6b4a4a3eba66c18213e001c1f88d170384bad29dcfb42f12bcfd15e2f45

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
91KB

MD5
9f39387b43460d8ebc9568950b735e17

SHA1
22d4104ce1f7f5dc9b9656700ec0bd99cacd3070

SHA256
f728d78294a1f605f2642adf6b458678a9c1ef30da1a3c169d2cebd8a4d4dc3f

SHA512
f9610f8c187bfeffbf330dedc29ac4b146c275c8148f8f85314d80e5c0798405fde739eaf7fbae64433ec366cd7a868c386373a660d36e43da8855c6ef97bf48

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
89KB

MD5
cca930dd2e2f7b07f1a909bb06fda839

SHA1
5060bc8096e103296335a7113ac8c6a56bb8caff

SHA256
d3ef1fd785bfded305ee5e287a4fcd6c43094c1875555600d7d5174b335c857b

SHA512
2f99dd5065e07ae8a122d223c3c64d158c008eda2b4334ccfd5afbca6c887813c8dc1a22c81b644e5f78ee3765dd2a01678c3e12529c94d4eb793cd4e5572f71

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
93KB

MD5
9086f1fc3c2541924e85b1d12361ccec

SHA1
c51b8718a3753d964a1d863fe0b95be8c9c95900

SHA256
6386c39a662db9419a2ddef9259549df0c0a913396d22d8b10bf8ac2bd78ccbb

SHA512
4dc6af86018e501087dc6dff04c1551b4f3c2c5148a9bc876d96dcfbfd36ec2a7f43feef2ff5ddc73558812bcde26e75c4d2b2e938916b3eff6626a5b71c5666

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
99KB

MD5
65fb8dc65a69b77a12ef157d3438fb1b

SHA1
6681f89dc33a1434378dcf5691539040dd46ad2a

SHA256
cdcb618cc8fdbbe2f37a736d4d51718f7b0952952b06dbff8b337b4214bcfee5

SHA512
c3c9e66d81db701044843091ec71980f87c0f84ba694921c62d44ef86b13357f008c720b53a622d8fbccf1978692a42ac8b0b38e5af0bb706380ff55afd10cc2

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
89KB

MD5
b223842aa7f229b257b6226878ed9ace

SHA1
39c4db0e0ad3a80bad8473f02b5bef3a2df2b5b5

SHA256
1cb5ca4aa80c8d2bbc72202fdbf9d9e373fd8566457796a4f498df56eb6aa667

SHA512
a51dacfb8ea040cc50c53695ef8587d6cfa884fb88fa0fbb670ee7b41b3ae291b4ff985a85ba70400c2a40b4a203c66fa72aacaa6049b23d8ba241453900abab

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
89KB

MD5
8f374a5c428c755d7ee7049a0e85f125

SHA1
9b73320450397743f9c1ec091e9e7d57414c92c9

SHA256
1acc78151d5aa1f446a523dfafe0b7c33dd527f93740056c7177ffd271040096

SHA512
eb3eb03cda16d5644c27659becec0b976acff97f065d71bbda33bfabc7077599a6047e0f777f3c5c94482235c919a5a7b453fac18dc5650e6b57fee8ff1927e5

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
91KB

MD5
07f0e34582a8e32ba49fed848493985f

SHA1
30675d7f80465bd2d07f6cf02387075c751c7147

SHA256
448228224a0f7ac2874c710c96f76e47714acc9d7b4e28286314228129d9476e

SHA512
4135cf004007a3b87a0a6e12f35bfeba4bf57d47610ec7ca0d51da24a2b31c2e7f3dc06144b8b59bac8fe9a3ed52d102caff00baf5de9d3ac8298fc76c332dbd

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
93KB

MD5
32b9e799b791dd620f1d2eea69891702

SHA1
e228417e2fa46ea47d25a42a5ecd2db295a72ec0

SHA256
a86d14a5dddbc871022e4d7ed8c4e797cd69fbf93dd514ba16e3496a53e10c02

SHA512
44b23b961ee30e6c9121ce7887b08c39523ceb693238e2ad17da4802a1f01a9bdbbea9348a1d447cfabe863fb0c2cf42d1d92e21ecb9bffeb78d11d0d38447cb

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
93KB

MD5
b19a658d5dd691343a0b8cc800c2608d

SHA1
53e816dece99185d4e3e471089a41ec191fd1431

SHA256
384574a70b96f668a811f2d034e054026e4e2b0650129a4861e016e35f26fa68

SHA512
d326bcaae3c8a3b4e5d10eb0a180f6c202d8f7c0e6b416ab86e0aab0fa026e9068fbb19ba24ba805c0c31a1e48aefd69ba9ddfbfe3c4ba2f9820f53e5a0321b3

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
88KB

MD5
0d09f93883fa92d072a153cf6be70f28

SHA1
c0af96a86f0cf9611a9df7aee1325af93056512b

SHA256
c0a3fac8d2b2786fb77e7992f293f649faf767bac4a1048246e51c768fe9240d

SHA512
3a9014d610e99fa48994a7a85b662df465f488bdadad4245a957f5eeca77b8f563e21926a64673be7ffdc708663aa3441687e1079aa4948294db82dbf1b28723

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
89KB

MD5
8061f273d2b03054623df302c0ae4e88

SHA1
5db385eaf557bc750947acad4554d217738f303c

SHA256
e6437939b5eca9ea68ad02811df2cb9cf1c71dfd528d4d829f60bc80a9e78f2f

SHA512
44f510d57074076a56866dbb57f21e4a5c5e5c1e9b7f52fc25b1bf9c7890869db0a9b39027e9918740ffeae57c741df15fbec9a0a3517ea4dbf6917d2a54daa2

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
89KB

MD5
da052dc2a4ead9fc034e3872273e5696

SHA1
8c9974a9bdbd1db19df557d0c82d1c5b412a324f

SHA256
018e3c691c3e87afc49e5c94834197361feb8d32cd9a8e6b8b78a1cdd628930d

SHA512
d6d22afa69d1f84b0032ec420afaf42c3995292382245cb8cad24e0e92d33da8e99acfd81dbdb0d582bb525a6a7974231e63846c9e80e5d2fbb611fa55ff6296

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
100KB

MD5
da42e76b568265410de1e015276f0ac0

SHA1
5ef0b6ac4ea446ded9c38e068532a1c339a2af25

SHA256
c0e900b34c104c61aec6dc30aeebeeb375dee4840396870286b66e53c452b94c

SHA512
1b9b1f9ccb8da9cb318ee93c25676fd0f7c0759dfee3827f8c3ad9168f14971a30ee1796c2a93fd390948b1ec4d3649b54822bdee181cdd53fd28a329c04b808

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
102KB

MD5
59f95fe51048c8160775d2852d0e0e2e

SHA1
fb659cc56ef96cbbb552d32ed1c89344672a3fda

SHA256
31f433cba4cb9d733604c0866a3210c40ee038c371e904a6360978828ecd3156

SHA512
c42e33ea56c9f88ca1cd2b670d837cd2299ea71ac6aa97928f5786f4ac92741086214db8f05c8fa66ce8d903e32cd1171d904d399d748c5f5bddf131becf99b3

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
91KB

MD5
af6788a40269a1df0a8919607afc9805

SHA1
f98aed0e73b67beeb04b211a1be8c5801cefb14a

SHA256
7b5c12cc65abbfd44da6deb99f9ff4cd63b109593de19e524d4ebdd3214dfa12

SHA512
7cfb156c40371cab04d0416cd2eeb3fe268e78258e915699da2738fbebf0a85a0007013dc41d1b644dfe5854918ce8b08af404abacd42a37dc898160939b0797

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
80KB

MD5
24bcee289be2ff69c84e29129b3274a5

SHA1
664755a868921318b0064c5d067381eebed3e859

SHA256
006cee29bdacb29d0049c888bdf81e9a5454a4713318f5ef5dfa8fefbb10352f

SHA512
e7bfc345d610a60be1dcf73e5be7632e868d1e200c7d581e443f4488f78b02aea51a63f5972aa5089b872f73424773c6d77c18284e9767abd53e7a0f2fe48c01

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
94KB

MD5
b12020f713ac1392928d32b9134265fa

SHA1
9f6b2d2286ff4395b2728ca97513d2e229a194d4

SHA256
1bd4ec8c4a60d20fa0ffad87106a7d55126453b13bf84578b988a94a2ba13202

SHA512
28078f2520e5dacf2e450449a65dbf6ac1049a48cf889bd940d11603062c36ae58c0e6f8db395bd86fd413c92302b565327b30627f04897a93d7954cb793ae68

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
80KB

MD5
7cfb573ed1ffbf160f28365f7ff3702c

SHA1
3a8f9fb5cb21f5b99b68026d8d3702d6c191c0ed

SHA256
09ce580cbc3756f5dc8290bfb860aa1f7f5d6100744a1e5bfee5e684fa8d12ae

SHA512
3422cfa785bad3491427407ba8c484231c42b00a1e2556161884eed4c4c5c66084cab3482dc7d0c1d6b152aaef95ade365e273f919c51a8e7c8d900ef4066c2c

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
90KB

MD5
cb7571902516832b4b4810c9aa841ee1

SHA1
b83fe642910870272f917d8d9799f529ebd3971f

SHA256
11b944b453b03ca2c7845d3b8a15c885667e0ef5364dcfb4e8d65b4c43a320c2

SHA512
2f722cdf1b93d0fb60706e17bd5e625c3dda67cd7c4e6261a3aeda4dd8144124a3ca1deb6cbcfffef2f4cd048111459ba842eabf6e4f636fdd3153fb722cf200

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
89KB

MD5
78abbcdcfdb4baec4f735fa2c2500291

SHA1
7218aa8fd26aa7cf9f751dcac1b7d74b5f5d2106

SHA256
67d5a508a07c9a6a1204eadf4eebaff6840e5d3e5d8f200e8a4805d7bc268421

SHA512
65ada212644bff4d8097f77d4cbbfc625a11854e0a07fcccaf9ad965e0ba94e5f11b3305bf85114e316ae8d24d1eb2f88b43606ad23bb07b548146e346a0a2d9

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
90KB

MD5
5a2fd3e3702f9dc14a9a9f602d6d966b

SHA1
00e9a9eed2c7bbf026ca95937cb15034628ae0b9

SHA256
4b19e90651b70c0fa87183f459bf5ad693d90bd21c0f82b9c026397617a0353b

SHA512
1481cd8f1ad46276b0869825abe19e22fd99403010efbf6ff3b5811a74e87f6a26093ad3953345cdd6ab288479e7248ef25812d955487ae29ffc21cf46af413a

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
90KB

MD5
feb70bbbc064e3382bd457c04475fa29

SHA1
5bef8935b5544701e0d55b84c1372faae6b14695

SHA256
45971145dea4e76f72a16b959d6af29e64d509da95c189dc23a730625e021412

SHA512
1dc7b013a0fb37a748eb5cc036fff8708c545fdf52d085e890e3ee6700d2353c006c2e788644699c84dcf06b4d01be0232dc29cb543602c1ae5f80c2a2504b48

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
96KB

MD5
cf28a1c58cdeb9d210995aa049be08fd

SHA1
5af36580424cbe2dbda0740af0c5624ff5712c8a

SHA256
0b410c253b3fd11db862b5f697ff596529c9360a1fca973109c957480d1223c4

SHA512
ff2224ed02be5ad87bb4e1b8e79366fa80d747493cb03f6447834af3709e504cfa089055ed4052627c6a2c9f9f7c0114a53d4778f229fb32698300bd3d1a1321

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
100KB

MD5
98720181fac60cac12525833e5485f19

SHA1
5aa5bccaed4f6e5e0abf9b91b9a9e4a0ff404aa6

SHA256
c1d290dd55ccd363046437ab6c1ab57930c401a606da73a3a46a860bbc15b640

SHA512
df0622b2882b887b3982d035709100785d441f064ff5ae42bb9ef1d1b7bc32f2d90e0bcacec4be7348bfd90fd621c2a3f2259e4e738ebc2a0a29e17bcd31654f

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
89KB

MD5
fef8b47a21cf6dcbeeffb4621953ee20

SHA1
deae67bbd967cc581e25ea40a1d445c3b9f3d47c

SHA256
037bae77d4ee97808dce29130685bdf448989bbb5e986c10492bc6ab4d537065

SHA512
18c2f34eb5d25c86ab69b165c380f0ef9e712ac04249fd178755448f8f6dc3a4523dcbc6e4e4a43628e964569c0b5b3f9eba148d4f85eb8b7fd6e0cd7f52edbe

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
88KB

MD5
abd017de056d40bcd25920f22f151d32

SHA1
416995aeb1a9ae344d876ee6d58aac0cef4be374

SHA256
3d7fd2a3a211d693ee7eb3c16ae497dad60742b613d9dafb8917a0559b732771

SHA512
9eb16ae3562da619e4ef9d252b5533d35ca1d9d88880949082d5b5279a0b3b45c35c4221e92f1563439340a33e8403ba378d06a3b86c9dc318a900179971d2d7

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

Filesize
91KB

MD5
c69c12892a555968ba88c2930e1fcaea

SHA1
56c2a0a232e219426511177b6c33a8eecf957f5d

SHA256
ccd01cb6da7a5899e775616bf1e7767b4dbcc993ef1b34a35ba381254d9a6b1f

SHA512
16aae73909cde3e915a45f4ad2552b62419b50fddd95d43c7a3f2644d439cf0507cfb670fe3844d92f71c68c5f67a6fec84e97c3ea8d2a3584293c97d43ad635

Download Submit
C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

Filesize
87KB

MD5
7a7be33840c0b849abd65924b1e84e08

SHA1
088dba490be925d8d3f8566d3fc194f6b98b6e4e

SHA256
66c4e8bdcb7129cd38200f3dfe8a4fd307cb9d00a42401eea47d79e5994f5c40

SHA512
9cebb05e6b365187164623abd6747705a855aaab64cfb172e1381c143aa9218fd6ab9bcf4dbbbad8e05ca22b0852c55650320beb7e2a37819a9580b7394ae9d1

Download Submit
C:\Program Files\7-Zip\Lang\sw.txt.tmp

Filesize
89KB

MD5
6c3f495c599bca4af3f1e59c31b96b23

SHA1
838ff0073e47a9e3ccc6b1fd6e35bb677383c3b5

SHA256
3d72485e2d4aab8ad55470f35d701a3decec30e2136d4f3e63bb357510bdedb5

SHA512
cd882e464cf300439bc04d045718f2e7cf2ac5371e0acbaa95f157f305ab093b704f09e0ef8453f33f8ddc4a0fa6ca9664c32f74e9ca6c8c8b5b5b1034130c73

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
81KB

MD5
13f04ff5101cb915484f91acd7331e31

SHA1
3c0eec77364bfd077a513ade8b76010b239e6358

SHA256
a1d403e4c8e47b30e589d52cfd98819f83caf7eac40f3fedfe27db624c2f626a

SHA512
f5b3c286bca72c4cd3e24dfe3ea312d4f09df3b9a4b017e5f1aa677a9c8e74c3a71debd71ab18f8b9a00904087890b9ce53d0dcfacae44d370093ab550370a8f

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp

Filesize
92KB

MD5
c15cc987ecdabb5cdd15beadc598318c

SHA1
3f4ac42b3ff3b9e9c8a98c1d2f387c7bbb88af20

SHA256
e2b0d31a09d7eac8bc48cf95ab189816ba2e1df3069c722b496e7495001f94b2

SHA512
6eed850471c9ebb1a6205b7e006df9c8ea16378eb2cbba9c5bdfd22543bad23a941637d233d4567a9452881de0065d8ce35547b1bb4542d292d6e7aa14afd99f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_.files.exe

Filesize
81KB

MD5
aeb026a049cf3014298db47053b37ca9

SHA1
4248b64cbceab1751e7642c9ed1a745c99334cc3

SHA256
43c51d8693090d173459834d40d43101fee92d3fcc55c2c49e73554bdc152f7b

SHA512
8eec4173a7f1e2f7726de536df8312bf613fed48d8cdc910d44fe910dde9d6c376b1a1d022539df8001e3fa74ebae2187f69c6544580c0035566ddf8d21864c2

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
80KB

MD5
ba72c7a5adeaa51dc3f5d70edc6dad39

SHA1
dd885345cc8d641aa4befbf40a507e47bb6d0af2

SHA256
754e30f819f1fcb5061d0ab3c35fb29cc13f8f577f6b75d9f003fda7d779ae5d

SHA512
153bfbe48f3404f10f10f865dad60dc7096d06ceac1b8f941765311e8ff380ce89b560b45b685279994e84b78b73c68ba9549b58011df61c40d60563990e3bfd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads