255be8ab1adedcaccdd68eddbdc83d7a3e78c9d4b8870593f9da40db7173b908

Analysis

max time kernel
150s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

255be8ab1adedcaccdd68eddbdc83d7a3e78c9d4b8870593f9da40db7173b908.exe
Size

160KB
MD5

5df7dfa021e2e62914debacba49ec775
SHA1

55be5c5141688883f6f3e11ef63b8355c27ec4fb
SHA256

255be8ab1adedcaccdd68eddbdc83d7a3e78c9d4b8870593f9da40db7173b908
SHA512

257476b90b082888379c3fd9d87605c6ba7305775d09472ea6c97fab8f356b2f6901b41d156936aabef0132e02770f6943f62e6f8cc62f0192e604d74d4a6d48
SSDEEP

1536:W7ZhA7pApvOsOKjC0YSilpFpfkJOM2kJOMIsKsc696xZXsH7ZhA7pApvOsOKjC0X:6e7WpXYvndbsFe7WpXYvndbs9aa1aaN

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4898) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4504	_Remote Desktop Connection.lnk.exe
4724	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	255be8ab1adedcaccdd68eddbdc83d7a3e78c9d4b8870593f9da40db7173b908.exe
File created	C:\Windows\SysWOW64\Zombie.exe	255be8ab1adedcaccdd68eddbdc83d7a3e78c9d4b8870593f9da40db7173b908.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	_Remote Desktop Connection.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	_Remote Desktop Connection.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN102.XML.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	_Remote Desktop Connection.lnk.exe
File opened for modification	C:\Program Files\CopyJoin.xsl.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp	_Remote Desktop Connection.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	_Remote Desktop Connection.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Layout.dll.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\he.pak.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-pl.xrm-ms.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp	_Remote Desktop Connection.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	_Remote Desktop Connection.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL111.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	_Remote Desktop Connection.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	_Remote Desktop Connection.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	_Remote Desktop Connection.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp	_Remote Desktop Connection.lnk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\hi.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.exe.tmp	_Remote Desktop Connection.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp	_Remote Desktop Connection.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\release.tmp	_Remote Desktop Connection.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	_Remote Desktop Connection.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp	_Remote Desktop Connection.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4504	4920	255be8ab1adedcaccdd68eddbdc83d7a3e78c9d4b8870593f9da40db7173b908.exe	81
PID 4920 wrote to memory of 4504	4920	255be8ab1adedcaccdd68eddbdc83d7a3e78c9d4b8870593f9da40db7173b908.exe	81
PID 4920 wrote to memory of 4504	4920	255be8ab1adedcaccdd68eddbdc83d7a3e78c9d4b8870593f9da40db7173b908.exe	81
PID 4920 wrote to memory of 4724	4920	255be8ab1adedcaccdd68eddbdc83d7a3e78c9d4b8870593f9da40db7173b908.exe	82
PID 4920 wrote to memory of 4724	4920	255be8ab1adedcaccdd68eddbdc83d7a3e78c9d4b8870593f9da40db7173b908.exe	82
PID 4920 wrote to memory of 4724	4920	255be8ab1adedcaccdd68eddbdc83d7a3e78c9d4b8870593f9da40db7173b908.exe	82

C:\Users\Admin\AppData\Local\Temp\255be8ab1adedcaccdd68eddbdc83d7a3e78c9d4b8870593f9da40db7173b908.exe
"C:\Users\Admin\AppData\Local\Temp\255be8ab1adedcaccdd68eddbdc83d7a3e78c9d4b8870593f9da40db7173b908.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe
  "_Remote Desktop Connection.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4504
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp

Filesize
79KB

MD5
15f05aab23293584e7889e593ec8b133

SHA1
f7e053e4865ebb4e8c28d369ca4f3f1136bdb15c

SHA256
336c43fa3f2d80161bc8a4a7081c4a0fcba380b6bda66fbeb018bc952ed177ad

SHA512
6eecea04c8516ce5d9eaa1d284e41cf746e57105c2b5299f3362cef71485114f2126ba0cc7fd62014a097a9ca11631e7a25c78509d56c422340c92994a82e770

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
191KB

MD5
cd01cb7d46c6dbdce064b37342854a42

SHA1
e215c26c1e062358ff7573d8385f4bde869bbad6

SHA256
aa5f73c4a2a372dbf781e7bcbf0394e44883678f318588d7da903f02bdd00e98

SHA512
61bfda24a4b908266cbc822b82cc5751926c528cfd1091ae1d7bd751ecd4fac70ca9ae7044e242494df4461cdd51c522586f97de4d849ff1a8dc60d8657ec209

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
177KB

MD5
76d9f02d73e707e02cf80888fce7f68e

SHA1
7a94093940e0f12e2046242237b061a2e42dfd9c

SHA256
bad19c7f73cc2e2d42d96a79f83fe2b048825486f7d58fbccdd94ac45e17f0fd

SHA512
4fdc1d8d9f476b09e3e62438bbbd6cdff6e5cf858732b54617fb91ab2953578aad6a9722609c9d31636b957f0e6dbe172ca01e7f6f7455040eced0c1afe3457f

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
b39982cd5b923b0b44bb28d649b0a03b

SHA1
96546fea8c83b7447cc68b6f95314754f5cbc95a

SHA256
d4b9cbcbdb8dfba5813d4ce591c36850d8292ae57e0fbd032ea050495a8ed93b

SHA512
4b76e50d06ed2104a6c1852ba2f83958d8f814118d6e1f267fb353026dab7c958bf8de26682d6419abb30a47ecb992ee16f95b8f5659616fd1a4bfe630a3e072

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
625KB

MD5
93925736924b6083556a37e97f0c6ce6

SHA1
4436ccffaba40ceb46938063432683c3a22bf30b

SHA256
e66d40c3f625efcaa6433475d3cc107c50c425120c80d3772a7a89ec57387537

SHA512
776fbff59d7384ab06a3c6bfc226451b6a0573434931e8ee7fe75d449596ab286ff98327c8041acf0ee1645586ce6ec5acca9cb6b4a0ec6000c48d959f74e92a

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1011KB

MD5
b8cf6a1b8d6b5f00b37563f25fcacd77

SHA1
93a3c74fd03efb4d5e68df05d5b2181b2aa7c1d6

SHA256
c6fc96052310cfe74efa3647071ec41fa517dcc1a5ec53fe8b08d2c5756f081c

SHA512
4230647f4cc8aa834bddb9f26ee34c2722cd2105e491de350ede7297e1b3a8719f44f11b8759482235255995095a97e39cbb1dbcf28609f70ae1d58c09f53148

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
765KB

MD5
66d7ced5b3a3e5f5a309ec17b649b947

SHA1
3cc923f823e125326ba894af79ed1a449731d937

SHA256
e9fc1e2953e7c1cd4eab1cd3e4a7c66d3a79720bc3db99cfe815b37722521c10

SHA512
ffb9e64e664d6f1aaa1c3f899783e81abf4ee8c8cc2e49fd0708d566475d3389794659d5ffcf70f518099357b4def64c82131f26d7b1b37f2e901af855202958

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
138KB

MD5
cf6f290f07812169a47eec2b4fc7a683

SHA1
84e25ec961ac58c59b9c7fc776dc29ff31880c3c

SHA256
4b4448e44656ead26e8b382101788b3078afcda46880f2d05dc0547d06601696

SHA512
6471128f5c190606ea1691459c336435bec1ccfb8a1e1224b82aca891afbc446129ff842598523b12181b00d7bf699b42c78a4c1d1c2b48dde3a6fa8bb62f979

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
88KB

MD5
db74d43230b8ef9725866936692b2f44

SHA1
4ba62ae0f507e654626b2e86b7995c32dc23aa70

SHA256
149a0008cbf7a71ec9de531784ac587949d00c9e02fb663a17166bf9df16e598

SHA512
1f548c5af64735164b6eca483ff2553a594e7dae375a70025f9aa7ec400aa7ca0876b73c44b5340332c5385e8e2d86ce5b21d4887a14a4f5ddf099807de9189d

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
93KB

MD5
4f65ac5a27b9e24c1043349e075d2061

SHA1
d612f2058d3de9d0640ce08bd6e059796063e705

SHA256
2bd58e0e00489de72133cdc6672a0ea249c753f3510fc41564835fee2a6e2963

SHA512
fd1e141ec432f13616e5a6148b71f7c4676c8ecd3294b40b67e3a8fc5d69a4a076b9d293e600975fafe7ccbf50d81d01e7d4311c3fdceb9e26427cf603637e59

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
84KB

MD5
9bc0809ee02cb50f8e0f387addb1137d

SHA1
f0d8e733a8e23f87ec82035abff2947029dd130c

SHA256
99ec665856d397157df059539f9cbfefc608a1508d6a244f0a41a1eb80f4aeb6

SHA512
fd3a812f9a37bd9fa250e1ab5e49d0e09bf4bff9532f1024656f5d9f19a457fa1de0e825c1cf2ddaa7f60b010771c364c8c7b227ee5231042370ce63434648dd

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
90KB

MD5
6065b66420cb79809a5352e23916bdca

SHA1
50dae08a5201a8e995f2fd3746f523e221b4c69e

SHA256
e26d1f37be0f7092c54f069b14f75aaff82ebea6456d9818c5b020db2c678228

SHA512
031472f602b00c5d96cf50fab300f81d63f9fd8bd115bb7fcd4308d729bb12a5e67e45db62b3aa1db8d3b89d53d5a847ea0fdfc3086bfbe25eae6464bc790251

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
93KB

MD5
fcd5caec59d1a3179f3791138b20ff21

SHA1
f797b4cb808d5d81c0f65bbd3b424ee99797c62f

SHA256
bd6c828c8d95bce4c6c1b853996592182b7439e91aabb8101351ae12aa97fe9a

SHA512
a8f4209f5b39a5832d8bcf27235d7bf6988a4beb061a70b3667c6db133f27de83b2a7b555b365abd6804533e5b46f25f684916615b9b7907ac0f53947e3462bd

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
89KB

MD5
feff5c798c9cb0e0e68ced3d77cb4750

SHA1
26defb7a868f757f9a5016e1acb1d5e163bf0ee0

SHA256
a05e032630693ec70a5a7676ed3a07ef74b6aa5417ecaa0c60d3fdfbe9f99398

SHA512
0fd56fa1fe00cd434a2af8db89f6c0a87823e9eb7ef517b4b287f66210fdd7dc2a8f48b995dc1dc5bd452d7ae62f3a4ce1702723c92bcd40867f0a2021de6731

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
90KB

MD5
3dcecc720f9f93d19e4509ff6b25020e

SHA1
a40a0c98a93ee5631f79ac82ba18bda318035254

SHA256
92fa24543b340f1ea410a1cc3ab4ccc0b7665288a8645bf2454037901eac398d

SHA512
0d44fd11cbdbe8a978157a6ec6ebdb9faf3663733fac339ef9d6ef2529f527d1bc0a46441ab6e4f01ece51b1e35acc0e545872a3d0c729b6341830ade2c7c0b5

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
86KB

MD5
2cb0b6f5ab17bc14cc7af1bd56bad931

SHA1
03e16ecfec385058fc08e634fae4a2000e01aaae

SHA256
c6d8f142e2583a0bcfadc95484fb22e1323dc011c598cb92530aaec3d0e0da64

SHA512
277c8608f55616ad57f8bbab222dc005a4508c107fe05f8ea2b9ad336a9e761c04fa3d1cefa8c8043898474a76fbfe16fe6ed33e752f5e397bfcde9a078fc1dc

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
87KB

MD5
9b9d3a074351e9945695d2ef65dff592

SHA1
25200ad90dd59fd5fb9710e505eebdbcdc6721ff

SHA256
b2073c0f3f2c5ab4c52754a103ba590035f78b42cc30137e35592ac35952ca04

SHA512
d4f7f2ea134834348ffbf31c78255717ae7dd043054a15ac6a8a006e45d7e1481d99e336e776e08febcc7b0ff529942311ff24ffda16fb42eb12b35fa8e8cd6b

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
95KB

MD5
5dd9a782e5dd3d59a0a0af78434eb88c

SHA1
8fe11ebb656ea34a7a78c967ebade329a4ed45c3

SHA256
e507e6c4931e41fa091946de912b6817c8b90b582c68c489599ede452ef9792a

SHA512
1fa9c6be2a613f826abc79308db5e92d4db825dbfabaa39d4a067d34c345533d40cb0d42788eb3ac3846f83aa775b5e4b2babc145cab456649249743a58d81ff

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
85KB

MD5
ce96fb51e815a18c635a42a166b3a361

SHA1
4763144f079032e7bd15b822877e5f4a92cf342e

SHA256
c110ef579e37ac4bc112d045efa85a47deb8807c26a1d8c35cbe11784c36f891

SHA512
d1d952e107eb0549171f070b0ad9b22339b6614c8260a787772345e52325d1862ab957eed63257a6531de7bc5cc9990a8d913743b2dd01e1314cf670c2d28b1e

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
88KB

MD5
91cb939ce4b7c64da124df717b186a20

SHA1
157d8d85af2b038e55c5adf05f20aaa227386508

SHA256
a694af6823f7e1469c4dc4904478661dc35ac5b4b591a179bbd3e364a4d68ad1

SHA512
9b1b09fd7546c602e1b0409d2805c242944b6ea52888936859094c4199c97a514ecfb41526350cf515dd1fe05ca73b0ca632b4a52d2d9b790f5552ceca1c018a

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
94KB

MD5
3a475b09a53fa1a21adc491ea894a9c1

SHA1
eaa64c1e72ea006bb01dbf72687750fa17715381

SHA256
5173a1724ad3ea9ad65d87455b5de2d8d4d12908913e598ecccf439000468d08

SHA512
77e21db9425c37d0fe891b73ac1a4878a5910a2d292091d24493234bf6e3cfb116ace87cd0a8f8caa0633b55bd7024efe1c045e76f2fbdc1659962a29846cca8

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
90KB

MD5
e2d19f5750a85239e1d6f6c104b16de5

SHA1
683e50a0b0af372d21ce97314f3ed4e6c38f9958

SHA256
5980ae272bc14fdb60c706a044e24cb4d00235214303f9a75fbfb0239b83c087

SHA512
03b547f6e130ff2b8f2fc20e492aab74f711c317c6528365c4407803cd0158b149e402165cb627ee567615947325d389d8b831451d5aa8314f03040518634d1b

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
88KB

MD5
38f720e89454fd8941ff68e5aa762534

SHA1
b1052cc0ec3b32ade12c1276cc9a351dd5a7e2da

SHA256
90be6e3103c92378acd2f3e05812a6a6cbbff8439f60261c059bba404d460d39

SHA512
de7cab1ce88d7e4d78715f291226eac0c449e995d07baf93e73573f1b2d993ae4456066aea2819a576943efaf4711ce3dc1a9e64d41b7963d7e72946d3db4762

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
85KB

MD5
e9a11973d2ae8e4b7af4d20358b9fe15

SHA1
707a199adbb53ae1265dcff187616174ce9a5c81

SHA256
6192e2a74616281ed3ffce31b88c2b31c1f0b2936d73a159489741d15af3b9f4

SHA512
9ca095705ecf088f8a96a5f983d33d04c953e53653107fa36533859b08ad8379a9e9451ca494df41e26cb3283ae36171ae42b6063f26e95efabb7ed7c176d2e6

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
89KB

MD5
5d60751de907dfb457141c6e5c2bc67b

SHA1
2f7044c2118b68d5eb97a1e6ec15b25b6f422270

SHA256
38c4595032e3b2e68bf762b6026f96817fbfea02287420d4ea17026520daf6e4

SHA512
c0b5af30eb48eab178be25e952a89795daecac074569b1a0619dd9343c55c5a06e0638218bcf692bd4ce19632d87076894cc10b823c198a71a5aa371f9afd04e

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
92KB

MD5
6abd878584e5af5c37d9a0b13c0c8e4d

SHA1
d7c685e34a4386b46e914d45aeb68e09708da9f2

SHA256
4619eedc392a4f4ef098de686d30f9e064fe33fa16b4e2e68ad065832874ead6

SHA512
782a30fd336a3c21921b201cf6076b1a7870701c051da5a485a18b31c2e234d670f9b789e26d5f26ab997134585851a7f452131b221738577182c5a9351c1f01

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
98KB

MD5
e00afd7782d745f0385dba30451f301f

SHA1
67505167caa6156ed282f0dd1f39679ed08886d4

SHA256
d2bfdb88882b747d16956cebc719e847d5be53110f26d12e78d497f324d42f23

SHA512
58d2d4a74185cf7c619de56c7b6518db6ece8ea96a4a3c9635451af39fa31eedbd1d6acb642fc2f15fa2c90539def2c040ec29505d566e8cc77eb3ed41a7b797

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
89KB

MD5
3d37fb1e50afeeb0b46a7fde3245aabb

SHA1
f0948d8182dfbfaafcad59f7de5beba3235a1887

SHA256
eca5f77255f582998ca8bdee6f455d8af89932dcc5e7a9038ff61b2431137490

SHA512
4f891057acfa73b2299235f86181b775b335d25be0d17446a4cc2c40657d78ed92dc4ab9ab0dfd16735f71992938d5655183ec2044f77eea20c91aa9a003b059

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
91KB

MD5
d2435dd9eabaacc61bc0063815c06e6c

SHA1
3a9077b93b9bc6f66e3c98ed31c9976722e06d4d

SHA256
a61f39631e015b6a6c031fb430ca2fcd1107bb70e41932d3724d4d60a09052ee

SHA512
bd616c4c2a7bec79f3f7ff4aad84ff2e209bcb23c8403c13bdcf6136e43156434ec1072b4c26b66fad2e32cf2037a528dd129f7c7278399a9c59bb34c17e870c

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
95KB

MD5
a626ce75b05ca99b6b5152c86890a3a5

SHA1
d6471bf61c691f1fbee502835ed733f5a8600d3c

SHA256
e8f52bc9797f0bdd74ddd31be1797cde55cbf7d3e0307969cc38828e77a0da15

SHA512
ccdc6d51d57dd38b715de34eb319e84932f936a2f3fcf9348cbcf635abaa110cd2236630af7c28d8d41bdffd6712ad4537e6bbfef5f22f8fca60b3c62820694a

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
89KB

MD5
5450401df3de6b3cefe353cdbb0fcb8f

SHA1
a94328992325fe1f681f6a71c4f52c5273caf850

SHA256
a0c353d1dd9ed771474a392c75f405b2047b7bf8884c5678a3c9a20f5072f223

SHA512
63d9fef146d89456b5b7ef92ff4f0df60c95ab1beadb4179028fcec9d48be7a445bb2bdbd089339726830decd542cbc18af9345addab3e010afb7a8333c97d58

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
78KB

MD5
f57b9088d111eba195b24d6ae8c5493e

SHA1
dbba6a268356f3188fbec3a4e3e85b130cedfb1c

SHA256
aea2de3059fc2d13fd702dbf2c824a88b97d0737dcaa7d771423e35311cf092e

SHA512
c00d36c18e7b4532d9cd56d4f0c830d6a49e46f2b0537914719b71cae460f27d7e44e56c7853e78c0068afb7d885f3f7eac159d6957d6277d7dfeaf3e5d522bb

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
90KB

MD5
9dfeee232dd8d68722dd187de2e2c440

SHA1
cc08e5d8677668b660a83018d7b4a814449a2a15

SHA256
0d8801422b9035871b3bbc7b2101d238b1de6afeed238684358994cafdfc5537

SHA512
ca13a549e30c86d395a15e55ebb141338e0111bef3083830b675e8793f5c3756206eca629bbcf56fbcd76f977147d7cc64eafc67593ce991dd477a3f2623a221

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
93KB

MD5
1204823eb918ce39a4b084498acaeb77

SHA1
bdf0e03c381c7c86f4c7e0bd3bcbd17a97f2c069

SHA256
968063d32f60b2be202af6f8a2975be2e32174f88952989c785c561a9234db3c

SHA512
727afcd2875baf93754f31be7e0a4952065a2b0c3732c3da45297c57738da069b931693b8c94dec82bd46496319cdba36381fbdfbaad6cf9601ea926f67b5fdd

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
99KB

MD5
a0c6205f3b18dd1b0fe67743712442f5

SHA1
b6feee7aafd53dd52100c29c2216ec1f492211ff

SHA256
2fda16dc22aefd229969dcf1102f61af56145e365ef56ff219f4349be5e0a4e5

SHA512
0041414a553f38e8bec5bfcf1ff170d68c327ba6ece5b36f54b2c52fb6960652a1f366cdbfae907614134ade1366cafd3ce595392d7c623f8c6d46aafd307905

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
89KB

MD5
0007fa9cc795ab194f5f94db1cb27aaf

SHA1
c2e16a1a189effe2033d69a0fee338f3f3a3b957

SHA256
26d696f3c75c165fa930fe27330be56a04750312b93beca863e08982714c7558

SHA512
f6fa1a131c892418ae636a8004a911655b2df6a550faf852a144cb3112c4b0f116a37a786cd3dcef6acf2a0e26c66e52b34d12a758ac19dfd41f3ca8df6a8f1a

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
89KB

MD5
933b42696360615a1818b9c5e0accb9c

SHA1
b07d20e20dd99475289cdb4ad56572be2800b898

SHA256
69dd1553d559f860c7c728e3ca25ec6940432114c859defd8d6d03f8566caeb4

SHA512
04bc2eb69d3463c1303935855e8863dd2e6a413e32a6f6b4bb8744e57503dc413ad20b979ff66f9dcc30f57590c3f8858f3c8a35d48a59bb533e405989f514de

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
91KB

MD5
37dd35c0b17bc4899f796d2615089891

SHA1
ce1315927d9a375892bc6f3cbacbeaf2cb6aaa7a

SHA256
74b23a8db44c56bd6b60969824568cc36c60011adbc2707bd7713289a0abcbae

SHA512
82d0c4868caf6f426b668add68a50c17131b02b314bf35cff17d98eac3b2a6f2dbc061546d8019de9d3114a88e645c0714afe2ff7b502eba59a3abd4c2c2476e

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
91KB

MD5
1bda780ca0d3cc3c9c6bf728b1d4ab38

SHA1
784bed02b0068a034f01d7b07d9c54687945c5fe

SHA256
74778b17be035cf3a23c7265a4b26aedff590138bfefad4cbdd356980252f79a

SHA512
a71853d75312423fa10ca661dd03d67bb48592bd9728df8eb75676b8d273658b0f698b2c0060a4cff8256e832325bd2e2faf14a6b67ac00bfab3945695d1f27d

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
89KB

MD5
e1a627e231827757863dd736379ca2b7

SHA1
a436d842b66c3545dc4a8947b962171fecc04263

SHA256
e90c0a72c3c795f38a90b2b03629a6cab4fe9e75883590d830e53e1e0f6d95e9

SHA512
25b4029c75cda333ce26266b5bcc5455e426130487f6788159c67d6726eebb1e133904e47ffa91481e5b425fd716ea6eaa3f740bd0d6543fe0e3c43dc0506404

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
86KB

MD5
bbbde88341453fcf4fc7173e69da4d53

SHA1
80b0bf73f6e48df4c9c5b39e6bb51f4731a109c6

SHA256
5163a0afb1402b8a9ed6062596988f4acc983c385c86c912cc1706cb3b2ccc09

SHA512
f8beba559acfd97e7084576cc0dc1373c82c63e6c618b90abda635fecc56a6f560047544d01d9a8c367b49ade2a94b813520cf1506609ebddbb891be85352927

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
87KB

MD5
d8c4f28e24604838b5c5b073c64f2892

SHA1
0e70237247bebd7da5ad75f35bb8fb691739df81

SHA256
f31520a2f454a4484dc9209e361d54c92cab241f9fa834a8fd0f714bbd5b7c51

SHA512
9747d600e339854900b0678efd7db9ffd9c10c6679e573f33035ab494e6da0e993e8024b207e7a3d1ec3eb25c2248750ce2426c29271716c643bd09448448b89

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
101KB

MD5
741f40af5131e3a5b2b303452dbe56e0

SHA1
c19569fa3efb2a74d7d3b2210e7b2db886135c38

SHA256
fc506ee296e662a0059bf63fdb857c6d46594d776ad3ace8fea9dff8e504a632

SHA512
b929a979b9280e199c0d763a8f7aff1f09402548918102371a1c72d7b51ac8776bd4cd44da8db74de7a7283a60ea02a6c58ce707b71ae9267d9830422e8247ce

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
91KB

MD5
000b1c4aeed8f938ecce27cfd5817d19

SHA1
c3270e06313177e25891b1b5eb72c68779d8efd6

SHA256
8864de623efa00ceb08fe7cab6767c976fb1584f20a674ff0eaa592dad9e68d8

SHA512
910d342f28e157aee5f8ebca074cd16ce5ccc1d928da9005994706a3dcb316356ab4b1bdca7c7ef2f89c1fda62a41edd7829c9733aab2b06161870bc89956330

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
86KB

MD5
f30ea22f5f4c0f219a100451f76a2437

SHA1
dd3cfc3287fa9da4bb1dc7da2751f4318c5bb1a9

SHA256
162f4c1cd51d546638803befe8b2e9f1922a887aa7c4b51a1ce3ee36baf764fb

SHA512
8e527a481b95e2c4d9910d1e66effadd45989da57c6a96d49ac330df77028ee54e35425a3609d022d55ba565890ad21b63075a0d5383e7b6eb0e16dcb46ae4a1

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
84KB

MD5
1a9bba30e90cf88b7317f4a2430ce9c9

SHA1
9f145972ac1cb3a3cbee7d25379b773631ebc96e

SHA256
b24d827c194f20c1cc6f2706cd333852bb830bac81d99c2ec2db36163c523e76

SHA512
dccdee4b2ea9fb1ebd8cbb0a92a3c00a98c24a68b7a74fbdc136a63eeb8c72dabe79537b128a67e83a272c1064e8d8cde8ce51208e39a0e270e090cf965146b7

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
84KB

MD5
f39b1f5d4b265b7f95ec2f8d79690894

SHA1
754659ccefd5dfe49823cc60b882111efd9c4c49

SHA256
0bc77286bfdb0292a7458814de2fbd74e29a62857cf9c845f201220fcb6e7f37

SHA512
6c90b8648c34b21e026d8e251f6f4d61b85a01606c976e4c77fe567a61c7d89574ddb15bf9f4f8b3bbacb770fb9b1fc26574668ebf42cd9b75a6761350b9ec74

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
92KB

MD5
012abb34c52d31c7db4d36e0d8531cc4

SHA1
451b03bc1b49060eb6e9667f3e07639da0ccf30d

SHA256
38f4b2ca957b98c8706279b4ede2cf3745ab46be7d7733c2deceaa2c25437ed4

SHA512
8f35f05bcc58cafa106eb33ede6b6c4620a31404284b352b4a04cf27bd155edf1b1a44b3564d52f5d04667b6093c23a17c8d86e6932d46a8214548dcc11f0add

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
88KB

MD5
45bfdf09f5c62d5fbae478f3a71e9b41

SHA1
14c383748c7e5e82b42d7564e9ee4573e000361e

SHA256
012a26ca006926fe63be40899b2408cfa1c6027438b7f046da57ce3d82e13a92

SHA512
233952eb563cc21d6d5ef77c1029f30c6ca94a7598ae565a2ec4ee62e9184a60501349ef543bee16e7b92bddef0e325a5454cdd440a33ffb915c3e39d851601f

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
84KB

MD5
db850f57a4313b7b1828d8ca83497457

SHA1
b70dc6d7a05ded5858bee462b49b818b3f2e9089

SHA256
2b92db6fc0855ff20d6171195eec15cd56f128d458e1ac4e44966e63c1bf3f43

SHA512
a6c58d954d5dd9841212bfe478c85f29dac48eeb3cca0442abc3dadf5f17e9fd5387e0fe363d6dd54d212d17161d36f4b4a2f69d03ed48587f6d1c659c63a800

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
80KB

MD5
4a7f8ea5cd5fa52cc3fe01d32e5bef82

SHA1
32b7406d633cd1cc9a0446d86fb7a45c8b2afc40

SHA256
a287101ae113d395119717f2b36f46060d1603e5279967b8bc5b764b5f66416f

SHA512
e80ab66c36d2b5d168ef24003405ef80b8f2fa7b37de610b6c79769d3c87459c0de32b16010248f323b72bef470f1028827f84549fb6839689effbb186c25867

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
95KB

MD5
d10d5504665045e97d4b72a726e5b305

SHA1
24caa96cab87ae7f15b2c1c1e10648b7a9d1ab33

SHA256
7abc1d834ec4105cbe0d8f1ab16c21c8a734376fe7c589ada60848aa5e4003ac

SHA512
961f7899eff8834d6a434f6218d472c4302eb30dd655284552bbcf489eed58077df73095cf7f5fc68265c8233fc1166099eef490cfb7c9fa050b9c2fc467579a

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
89KB

MD5
15fbf95361ebf0ea4897c357dc6686e3

SHA1
0cb08d0e90e685e32bfcf0283ed3db450d13d70b

SHA256
3eef64699df0c4a1db2275660f365563dceaf3a167ddbffe67e6efc13667f765

SHA512
8bffe295064eac9faad3c8e860fad248eb4e3ba68ddde818368a1b1d5195458d9350236dde97f88b999dae15819e7b053ed870eded76dd668233cfe106651324

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
81KB

MD5
224b2a3563fe6be49abeff4dc59c479b

SHA1
e4bb3b0b56ad975801a5bc2d86ea78473839532a

SHA256
555e21dda2433a6bbc2e08bc750a6f2466d592967c23c1355903efbe741d0ff8

SHA512
0066b57f268acee630f82f3be0d6dba8dbbb6d73febd31f16f706ef193ab067d027211650149fd548cef46afe9f1383bc8bd9dfc18e4c532d64956e1b2a24607

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp

Filesize
90KB

MD5
f3894461f47633ae8e9e64888acbbfec

SHA1
4cfd4d68da3f8c87d1398137d0ea6f108d019771

SHA256
7215a7947a0409780f9c63913131b8ade3bb34b85cf175e31e781b41b5482f30

SHA512
83218dc2abdcad060ee3e459e5a40a70f803c8f1eb6072fccc6b5db72a9531a615e7e99973341c477efb0fae526e77a74a5d103a91a8edfc88f649602d6cd189

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Remote Desktop Connection.lnk.exe

Filesize
81KB

MD5
72ea5e7c49f2a6f89a8ccb0a7523cfdd

SHA1
b9406079d69d3e6efab7a548616e024b3b8832dc

SHA256
65b86be0ce7751284d58a1caa8cf7f8311000bf33a7425da5757f0a936d7fe29

SHA512
896cebb3bf05a0098a665c263c33b7aeb52de9db69a2d86b6b0e434ff6e0db92f7e58bb18f2848dda81e5ae9565e956af1c8cea83fb648461addf0795d1089c5

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
78KB

MD5
c3f05b149b1911e62ae2f71f9a25045e

SHA1
3a4216cc45de138acb3dcb2227636bc20db4f1d7

SHA256
d290cfa51a0aed327a1a9d0f64ef4e8ffd7d2c4bfabf2d2af8511a4f2fe71c77

SHA512
fd051e9f133b0b9c811aa43808868c78eda9d9000409c2f472905101d5be1bdf2d8db83953e76a53be7c5a7e8b7e0e0f95aa59e447050101e89e88cc725a4896

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads