6c9dcee886a76829ffc7deea910e81704d1392754e941b8ed15eeb261b819a0e

Analysis

max time kernel
150s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c9dcee886a76829ffc7deea910e81704d1392754e941b8ed15eeb261b819a0e.exe
Size

531KB
MD5

f9292e866f948f485c2f83429a7cabfe
SHA1

8f552764687ea9fe37574dc225d57f1f4428d873
SHA256

6c9dcee886a76829ffc7deea910e81704d1392754e941b8ed15eeb261b819a0e
SHA512

273a1431edd366a4d0221f212ba65b834b13b9e22211eca375bb3ecbfcb478c6dde2e62de04d27a4012e461033bd16ee4c7b7429beba576f6e566ae8037ac418
SSDEEP

12288:yQthsUsWU9BHmy1dmh1D7QthsUsWU9BHmy1dmh1Dw:yIDU9BHmy1dmh1nIDU9BHmy1dmh1M

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4660) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1900	_Wordpad.lnk.exe
1260	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	6c9dcee886a76829ffc7deea910e81704d1392754e941b8ed15eeb261b819a0e.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	6c9dcee886a76829ffc7deea910e81704d1392754e941b8ed15eeb261b819a0e.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	_Wordpad.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	_Wordpad.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jni.h.tmp	_Wordpad.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	_Wordpad.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	_Wordpad.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	_Wordpad.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp	_Wordpad.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp	_Wordpad.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	_Wordpad.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp	_Wordpad.lnk.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	_Wordpad.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp	_Wordpad.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoBeta.png.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.tmp	_Wordpad.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp	_Wordpad.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp	_Wordpad.lnk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1900	4864	6c9dcee886a76829ffc7deea910e81704d1392754e941b8ed15eeb261b819a0e.exe	80
PID 4864 wrote to memory of 1900	4864	6c9dcee886a76829ffc7deea910e81704d1392754e941b8ed15eeb261b819a0e.exe	80
PID 4864 wrote to memory of 1900	4864	6c9dcee886a76829ffc7deea910e81704d1392754e941b8ed15eeb261b819a0e.exe	80
PID 4864 wrote to memory of 1260	4864	6c9dcee886a76829ffc7deea910e81704d1392754e941b8ed15eeb261b819a0e.exe	81
PID 4864 wrote to memory of 1260	4864	6c9dcee886a76829ffc7deea910e81704d1392754e941b8ed15eeb261b819a0e.exe	81
PID 4864 wrote to memory of 1260	4864	6c9dcee886a76829ffc7deea910e81704d1392754e941b8ed15eeb261b819a0e.exe	81

C:\Users\Admin\AppData\Local\Temp\6c9dcee886a76829ffc7deea910e81704d1392754e941b8ed15eeb261b819a0e.exe
"C:\Users\Admin\AppData\Local\Temp\6c9dcee886a76829ffc7deea910e81704d1392754e941b8ed15eeb261b819a0e.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\Temp\_Wordpad.lnk.exe
  "_Wordpad.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1900
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.exe.tmp

Filesize
532KB

MD5
c22fea1ca429043c535844b6d7905fce

SHA1
2174a6c2547bbabbaa27753298700dda032dc4c7

SHA256
9709dfb3fb559d5355ad863eb6c7807d58e944b0500e0587116c809d1681fc9f

SHA512
59dcaefbdd0fb4b49c813500f0500f37fec57439538836f7cb27393624e074bb3611358f138e0cd15f5edd7473e8218c264055996cfe69a971def304f71681d0

Download Submit
C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
267KB

MD5
6b7b15c230d3dc971c32b460aa968472

SHA1
ed5e576333fbb90a57669769c751b4da2fb6d6e5

SHA256
7fce748d277cb2e4de0d45f77a3d17645e800282cfb2681a0a820f1affaea7e8

SHA512
1684184406609a9c2b43c21cdb7facb7cabe4bb667c142b9d883e1c540b1db2274e9fd421eae2e16ef7d18663577bbd5539afdf7914ab1ca9d5c6d457ef060bd

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
379KB

MD5
c0a4888d641ebfd53aa14f001174d579

SHA1
332f1492d570a3ef7fc14a07d57049d5788fb9e7

SHA256
b742e72fa4c561795bdfd04a7213e12f6bf57e1942e612007a444d224b1bf5a4

SHA512
8fafe0dd43bdc6c833ee1e3efb8ac752e4dea6db797797d3d910a868f9f93c58b81261387f270689f67c28f3ee39133d249cefcf2c842f0a76db92fcf25cff2b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
366KB

MD5
63db1f1d129cc1c8e29bf3f4ed38f600

SHA1
3a96a1be3effc238c00e582192c07588cca8e4a1

SHA256
b75fd2042bcf1efc3bcd0c3a889054bd23d39bb892b28f5d7c2d4d6baf5aa9a2

SHA512
a8c2729c82d94847fabeab3db3ed8872889b90f943445aa2766af164a8a18e909097d2be1df8a9c518ab75dbcf42a17c37eef4d0d1a8b8b431f04f40fb4ac9ae

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
2.0MB

MD5
23369ea552b054934909c7e98e408c3e

SHA1
7df670765fe6811e2ff98bf5f4e2744223ec38f5

SHA256
3f5bc82a975c9de1fe35c69e8d9301457d52b8bfcacab8aff4cd5d19cdd6d1fa

SHA512
8c828078519fb7cabc5e16b04f7d06e85e6168d80f1a5c38935a5d7030019c31402fc7775fe33e6a6957071d065f82d274b9dec4c2a737d41fc3d7fe06a72634

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
811KB

MD5
b4b1f5ba71c82c53c83dc9e29ae7512c

SHA1
c68eee697b306e552aba0b3af46e947af1c215fb

SHA256
0ff5526cbd8f7f8ad5a156dcf6d3b4874b75433a5a30f31d1dad28686a959378

SHA512
dd946e0d9017795d09fe2d4fbfd8f4150276da4c8f25b29efe56a0460c3eaf280be7f2cba75aed23a5d599a5bbbf9bc8d7de6c6480055c52f6a33dd7847f34c5

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
476KB

MD5
5f01b5ba69b9e35799a0726b62cc4ce9

SHA1
fc48165d2949cba1acbc0889aff50af990026fc7

SHA256
6f0d25e8a4aed8d73cb6624732b30b25d080f7c2257deddeaad443ac642f98ae

SHA512
2d3fd62937f4618cea2cee75f72d7d789e30d95c9f70178617bb6032cb061fd992960da24334dc1847cee0a3c7a5368572473d10d7fc3968a1c65ab83e9f8d30

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
453KB

MD5
7c7689ff803d580c0b06e3677f23647f

SHA1
f449949603b03c02175565b01fb09e67749e346d

SHA256
f3712a1e58eb729e2dcaf9b4f11988afdbd193ae115945cd657eb19b8579b520

SHA512
df147cb915c587892cf8b9a19c27f83468c646aebcf332c949d63cef7f655fc5f0b80f56cfe91741076584323b10c831a9821099da890bfbb312d2e03db1d70d

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
676KB

MD5
cabf7379d2572546c877a5969a1380b4

SHA1
0c2e5227a7c04f4056d45cdf3f2d6396e59c2aa9

SHA256
0d013194d7193345fde0858b7007a3b415bd696589863876b4f340b2fbf51680

SHA512
54feb38dd7ffd988668af7c64cd56b9d36eb068d980b595e1bdd260e343ce861b0d200807e137de5ba43839014b6cababd21b71329e0d93ce8b433db4a6c08a8

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.2MB

MD5
cabe14a528ff5ae1e9d4008a0060bc26

SHA1
95c9ac7b4968d7d68f1c11e6feeb3f0ce5971f47

SHA256
4cba85f85c9e74579ec5d9e6493035ab20e896020b4e89f9253ad20a6d5135ec

SHA512
8c6fb60f68ada3e8288f788605cbf03a0ef2a90b80da1ba8161f853afb481e6b6d7ef67c742a18a093d9a7a8720aeab2c4dd1966c257e7bb93548160281369b0

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
951KB

MD5
00d1b46ea916eb77eea2046bac642023

SHA1
ab1144b7ccaee140cd77d434b83260f5d9966626

SHA256
295c11241b7677758160035f36338143beb0be7c9f2d87e4c6a5c3c4585266a6

SHA512
e852d07cd7ec7a4c081b4ba27e291087eee7d416a780d3a0fc96a79ec7d27d50883c2b22e0484dade4baeccaf1b6c54ce7c87aadb5d1a0a433dba47032ef327a

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
274KB

MD5
16cb584db5c6fd8746159fd57506f181

SHA1
098b0ea4522a87217964d21f869ac2dd64dd2440

SHA256
0fda407d670ac4cc173b86621252ad3f3a5cd7ca77f83287ac72dfb3567fc44b

SHA512
631f357146ef17ffff42458b029a774a3560ab244bad64d3da58372958b3a6b3fb5b2cdd61a359dcbc0714d1c3e84053dee90960c548b176a7398464d4778c14

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
274KB

MD5
33ce41e9c07e762bce98c1f3034e05d0

SHA1
6b8147b07accebbd335efd7e2edd79e7765bea09

SHA256
e8fbd0a89539ad739f35d5ca6dd19eb2e1e220a67a1cd34bb8aacd49968bcba3

SHA512
6f36e50ce1f5f41326e6767b52b15a328d181930e1cc18817e7f5fb1ff54f39fa938c746630b844b0b22ac6779c6a8f1d2bf3d3a40b21c7656382bdfe6fd4c54

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
279KB

MD5
732f89f82b24d43cd53e765e2e2ed68a

SHA1
a23142e05ce5fcecd40984b1d912b99dbc69ad5f

SHA256
c53e5ec9b86bd79a3aa66b88c4020e69fa99aafd7f2841df03b45a35438fc394

SHA512
7b1103e0c382f05c2eb178d8c406e0d5483bd140bdc84fc330d35a2c5cca2bb320f3fd79c2b538f7b767541033ca22d15fd0825cf209c0cc434a9a7bcc632b72

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
278KB

MD5
fa46e56ceb7abe98ba01ca8a56bff70a

SHA1
7c411b4dd399f90e116f6224b2748129a5a68087

SHA256
35136703edbb77ace6f1ff0706bcd3e5798187bce342fdd6ad9f08c6b1cfa0d6

SHA512
ca239fa0856ec56d26237cdb189b841d0c3f6dd7306686ed4ac8c7d59a9c676dc41ca272eb27c12b86aa7ee1a101c1aa5a2c3ef4dc2fec23bc86e00ab7fbf6fe

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
276KB

MD5
2f110705ce7aed5b69365c358cd566eb

SHA1
d8d49adce7a6d8ad76bfc50f7e034d66420bdfcf

SHA256
27d6888d71b0d25605a8440f2810bf26cb8123286366e7b59e37081d8a75becd

SHA512
55c3101d812218d900b9cdf09d8a9d7b0b9f46db4d05913f9b5e2dfbdf3bfe2d08d1e9e36ccae232d64a62af4609b2151bb0e46bb6720d729e30177fd2e83f99

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
279KB

MD5
8f58ebadf1cdbda74551f7f5f3cd69be

SHA1
1152ef0f2a84c7afdf644d597be0236ce17b64d1

SHA256
85336f1fa172ede5009fb81e8d7e527665828629c59796284bad40498445e902

SHA512
1195e4cd39d923d1d514b39272d1715eb6683c175725ba506be272d09b697158ce5fc17c35f4673cf3695a77a6fa6a192a4a114e34972e9d2b903386c370f191

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
272KB

MD5
6ffac52dd9c72a0d72fb32ccda7934eb

SHA1
9c2432eb154ac10b893dbac778cd06de05d5a192

SHA256
2c7c04a3fe2dcbd212657e01a9460cabddff88b8bfebb507758f58ad65f1f2c4

SHA512
8e3da3c15d6d8735a242bf62a61edb7de88f04850ba1c34580b3f4d91958a08c82a1bf277208bdace5a02fc6deea9c27531413027c838fd29b8b1adf744d9ea8

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
277KB

MD5
929c15dab7143a4e2ca83b26f5b16d2a

SHA1
04900ea47d0825f7024e80392035ba30e0496a55

SHA256
25b27950e015c03aada59a184737b00d88c4d8951a3c1e6026ac487aae457983

SHA512
f3745cda8a319086773f254ca1419634f0fd7ca6bc57efe3ee9d5b57bf42f8db3312cc7b884393109f931981e8356e4473c856f7c674662aced000185c080757

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
272KB

MD5
61a58f4489d96b60c1130055841ea517

SHA1
990480386ca31fd7937061e6044fdf49ecc34a9f

SHA256
065c1903ddea42b9e714b148fe5fe7d376edd4a6db235cd7c7a1813d1bf7379e

SHA512
705860642672fec85ffedeec3b81c7e7313273637e9c6a1bc0ea654e7ccb5044ad2e8c542507565f4a95144256a63dde742bfa16c7920fc849918c8d612bd0c9

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
274KB

MD5
27a85a091e8693ad1209994749807325

SHA1
91dd08c644233c993569136d1baee93f332eb55a

SHA256
1620137aa1f39fb145973195d9684bf3eb9544cf2932b359a08caf8692e20889

SHA512
6dc546ff5328d2687734baffb3862cab0c5b90ca63a608a214daee547426565ddabe8f631b190b0f7f6e794d3c01902285f51dfdd3589474ae8f0bf1572927c4

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
281KB

MD5
e1bfb9a73fadba95a2538d9f8d0729e7

SHA1
ecd303e9d444659350a0196142c74bc66a5f3be8

SHA256
755cab838fb052dd6f90c244737b9581380b4d494a7737dc1a815e28692c8a31

SHA512
9c411e9c44b02202e5a8e1d0044a4c0473bfea8e09bd6d049e513a721584a4578d1da096831f739da087831f6a1d92ea7ebd3bcc1823f604699440bd45c18370

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
272KB

MD5
1b0dc41dbbfd99e1314268fe6cad72be

SHA1
67966fea023df7cd556bab7cc602aa5bac7aa6f3

SHA256
04a6c5038e7c27f7f60cc9e85e6d8f5025a3bfc852128589167f9f70f9869a45

SHA512
f8753ca9a6969738d8074781a0ed3657e2857473b67a492f47890c4fcee7d286ac67862d794710b5b92fc12e0f158391ae7bfd4183399b2579ea7ae088c44530

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
276KB

MD5
6e73eef14e59bfe32b53ebd440ae0d11

SHA1
f6ffe6ac971c6c3f81a66c7c70a682c91100a682

SHA256
3ba892aff48b96510d541aa99bf1849ee116d242f241826eff76d557acb656cc

SHA512
2100e2e23ae96a05db66e289ffa15ad128715e63274ea69195f26c50d751310da2d2786b28342391e1f9171f270e7795354bba35348af4592a7601ee76548123

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
273KB

MD5
4b9292bdc6ba465bd28cad0956470a1a

SHA1
86831b7d5a7b6eb49b55db24389a2df351716a92

SHA256
4b602ebdeb71085a9cb32b44dc11b66efddf5022f58c635b8b0b41a846198c72

SHA512
5a27c15ada43c933aacc8e9ff3362990d1c77a8b3c097f304804e7e60c3b19ca4ba863f4e79741d918445082fd83425ea36d96409411337467108ae586c25db5

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
274KB

MD5
4702dbd915dd5e7e280d15a8e2133e3a

SHA1
6f091fbfdf1e83772dbd0a496fc6d59b367da064

SHA256
cc948aeb0e6d147c0162de077524834faa175c13bfaa559f4801ef3027d4c1be

SHA512
fa89a8bd12925c87f36d7cf91bf0cd126c48fc757109fb193101c64a9fc65ee7b18bcc7fcdf08fbd4873ddc6c8fda4d2a05ccc34e2b3a45390568b8ad54075f3

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
264KB

MD5
bc1d279ad0c94d4319b2e15952293ca3

SHA1
78875ab2df2ca3072d65f1f9884dbb6617fe80fd

SHA256
56485489fccc5d5cf37d3d817320c81e2e527216342de1b9370ba2cd2c6ab655

SHA512
c3fd6fed5519d50f099eafa719bebe263de04a34b9b56eb0d56b08dd1541337fef51950e2d726c2643dda45518d22d711e80dfecfed5617a6a27c5fe18259419

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
275KB

MD5
82e7843103cf3cd1a048921d6abcd911

SHA1
66f04c6c2a75bb23ef98999c6a38cdd47d43d38d

SHA256
b1add97a7eec32a75d96b3ad8f2c4b62f9ee4756d62aafb5ea9161fea0935fd2

SHA512
b2eb8f971a1fbecca7ece83209d9400a565ff2705931e1dfc3c28ed066d2b1db87717829bcae69b668c6d93d7337be85550731897cf5b2cf5ed250db1590bf7e

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
276KB

MD5
386debbd6cf44092e2e98e610ceccbb3

SHA1
a0cfc9682eacf6d76fbfd45b6bbecebc35e1f3e5

SHA256
484fa81734b9961936f38e15f2c5a84901253b9834d9da396f7effb73c76ace0

SHA512
78afb25bb92d32b61321f7f79d9c96916dc7dc43a0c36fc7a7fbd22a0dfab2aaca7137d2cf5c4f2cac6fd4d5fa9460d2a32b4af843ed7dc0c544381ed7e6116c

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
274KB

MD5
ce8b6165f99a1f3b1dac7bbca373abfd

SHA1
5bdfdcb08b70cca17d7d48d43cf8052b23560b7f

SHA256
e1a473e7471efc168daf085f44658678e9cd9c8a5ad0e72a9bf7e613bae5a924

SHA512
590f0f772f132fc2250e691f25b1b4b92506f2115fb5856ad8df8a1a658e8704c20d4acf2230f04ff6e3d9278c69d36850e0b851f8b918bfbfd6d0315938db12

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
271KB

MD5
b48b41b0af211d3ab782454d805d671b

SHA1
66b7f0be8950311aa9a6006521555106d9dec0a5

SHA256
c4523b8949d69f3841c899682d2bce237e5fc9108d770368c05a852f0cf7b42e

SHA512
821cbd052e215e5f76486e9ab0352815aaae1e6ba9af69e1b7c15a40309d95f1d4c9b16acfcb8b71abf0d4c5204238b5c17220f4b1ed6ecb34cb95f60445102a

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
272KB

MD5
99acd42faa7f2857e91610804b7ec56c

SHA1
ec5c08e9fc6a50432d11468e771b8bd34431cc88

SHA256
7d4db8102ea321c571655d422a417f34bc886a5f3baa81f034f6cbaf4768cc26

SHA512
6cc4c58a666b25619a5b1b075dda348fdcb29204646fcaccdd59f96bbe9b97ec3e82469ab419c990e93440c074506a9ffe1b7439a46f9dd57bee12377cad6b14

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
282KB

MD5
9e98b2dd6bd200dff205a8f1d56bc539

SHA1
735ad91e505cba8918199f9a7625277a31918b4a

SHA256
84e8591f7e580f637a114bcbfa610e18ea02c1b160fc8c57ea1d73ad815a80c1

SHA512
8bda493ac3c555b67194e95a62ca505deb02cd47bbb25c60dbeb2fc433f87b9e91fb196bf46dc278625d51f14f8360c6830a1ad681965cef6dfd38dabcad89c3

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
275KB

MD5
0b58f1d9750deb3df6ee5099fdac1ecb

SHA1
90cea69e15d2e5919b679c3e6787651495e394d3

SHA256
04152e8e725bd5cedf1507ec1e6ab3ee7d8cde28a233e6fb14ae8a7623bd4037

SHA512
cd6f45fdd5fcc37cbc4a22eb625404c6920989c969f5f5d6c59774c9f7ddd3c2696d5c89c96a41f1e155b224be2acd297a606e30b4be06523b50a6f02eb7e114

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
284KB

MD5
fc2d41e3b31b6c81bf96567ab5a0ec24

SHA1
06ca23d9f60e02dac8936feca5b405c0538d4ac0

SHA256
d5f61a51e841a80c0d51a29ade2bdea4d90a5ea8564903a2ec298da16f5690f2

SHA512
0b57ea23bbe1e38f8e3bd3a07fcbc14de8db9a1ece2680f86614330e1cc1c0695216e3f31117fdb22b7de2b1d1fde09e869a175e55c1f9c042996e8768464de7

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
273KB

MD5
f875d4dba52fde08e428d31b57cffded

SHA1
134a94a365c23c6a330a772a0cbbbc729d6d9f68

SHA256
c71e9477f07429208277272a81d22824625fdba3e9a3e6883df7f6483a973f15

SHA512
b9b48c825ca865a6d5a204cf6e4ab2a4aa9f7c3f7ec3c03b6af9b53e72eda60de66c102a9c03370eb0e7b456ea532892eea1af5de42e42bdebc98d7223a4ec78

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
278KB

MD5
b39e734c3e9d0645ac3fc2702376e265

SHA1
33a704ca41f6190ad9f98be8f057bc3db95de9f8

SHA256
41360b0509afa255f4b062f6cb578cdfcaf0d576b0b9e96df86f4629648c05d6

SHA512
384bdbe8fc68840af90004bbbe5b32689d8674e6b4c87ff3392970ce0f707251bb61c46b1f7143dc503d5033716ac352de8792fe0374a6f0ebb79fb4f1364eeb

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
273KB

MD5
f0fd659d26b28546c68066ce39302fc8

SHA1
4b17f44b4efa4838bdeeaa57b6a10d8cee95c252

SHA256
ccd04a447daf4dda0c9e5594c02134d985602025f492f878e8e524041c03328f

SHA512
d1ff51238bf748d8b4255faaabb18a24820940b1b89530cdd4a0be13d5724e6b5030034e7e57d1af8bfe3d6647a2a843d3955922d0184519c6f44a4cd98dc8e4

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
273KB

MD5
fd88da323de75038fbdc5d76c4989eb6

SHA1
4cc2820d4fc9380df14197da2ac34a939f0ed9aa

SHA256
da61880b0ab3f5059f90f10f9561e6f6ac5dd9f1eb76751e52bcbef6dfc1e9b7

SHA512
313845a315955683495e5f8d15af38cc10edeef644885a509b94cbd2cdb15839e78a2e610f3ed28f4f6c2cf36d5bcf95a4e36a25c05e77448c0bcb553699c03c

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
276KB

MD5
eeb2a55bddc7db27a6217bcf373673ad

SHA1
24a431210b36400fdddb4f5b3fa6376a37c10b9d

SHA256
956fdc5f481aeb3cd889a7fb186eff03a01d3b072f756576f685013480a68997

SHA512
3dce8892cbb5adec1c9946941e62c7a2d4e4ebced96ed889e0fd5e8049e293d66f0a8c8f9a68a89c2454c143d191169cfeccee1d16f8add1cfe6fe08a962069c

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
282KB

MD5
0866265277872c28930c5df346c493ba

SHA1
f1c5cb9500d6141d215bdb194bc56b6343893412

SHA256
4c153a7dc3366b550215b27c55fffcf4c6aa8517c51adc161e67f76a35d3b2ad

SHA512
5034c0f411b8549e8fbeac7cd917a2f3ee381b7011c1567ac633bbc95dd649ecf7997ee48c3428dbccec89b3210f9e81d42830524ffb049bbb86156d6877c4cc

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
274KB

MD5
e3e9cf9a333664e1ee8bdb69a35fd74b

SHA1
72558efac3020a570464317d0113a79e523d6575

SHA256
4df2e6c347a03231eb0c056ddd9c154618b8cd3b98e41ae6438ee7d27a905989

SHA512
6522c35b45b8ed37b466f2ebc5daedd10356721fe0b2653b3cb6663aec0b8b9a4422fb29a78ea80f7737727ba80600e157d63925370a9c76348ea405f8e1ab62

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
275KB

MD5
bb21e9d5f091205ff5df6477170a720b

SHA1
652989b0f60559ea94575b0214beb084c80875b1

SHA256
01cf13d7b0f43800b06c36b7e6385e9a9254b0059767377ac2c74d2b1d2c2fe6

SHA512
f6276e6ef86cd921acf4079367416269229249b70a89c8c67730ba4ddea3287a494de7a03ad3cb8a05fa02453ed51c86b3aff1cdfb2e7daf02ae4b1acf8dd101

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
277KB

MD5
cd2853496b3d7f2b53ecd94ce42f8d84

SHA1
4726e3c5bf001671cb02aaed981f745e84e0017d

SHA256
b1699284e29bb7fdfca15e3c0ac3a3a3c7b4ebbe0b9a0f282e11c18a729f10f6

SHA512
9ef90f226843042bc797852694e097debc533808cd3c92b298ad4a2738ad82e2a3643863ef34037d91799f19ab1e77140a61fa73b98a87888ce3a2f9220ec048

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
276KB

MD5
ab8d83f4139a8cfc4af2cb0b5b96c57b

SHA1
dbfc9ea47aa7638e4052137d4d50a1f90a016e56

SHA256
da004edd8e94a4a5fc952de69eb27a212cdcb1ed3e41f0e41df134c1aba925f9

SHA512
ae2ee69502449533114eacc2847de78ed2906f7bf0f4cd0bff6768597a5a81bbd60014e194ca3fb895d2536e05eb5f0a39d501f577c677e11eb1f7326d4da1a6

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
270KB

MD5
2ab6bb790355c5cbd2766daec03cd1c4

SHA1
59567126ba3cbab1a92d56964279e1ab83f4ef3b

SHA256
0b523abbbd807523c4f5f9a32defaf00486124f5d49edb466e6a599b63aca79a

SHA512
8769d5799c013a683ad50d0b2b952d1c4c9be3bf05abaac7ddce8861ce91908270708c050b0f1f4bc474c2687ac4635bc2a036ad29f563b92f53f6f0e1169f42

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
276KB

MD5
18f4f5f6ccfa11dacd52385a82c00c5e

SHA1
b20614921cc5cfe3c14e7aed1805f3a1a52062a4

SHA256
d84121af9f01f5a54dc908ccf8e130b2110b690c1974039f1ee164c29571e35e

SHA512
6f2329925c622adef3b4189225a135ad9d734ad1062ed57e8ddd44375cf86ed62f3b82daf582c6e3c5d67143a371f96f25cb33b3d514e6e3d24bfc75532d6e46

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
272KB

MD5
ea6544c005b9e349c9012d4cc5c8122d

SHA1
b33961b939e720188fcc4e2ac6b68c0f6cc6f8a4

SHA256
3c8d3eebea8d2282a2835f9227326431259b7d7bb86c70608a7bff45dc5c97b4

SHA512
3d08bb71f14030dbd286dea02ffd17967618ef8503a27fd90b3cde2c80acf693e9590f967740fc244e203a7c83e550a088f2ce8cb7f64fbc38cf9f6d09555a97

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
272KB

MD5
3f3fa9a8e60db859baca5b306d865f65

SHA1
f485bdaba050cbc0987fa10ceef8fda0e668d245

SHA256
33b73dc4fb4a03d9b5cfcf185d902467a06eb4b4d538e7fa0bf15620958963b6

SHA512
e21198972822dfb4a089d8d728bb827928349664b83b2ec3f6f6f44930136b7a7127d274eb9e8c6bebe9e601c66f3147ae4bc4891ba0e3dc7fa6d1d0da3f1b81

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
275KB

MD5
f71a9ee51760d13d122b3b30a14d28ae

SHA1
9a43a132295dad3807908a6662b215e440c02bfe

SHA256
76b8f528751a5c1a70813b7d372616184ada752eabc5f5e289a97e2d2c049a7b

SHA512
36c00e2a728d659a91d4ed9e463265345afc30bd1a4f4dbf48ac160f8dc6f2e37a78d85ab5e1b272a312cf24ac89f2068c7cb38e2dc25285571faddb6dca4b92

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
275KB

MD5
4fc10c6c04ccc19bd9d98ea1c25c80a9

SHA1
72d589420fb33261e93a2807ccd3943818993fc5

SHA256
6bbbd7802bccae19ae10307cd0269696757733b73378b147276cc466652b993d

SHA512
5f96505366cae0bff05efadf1d2685971c19227efbb55985bda5dd05a150b3c530d9d223f4cee80384083d7f1282a72532c85b7c0832422cc3dcb5954653c103

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
286KB

MD5
89e7549233f901be584949ab30b15059

SHA1
a947e2ff162e8b4bb5c8be853fc670533fbb8272

SHA256
c6d60c40d425114d0e5b80005c056b194f75e300217c2bd24c1437ed6a84114c

SHA512
59e516fdd4abf91b86ba452662f124f744337e1ef363847b277501bc04700d4c0e1298b810c195bc60ee304f3f0eabb1286b505f6d3d44133507a62c39d75f33

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
267KB

MD5
9e87801d3e63b6b8c5a7e3dd7f128291

SHA1
628f9f0ab67e23ab784467b271f1bae7b3af1481

SHA256
e4bc5ce84a6c676332866ee8aa9ad5cffb377961e491fdf435b1dbf81a441594

SHA512
c22a7cbba022f7fc85358c6c6660fe2d64ef141317128299fce7a4d38e4fdf0b4e84d66c34ebda5f65807690df7d6f40b4649eee5bf314af4f3fb00bed94740d

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
267KB

MD5
40e82fee3fde853c8612db121f8d02f8

SHA1
1596497100554c387e849a6b49d91c952ecf22d2

SHA256
0e12c6a92ed00f7bae375c72c59227f3ec2ada77c6b29b97a60f6369967f6d01

SHA512
457598be55593106b805a267195db748492d7cbde02da0eb8a138fa36525ac936b2194635b72363ed351e689ac50b030f5707bea834a841de10e626041cd2544

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp

Filesize
276KB

MD5
17926bdf134d8f6de563474f7799f3a8

SHA1
40876d8ce36e07ca46b873a3ee87a94eb43f8f49

SHA256
2bc3029284cddea0f9f772638c69316e0d96792b2661f40d21aad6ade6aac027

SHA512
6874dca303478b27f05288bb6c34528cf6d7a2f2cb094de8df043132c484abf076ddaacea59b7c42c5ab2b55ccfa2e64166edb5acc0ddd2b7f1776f352049118

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Wordpad.lnk.exe

Filesize
267KB

MD5
880add451f0bb9b31b6a8b2f0117120e

SHA1
8fe7f8f201f8adff31376c9bb3504690345405d4

SHA256
3fade79aacf7e226abdee1553283302f8278a050b2b0f3730c3d4e78949328c5

SHA512
744662496928d9780527aa8363742e242a25ca1b74f250ce6b5024a08081e49a914f2f67b994a2f22c5c6cddd070a2dc3b617d574a689e397676ef9a1cc81a11

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
264KB

MD5
8a291528d2edb935a094b49f620650ff

SHA1
bb4304066e2456ef7149f03d3906c2ba8c2618ed

SHA256
fb9838523f68f49cbd0f38b7e212840ee5a17d7f3946307c6704b2900764d110

SHA512
9f261409c3ed6f60ad47c1565a61827286e85428126dddd2c19276b84cc311eaae4d44a2063dec59d70ff98d6d9a8a143989712f4f1e21bef1dfa3e637f155a8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads