a4b255a2e76aea3e69fd8b94a4f9525ceb90594f793728d35663d1d26739b607

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4b255a2e76aea3e69fd8b94a4f9525ceb90594f793728d35663d1d26739b607.exe
Size

187KB
MD5

fb388be4418d34011e53ae25435305b6
SHA1

70dcce5a848e6e2be36e84eecb8119b648561abc
SHA256

a4b255a2e76aea3e69fd8b94a4f9525ceb90594f793728d35663d1d26739b607
SHA512

d19905459468614b68d2fad20e6a29d1a2d889ac597a4fec35f2cc9f7f21347b7faf5c8896ea72e386b09d026cf94008dafef6599f92cc229f2c2bdae172597e
SSDEEP

3072:69WpQE0zUMTcTSWEmOTcTSWEmc9WpQE0zUMTcTSWEmOTcTSWEm7:nIZeIZS

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4897) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1896	Zombie.exe
4920	_.arguments.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	a4b255a2e76aea3e69fd8b94a4f9525ceb90594f793728d35663d1d26739b607.exe
File created	C:\Windows\SysWOW64\Zombie.exe	a4b255a2e76aea3e69fd8b94a4f9525ceb90594f793728d35663d1d26739b607.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\eventlog_provider.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll.tmp	_.arguments.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp	_.arguments.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFUI.DLL.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.VisualElementsManifest.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp	_.arguments.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll.tmp	_.arguments.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp	_.arguments.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Permissions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Windows.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnWD.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Windows.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.tmp	_.arguments.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	_.arguments.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.resources.dll.tmp	_.arguments.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL092.XML.tmp	_.arguments.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	_.arguments.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.tmp	_.arguments.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	_.arguments.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 1896	372	a4b255a2e76aea3e69fd8b94a4f9525ceb90594f793728d35663d1d26739b607.exe	81
PID 372 wrote to memory of 1896	372	a4b255a2e76aea3e69fd8b94a4f9525ceb90594f793728d35663d1d26739b607.exe	81
PID 372 wrote to memory of 1896	372	a4b255a2e76aea3e69fd8b94a4f9525ceb90594f793728d35663d1d26739b607.exe	81
PID 372 wrote to memory of 4920	372	a4b255a2e76aea3e69fd8b94a4f9525ceb90594f793728d35663d1d26739b607.exe	80
PID 372 wrote to memory of 4920	372	a4b255a2e76aea3e69fd8b94a4f9525ceb90594f793728d35663d1d26739b607.exe	80
PID 372 wrote to memory of 4920	372	a4b255a2e76aea3e69fd8b94a4f9525ceb90594f793728d35663d1d26739b607.exe	80

C:\Users\Admin\AppData\Local\Temp\a4b255a2e76aea3e69fd8b94a4f9525ceb90594f793728d35663d1d26739b607.exe
"C:\Users\Admin\AppData\Local\Temp\a4b255a2e76aea3e69fd8b94a4f9525ceb90594f793728d35663d1d26739b607.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:372
- C:\Users\Admin\AppData\Local\Temp\_.arguments.exe
  "_.arguments.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4920
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1015551233-1106003478-1645743776-1000\desktop.ini.tmp

Filesize
94KB

MD5
1ef65755130e7fd9d8f9026b95e5e155

SHA1
050b0189bac1bbe9c4fba41660dde173083d20fa

SHA256
21335c2643518614e33f5ae8c24ee783d4ce9da2f9eac8aa0e4cc4f8719ebdfd

SHA512
2c337a2d2410790753f1d290acf69b92bcdd58dd51f460a012dbcec93d38b9744300a5f2ea75539df3e026e264ed00117d1adf2223e2e55968df2b07ff80ceea

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
206KB

MD5
3f85db2588d7d5c54309bcfd72050d85

SHA1
240e42571af7ece8c232e63cabcf87d0ad5d1c4c

SHA256
aca944bdecbd4a06141b9eea57f65040b698dc8d9e458a1f44fffa62871b1bb8

SHA512
de2b164a4f870984c47f86f6b835e225bdad1211f5bd3ea6c175dae9e94a15af65f8c16efe9052f29abe509eb2b9e711d72cf53e6ff2d4d6af774eb5a18dcf2d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
193KB

MD5
26d114fde5d181d4c4770f5e2d53858b

SHA1
83cf7d2d3542b2c1f17005574b76a37acc9322b7

SHA256
a05478e207ac26f4e7ea710badc9e62d79f71cfe81f87e6b56172becbf137f69

SHA512
0bbfde9e8e95175661b18f65b1c8a4cd01020bd3774d96ecc77c87233398894f1bf0c015703d8d22715d927a27bb59ff63d2c66fbead8d76183255645fe40daa

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.2MB

MD5
8c914256d9646271ebb50088d91310e6

SHA1
25b69c7b12b1636d478d1e2b3d027c201a9df9ff

SHA256
659670dd20b6ddd5397ba4b615d86e8193edfdcaeb96a23a8033bff819a3d638

SHA512
1879f913ff97487041453dc081969cc141864f4816fc543fcf79992b7f503f2060b407049c21ac62666a6a39e066811710405ffe32b1677580aea3de3a3f3e65

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
638KB

MD5
d0ac478749397e74ded81c6426f572f9

SHA1
e1f4121c45a0bbab0069f6e5cbdd8febe1da0dc5

SHA256
4e77296b19cafc5c46004288686063f4a9c9286e0c7243b553c74be49b54d58f

SHA512
c2733134ed104723a96e1a10bed821e7a11365b57d1291b23de7c8482a2806cb6bac3a8ef006bb3a82b944813de09d271645e48e551c6f4c01eec67133551b73

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
303KB

MD5
378c67fab9f7213037843888af4b1287

SHA1
7fe615c2f02690c97467ac21e5e98aa21c2947dc

SHA256
7a11fd3501a445c246ad916d32319d9faf000d9a2faeccb6db33e0a0f1e45800

SHA512
a80bf69fffb49b3a644fc8a627acf4c6969916782ff17e2e24775049b22a713c7ba76e0ae58c0d944c670048d55307c75455f6aa814893e220d2c1f3c4de8a67

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
5564e8a7d37f25b12bf28466af7a714b

SHA1
e1b344957213ffc937011ea8ec0fc8445ab9c561

SHA256
6b089d457e90d76e5602fa9276c529aff1fa13b9f1b54acf53fe8417d9fe328d

SHA512
771b9c2a51568644f694c32c3c5eacdc215edc8cdad07323b0d55ea94e6ee7f28110c98b89b587415d6fa7267d470ad2acd6110c20d5de395a182f56f2d3bc26

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
778KB

MD5
0db9975a9895faddfc6a9507d1dfd5fc

SHA1
9f8e4882a4010013ceae10fb199bb02b0fc74e22

SHA256
4e066cf686c3c30e4f978b07684a559c8ef1171c29e71a6d6438a0bb76267acb

SHA512
35fe83b793de1e2f4be515e02228ac823f0ea1e8c9cf49eccc9403c335362658e5cb1bf71e29689108214aa2ce13d053132d95216ee8fcc0d8f22f3956edaf5f

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
151KB

MD5
08aa128e306d7a5dee46bcb09c508255

SHA1
7a5177df94cba0a7265cb5a53186f8c2402803be

SHA256
8e1455b5c65baf8762bb271dbcf75d9e9f50e9d0c08aa26fa014bfc2c69928df

SHA512
00a555e3af4a2ab834ad65cfc5cb88a7b113196791f92c229e33f100e6943ca89340f02b2469fa56e48f949189bfb07487a0436555a9ea9dbe5404519e3d7504

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
106KB

MD5
f55645075e01fffa3cab61718797f51c

SHA1
fd5a9987f490ebad8f791d4a47bf7b4e20b296a0

SHA256
0ea7e292f03a64ac93056d985dfdebcb3ecf7c4ad560632562b38ec508f5f715

SHA512
d09fb1fef3554a00c5caca064f127e03541078e621464e789c6c8c10bdfa75560b8da4c6124185fee9f0df2f4c1b38819ee99a356b8b5161866712523f9e4049

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
99KB

MD5
35d38c0a942278301d7ef0c1c2543404

SHA1
e6f96f861b4d14a25f37335c5b09d8df017fb964

SHA256
eda9e1f021b6547a9c45b27f6765c144ee3b84adefd08d3dd6cfef35740d514f

SHA512
01c80169b3ffee2d2f93f6932c49a72e65c2022542aa2bad87e1ed409ccfdf8940e073718c814664497204afbb7e49a0ddfd22f9c871012a1c0a302b4eabe25e

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
92KB

MD5
7e277839872c7b163b880f15bc8137ee

SHA1
e26e138ea3d7419d042fef7a7744082702a43dd1

SHA256
7371f96f2005b6b3f5277ae1803a748b8ab8ee86016c10b17f54b97721fc95f8

SHA512
ba1dc607f4cbab141de8b23ecbb1ce340e192a12d218613b48413bd1437d972d7450cad8100aff9ee495929e5fda169c64afa813a8a9ba08fe0e42597af0ebe1

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
105KB

MD5
ae483c0d8baaea7558dd1afd352da8f0

SHA1
01f6190d9a1623af02b3352079bb1ee5ad726ec0

SHA256
2a70151f0f544437d53f501a8bfc8655e3184cd28b415bdbd61fd32fbf051770

SHA512
d6ee1c9ac90a1deb781daa16f063db0b9818dbbfe8daa5630fc4e0eb9de921d512c72f54fa7a79658dd4e5361eb2c4d15af97bc15fcfb6882bcc35d05bd24f27

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
98KB

MD5
a155a9fb229c8d3502a368a38aaab27d

SHA1
1a1cfa589caaf6d3ff573a8d0cb4a432f70cbb24

SHA256
801964bc0caf5dadbf8beeb53030f0004f5ae45d1815f7b9874fd60d1aa4cb54

SHA512
b072203c024808ffee1e56b6ab7b79aa83999a53d6d822de70f56e95c963eb94d9737bac3bab8e809780849888c5b1e0d2773ed55fb451fdfa1cde8935a5411b

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
102KB

MD5
647ac81607db5e48c5cc74d2dd78c4f8

SHA1
4ea0b34eabc55d6b79613fee35d1f212e714d6d0

SHA256
cc2cf1165a30ef2a13f603d8b59e7819849ff9de5a407b2ae571a24ea0aeb4c6

SHA512
1fa0e49f1af5dceda13d3a87518e95cd0568c8770787eed99abc23d822faab8e3d99cb62d7f0ab4fc47105f95a934cc4bc7dbc750ee0aeef22dcd4e07dd337de

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
104KB

MD5
943fc8a52a5818af0f4a22d7305c95d4

SHA1
3ffb4801113e8e4767d9887d1c92bfb868a7a782

SHA256
3285144d15c66a6e2dc3a44518b31c946d7bfe1a1d5361c175dbe3dd66744fb4

SHA512
9d2bc7dad711ad8342f233a7a431c42c826f890e2df22c73326a9ace984179139a7f6d24264889945ad08af13a2b515a06e206731909fa3d86d091ec8de58154

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
102KB

MD5
eb721945e84751117e6ef762791d9f07

SHA1
d84fc4c6db12f0986a278db4b9bf4eaf7049abc8

SHA256
4e1d3ca1562608469204a7bd2aab80b364fb8adf5b33532a1268199a4253e6bd

SHA512
6508b02c04b47b9277ccd3215217a45f2db3d0e4bac49774db512f3ea7ecabb6996171ef8663eab2bca0922cfe12f45a5f3c45dde4a920a2ddbd1e60f64cfd99

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
98KB

MD5
f6eb91d1e16db9946de560dfacca8bd1

SHA1
6f3c36f2ffe062c7a1ed9927feb6f6f219159c52

SHA256
05f9d70857e20ed09aa245fb5be8f80539b5a8528449bbf8f9f6ba49072cd25f

SHA512
894ceee0a09435bbd67ef232aabc92d1c9bd27daf1088acb0c24f547739e42cda4b53950b5ac9e5d649dd3a8306ba43680d8d017296b07b06106dae751d17ace

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
101KB

MD5
8dcaf64eecceed75bb389406e0519b44

SHA1
be9481991da6dee95b36dd131bf886d4ffebcea3

SHA256
504e16f80fdef3980c51de1685327aaf4f2c526498a9b8b76727a208b0d27f34

SHA512
e1703c39af65c3ed355f301a1cbef5400c1c4fb03000d84775aedf59cf4355a6f30dccd418f51138ce7ff43a1f49d341c32a817a053ad3ba86d6e3cff2c80b37

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
102KB

MD5
37c003b083a40577fbdc93d512d70186

SHA1
83b88ee72698503882c443968e641c348359cb9e

SHA256
e9e5838ca0a7037305e6e702ab2584de65446d028d3bd7c6162e95ac1ebfa61c

SHA512
ded0fbb2f75d4dd9259ba6a7f99d18e99e30ffc67e4296aa9603c9341388844940013dca19a6d69fa07592e98e5021d774ede4aaf92327b4926b8ab111092dba

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
109KB

MD5
5da6728d5dee101509b4bdfee24a611b

SHA1
5055c2565baf77595fdf65cd1b9960cbffdf28b8

SHA256
460e616c1ef9903996dce906502a8bf8471f950fbb74010423f93c6c8003ac56

SHA512
b1119bbbc9013d4a50b8499aedddb41c16a3274b7d55426f8eeaa224cbe42dc99c97aa7d6767b72335061f2c2ee54d666a9236cfaf658a26d5e11f193c57225b

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
98KB

MD5
3856c339a5b0ef94559b114dbde4b80d

SHA1
437f24338193cd58e9c7ade302a1fc44fb65a315

SHA256
9948793fce3b22e3b5cb349fac9988e8a902f22f892323cb989a2e278896dd4c

SHA512
68128222fa7c8c763c71042e245e73f761ff989af045cbd0823a0bf11335ab26b3f7493cb7fb68dbc266263067205cd0c6de2f4cf72eaec3aaeda2be056c7e0d

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
100KB

MD5
e47816ce78e473902107eedefc538a4b

SHA1
0c7a13c73102e4004ab5b9f17f94007b4ddd4707

SHA256
b4db31a5599120f4b2e077b36a6dbcea51e190b144ed9bfa04cdb7c5aa0e50c7

SHA512
01da42cfe37f018638b33ffb31bd63bac52304d74944e0c7be46764d88d19ee228191973f009cedfbbf13ac2fb3ce002d135844ee9f31bd67241130045234bc1

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
103KB

MD5
9ce289d8ff281509939e56fedc501e53

SHA1
c18a30dccb8b8991ac851eded046ead6e2d69001

SHA256
7be94d359e2db6c2946fd150fb6c840b55f8877a6df048817ea9ed795107dcc6

SHA512
c4aa4921e8dc5b05439eedc09576f914e708be652e0e1957e75859e7a57506e9f5df7bd015b158529be5db904819cd8b70bc6588d608e532e61e9f2b35dfc741

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
93KB

MD5
c6f687b08fc07b333de5ee546289c60f

SHA1
c46b0aab5540b09fe60d6ea56f0ecdbea4d92dfa

SHA256
33cb266a8fa23f8a462b42d72a617d2822a27d9781dc0580e8a0addfe7f8894c

SHA512
5577ef3e0785a01738308e131f55de6e070d55bce646062cba48769cd99136527a8e5ea97f5d9752f7c1e2143b78af2a81413ddae3d8015bf07a435f8abd93cc

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
103KB

MD5
82af62f50229a0f0ff305ca3f6692776

SHA1
8823c1451d7f7d53db6762df59b61d23c9e8db1a

SHA256
af5e175149ab561240f5ff9518cdcfc0c24a3af2de77edecaa08d59acbe7bd39

SHA512
97c27636d44f7c65c86ab13ad9a895f2873fb9698a4781f365463bd537e34d77eec29b5597f82f9df2d255ae535b3a155fd22cf094c774ade87eb0b96cc2d9c1

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
110KB

MD5
8f2e86bc0a6dc00c78f2f1821d1b9510

SHA1
3023d88bf646026b20978a003702c1cae52f36b6

SHA256
7b0d75844c3c51d834e96a9544767a2a59e8d57f8abb3d035fb016a39c680022

SHA512
a8aaee4a29e05b176cec5980d24761713452438bbb5f45ffa883df5eba2760650c4f44fa6320f759c021300b5d5e223d8259380363f0e1c7b34fff973bb650d8

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
105KB

MD5
9df051d0cf8aeabf1970bea5543b99e3

SHA1
9512180bcbf5c7f96547f3ac49ddbb849ffc37a0

SHA256
04a10f167779c4fc2f9c4b4b72c373eb7fdad0cd9e736e39f005abe8c95847f5

SHA512
c6442ad43118bed305c25066e755dee798e3bcff07cd01451e0ebabc1d7b385403cc483a51af92a6fe38587eb84e9dad061eaae9e853259f62cc00ae503cd258

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
110KB

MD5
7d5d711e295ac2c2b15ce74c49391b28

SHA1
6adc2dc21e0040ca7f05b265ea77087be43e6f68

SHA256
43a3b984f5ba5e842e8c449d3889d5e31014684c4bf467ed8d1cb9d462e5fa41

SHA512
5ed4df4be4a01f260f549c96d6eaff1c7ce4cf131bdd64a392b53192012350e455c5472219dd1cefd6f82509d16233db27a6c9df5e97b2dc05c66b25f8ffa90b

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
103KB

MD5
68038656c44f7a2d25af0e613c2dc9be

SHA1
98cc5ffc132abbe8d34e7f3e2013a4a733440fa2

SHA256
9964fc428857906b3ddd400e345823272271084d1fe6fa38fc87d43eb6dbbb49

SHA512
b58220ad9b6b07fee490595a093e4b0bd9145d574eab2b3e645d6c3d545cfebd106446861dfc0dafcef9f79f2d9eebc23f30ed1ffc94cfab8dcf9aa3350f2d45

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
101KB

MD5
cbe61c16ea8059112c6ba328890cb118

SHA1
ad9f98591bd454573ca412ac0b1308fe1e682231

SHA256
0ce330e36d0ed6cf9bc696be021dc3eaa1bafd49f6e4ec8750a34c98c51e3f70

SHA512
a7d98d0ef6d020dd7e3fb0f4e6cc643e4405fabb8900dd1ab8fd94f4953ba79f89667166538ee80611ac0de63181fbec446aa1a976b92f25864fe185c703ebec

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
102KB

MD5
1d2591d4c117b11ca03607cc3b4de9c9

SHA1
3564252ec399882c40c2daf649844170be9a6f75

SHA256
7d2fdccc10d2e001b8a3bce0711158e1bb9048cb4a17da134a6937d820e98096

SHA512
a77e436e6a7b402d28a3b40314ee9d3f25820c4f19b4267ad56ac71f26063674fc155f914e2c4bd1b4901984af99ffcc4d60add50c0ba1223c0ee31c8699909e

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
94KB

MD5
a5ed7f2db310d46f7825edb076020371

SHA1
39a9d7090ca80baa09d5a4e5284e9227b7afdf17

SHA256
db872b9cdf165e2b004633f388dfa656ab38a744519e8b68f2afdc88caed4385

SHA512
f425d77f7981eb91ffc931bef6939d8df0009d7c337a7b12713f8fb61bb8024c7b2391b1c9d15ee0cbcdce8065d2d0edb03b80bee9106904301730a1ef36cfca

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
111KB

MD5
d6eb29954298abb5aff7b4f8c76bd299

SHA1
df91832c878daf30c4cde1b4f3b76f0fd20df12e

SHA256
a01dde6a74e53d25b33885c0ea20d6d377e9365e83a4a1c0b0573f3b9905c4bb

SHA512
c814889ee412e174c6e7a3f905c267134d042fdd43df61f937867c0bdc510ae29753823ac5a87fa395eb42fca1069ac8272b2a9f5db0e2de1d6c8d19bae12bf3

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
101KB

MD5
9958e998a76115635ff346545c677c2c

SHA1
f163dae1b27c7ca7a313cd44f61812de1efe60c7

SHA256
dabed471a8cde5219d42cd4d84cadd2969b1b1c0d77dd7763315da2fb0eb7046

SHA512
543e2c007e0c87658c089639e730bc44eb756bedff323c98934be49241a4797f799aa201492ed6d718c605756f377f14e7a8a894b95ef9d2a7c3d5026a77ced5

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
103KB

MD5
5d99fd24f1484c01d444c44b1f533834

SHA1
965ec4acb7c67e710d0d34c2c9a43a8f40b3b895

SHA256
0ef362e33dfca3c944ad2e92e519b8a5b859a1be1cfc6d0a766a67e83b18b6ab

SHA512
c3e47301e0f5bed99a8f77847372472e935e46d7c7a9f9c36ef4395122fa433683ff94a3d2cc31bfb556626fb2ec234158476d16f088e5e66f383938b3bcbb3b

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
103KB

MD5
b9a2675dde8779d20485240966859c1b

SHA1
0bdc8940dde8df2bcf82c3a7339bb22c923cf2a2

SHA256
f9e2f1f61b78cc47e2690464eed608dbaf4221160c04ea3f828e38672a75c62d

SHA512
90aa4ecba660bf154026a593f97f526d7983e5c9f046803774c319a0d9e0ee39f3a91e81decdf26db6ecce242dc73ae49dbf0fffedb886a05b68826111f3f158

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
93KB

MD5
8d7c892149ef25cd1fda2c1f98f53553

SHA1
6d9aa31a7a6783ec17b20f995ab2f0811f111adb

SHA256
f809b3a94cbadc083073b462d4933ca4246fd202e6441ac40616dcfcb212ce8d

SHA512
03252e7d889fbffe15a3779695425e40462723e4029293df452e09c57f98723e2d1239a5d5efb303464856ff57f81a9a56e21f1ca6989eed1e77e76f3222ed6b

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
99KB

MD5
871a2812b68bf0304fd05f624c2303ca

SHA1
cf1574db05e380556eb890159efc75e923d3b2c6

SHA256
0ac0da1bfec1ac8cc059c617df7900f7728630eb511bb9a1c3577fbb4829d6a5

SHA512
5cb6caf273621084d5710788fb14808f4f9dc2fa8013b87e8223320b854a021d03cf8971644ee0d2227e4b87618923c9c30abb4f68b4a9fa92add1b74872f657

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
103KB

MD5
45085d6cc17ce200019a08f7bdccb02b

SHA1
76d1386f3ad75a3a22499ff6b8b25a33dc870057

SHA256
22be9fd849a73f49b5ef0de8c0632f08fb4dd418bcee9485e0f14a6d82f5ebce

SHA512
425f4a0aa9df6035c97e489a389bad0988bcd5183fa1539856800d2e1b4d966578d12dd2adac5cce4a6960f491e597bb4486a66348e28f3dac165a5d6e891f61

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
103KB

MD5
3dc18d18aa002573d9309d48c7ff9eec

SHA1
01262d2af50ebe2a111380a89c0eba26d06fcaa9

SHA256
e49b487618b17310e1211c8e11677b52d45925eef03af9bba34440bc21e4714a

SHA512
63f1b89e8f23d93b8917e26577001dc9d4e5c462e223cb29e0c46fefb0283e0a5c7c481393ddef28aa8bd8649cf11d7a1fd1fa21108b1be38e99d67184bb1888

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
99KB

MD5
642f56f241fb5a20bb8b4a4839a3d414

SHA1
af33d4a22d7e0957279ef8065bf0b51380749bfa

SHA256
f18089071ea119fac8501a5638aeaac219d34b052d446ee8aef911056ff1785b

SHA512
9e06afc96bdac93b773070f49cdbfa9e35ac21d7bfbeaa220755a862e43778d0dd03f27b1ca2d0500f4b4ea69ddfa10520c57130e7ae5c8bc53c52bdf6cd6a5d

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
102KB

MD5
3fe095720efb85b856507fdc49485cb7

SHA1
f4891a3e1ecf2578ba3e87f4b1bc08a112d3db03

SHA256
efe7f5f8ac66189a273ade158daf8bf13723e8e14d20b88e4c5cf41e643c6bf3

SHA512
a50a2e55c30ffa4eb6b61e8eaa5a55402f9c4c5f2e84836c828eedf3ef5be0eed42628c1a5721d1646650af61715a7b75c8eac935c461a5c107473e606990878

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
102KB

MD5
c4f0922f2b36fed63fbc1a46eba1d0cf

SHA1
7263a0a01dd9e48e10847179d372f6ae75990ac6

SHA256
009e18b25bbc0b1874fa9b680dc75ca4310ee041997504a56865260b0de7dd66

SHA512
9daa16c8630d716b5cfec8faf5073ae4fecebd8bd3702e0c5c92937742e84aef1af335920281c3c3892fd6170c401f16fbe9e8a15ff94343e70f51b689ae8f4f

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
113KB

MD5
3f6170696e83f2f01c8ddc746796e24b

SHA1
3ba1a63f9771784a3cccc1513d49043aac2a4ebd

SHA256
17cc199002da157e932cc29ce526e5bc29e444383d9e0d7adf2b26c25e7c39c6

SHA512
1349dfc3ea0a45fca8d5258dae2a0cf2106fc074027f39af545d456d5c48640775d96d33677fea96dd9f561d4d7c53cebeb52557fd67075f825d0d6f7db384ac

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
114KB

MD5
5c678130e9bbb346f00e8ee4807c2933

SHA1
c13b543473f46aa0ef801e77d4a698fd70812e8c

SHA256
ed32983b83d1b84de81bdb5e9ccde6a2ad37990227d0c21d865a8ea71e896e77

SHA512
88f2564fc4437dbb07578eb0df153a95c0197f5c3f2b1e8dd7fc8a1e5c4e3a51ead200feab04222b33eaa805f86ec6ccc9924adbd32272f63c6cfdbd3e1e77b0

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
104KB

MD5
021ee0931b79a83232e92f893725adba

SHA1
f3aa5f44bffe43b59c8040dd39ba8da89a324e1c

SHA256
8aff5e1955e53208936f70c718657c4431f89a559278e12e116551248a649941

SHA512
b6622f4cf5382d85835ae25610d1d4725d49680b9abdf472411eaafea836378eba5a45c34fdfd5af6226abd1f5ea6f468ba435bad93371a1c24606f6f53eb863

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
99KB

MD5
435960056597565e8b7078bfe73660f9

SHA1
41bb25749434ecfca22a6dc58cddb38a518281be

SHA256
90de68c67905561957508c8fd78784132310bbe961229f61329fcb979b105b8f

SHA512
366119aa18bdec1a9f164a8b49ca39df8c82011c10185d118b6c4773b28a80abb343e89cbaa4748385ca65a2516a3384b86fcfaaf222a8a28e9e73e81d474292

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
100KB

MD5
f9dd573767b44e3a87829b92d767b899

SHA1
7604fbe7b2f400d72c8aedb7adb2caea24983a7a

SHA256
afb335b6e1669859f9c83162855c20c721dac5d7fc7f1e5c8e8bc10c8e7e4d74

SHA512
c29bba85255267a8f0639c03d780adf4607720d2c4f5e7af93b50026743b94fbe1406b57ede529f68d99bff949cab20eabf9efbada656d8146191c488f4531ee

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
107KB

MD5
b34822a883507f6116b33ce2f28aec7c

SHA1
cd873df696cc2c18e146ea04febd528cbaeb3243

SHA256
8930aaa2e8b097a1ff489ee1a1604a6a52bd63ec26228d09c1e47c1f801e9239

SHA512
62ef55675eacc718ff3dd4c4fdec4e95b7db91f5f036a9c0a30dde991818c3c72e2ee1e3caf27ba8963e6ae8c8035f9c00f77eba17fb76dc264b876dfc07785e

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
103KB

MD5
ded57bb46d1b968558a5abbcf4e08a9b

SHA1
657cb3ae497de5f54bff3e7db922b0a6f67515e1

SHA256
7450206d2dd4c90d333ca35de55bd5e2c7ee6da7b0e6f61419bcdef456747cf7

SHA512
71c4ff8475176f7968cdd0c71c3b48d5ec3bf0885e884894ecb5471e02b96d4dee2ce423323afddf33f17604e9a670bffcefdd61e033bdde7dbe459a8649a637

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
4KB

MD5
e6cb65911f645b425dc2876d54bc36f4

SHA1
a6c3d54fbb02bbd9d7da74bed3559943923b2f66

SHA256
3cf7465ff7f10c9658cb4d6f81458ac23747ad191450b8b311f1d8f674d84a31

SHA512
35d1ced63aa8cd63cd2c3bdb470f7257689b3897da141cb0e208973f22f3b95564d0bde4a494900446abf0560cf96073095fc5e88521df3607f91a2d2069b299

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
94KB

MD5
125639cff8204e1e4cb60727e59231d1

SHA1
c386dc26b6637d659ec47f0c5d862d012171cc96

SHA256
bf595ca18002a6f3cec356ba63ae45319bac7dfd4c203c30439f9302cb46fb9d

SHA512
18d3461d62f0f94b1dc2662ada0e603bb17b836a1123b856d4de997bd3e27fb1c3d40ad6e4f758896a1d88dd36bd53c4b9c234c9ba336b1919c183ffe5825efc

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp

Filesize
104KB

MD5
b1969d38825b2057698ffccbe47a0c85

SHA1
31627ce794cdc1b9ba5c2d67eafb0e417c96a782

SHA256
3c45c96c103c1c208830397a5eb90b0d04eb0dc875b1f1092b5a1d4876f16d7c

SHA512
18dafec424f5dd7cc0c088e5c59d5372714fcd2c2063969ee3daf04533ad2bdbd566ad46be184476435d47d8ea08149af918d82685e2c25c9ed8cec102906122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_.arguments.exe

Filesize
94KB

MD5
30013ed936681f7eef851cd104b52ec9

SHA1
0eb0c180ff3c78f7ae020d57873ccb40fa8743e4

SHA256
0e959f2faae796aedf817179544ecde789b8e4bf78cb2766e1abda2f93ee2ef5

SHA512
6f4b2a99532133c36d69ee4e3b7ec5724af319d51a91849872bca763fc225f06eceb3ca51f187b732190e7223d2369095eed44a05004d62dec4815de70d01779

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
93KB

MD5
8c6ffcc4001f046f349b53354ace861c

SHA1
8bb6ee06ba5baad1ea105585e9d26ee0310f58b7

SHA256
6103bc2537215d6db981578acff460653d304afe1dd67aa4661988ff1ed7e7bc

SHA512
3ef6fc57555225edcc8ce37aaa18b90bf5edd5a6627ec669e0baec85b047cfa130cc3d228a02e5d37f9cea93d915461e20abb6417f066e816f952b3168fb5e51

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads