49c87f83e4614bbfceae524be75c5a5dc61750b2e31bf8ad54bca55b3ecb7fa5

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

554e644819d5f138559e42b737104170N.exe
Size

183KB
MD5

554e644819d5f138559e42b737104170
SHA1

6343fa56f23f462caa40fe771c0a25e3d5bbb92d
SHA256

49c87f83e4614bbfceae524be75c5a5dc61750b2e31bf8ad54bca55b3ecb7fa5
SHA512

738dc2398e5048300d3dadbc0cba966d9a005273b26e51a4513e6c06fa0bc2774dc2fcfada983918896005e571c6a371d8194085f085162e2694e1f9b85248dd
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZHfFpsJOfFpsJWe7WpMaxeb0CYJ97lEYNR73r:RqKvb0CYJ973e+eKZ4qKvb0CYJ973e+b

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4382) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4648	Zombie.exe
4516	_3.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	554e644819d5f138559e42b737104170N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	554e644819d5f138559e42b737104170N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	_3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.exe.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp	_3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	_3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp	_3.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp	_3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	_3.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe.tmp	_3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp	_3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-phn.xrm-ms.tmp	_3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	_3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	_3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp	_3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\et.pak.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\de-DE\ieinstal.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp	_3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	_3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp	_3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	_3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp	_3.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	_3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp	_3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp	_3.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Classic.dll.tmp	_3.exe
File created	C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXT.tmp	_3.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md.tmp	_3.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp	_3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp	_3.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.tmp	_3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp	_3.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 4516	3776	554e644819d5f138559e42b737104170N.exe	85
PID 3776 wrote to memory of 4516	3776	554e644819d5f138559e42b737104170N.exe	85
PID 3776 wrote to memory of 4516	3776	554e644819d5f138559e42b737104170N.exe	85
PID 3776 wrote to memory of 4648	3776	554e644819d5f138559e42b737104170N.exe	84
PID 3776 wrote to memory of 4648	3776	554e644819d5f138559e42b737104170N.exe	84
PID 3776 wrote to memory of 4648	3776	554e644819d5f138559e42b737104170N.exe	84

C:\Users\Admin\AppData\Local\Temp\554e644819d5f138559e42b737104170N.exe
"C:\Users\Admin\AppData\Local\Temp\554e644819d5f138559e42b737104170N.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4648
- C:\Users\Admin\AppData\Local\Temp\_3.exe
  "_3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.exe.tmp

Filesize
183KB

MD5
bfae2aa86bf43ec23d106ee4c1afc88b

SHA1
652a9530247fa82fa4818a394f3a8641691224ca

SHA256
869c8565b727a7240feed993f5df1064b619c76b921b39468cf8673be40074fb

SHA512
25c8fb9657ba045b06ebe135d22160d92f44d49cce1a4bc51249425dd47d79e11bd7a0c1d57c79adf3253324b33f798efde7c65f17cff344420ac51bfede277d

Download Submit
C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.tmp

Filesize
91KB

MD5
eed6f738ad419e2c2a723d758240253f

SHA1
daf387ae6e19ad2003f1fcf9252b2a6759b84d54

SHA256
7f8b97e044ea7e56f042a0d0cfe073a7e958a561a3cf6ef998b79989b0a91b03

SHA512
1d6881572e9c9e4cc5a211991cc4cc939ebd40e6b2e48c4db5fa7fe3b82e60f26696770e5949f45240da835be6dee19b7f23cadd0724f026359bdeb96419b630

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
204KB

MD5
ce651ecfe9e9f31c14fa135fd628537e

SHA1
150f486f191c0eff4f8c307bab62c15188ef41ec

SHA256
ba883ff6807498cecbbb23d6afe9b6e216624938337a6a36b7d1734f43ad0222

SHA512
0b882e29b203c39980c4e6ee3bdac3f7bb0bd87b7a5a4c3cfc860c13043dd335e6e86a2d550e81a5817b3a59069161aadf6d001b59b655c85678c401da569238

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
190KB

MD5
339c80b0cc526fc63876d378e5581d19

SHA1
53fdc86b015306a37b895820e17d303687f7f717

SHA256
786fdf06e04badd17704a74c25993bb9ee1adec9052ccb9732bb244d443cfc3c

SHA512
ed9b6b28c586ac349d1415b4b1c610db0cd4c993f9445e1d4168a3d5c3314ce378e4597fe90c975d88eb31f5ec264f623c7bc031d87bb9a3ae519402967e31ba

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.1MB

MD5
f10eb4f8306dd02d20f1c0b3e3a05d5c

SHA1
80ddedb01577c2d226490948590b7136f57ff2f5

SHA256
126a700a0da6777b772bee0d9721bbb6650ec2bcb7cebc9170cc72038a6bece6

SHA512
67be0904b80ec5147cd9bf8040e7c5dbfc276bc807e1043a485a0a2ab1753aef2856cafab699fbf3f9ab7628d78e383f3ed3c7dee21ad5c7bb402ba02e8a963a

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
4c77480d44284e2c75bfe73128995d5f

SHA1
f6ab878089b0ec4b778cf0323244570ed1028042

SHA256
9b6f23bc952d00a0d40ec91e39f1019cf7f6cbfc6a125ce4123e95652630b1be

SHA512
7d908564bed77d73a75898ba3036737d8d6350844dc1751e31f053c0eeea0f471212295ab83efbf31bfd1687f6d4d7b4ca0bb65390b18c80593cb4a0050212f5

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
636KB

MD5
f0839b826c3ee78ceb0aa161e60a77ed

SHA1
bbedff5a3d97e5bf5aad9ac59b41631916fcb5d2

SHA256
5148d03542c38af72f9e8822e8984f0b5f2dc006da3421b88be7b00eb5aa1bff

SHA512
7e8fcb0e4954ebb3b07aceb4a6148f744f08905ff1dec6daf20c3cd77f4bec8206631487962eab8b87510028f89be2d40f11753440fd6ae4fdd7ef5db4f51092

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
280KB

MD5
2f7beb4dd631cbb1013f9f48ef6f5ccf

SHA1
37ccb01ff32c32c478e55625532048c6c7708948

SHA256
0aa5b14a80c35cab2d0b3634a48a6dc0ef45366d42ab9a2ea5b9d1de91abdec0

SHA512
9950f094bfd4de712a83bc30ae0b57b58287b369c479030a3028875be551b0928abea1072877e4b6c3551cf431a5dbb4d6299a39e1b75f9c364f0b49fa608464

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1022KB

MD5
1166b56f5adc8ff3f23be6a7a768d839

SHA1
ce734fd81c6526a8fc75b2286876cbce19909d65

SHA256
d75169895cb1f65ad9aa9bfe54bd01f56aa67a73c9a99d5a58d331934483ff83

SHA512
f2cfdc8c1c2016192d27ec1ada21945bd8a8e6f50fffb8edfecf9494fd6439f7501fc7d880d03c76e80f7d0ab3beeb3a1fa46ff48b55f6ad58c3d979d3e7eae9

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
776KB

MD5
f6c6027260ca759f26909448f0824724

SHA1
15bded1c64761b2c66e7d1b7a1b89aa2ce5da871

SHA256
89f8a309f86878696c11735a7a1c2b01b4145d6588a0d687ab72b469ff53a588

SHA512
2bbe958bd7a2af3df4266d1ee04eef8a42c218d1abdcdfcb0c0cf7cd61cf8bdaba87520167030e0eb6b88197b2bf333b349ab18048b05e5e4f0d1e171dfc80f3

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
148KB

MD5
e2ca31eea99a71d6e7ab56ec638310b2

SHA1
0f235ab5e37a148db476da9186f51cff0abe5539

SHA256
a2aa8d2c09e2292f67927a40e59aaba227293c12db77b8d0c6fea4e4e1ad7bfd

SHA512
f63c7c49336dc87989efd10ddd36cd5090714a27efed5019fd643dabd35ae9295c9e7bf17724602ca399e9f5b61a36613c1411dff3eb215f16b7157e7a40a3f5

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
101KB

MD5
bf6e09329cb674a84b47f7831ac2fc46

SHA1
5894de1c56ab29bfe8eb271a153dea8cdd9e7ead

SHA256
5ced1f43c5f48b836d5a1800a8917b050f9a538f94ff690c7011e47fcdd1ac2b

SHA512
06fdc8645bc0c1fef3bdc7296b240d0863c702c2ce0c441b962f8efe47bc91a5e008b1f3651ea130bad8b9150dae6f87923151bb11fad3a4f80cda2903f62158

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
99KB

MD5
3e7b9397e1a38799bb1eedad47fbf4d6

SHA1
ccc239191705d4977ffe12ac617e8bab01c0bcc2

SHA256
46106eca63866598befb61160e8413bbd37585766991550c7dd3828918d1a26d

SHA512
7668c4bc7222dd4926628131dbf5b35fc1522f374140534f4307c71b306ed59b2c0e4b5e8b622a28b8841ba20e2361d866f2920f8e0e605a00df0183b7126b0a

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
102KB

MD5
9eb0aea18784254146865b68c7b4f7d3

SHA1
eff4c6d49a86b64d5ebcae9ea78fd999fb0eb411

SHA256
9707afefb32ec4356350b209dc875b118a65181d7572c24ae1beccee88568c0b

SHA512
79995cd9f909dbd60f9d6b5acaba5778bbb00a81f464574e83bc8c468dd8a078a66aa247949e7dade9410f0ded3046d204e08790fca233ef6872fd72937731b1

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
106KB

MD5
ac69683a28d16ecdcf2ed2e77de63e64

SHA1
37af3c745d08fcf5a1a42c630185da11fc8dcd1a

SHA256
5bb2b8a33a87717c57702efcc2f54d599d6471143f99aa6d3e34e44dbedeeb78

SHA512
e77920a3f0cb7730362653359b7b2664fd4f9844d82f244376f81ec6215f8fdbc7e3df08b1ea8e6a0f06fd5733b4c20e6bb4fa37732c2f9b4e15b2aaa666c0ff

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
96KB

MD5
314b375b57dddfc3011d8841a13b3af7

SHA1
6c41331a0876369284ceef63896e0e183124bee1

SHA256
7dc055e9a18a191c6b7879d50161af066912f3034fb876ec76d1585c6acf5786

SHA512
bb4eebe8ae5db49011a6538a8eff65040907c2b7ecdf6f189edaf48593852bf452f7b6d2dce79f35c2b136b66591d0cc41142a468eb95ff82ce8e2afe2276210

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
100KB

MD5
ecf6ebb19f2d52467a99a18089791b72

SHA1
770cad20844af67555da89e4573992252fa8eef0

SHA256
0ad73fc40c6815406ceb4bbb32eefc4be82d3e4b13a58fc698a83cbfd0500b5e

SHA512
77e43343a60b27a987f58f51a8cbcb9e597fddfa4f4657fd398451d0d49cca842799c3bd3c82ee8aa9fdeaeafb232691d2ec5c75e66238cbb7ef0bc7f9847ee4

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
102KB

MD5
25b5d37f4e028a16ddbe855a146b4fd1

SHA1
7d44696f841816b3c0c5019c9aa425e230ffb97a

SHA256
cf2da63aabac519132b0408fdf1d25fdcf72c0f1f6c9b56e9b067e629dabe20f

SHA512
fa47a82c2556fdb2ee67ce679d4027ff865e7185abfce6bfa24006c504cafb9e3af426ef9c33cd5d63b37e54263366705504a3a1420d45265eca7c0896ea8b8a

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
100KB

MD5
fb85bfd1d7a8a0ddba2d515504416c5a

SHA1
7700b9c95b89f65fc7eb8bd0e385750d5306d197

SHA256
87cbaa4df231f4d2c14351e1a099973bd7fdc880ef848dda07aea08f4b6b02a2

SHA512
5630734a8afe945ddb53e79011c09056c71bcb02e1d4202cd70e80b56e5c5d825240303f4c08928afe9ca9784ca7d672ea9ee2f25facaa8184d336b16f3cffd9

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
99KB

MD5
8dafaee9ff872f3cd3a1cb360f76a7af

SHA1
87bd0f8c590c3d975a2570319fb4eda6b6f99cb9

SHA256
5e392ef63d703373cd1f4cc2b4bac70afbd7d251ebd5699ea89894cbac52c6f4

SHA512
003662cb76f2dd5f010f2c5a46f2460a1414c61e06e1cf424e85a209a1e0cb2cf1955fbf47eb0756efec974be567e022c942b4d871211998874de19ef9cbb74a

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
100KB

MD5
8c955c4920b5b0abe22fb16c91479955

SHA1
eb284e5495dbbedaf42d0e3bc7c4d46eaa1965a5

SHA256
c1796178b605f958618ef13acd26531e37f6a31550c86ec0fc00ad4456455e81

SHA512
32e20801a8c82689caedb669eb614442802a7b8ee83e3fd2a3663a92b5a10d6a34882f3fd4147ad42156ff05f48f70786ec8f1521fee7865bdd07cd8512b52db

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
108KB

MD5
bf3f2d1d398f21576e037d4fe682fbdd

SHA1
ebd69e9f5b611bd5199532f2262fd3c020b17dc6

SHA256
150cfee3c8595d643b3023ce521444e0c413fc05cbe43665d9bd396a8ca2d93b

SHA512
e8083575daec82c8ff1dfc2ae8093452a4ed623835c4346b475e36bcd28765a4f5ee1edac315505e6a56f7efc4eb9e88c515c3d01c61c368fd26ae0ed816bf6b

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
99KB

MD5
9b23f9278cc403f609cf2726b571017a

SHA1
1a9a375137f8be5c51bbb4071c2b844612357b24

SHA256
9d82e80055c52d211dc358dc25c50bf75002cb8b1391838cd997b535cb1b6edd

SHA512
0af6f0803e7eb0b1167a0eb0b17f2ff701d4200542a845f9a8da4f9ae2f7e705228cee963d92b5a01ca7114529f073ae3ec96a103b7427ec8094a50aadd8faa0

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
91KB

MD5
bd32bc070cd661a247b94d20f5dcf4f8

SHA1
f04d54d23e855ccd8185f5a0a60a62b51e28d54c

SHA256
cb2bcc623b96f84a0aa10247e7d064e89cdf19777673ef613716c75aed3163ae

SHA512
7cab065df8af6bca38986d747e85e9c620789aa3ee6470570d877043f82d9c28f7c42ac28319456ffcb16b81f86b186c9e3a03058ff182e9f4c54e654d3d49aa

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
101KB

MD5
a8812673c0dc5678df16297b1749b4e4

SHA1
b39e6619e48e61c75c787ce07a8df2350e02813e

SHA256
768982f6aebe457f9cfa4847317da698c74f0c7c933fb0a163dfa35536024bf5

SHA512
e5176666d88a24f69ea8b2bc068ee1fab7950e35dab7ae7f87fb5a15ab57673c5c2469f77bd6a7c44c0e52d4baed7758cc53eb15626a4d2ee0d152cea4dc9803

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
98KB

MD5
88474690d6012ff69d902c2ff9873bba

SHA1
3a60f930ebed44bb0d2758d9d6b1e68de9e5f9ca

SHA256
97aaa7282ae7d30b0c3da1503cb7b7eea95e4e71a6b7c314416a86533a27838f

SHA512
5a9a3516950cade622d976b9debeac850b4c6becb48a644346df4a1fa6b1fe4151e3e94163b64d458a99dd1700ac9703c136e20834a56fd695e61e55b1c8bcdf

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
99KB

MD5
93b11f589ecf9219bbcb678b2595519f

SHA1
abfcf4ca8be9f22d3c2713a4f10fb1bb48b80e0d

SHA256
72dbcf67cad04da60f8c171c4107a9eab4f195148465c4fd5c151ff88f58a4de

SHA512
4fcba118580a03792e33dd6213e47533c5b451a8803caaf158e492e93ffe8f456beeede8f89824207c1f0055f3cb8bb0da42b32829b7cf2b439e45d8d9f53833

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
105KB

MD5
901a3ce4ef10d66802663388c5caad46

SHA1
e784bf307a02dad59f2f804fa09834c99f930630

SHA256
7ed593d4854b54e4b650e673ff397c7403b094b024dde7570756e0fab0a2129c

SHA512
e9df4af2f77ead2d0a63fa6529751a22da24686e63d57dd2e290ea7987917ec4fac8148c0adf82f9b9d64d1ffca7a4000e9d49ef4cbb2d149d3b2803ca7120fb

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
100KB

MD5
fb58826ee9c5e9d4629aca6287afee87

SHA1
e43e5d8a7e5e3f8be1719976693eaff37ba38789

SHA256
29ae7472313294633cd8b3ae95d69c37cd1761ddd90f883ea5268b72331b0248

SHA512
71ab15262550da286a251a63df928b6033625218056babcb26b593cf845f05419a4ecac79e30302eca2b1112d9056858029acd0418a6d581bd5b6519058b30fe

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
99KB

MD5
5dabb2614da50ca7ce1040cdfff9fe15

SHA1
816a4a15c4f12b6c507409b0508831f5d6a47035

SHA256
95790f0a3da90e5b4d201052b187cd447235320a328abb870a26eb93e5e36a45

SHA512
dc5e6f0538cc5dc11e888b6455bbd5cccc9b4a41c820678c3ef099adbda067ce9cda2faf3851cc1f01238f0343bfafb8b9065b4403d999dd4f358dad89d65c73

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
68KB

MD5
130bc1597cd2c427e9809292f27ce02e

SHA1
cd65bc04a18f223985699a716a52c8f0875b074d

SHA256
21d1f96441fc7474686a81405b1b62d99560a23e0b3ef7fc9c884abe7a66330c

SHA512
7382d74aecfb92d06af96b32e07d128506ef17bc0ad98abe02ea9df23111a09b241eab2028703b68485c3420a0c146c66772fe8d3788897e3fc6f9985b310742

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
100KB

MD5
ce3a2ea56439c9de638c60758114c8b6

SHA1
7b97f385d80b8deee3726e3384cad3a9ea1f5852

SHA256
a91ae695d0c445b1b33de0ad56ca9285803b047cb01f264324d28ffb73eda863

SHA512
497932b4786156b5557ac370eacbf95158fbb54cdc0afa64e2657aca0ca9a583fc97e335b1725b2199e76b0d9b02b0c1e221250ff8446f4ff9d7ab6c6543aab7

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
100KB

MD5
d6f5b104b5ea4eee6913b17469ad3240

SHA1
7c0106ec034d67b5b19003fa02c57aece55181a6

SHA256
356d7562d61d3447c09197464693a7fb75efeb694ba18af9aee95f884c923b36

SHA512
34707ff92f0fc8229713c8db6d568fd6431430e880d194edd88570e006c7319473609c75206e285750f69163e9d3a895677416d6e97cb20f0d33bc1384ab3845

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
100KB

MD5
5e6751354dec60bb24805ca12a9c1b62

SHA1
c73773cc423dca1f040893751e5724a8bbbcdd87

SHA256
56366f774fbf83a9e35214dd89e246546ee57064f40244adefec012f18190edc

SHA512
bcbf2dd11239544d6a473a91fe9f9502c5830688640085af0b3249fc59f4612d3d6dd54b549b19950444969d6f6a51d066d6632f339ac668d965be4097d05f37

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
100KB

MD5
16bbba8f267b75f3239c123787d64d77

SHA1
bd3798e3e568a43a4e866d2e78f14ce36c1aa881

SHA256
c261abfc180d2713ba0b29e539718b0d74c32c6401c85ec590e5c07767857667

SHA512
68a190571dd0ba3be47aa4357a47adc46af3c18be2bcbfb23a5408d7f007856dc5a10c5235a58f648337647e7a0c1ec99e5c7ec777dfe83f19d240db0a35e62f

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
100KB

MD5
bce776d2ed27820943a1fff946b4de09

SHA1
ebe742c47dbca05cb353576669f728831686023e

SHA256
3f8377cd642ebac885853cf182c93f227d02480cb17a973c5aa901d7d1d66977

SHA512
ea133b42cfd03ca7a577c1bfbd7c81947c0afe664a9986d922728f2e179d90bf969ccf640b52113671cfb25c07d37cdab229f51f4e0c8df0020f9d46e41bf19f

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
100KB

MD5
0189390fc6068c370b36fd63c5c25018

SHA1
328e519e3490b2df7cf20137b71d6554dc0fd2e0

SHA256
33e3227ba1e3f0fd40594a4b6c6b60127de1acf559d3e8507573ee96f954c3ac

SHA512
0ffd784d0fd457c282606dc873def18d0b57b551c2d9c6c3592137ffe5844ab1993b1d553cb1f8a71a0d1b3316f791b96ae775d91af137c26308889b732d2ab0

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
101KB

MD5
5c2614c212826ef04fb8542f4345384c

SHA1
a6e2d70b6563ff1b16f9172b3bcff4410354001f

SHA256
4f29b281e6486ebaffd9791aa97b13507021a4881ebec34cffcfb17520151409

SHA512
ee21e2a4ec71dde7c482b887559e120cc6a5d422027e956a43b5a647960a7b3c5bd82f82ce854cb4e234a3ab4a8716ba4be0707c1bf37c658450107dd027adce

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
103KB

MD5
df48d580fd51d2d949ff7beea3b38102

SHA1
5c188da2f9429e691ac7712941f86f23bab86c2d

SHA256
a74096cb40f8443d17c457f889e2cca8f871c8bda6160732d4535ca869e1171b

SHA512
54e02f454e21681caa4aa73fc5e286e9f2cc4e47e1580fe3ef090a66a46e08dc24e8d9f160a5bf78327b5b5f68fe6ec35b49822bad424d394b5cdeafba26dfc1

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
109KB

MD5
4f22e29e9a2458c7a0ef21d01d19909f

SHA1
7b2601aed5ddec12958e178988cb46323c099241

SHA256
58055f08378740f86481c88307603107d5254c7d5756b1ef1b4017db094b94af

SHA512
45c9fcf687e16a1ff0431cd1b62435c3aa0dc1fb0a9012d43c868a7a9be4ebc7f8c5e286328e8313e337f6f0941b8d67ebc907ce00f796b88f7c07918891ef69

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
99KB

MD5
fbbf4678f3fac22016242f974928f5a1

SHA1
3b00b892c15bf2804a0afa6287ef04f679a24cce

SHA256
46a5c29831261810f527438ad68de4e4baf3ea903ffc6fabe1b2d37b5ab8e840

SHA512
832d3311387b2aff61f4bfba2bff00debd96d13e766d7ad9f37b0897d6cedb03dd0a2a2aa06af90c93173998fa17e9c15593ab391b4c2e228f6236c056022e85

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
102KB

MD5
a23002e1509453ab62c2c1297a265358

SHA1
3626f8c01cf15e996c3cf35c3da0f4fefbd90030

SHA256
6cafdc7c14fcce3ab8f5bf0a32223eeea279af50cec264593db56aa032e12618

SHA512
d3f8d416e95c4ea2e01a0bbe703583f8802535a151a987f3050720ee273cc9fc231b46a928644c521f1b85da6e6000beb09029f43bb86eeb27dad14d6ff9d30c

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
104KB

MD5
ca05cc7e64a4c826c45c09f10547405c

SHA1
cc3875d904b1711caf479156c82e9ab6897bd8d4

SHA256
0fd6734f62e947be7a675510c9365574436c4b01b95589ca6238c1a3496f19ff

SHA512
ddb2e49181fb1858b49b3fde38c1b1cca4ec0c76a2f401cc754ff7352374e7d19d662e13d5c73012709b8de9cef1b1963bf94b37a07dbdcb97806121f31d4078

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
97KB

MD5
8036d0999732193cdd40454215668ae7

SHA1
388baef47152a631e2297b6113e5c4e259b7b814

SHA256
4938b9cd8585e639ecce2007ba1f86af5e5685e741ab54e6356e7348d9180e5a

SHA512
9bb7631eb3c63ce29432a5051a82d75354434e6ef39b87f9d4dd4ee8cec41b39fa33005e1e62618ad88fc70b82e5c61b231aa9483ebdbe045dc4af5fe96e9857

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
104KB

MD5
b7542060e3b10e4ea46804cff2426b4b

SHA1
aa85e1b7dc535a39651e414cf8117b1ac3a37369

SHA256
8ec96b5ee218f630a0d2264eca28a52b0046035111d43a411be1902dbf7c7c5d

SHA512
d55a4c517373d7ce111ff33732bb5cf4dacc3b2f4d7e229bac2488753babb57e83674401c98b2cb7d30b97dab5b08e8c702a269c764b253e4c464fcb1fe5dbf6

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
99KB

MD5
9f6b2138287d87b8e56cab34e4fa8eb5

SHA1
5863216673c305d9b1825134597c89421318b831

SHA256
41471e1d25f72ecab9ebc6d24616b70ba78333ef6b5efcf0f97ca589cae5f57d

SHA512
531b66ce779dfae159d4b84e460db8c97d6799d3ee4eb02672b2b1e0afd5e5edc348e18e3e7cb5fd51cf69444f953eb167e4c67b95c516cce05d3c913be106c5

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
100KB

MD5
5557f48e221efe9c5851514768a01564

SHA1
1d86445f22a78682d3d14c6bed8d4a3d59f6ff48

SHA256
dcc61baa6d17593c2e79488ba80441da471263590de8d6fc930b8ac2c370737f

SHA512
fece6c08fbf9c53e02f9e51c48aefc34df741071c0e5bbfb33d3ce1a97f842bffb4ee1adaac617bb38162d817c0ec4fb3f4d0d435b527cb53f01ac33c426ec59

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
100KB

MD5
fb381d1d78c225c8d3652065a0137a02

SHA1
0ff6bdf0b38053b043d29382e1ec7e4be4f0d332

SHA256
482cf7875b1d88ede00b78b52b8a2ed5dcd7a62f930c2e6d7ec64ae3f8ad31dd

SHA512
e39d3496bda29f81a63eec656217054e00aa1812f31662e9a30c330dde13a94705973ce2db0232ce34402d254d8ff89feab591341a5ff4281b5e5ce0b6f570c3

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
111KB

MD5
d9477328d040fe68bd6220c8176a3970

SHA1
0a3bc30893a7e947d7a2d6557f7e3979567fe94c

SHA256
43ce232cafb0c3584df6a5a0ca65b1524c82c6a4da3e8ebddc5fc9e9dbde64c4

SHA512
fb4b532fc9731825c68b054637d6b1c31d5d955ca460c02c4135ead7280c583469c92bbcb8f398aaffb6cc315862cf1c9dba36edb285f93718c8ce6c8e9d4184

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
113KB

MD5
f8aa5ac082f19f2739fa87368ada57fa

SHA1
52f8b016959c0076a18ffc2108a3ac7291604016

SHA256
bec7762f0a657aaafdd470c70d0b4c22a47c58a37ef58fa0007037083f52cb44

SHA512
d6bf761f6cd098e71c217fc47e7eb3f98e7b4d17dbc4037a97d2c1d7cc7512c633ed82080466fb86dd9770db5d6aa7a5d6abb1f97f3ada9938b0c194b280d21e

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
97KB

MD5
e5476b6cd144e2ae23512f2e8c396e11

SHA1
6a09e6668c4863bd402b1e4baa1805d67de7aef3

SHA256
4b82311ec6eb19146a0132e4eca66629bd0d5386f5a6cbef10a35b3b0c492348

SHA512
a2f50e498ae1723893a7804925291450f5187ed476d08b9dc16d99266fc526cb2d6c267bcbb062fb3bb4cf253f3d9cff429582cb11f7be22b5fe6776dd87748d

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
106KB

MD5
0100914d3512b0f1842265627567faf8

SHA1
ecc9f00431ad320ffa21823da7848fff69feec28

SHA256
0eeaa5c4f2481bcc955bc2d8455c5a178c11ec929b69bb2270af75492c94581b

SHA512
3d76f4091c42c26d0183808ac1f664309cdb52524c98a156475a4d42d390b43a4dd238fc9c3fb4150786a4f6dc02420cb80e9dd3f53fd0c22c07e81c9cc1a141

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
101KB

MD5
e86b16781135cf3334cbed92bc1c91d8

SHA1
60903f44b41be1d4c5c5dbe9523e1affcbff43b6

SHA256
19e9ae21b81d728cececeb769f33d4d14a8040d1991da75cad81d9065f129faa

SHA512
1ff6d9b37bd71bc4338dbd548e1deb32a89c3d93be5fad470bcf0ac7f3a7846abf3585f1032c3754343e0de651810dd5e415d733f90e72ba550a6fa55e905f0d

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
92KB

MD5
3fa311129f5a968d408960711f34746a

SHA1
399afd564fa889b4e8101c5109bdcd7689ebfd7f

SHA256
735baea4ef860ea66bfa79980d07000e49ad9ce412e54b32b9aea4d26a1985bf

SHA512
37335347e5b3f4b863ef9f0deae6ad7a0754aa0792e87bf96b37d6f75b1ec2a63fb00796012914c4d4ed99fcfccf5fc5a2863c86fe2f5ff672bb4be8de978d27

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
101KB

MD5
89b0319384f6cf0516684e6853185e6e

SHA1
96f14fdfc5e82feea3ba1b13c8472b51512d1d77

SHA256
0f2311b74b081f9698fb4e03d160045bdf5163a200546d34c16d006ff232077c

SHA512
121394b0fbb192bc5fdc6fb2e1cc090a3abf875b29f3eea3da3e044e969facf75a5c48e9bf308567e26b70b2b007f01864a40876f9369471d0cbfa6335b12ec0

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
110KB

MD5
279f826d242ae61f4299205a2a2286d5

SHA1
7478303e8a6469cbeabcfae7c95378965a3a2406

SHA256
fa885b78874e6f8a1dd83cb083d2fe17143ef5f7882d027c0c1270fdf525878e

SHA512
c3d4125c130f5fd2e73a2b059a9d6aa5511c39cfade82c3566f00bcb1397bb85db5f133b11039959d293b3cc29ae80b74a0638978e6235f776549a3ecb65ab28

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp

Filesize
103KB

MD5
815e56fa6c5594dc0c1f374c556eadd1

SHA1
d8e92738241a4916605d0a1927529e44b3e9860d

SHA256
71fd1e91b751bb6c34087a86e959585be056b404d9ae78ae5f2d0cb958f71518

SHA512
bf7298a338acae44d65974edc70bd74b859c96eb162e6debfae66e50a6862890c9ea8b2237cd90948b1ab433ce234f29bc503ff38cdde2358ea966de6dacf453

Download Submit
C:\Users\Admin\AppData\Local\Temp\_3.exe

Filesize
91KB

MD5
37f3054d9ad1f9683ee3d94c9ddea794

SHA1
27e917150e4d583aca25949b2a556ace696f99c5

SHA256
afdcf0170e60f4f8fe4eacfea6671dc2d9aaf0c874706a6880336c431be57cd0

SHA512
4c1ad57bc9a89f30bcf11fc4874ec3667877471f5342c2a197825da536afd2073dcc2b763741ce0c413886dcd38573ea0d8950e8ce876130c7892b5d3bce909c

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
91KB

MD5
79c0be43049406167402ace7f38804c1

SHA1
854d7db814ab76b5d634eb5d698c4cb003aa41e4

SHA256
25bb27be9a6a37b8d06f3b88bb5619c7373bc4fc7f0c7376ba15d22e132253a5

SHA512
eb976655586f936f305b75159d4aa2b56fd02f0f1c19b7e42e31aeda74edd11ce41925a1c0845e335242ba24b961a2212f1ef7d579258023d10e96b81f7f5fa3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads