27151d65645b99f7561a820afd4e408e78b3e88ad37ef181f3e9566cf7228179

Analysis

max time kernel
120s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b3161cd64e28a91e5522c9c583bb3790N.exe
Size

178KB
MD5

b3161cd64e28a91e5522c9c583bb3790
SHA1

4cc7abbd96170cb989a441ffe86b1960eb623ff7
SHA256

27151d65645b99f7561a820afd4e408e78b3e88ad37ef181f3e9566cf7228179
SHA512

95abb42f76b0176fa0917a8a284f63dd749ecf49187984653e03ec426910c6d378962abb241bae10e209ba9ffb75525aa7e54a759f7079ad9a65f4a16316b2d0
SSDEEP

1536:W7ZhA7pApH178NKsqzot4c4G444444444VkyKAVj84t7ZhA7pApH178NKsqzot4P:6e7Wpazq0YKAVjBe7Wpazq0YKAVjr

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4609) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4332	_Compile Script to .exe (x64).lnk.exe
1048	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	b3161cd64e28a91e5522c9c583bb3790N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	b3161cd64e28a91e5522c9c583bb3790N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.CoreLib.dll.tmp	_Compile Script to .exe (x64).lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	_Compile Script to .exe (x64).lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	_Compile Script to .exe (x64).lnk.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	_Compile Script to .exe (x64).lnk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\notification_helper.exe.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	_Compile Script to .exe (x64).lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp	_Compile Script to .exe (x64).lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.tmp	_Compile Script to .exe (x64).lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp	_Compile Script to .exe (x64).lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\.version.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.CodePages.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationUI.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-pl.xrm-ms.tmp	_Compile Script to .exe (x64).lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms.tmp	_Compile Script to .exe (x64).lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_elf.dll.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms.tmp	_Compile Script to .exe (x64).lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	_Compile Script to .exe (x64).lnk.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	_Compile Script to .exe (x64).lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	_Compile Script to .exe (x64).lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	_Compile Script to .exe (x64).lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	_Compile Script to .exe (x64).lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp	_Compile Script to .exe (x64).lnk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4332	4704	b3161cd64e28a91e5522c9c583bb3790N.exe	85
PID 4704 wrote to memory of 4332	4704	b3161cd64e28a91e5522c9c583bb3790N.exe	85
PID 4704 wrote to memory of 4332	4704	b3161cd64e28a91e5522c9c583bb3790N.exe	85
PID 4704 wrote to memory of 1048	4704	b3161cd64e28a91e5522c9c583bb3790N.exe	84
PID 4704 wrote to memory of 1048	4704	b3161cd64e28a91e5522c9c583bb3790N.exe	84
PID 4704 wrote to memory of 1048	4704	b3161cd64e28a91e5522c9c583bb3790N.exe	84

C:\Users\Admin\AppData\Local\Temp\b3161cd64e28a91e5522c9c583bb3790N.exe
"C:\Users\Admin\AppData\Local\Temp\b3161cd64e28a91e5522c9c583bb3790N.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1048
- C:\Users\Admin\AppData\Local\Temp\_Compile Script to .exe (x64).lnk.exe
  "_Compile Script to .exe (x64).lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1750093773-264148664-1320403265-1000\desktop.ini.tmp

Filesize
90KB

MD5
88827c2aa7114ed566b8a1664e642b55

SHA1
67969c427d396bcec7334878b271f973320422ba

SHA256
c1af37bf465e0da5f7d5cabbb4a8ae6a90349410d9329de4989c9ef60369a33b

SHA512
b929f0fdfaac934a2b72199b130385278499885ca522a73821730e4b9a11951183ce93c9f8ce8d91a5a7dde088b1ef7680f8e824a8285ec28640b4e7450ee6e9

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
203KB

MD5
2ecd0529d6a9353040ea1d965edfbce2

SHA1
99daeadffe19a75cea1cf64b556c2cd1d3312a0a

SHA256
8d6b21840bf699607a92607c2808889ff8ed65df70b6746725046011f88152b5

SHA512
b8385173523267f7c87d3a08806f7381c8ec9e308f42549bb152a675b4c3ff17157d14b5a9333344e49a90fe2f87c1e0a881a720e9a607990d4bed21ae38e36d

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
8068f91620973435e6eafca4f7a90c7c

SHA1
f7d789e4d43a2f3d92bc6d221c77ae14f4d5aad1

SHA256
cc61249340e3144e2b076234bded640e3c866fb05edd84e0bf7bbc155496276c

SHA512
34d14a180b672b6411efdd9b8039118935a3e3d0452b4aec643d3137afb74aa10fcb55fdb57b738a58c2b5d3f392b78eeea444f909eafbe7a02724af9978dab8

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
634KB

MD5
d50f71461c11d99da4f54aaf945bd499

SHA1
7a0cb008cbc1f7f62f68db9317bc15bca94747b0

SHA256
613e26ed83737b3c2060deb367949844a48b6f28b4feec93e2b61d8a96989263

SHA512
d20b5c5a26f54b653bfa94c3d53f72469bd160729c451f6f6c901ef7c18dd24f3918a11717ea1430c4963c394008542e096c1fdf94899138a02bc69ba1a475af

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
92KB

MD5
edf59532cfd0ff94775d5d7f51d57351

SHA1
7cc1da46b6a6ab43d32f89249b5d65b4bba361de

SHA256
7f950407a0cc6d17dc1bfbbcb10e00a7e42501c0048787227c6d2f96cb0c8f95

SHA512
17ac875bf3bee719b3e3b84b375991b3ad3d7f359e65da687d14e6ef339214c957f028e2c348d75d852f1bca0be89ffec2990d6c1fe4cecd628d6d19100d837f

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1021KB

MD5
81bb4f4d6105eb862cf48aed8ee15107

SHA1
9abdd41fc5c74d0d689243581dcb8feebe98fb1d

SHA256
d07b2d62e9692c05cb0e95372c6e8643457126c7aafeb9134d3de032a76cb6a3

SHA512
811deb64bbe735de622749b1f1cd27b53052aec4d8f535ef13aa8542c642b1b64a643707c838672dc3260aaec90ac942725cf5f01a51d5c2e94200c7c940fd1d

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
774KB

MD5
9aa082f586183f08f1598e8a0bdf793a

SHA1
26823b6a2dd9117b5b9a0775d3879747f6c96c95

SHA256
5a81632ac47b871371df27e0298934c2361398499aa700e09394602dfff1660b

SHA512
2692360e8c37927a9dff84be8f315348a44be98fa89401f3aad3252e86c96eceacaa4aac4427b3fb2065568864ea73b237537716b5c0facb4b7fffb52cd3d6f7

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
147KB

MD5
e3d1b31d3617bb6f154d7ef2545c53f2

SHA1
958fabf6e24f0aaeca1722f2ecd83dc3339db498

SHA256
aac48d38449a22350b4b98b8f6d122d45e458f3075a50b05beace6dfedf89978

SHA512
cf89f820de6cbcd7a7a100af4be98a89bdb85222a29aa93b6e9cdcbd18f4dd4932e7a39d468c48dec8ea6b30b864fc0383cabdf3ac506a09dda14626dba96d55

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
95KB

MD5
90af653f1c9386010c579e42b542756d

SHA1
92fe6d718aa2acc1e7ee7e3fb52a05785f9e4637

SHA256
fa78a97bc48aabe2025fe87978d82d8eda003cfe70b1c9bf4a6bed410b5f4ae1

SHA512
24cab2143ddb2431f647536cf7920d529f8e77b7696b1e750b910b933eba84cf5257633d36b959488859dcc3a7e4a40e32093c8e569edf9d8c1824659f24a949

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
100KB

MD5
0376c3cbaac5f83f7f9f8252a4fc5b5c

SHA1
67998fe5bc58b6728aa8eac26eb2cbe2d1ff244c

SHA256
9122d99ac2fa16fd86c4e3095341326238468ecfaf6ad3faad7213d2de414261

SHA512
ad9668792c208be478584cd6c785af7003390bd7953aee9cf063a2fc12c00a024e2dc54a7b504a3cd79e0e7f2ea96754ff6a344f1095cbf1e1d60b18abff7f4a

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
95KB

MD5
39e6c7e4a7f18f8534a45cea9fe13632

SHA1
96bbd20f3a03a444b0862d75da29ac48b208301b

SHA256
3e60321074021ef195c9154ccb7987b3235ee95bafdc808e1270102711c41e01

SHA512
ca62b5372572847bdcacbebf4b753178747b95e5b847a1eff3a0011bdc708db115dde03384726e74e2cb2bbb8b2e70679ce9bbf7fab80c1d2b30261544518963

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
101KB

MD5
8b7bfe0b33b0ee9dcdb567d61d92e219

SHA1
5601f4ca20a471101c0fc501d78c24b6d5aa8157

SHA256
0847804d5e14475ca9e68207e3af4014f8de5ffec6721408b130807b3fd7e014

SHA512
bc1f7088dd22c9c0a03e34732e4dd83564de1a9eef6f08e638835881d3bbabd73d37747a6bfe6ec4eb19c124588d13a81c0b9dc2609995dfb7e4244013f79ca8

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
99KB

MD5
3fecd32a0ae939e9eb466aee8f135550

SHA1
9e5a8601ae39a125944864912c395c8a0321b040

SHA256
ca2d5bcfdf9380ac20377bbc0f4bbf5beb694ac9e87d25afb255adb62e333cd9

SHA512
37a86373489ef3df5ad667d5c0d48892a44dba358fa69e93fc79b0deb8fa98abbf4873026de6e490115e7c5805204858f00916e1d04351c53e9e04d8da0091fa

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
100KB

MD5
8c89b55f313a5b77822581246ad66860

SHA1
93a6da6d4b660f216513f388842ce586ece98dad

SHA256
a2dba72fdb8825fe25190fc1a959dc39d33a176fa7e51e0b493a03eeb5112d28

SHA512
d4d5c49421d442b97396b83b189fb5c879b62bb466ea13deae261f5730f977940c99b76eb792d8726fcf02dacf57251e591ac452fe11fe2c19e607480523098c

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
68KB

MD5
adde35d5ef3f5794ffee804966edb14a

SHA1
8a47b6f2f44fc29fe63a38732111bf4c284adc4b

SHA256
73d9d867e6bfc4aaf33d1c94ab371ec96731dffd6214cf481e5bb1a19dd67902

SHA512
fd4ddf040d68a93dd4fa59125d978fc761bc1467386b2d32143d4b0bbd9822fffa9904e32fe005e57444e052816d9bd11ba3b1580386730261c9f6e4f34b0b18

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
93KB

MD5
adf69a804d198336f6d854d824dc5d5d

SHA1
2e6362de18fc81d11526808165a2d45ceb5a65a5

SHA256
eec10c2219d44bb430f338de1584aa23a77b530454d701c2f74e028fc411b307

SHA512
80d062445f4ed0bfd51d82527d70a24dfbe143ae539447fddb3938d3c6d044d10bf7f8fe5d4e8c8da1de579f37ec7d6c4b07f2c344b0f205f7eb063d56a93b43

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
99KB

MD5
a5d33604ca06684d437dd8d6fd7f8b4e

SHA1
7be0aee910dd87e5196c0d6914d32d5237a85ed2

SHA256
89877d3b7ca00de0975cb4711a65e83e8cfc8959ed7d6d26c401927b5b751427

SHA512
599e5588f513cbeb7021c498bc9655ae01386d6e1c16f81a8fc77538d96efa758b549dd80fdbc5924e794eba1f15f43c64dec50552475e420308f07ee4dd1dfd

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
99KB

MD5
57fd88218dad930972ce6c9c29b0a8dc

SHA1
b5d45351d59fd017ede09bf118904d83127772fc

SHA256
d3b8777b734120bf99d496bfbb2ad3bb2c789ba3931b9ca3fd1878d5e081182c

SHA512
bbaf3c3c024be9ccab6ebc8917c10dfb1895f165a7b40a045a5e880ef8ce0c05310b1e00ccff4f7984ec38af05b46d293b2f230a876e01c4aba32c1b2d7c06ba

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
96KB

MD5
f247a582fac935bf20c917ced54e0cb0

SHA1
4011695141ba9cb87b5965a43094638bc83a3bb4

SHA256
f3747ca81a72a18e8f223a8752a9b2811e2b09833e8cfc88ec7502d7036042e0

SHA512
8743fef4e98e815040037edaa554160aed53bde46474d84dc8be994039ec451d9af45b0beb99cfa750317af0f5a6e26c132103620e96ac54828c69aa25e7b47f

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
97KB

MD5
041fde710b52f969239a6ef877843713

SHA1
da8975b756913132b47a5d45374109d581741796

SHA256
9cc2c6ba436fec035433eaac8abf0f7a4bb13261e60a619205aca265043b931e

SHA512
b31ad23c8369c6131d74b5147db1d662f48649e38a40dfe981aeda77f1341c9cf660dd0ab21b390d32cc968cc8966c68159793b836b0f97b5275852e3ff594a6

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
95KB

MD5
fb9d8f0229f7297ce48788b5f7ca5a59

SHA1
6375020bbfc625d5f23b6456e6a0a1a2b2c1ad38

SHA256
1d25387ffe8f380a17445f11948cb3f367e474596a181daae77ef19fcf7d4076

SHA512
bd0924de95aa954bf0fc30d4ceb60db7950751b8130ffe88d14cc0b69fe37c26221fab752e991eefe5f8e26361f0a92fba518608cb2795269c967215b2fe2323

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
100KB

MD5
ef1778d8d621cce335732e414a79b142

SHA1
0d6c9d6a30d97980884da8032ca02451ac07b0c7

SHA256
1c9355c18f55bd81e1a7d403d55fefb2e758626e73e9b91c11ca1aa180d38f1a

SHA512
d4cb63ffd7971d6ad8e16339960a0e7a33713e2c602c519a8959aee7e48c0013274cf455612deb5ca9797a4ea06730c26b1949259dd0412e73030fc3239036d9

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
94KB

MD5
da9995116b0ece71dd2d0060207a0175

SHA1
1e3cf1d5af39c425f4c1f87397c7bd2dbb52f9d1

SHA256
49af7a8e03bd2436f8c0139db9fe4ef2a53c071204e2d4b61a0375ae1f39f749

SHA512
b48d75aa10f1cb8ba05e2a4d7aecf2f96626f19bf807d010fec1ebadf7fc9bf539df777d3daea9a0b35d14c2fa1d8abfcf98ff41d9ff0780a472a09c555ce05d

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
96KB

MD5
a6cdfd5e441bf040df789636d80cbf1a

SHA1
1748c61c71d72406260972ebd34aba396b58eeff

SHA256
7e4f1b6765351a7c575b24a1698edd3834f9740f3543691437af1f62ea336f36

SHA512
c003010bc312dc9a5f6b4fae1d4f2642be58d4f9d479b1ef093e2d5e74900384ec3d9ff3157f5c36137cd63a03a1718999bb8c07ab2a093eb9b0c778c2b3cb48

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
101KB

MD5
a64d3d27eccf46f7d5eb055c0aad765b

SHA1
40f8f9d472a9f25b9ca2ad8c6307d4557b5b65a7

SHA256
35505be5662c0a4f86bc62f173320921d976a0b13558baa0dcb93958f7dd676e

SHA512
955ea1bf78a28952430fd3b48c3ce4cf06b678bf350c7e9a8b6f95d48ffed5132f96fa8c6964b5d537ebeb99b629c3c1346655930f4d6ca82536e12401f05e7b

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
97KB

MD5
cb99663088df6334cc0c395a39d4db22

SHA1
9df1cf8bcb9522fa2cfa0755edf9aede4ae963e0

SHA256
888bf03360a4e5b85ad0f71570870a959c77c2b8f03497d29174dcb775a23da8

SHA512
bc93dc1f6c173575934b17c260efa401df9c1df233fd89d76478aeff53522d04d4c388a7a05d45f6f03eb42e85293501ebf01330fddd2a38bcf5a5e6e658fb95

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
97KB

MD5
48ec491b2fb494b16cd31c48c96932a0

SHA1
c2b5541283aaaee4c5c1d2abad6027bb53372a32

SHA256
5f9509bc627e4b03ccc88fcf672c0a708d40a7f0621601f337f392af7712dc01

SHA512
a556d72e7b886f6ecd7c54c985a09162964d4f8c0aa0a55a1585b0258b83ec1091f72034df84e5ba8d8db0a7d15f91cbdcb6a3d0561d96522bccfc2d1cf31da6

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
96KB

MD5
bebde771119099744ac09d39a418a223

SHA1
100a42a67aa15774b65b836417e185b8d96e7b8b

SHA256
39e94bdfc33e1e7f457a632c0affd1c7b4c96a0c41eda01204ec0d9dd6a42761

SHA512
0938d08c2a851fdc16b18f582bc7f70c6d87ede7abee4e5b18d9a2e63aa90fa0d8ef4a9504051135e55a2c0f6d6800624abf1e27bd81c99fd830d99a75594bf8

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
98KB

MD5
235cfca8cb759cc1ec55ee54844222d2

SHA1
08a48bd2b47bc3a3939ac32cb5bebb84e4740581

SHA256
8bce9b17bde08a90713d4051608821c7c39cbbd11f6425a03f77a4815d9ddd77

SHA512
29145ac04a19346c45216e0fe536a18c35c9f56ccd390c5b238a4707331562ca1c354c0ef3c67ea16d030081c1a72717e7f78e7d0c44eb7aa55af812c256d53e

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
99KB

MD5
800c83a180999a409bcfd8216d096aee

SHA1
20e6ff396dfed32a6ff4b5c0e9a2fee0aa57eb7a

SHA256
7d07a83dfd21f4af5a1a7065a263d7fe6d4b0b7f33d420a6d7bacaf675fc4500

SHA512
52e9b51463cd170115f65988886207a58ce13ab292a4163e64fd1487dd37c07458be28fdf7948f1cb26844208b86e698e6fbcdc4a5fcbb257e58a798daa216ec

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
107KB

MD5
4d17c0946ea10cc02da2ae8a42c31839

SHA1
6105261716101b9dbf43a860e02f114bd003fb1e

SHA256
74a9edcd0fb6736a0b2a7f05a87cafcda44f1d76dbd16415822ba12d85ed2267

SHA512
c2881e1271ef4a7de8e67d5e4e79a668d153e172ca3eaa5d159098bea52fffaa223e38d9e29aa615aff462ac1cab2de442446515798e8a66cabcc38a86f5c5dd

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
101KB

MD5
ea245a3875ac628af848446159043a59

SHA1
c07c23647b1e6d6e9b7c99a0217b88d1f421026a

SHA256
084e81574bde8497097f51de641a44c9e31b4994a482ba028120227c6bcd3a3b

SHA512
0d7bbe55350e5997306145230f66fa33a0ce9a035a43af7d9698559c0d5bba8c6aaad4dba809a8ca605bcb77404342f79f651f89e9e223abb9c4633df5b7b3d5

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
88KB

MD5
8d06037acc9796b18f6bed2345e5c13c

SHA1
305f86f133b4c9da12b78b7c38fe277288c9aaa6

SHA256
2dff0302d27a73e0a62f7549f01638e35da8664d970a367daef986db01a0082d

SHA512
6dd713c1265f20a19419d364be43cd61a64606182b5ad6adb5877578e528aee9cadc50e91d6275fac3af759fc3f9bd9a4bd26839d7fe450af083b33caba17a18

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
100KB

MD5
537f5ec786e7261aacbe76b110e6aa4d

SHA1
d611b6fc014221b8df258db955bb6c7f4612756c

SHA256
472bd5c805bf7f216b92f9b51f47e64c8d8035fe6ac2b388237908ec1641e025

SHA512
528c19f9aaf99156def9c26fa2e4800c976708d42f3e8cb70be72312683fc2648ec9c51f98e7a8e0506446a537368dc5d60e052c0761625d291e1d8f576d3eb4

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
98KB

MD5
ee717e222b4d0ef04fa3adbcb58398f6

SHA1
5e4b27b184ac1d52c26c3298bccf5d2d90464ee2

SHA256
335d4c3cb462c705044f6307dedb842cefdeed18d11bb977271fd1f458c67676

SHA512
72b2d6d3b1fc11510a714deb7c33b1d1a8f7b8baf2fb429a52155b3a7c26305cf7d6b9fa3f9beea3e2afd97666e8297af24d283c8cff7a507f593c05a3ae806c

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
100KB

MD5
fb65ef637f790f9d74d4b95b15992942

SHA1
e458878c10f4b39cf1a1b5056b3575fb6ed66824

SHA256
c50c385d3afac965afa9c67d82434c3e4a275002393db1e04e6319e07711b195

SHA512
3cffbb1cebd2781ac88bd12b1b5ab9e2b0743ae9429314a51575c3b67b9449742c59c730e17c148f4984b2ac3f4aead367518cd26ae82583d22f7be08f239f27

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
96KB

MD5
ebf00a21320cfc57c8d732c942cd4111

SHA1
c3e2596306baeffa8d83512d12c55fa495946d32

SHA256
1c535ae90592e7fc9249f0e0268eddd288549ed35e5b85fe3adfcdf8832e6a76

SHA512
2af90af23f99582e00aad657a78cdba417f8a62d8d2e97a8fbbafa56f72ade9ba7ca1a9145933cd2d0001bb03d83d00200c83153298705c81c53556f78290203

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
102KB

MD5
12b5f41cd1b8edd615b915edd4e09765

SHA1
cdebd06890dbcf742dd27c17d05d44579471bd82

SHA256
9ba2d99e8bc91bc17ac8e114ff668bd41938b4662b572d27cf82f7addf8fa004

SHA512
3614c8a7c58003befeb858442cc2b452889614e6da6f59b3cc1f3a51c643adc3f70a7cb68ae7340e6bc66831570c5e0fadb3fe672861e45ae6a409c98ad39036

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
108KB

MD5
8217f555a30305961f983600b49fa676

SHA1
22842e67d868385d986c7285d97692d1b14f6c70

SHA256
111a84d80fc1155ff1c3eb7589de52d204b0c1977730f5d7a2d2e54a7e155bee

SHA512
7318b8ea33b1ca6a8808cef0f18da58cd55b6161e33133814335d044a00bd0086406591d93f5049514d0b9292f7e14940753f38667ca68c87680f2c09a4eeada

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
98KB

MD5
5ced93b845f658435b7884df7613211a

SHA1
d718b6c70cc326230b9e83d640fef8878c9969e3

SHA256
961604f856109569646cf7998864b3f3a4d0386d4f64d88431e7e7e219dad0b8

SHA512
12102ebf6431414e405f77e3cb85f3ff909cf82d249cb93e9549e0d1a9779ef33bc33a75f72e1cb684ca28ea2141b1354acf77760f8b6bcc41931a14d84d870a

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
101KB

MD5
47194e40dd7971f1be9db077a6e0ce12

SHA1
1e17cf5bb36c366d005971c0bf515683deed9137

SHA256
05a6e7c2d0980e79a0fe6c611e3103860c38a91f65ea0da1928bb0e5d07c6ccf

SHA512
9d229b8349e654f77ae3a023cd084e5dd1b96068cd681bbf746395b81c4c063ee3c944843ab499445526247ca8a7948850db1e65474e432f208713c1c02abab7

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
98KB

MD5
d1375a11d7236ae37ff540b428555a98

SHA1
c3fdbdb35ba8df6fc48716206c01c1d9cb542f4d

SHA256
b3f1128b18dff4ef9110fe1392164162e143c85c2e09093d646e7968504f48ac

SHA512
e425dcfd5a83c5510328256af331cf7afd5ca8af723af4390d4db94350f81b6d860d1bfa33320e01554277186f6ad18e5196c1d45ff4c4dba98ab0d825b42caa

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
100KB

MD5
821314a96e51c5c37db2ccc8f10f7c69

SHA1
490126ccce3c401af7f39ac0eb0c15c9143a2be9

SHA256
879b0e9738394d383b65f51da37ef13dd0e9f0bc91c8f158267e1d73eaaff66f

SHA512
e2ccf03e1d2afd0f761ac58a4afdb6f14e14c0d8c9ef29422e92b32eea3d04a8fb486a7258d9446a5dee60af3d757259801cc13eae724388cd194b9509072e1c

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
93KB

MD5
ed0aede6021e67b749355ea76ed651d1

SHA1
b49b97c3af909c16fc490f9eba73d6c704567b5e

SHA256
6f2db2071e60ae244cbc44a2543f03f82b8b42e69ab69902e1e781f3da992b19

SHA512
2531d2db9652f3d08c82c5414bf1fdc882c11232d2747debad14e9ea0bac343dc4123988c0a173f0a0bf57d3c34324649aad5c7afe36fa87194b358c70b0efd2

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
95KB

MD5
eab6d013efab8297b15b300f85b17d84

SHA1
60e8b82523005a3ff1d8d4d6f1ff96f39e081d30

SHA256
9a75c654a08079bf9b24d2ac25658a0822d579dfb80d81dd5971868324481ff8

SHA512
d5f0fdb5e87266b0e813cee6586530a81526d2b9639d71f8c1f22b7174d2f3210d97bc8577b4aad7a48245866c8d2f59bd19b74a695012842f5318b38e94e9ef

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
95KB

MD5
e9c3ef752c9575824218dc647484aeec

SHA1
30f0c7fa6a44c74e08d187df20cddb2a3d7a7fa2

SHA256
e2eec8c80d9bca8cdf8de2413adc2bfd5cd89fbc76363887364b041154988508

SHA512
0b041314df928e1215731d8d850674614304ec8f19e853033039af5cbc8b9cf2fdb697ee50dd9345324658fa646efef085e20e2674a97e06354d060fb4d570c2

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
99KB

MD5
a5e2950a5f3433100bb451663f8ae533

SHA1
a2d98a1154d05f4ce75dc67e32595e54f074396e

SHA256
f18f2d5d0a09d7f957548ce2c1b50d42751f83c12a764992d4013791fc3ffc8a

SHA512
3dbb81807bb7566f62da71b186229b32ffd4e3c8642f12960c7c4271297f2c6cd226afbc8d42dda7d2b3731910a270b973aef09a5e15ebd8c69159b2f2ef1d57

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
107KB

MD5
3e43bf9a39b4535e945077a8e443a46b

SHA1
d6c938ad20de098c768967fd345a2032a09fa27f

SHA256
200c5094c76e90ea7843c9d861e24b427d4934c814aa6ee247c515b90ab95e19

SHA512
3b986daedf0fdf0cd384a68e605291c92a5e1c8bee491b125c9b0e1ad96968e3750a173b1bd63c40cd351d0404fe91d86a1625b3690734fdef50191ff1994d8b

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
111KB

MD5
2e8b3e6465d52203f6dea91aeea53094

SHA1
cf6108acb3927e88d0bb7391f838cf143f425494

SHA256
fdfcd3a8785592693f120fdb3a3d3b491c6eb11bf19f072b2d95c9694636fd1d

SHA512
56cf5e4586a7ddb481be1576810ecaabb9d49480e6f40479a93561ff55b5c4085c02e0a3652c268d277d062e4d912347d95162825692b9b16e3ded28d6220827

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
101KB

MD5
4b7de32504d8a0d01a24b07aa995ed45

SHA1
2f52a92425afcf95b33c268e627ab568984860d1

SHA256
6d7e264091992b4653b3b3427706960465256bb90ebcfe415fc1990e533db446

SHA512
3ac889b46e245f040522bd01bd337192180d635f3b8c4bb1194f54f4bde74c05e1ef1460802133425996d31d47e8ef48e418766e5089d0fa90a4ec5b90c7e90a

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
103KB

MD5
54eac9c3c446f677cdb1843b85ee1c2b

SHA1
fa0a1aa2ba868a28d5769f6c491b371ea4791c4a

SHA256
59a636f84ea912ef53cd1b90989acb6756124505cfdd0d4fbc7841a5bb69aab6

SHA512
2f115d94f55c3dc5c6bd72acc41b310fa97e67fbb44427fb2e36370914ce5f1d24777c1308b663ec9968dd7d239bb42920f1bc8d867fb9a69c46b29fbc4b3da0

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
93KB

MD5
440f5032b7f1049fc2153bb5b9d1c8fb

SHA1
f9ea9c6b643aada7c68b8587b6a6b6ebd52375db

SHA256
2cb5191c72a896de69eb89712fde58bee32ffbfd86eae22dabb6ac06ed0270ee

SHA512
9a94dc05eec03275b5cc33d9cf264f17928f221c9eea54eab9aa599c9a38efd4fa501a6ab32577e5a66445a0bde3b33eaa5e582c941864384217a9236c8ebad8

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
102KB

MD5
170a6f2c41cf8f37fb96f63b82c520a8

SHA1
7954d875ccff1c5bf1aaab3553443e643fb02b5a

SHA256
7578d3d1dc27bdf8a69eb7cb6ea55a9975bd9d21f41d87de37265a62aa0e2ce6

SHA512
246b35597034fca04298ce87b60c13ae848797b34cc6190677e9dd63f50195acd04e8684d280927100344065c10801bbed37053688ab5b30e0974727c5e9f288

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
96KB

MD5
53a4195fa401f58c0e8ab88ec7372b39

SHA1
a38596cf5ac13aedefe5277b3d3322aa0cc4e217

SHA256
041fab49c2278f86978d89222eb3615b0e93dddf0db401b081f42ded8e32823a

SHA512
a4f2b57f992be9810980e613db48afe976c8086d2e217196a366e16b2cc58404cc64cdcc7f511f3ecda7265f993f57eec4aa348db7deedafd4d7e7bfa3aa884e

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
97KB

MD5
fbe1f0079a8b6cef8774e41d31b5b1a7

SHA1
6d57af1a1521c8b7cbce8ffb2c2e4121e1629168

SHA256
4be71003a7c4b55a3bf31b3a28f4014b16da00fc1039e3a7ac96edba81f0ebd9

SHA512
eeff23c6c06a0d58def2005a7394723b44a4f321e234797bf204a202ea4a4446be6b8032cd7d04dabdfde992de5cdd6119e4aa347aeaa8d73d92bb02706bddd4

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms.tmp

Filesize
99KB

MD5
230ef5dbfc7f2fcbf3caa4dc69f03608

SHA1
c4fa7c491c711fca9e7ddee1a1a175f1b09dd5c4

SHA256
248cd7a2c21c545dbb82d88eeefa40be3cc49e84773b0ec0ce716dbfba1207c6

SHA512
49178d0f9803113d42e98720e4284290639909beb4239ee8c985d73435263c7082ace0e31d9ab216ac5699b550e0f77d95ac4c02e229e3776fe289afae56c873

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Compile Script to .exe (x64).lnk.exe

Filesize
90KB

MD5
983a2ea2df185052e47954c3ed9a8768

SHA1
e975becca42d37bc26c9ba8ed0fd7c4ab379f048

SHA256
6d445195c9d1d96a16916791bffeb1279a65fe27cbe04b22af81317126a7c5e7

SHA512
9c0d4b59297f6688d70488aa602fa1223ed95cb5c732d4010442165ab9b9a8f73c7f365359b2688bdc593277f617516620b10d6ccf20c3d6f9f5a5e60ba25565

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
88KB

MD5
451a10f8603e9cfad6ebedc7b4f2ef27

SHA1
3014fa3eb18a93c44ff79d75531d1ecd8f397135

SHA256
6b7bcdcdb836b88b73ffb6395684000a0cf39db838d2508af77305b83db343e2

SHA512
cf579e19281c1b9e7a7a33ed7da9fc1658227617a623aa7a487984e17b48269c42ced57259b1b64a080e0a9b48bb91ee3c5f43ffc3dc36d103183c84262b3bce

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads