88f27c566e3e13984d3dfb84ad379bfa33819533ee13d6b6c0ab1f127ae9ae53

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88f27c566e3e13984d3dfb84ad379bfa33819533ee13d6b6c0ab1f127ae9ae53.exe
Size

198KB
MD5

817807e39c1bfedd8394d318c2478945
SHA1

5e4c7cc38bab29da5614071be7bca264d7804219
SHA256

88f27c566e3e13984d3dfb84ad379bfa33819533ee13d6b6c0ab1f127ae9ae53
SHA512

21110ef537def54bae9199592b48f1dbedb6da2e13047adea7320433754e4f07279b1698991502800e5a783e7bb966e483eb986c22ff57b04943fb6ec06cc1fe
SSDEEP

1536:W7ZQpApjIWe+eoO6O07ZQpApjIWe+eoO6O8:6QWpBe+eoO6O0QWpBe+eoO6O8

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4949) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2524	Zombie.exe
3932	_customizations.xml.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	88f27c566e3e13984d3dfb84ad379bfa33819533ee13d6b6c0ab1f127ae9ae53.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	88f27c566e3e13984d3dfb84ad379bfa33819533ee13d6b6c0ab1f127ae9ae53.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.ReaderWriter.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\UIAutomationTypes.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\sdxs.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.VisualBasic.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.Specialized.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VVIEWER.DLL.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\PresentationUI.resources.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Data.DataFeedClient.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemDrawing.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN095.XML.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICI.TTF.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\UIAutomationProvider.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-80.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-conio-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Json.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationUI.resources.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DBGHELP.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2524	2432	88f27c566e3e13984d3dfb84ad379bfa33819533ee13d6b6c0ab1f127ae9ae53.exe	84
PID 2432 wrote to memory of 2524	2432	88f27c566e3e13984d3dfb84ad379bfa33819533ee13d6b6c0ab1f127ae9ae53.exe	84
PID 2432 wrote to memory of 2524	2432	88f27c566e3e13984d3dfb84ad379bfa33819533ee13d6b6c0ab1f127ae9ae53.exe	84
PID 2432 wrote to memory of 3932	2432	88f27c566e3e13984d3dfb84ad379bfa33819533ee13d6b6c0ab1f127ae9ae53.exe	83
PID 2432 wrote to memory of 3932	2432	88f27c566e3e13984d3dfb84ad379bfa33819533ee13d6b6c0ab1f127ae9ae53.exe	83
PID 2432 wrote to memory of 3932	2432	88f27c566e3e13984d3dfb84ad379bfa33819533ee13d6b6c0ab1f127ae9ae53.exe	83

C:\Users\Admin\AppData\Local\Temp\88f27c566e3e13984d3dfb84ad379bfa33819533ee13d6b6c0ab1f127ae9ae53.exe
"C:\Users\Admin\AppData\Local\Temp\88f27c566e3e13984d3dfb84ad379bfa33819533ee13d6b6c0ab1f127ae9ae53.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Users\Admin\AppData\Local\Temp\_customizations.xml.exe
  "_customizations.xml.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3932
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-275798769-4264537674-1142822080-1000\desktop.ini.exe.tmp

Filesize
198KB

MD5
d91c84e7f9184113e1b1227e20d1a893

SHA1
594dd5d1b1c6b75680935ed7f9a43dfbe4dcc861

SHA256
a612b38ca4bc9ad2b51359e0b7998ff11a3789b4a6245cbbcdc4e90dc6caf2ad

SHA512
0bc2c2247f5fe7ee5c56f161736daa398f767e7570bcad950748015b4151126fbbc07b50fc91b78894eb2d61dc611edc08f23a086d39d6be9c273516285a4e36

Download Submit
C:\$Recycle.Bin\S-1-5-21-275798769-4264537674-1142822080-1000\desktop.ini.tmp

Filesize
97KB

MD5
4e170e093325222399061b34cea73a92

SHA1
ca90b67e88c1a73ca83d4306b1a812c66af06a7f

SHA256
9f13e9cff6e013c3a8ecdd76431d2b5a6abc02fb5c12149c3b2eb5f6df503521

SHA512
044689b007462749574886f94e5849a47bd15528fcf02e1a4f384c3403b9a0c6126af7b2845f23c4e1e216691a1d177b3fbc193e5345696508dcf6dd6f45eaf3

Download Submit
C:\DumpStack.log.tmp.exe

Filesize
105KB

MD5
a5f0e71ae61b1ec2a81ef6c34d6e6243

SHA1
d44c3de9e57da0ec63f2757857f4d82e922602be

SHA256
861f68c6c8f39253d91558c9018741b851495474925f284914d82d8af75a19a5

SHA512
e1d670891a0eab9bfba5449225e738654c2c286b6ac9e5f20bbcec20fb028cee9622c13fa8bf1a8c3b5695d52de34b04cc75e783efcb19ca5639c631d2bac96b

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
213KB

MD5
e670da490a278bbdf22955ba095d3714

SHA1
0eaa2973a20a8369097565c6f6b879bc4a8bc963

SHA256
77d14b375908443be073d5d279e210eb3b61daa5f4a4d599a7b85f80ca366e46

SHA512
5d583649b3419e0b66dd29eb5888f320633ca0419e5fef4c5dbc6bc75c5c8a89e0755a1dbc2c065f1e69564e24365a3860495834f274a80c9f964cdda292338f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
200KB

MD5
1fb22dbbfed2c649877f228993e4fba0

SHA1
37b19633c8ceb99356570d2e25e272f785326ff1

SHA256
22595667563adabf05a2f3b6324f60c664e26b0e7baee5131ed0d3efb28c1723

SHA512
c3325e4bd42cbc50e7334aa2bbaf0465aabca5c0c9556b00fe3b7cc63735552c9a5e33b73e369073950ef5ef99ed0999f705604779cf4b2d1584e19c63cc63ca

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
166KB

MD5
7dc881783a8cd901a0e0789bb868974d

SHA1
fa77d1fc2fe2c5ba7e74ead0c84962e8af785f27

SHA256
e9af36c70300fa5f3e2ecc6cdd3a76c14c96e4008a08b216aebe2d1990a18bb1

SHA512
96bb99750ea1adfe1f4fd4f3021b5d8321adffb8ad9e8808c4550548dcb87725d763f22fe72893c9b5314a4af3b7a259d3fb76f3bc8f60e385ba40d4a32ba5a3

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
2e7af990ff079878c8e2da3cd2b2b379

SHA1
bb86fa801342c751421f8cae0767e4b13297283c

SHA256
2456982aa9a30492f3c23a46ee9f74ab2f59c04bc1b46e119f86616c6a0fd8b6

SHA512
97c35e84f8075682123c0bb8db11fecdf62bc496eb296149b7c61cbcd74718288eb0215397739d3099d081e146a647fa717ea909a1df376cc00ff551eabb1cef

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
cce481090cea4bd92c63a81bf98b8b58

SHA1
7f68ff051ade7fb76cff8dfdd14a621605aaed72

SHA256
24fd97fe6866f4c13b1b4e23025afc9d0998a9205ab1f64f8fa82742b615d426

SHA512
bfdc91d91a6f4904cd3145fc7720e66911c45b5097d992fa584d1e4898ee134937c693fed449f37c4d22e9c3e37cb06d8b6d02321b3e8eeb633013f2bebf0ff9

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
781KB

MD5
b955107ebdf958d323327ad3e13e5810

SHA1
f3eb1334289d4c0ad50cc9f333132596e0e5a343

SHA256
6bc6c034cb722f5ed35d26ecc38bc4498574acbb610c9fcc21bb195814cef055

SHA512
f537940d3addfe2f80f75ffad13ee97ccbb1dabd597806693de5f4ee19e5765d2209115d5954efb126948e9f9520835e360b66c8a9ce214d1d02a11331ffde35

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
153KB

MD5
ed3c88fb7e77bc941030a7990297a0fa

SHA1
261188232146c2cd0576853d459997139b1f9881

SHA256
46444cdd39f4152c231a7b5936632517c10e92060fad90c136e348c41a109626

SHA512
13387eecf1e09a5830caa2809547d714e2f1d0796d21235beeb8bbab22c0d05713dd600a264bac3659bfcecb1929a7d17b3ce101420f144594ec8c3060eccad7

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
111KB

MD5
004f649d335ea2401a35339ed13db6e1

SHA1
aed735ca2ebf0e36140db2ae4ab1fef8c01fbeeb

SHA256
b4220a70e5c08c5af6de156934edf0683b2af74620793ee0c5fe8118affbdb80

SHA512
813059ce25e451bc40cb7c147d32d080e72b272b1ede2f5bfc583c25a5b341fef841c18bb14277aacecba96aa232c7ef67fb7d015e4b6559d9c2a0d05b00b5de

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
108KB

MD5
3c8792d0ab7eec43ebe08b12c5e4f03a

SHA1
84f313a2954ce7893a50efc3342a44994b3e1977

SHA256
a300d5f44888886390b862b7aafed50a26e048c6463b1cbe30026c4d51f6a2a3

SHA512
55af138d533b5f127b11c4ad5a9bcc8a5f1c24e746d3b4e015713cde850f1a33461c5497a77822b60aacce0ed6feee1b765a684cb4a42560633877806eec0e7d

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
110KB

MD5
9f927771cb6393c0913850ae481b9b9d

SHA1
b4059e88c2bee6614e9982a90de1188a1e361be8

SHA256
96c8c51f9dfc2ed19bd8c87a2ab72543b58019ed0aa87670730b37fb19ba6ff4

SHA512
8d488c5fa7fadcd839870570afc7aacd6df6d3b9fd30c10db701a5c9f98a99cdcc8b8a3f4b38fae8e2030ebf44c4dcfb5a5903b937fe74f1e716a942d8c9630e

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
109KB

MD5
d402218e783073074409bf7b69e07a38

SHA1
40e0294c93f2615322116bc236d98beec87ca688

SHA256
d134d41b5bd3392bc76be24806b3360bdfa809a661db5b55f62dffc57ad2bd69

SHA512
e5e05c6c7b6636a417fe75f5451ba0b11369debf913429a94d1d5f3aa74b3eb3eb3ee093e20499702cff32a39c18c4d75c557104b5ed538586d5c13adab6081a

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
111KB

MD5
a23ad8a3f191737b4091b3156d77528a

SHA1
a3b51954b53f7baa6959d3e86b2cd6ff4de5611e

SHA256
97d92ad75d6838db7b4089eab4cbca09b2f7562ec13372360f14912fa9f320c6

SHA512
99fe19e2a2b13d0fcc09473a75d9080e595f6d503f73df639a996061d440b31e66f6d2b392ff28f770a26c07da20c51c88790f0ffbb9fe28e57bab3b4678a758

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
102KB

MD5
ca6e9536ec0431bc509e1e30e4957b69

SHA1
aad921824de77929f377fcc51247a460e99d978d

SHA256
f38a901ca5282221a481b8cee5dd30b31a4006cf108f22d7818cf1ffc2300507

SHA512
4881d5817492bc587797a28febb139f91a23ce8c7787fe9529fb794055e19110cadc1536d6980a2b4120b798de3fe9878bcf49cd77178b69ac9faccdf7ce7c32

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
111KB

MD5
ff3704d3459503fcf96aef3ccace2903

SHA1
7c5cee50d1e56dc2a242d8f7a4ef45bf4ee21faa

SHA256
06126e1fee7b1b3d3e4d68ed8eb3ee8fbde6ff620da6d345bd691c907220f8a9

SHA512
b4f35336b28717f3ac29709238c6cab62e0e6f1f2c7cd61729b978f5ac5de440f1ceab5469d5dd81c616b556ec69f30becf897044054fdcdbeba8f8eb45eead9

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
110KB

MD5
449c3d793952260c210e8869bfc99127

SHA1
bf9308323c63114ebbb78362c73658834559e60b

SHA256
7bdfa5cf2fa08a1d2886898b633f49510e910bfc207f2e408e73d55820036b95

SHA512
2045ef416d8e38a4bd8173eed527f5da46663caaf179c34f57ba5529ad9370bd036d12ed3867980d5374d08e5d825eac759939ae1f9cca49438d3da8056d1349

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
106KB

MD5
c80e4f30943c76b0a08ecaa8bb293174

SHA1
fdb6f1f6dc10a20c6ce266615de3d6852bd61f44

SHA256
d418012982e609371345a3cca6c2b91dbbf1ef2bc44287034c88ecbf162d1b02

SHA512
f707a92840d9bb62b610ed8c66779fe046c144ba5cfaa35d60e5493b793089ac04777d1d166079c5172578c179d12f5d9290df44015110ce7786f8526fd753b5

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
105KB

MD5
26d69a1b1f225217456885467a90cddc

SHA1
d102855c82585d325bb5f4a58cae695cbb027554

SHA256
c91153e785852b3988c336eff80555564fcb0fe2829fc063de56d1c433a135bb

SHA512
f47f160edbb5be4b71a15e09e959599375a2e02a05ffbb2349a946a284983778dcc046de8d3714fb46480e87c172221181796939ba68c94aa8e63ceee75c2f5a

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
106KB

MD5
403b369dd370957c0bc0cdc53e98280d

SHA1
b06efd388669789d39bee7e4a59497f92e368fac

SHA256
836fad83a538e6e20d93cb37ce7cdcad95231f4acf35ad59c08e9638737018e9

SHA512
f4f360aa0e2072fb59f42eb57ebf18c2cb0ee54d18a1bd1b750ce719ce654ffc547b51ea1d8764005447a45bad39db439b72fcf898fa14bd6b35cfd330a987d3

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
117KB

MD5
9014d0e1321fd6460e210024f90be091

SHA1
59e4b2df2d13e66ff48ae13e78b7bfe44d9f3fb4

SHA256
7ec0759a7d2de60d0bdae79a24ed5bfd2c0043600ea25254f010212f41042153

SHA512
83b60e54347b1e206a9062b9b6e372c5e71a8b69ed30e2ff31a1aaa63876c1f0fa507385b9a922e2c8645ae97e74a99fd5b3e6e8c5353440803719cbce1c625a

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
104KB

MD5
e099f2b962f08c5bd47a93355cc93eb8

SHA1
500d179b11566003543cdad04d9691392c505550

SHA256
35b285c8c82d117f58b87052ee56312c594eb1f83ae82f3c662e296de53b99b2

SHA512
178ebea12af0dbd087a9e6ea2ee475035bf844b15e2d3c7baa3ee89e4fd61dadefb752a35cc2c64bb85b546b7332ae11320e15e478cfdc819a459e7d371de7b2

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
102KB

MD5
b0aaa62f092c2c54beded37b5df1b3e3

SHA1
f64cf76d9b7cbdd27f5d966c05e9ab15d3612cfe

SHA256
85bf513d0bb6244004873796aa56c59c4c53e8da2bff74b6afdb6b01e7c2052d

SHA512
a29fc8bc81e229f5d3239353e3764955dac7529e16f446ba1877afa5a7356b57cfd2b3faf3eddd8375b89d2d84c0590277ca9f92d49751e1bbab85676418b3e2

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
106KB

MD5
9229158597efbe8c432bcb35d39266dc

SHA1
6d218603c1cbbb78b7a436b17082cf226efc1b60

SHA256
90d1201cbb92fac55b679ae41e2c8a38fdcc4f2aa82212eb809d0f8bd725cbcb

SHA512
383b0d3bda599251fff4e31ade719eacd0d93d5572a7b7b93f9912c84aedc50db9d090bcdb47ed7f90193235c04b17a45c32ff50168e230783bfa4f0e51bcbf3

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
103KB

MD5
46ff733f19a8e31bf5310e09dd005390

SHA1
5a48d19fce6156dc00d23b5c4b2add75a20cb4a9

SHA256
f0d02cbd61b548f76c1c60fa899551db104bffc988a9304b15b1d6e6730614ea

SHA512
0ad42a109a4f9c387f73197ca70b81d90c0f69c14bdc6db730de493c71c63a4fc57139e60da67f05d2a9e6f9b2df2b2141aebfcbd88fd63078ace32de6bea57e

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
105KB

MD5
562a308b59391fa87e92245abb98a5e0

SHA1
be821be410ff5a889e73a5114b4adb70abc44123

SHA256
59b1c73e9d37d10652491f09ae319a8f79f1403dbd414abe2d02bd9414f4052c

SHA512
c8e1f918830b296c4c6afc64b0a0b382e66d0c53ba96bfb879f3218adc4a0ea1bf7e286c43b427e037be7e104b8944b5157640b5c1d9ed0e07a5c925d256e88b

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
110KB

MD5
718086c1e077f26a1608558befd74a92

SHA1
22558cffffc25180cf956fd4422bf8379d6cbce1

SHA256
67d23df3effef8173b8bd7511db8b67f181e714a1cf96d511097ae8b2c73f394

SHA512
e13965124fe5ff2cc0eadc5278d848b9a5251c45e034934ab51d2b2b191438250ebd8bca867c6d78abeb387aee78a529dac727998f402db637a183ec2999ae58

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
110KB

MD5
b2bff2be27eb7899829066040793a69f

SHA1
b22069db2addf96da38f065ecb9bce1b155eb393

SHA256
b8b3a4056fd87168e6530e08c52591a60658789c5a336d7433525486950365d0

SHA512
a44c2da9786f527c6421ee636ba005e429512648cfdb2667496f9b272e25374e7959c37dc10a6771750b50269922da5a4f6cbd801892ca5f8dac33123044ed0a

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
110KB

MD5
8d2c9d5f8b95e8bd02772d080e8c78a6

SHA1
c89e6cddbac2c3773c4fbb1be67c82205ff5f702

SHA256
4dcbc8acb07fcffd2d6423540a29d9bab17c6e7cbb73bc96158a62f3f8f2c07d

SHA512
db042dcde90f158791718397cc666b1853d533229b27bde4b59c208da5ccb0a496349bd4ae2b914a0fd79145406ea1ca665294c7284a0bdda14f0bd52a26da3b

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
108KB

MD5
e8d94213412a54df19cb1cd820b71eff

SHA1
dfa0e558de67dc32f46798df6ab86382bcfd2b9d

SHA256
baafed6df89ccd702b0ed8267e46cb9fe842fd6ab25a76d87a75938afe54782d

SHA512
97469230956e98d97362aea0586aa12719d90e10229065838c00ca135dc779a3443aca0ba3361097366f3bbafd022ed14a146c979ab28ed89d5fe99cfd33b2bb

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
107KB

MD5
9564a03527bbc2c16f8b2595388fb54a

SHA1
a9f2c24702fd27f845ef4676dbb2676aaaa74f86

SHA256
6f7ca3c8c2692d43eea5948e6989250b4fe2787d3b526cb114e323d003473ee1

SHA512
9463527384bda035ffb29d742ecdab8997bfedcaa130a13a298b51f8eddc849ad1c945dae293c244f4bb911ed4f3ddec629e45b0279454c955eea02cebcc2166

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
109KB

MD5
55763e3ec85a84776cd39a3b9cf69e02

SHA1
6d62abb62841eb13b293a53cbff11dcccba5faf9

SHA256
f23476c6d1d9322a7441980a1ce2daaac38ed5076f9d98d4cb16c09254b9c66f

SHA512
8551a691246d8e751e4d23fedbb642d0577a56c1d5d75abd75106916a6d9740e5ccb1def649e5839c58abd8786b59162654d6fdab72a8ffb79d670902d091b96

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
110KB

MD5
374f4cf1325d1917223a2dca8d8292a1

SHA1
385b5c57b67d768521cbfd2d6515e9fc9a9bab99

SHA256
f9fab20ca2eaf62d44eed85cd705e6cdc590013a228f960ad1db52f2e40347bc

SHA512
eff4ae4009224fd2834e7ef7263ae7abd9a767df6fdb64f5dcc30741f5588a501fd1ec62d0d110f4d50eebe16e3657cc2e868dd704df79940c2ad5766770c597

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
118KB

MD5
c9cef663959be60918752148edc4b444

SHA1
8383a50e9784fcb38a58f208a902c02db890a9c2

SHA256
5f686d875bdfc50aa85e51ca0a7d22968f336b00e076d0844d26372dc56b5801

SHA512
f68051f2003178c0e90f5ea6724b75804d0a06cf10ba44ee98b579ec4845c3b2ae9153d94c34dbb25abd2950517ff1b35a325aedefbdc7e43f72b567621cef5a

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
105KB

MD5
059da70e0c06b3adafc101f7ee5071b3

SHA1
e087f9e03660362705791edd5e66a210a027d680

SHA256
7bfd62df40dc7f45d31ae09aa1ecaf4bbd06782e1408f56e97983311b08e544c

SHA512
e9e871aa2904c4c9035dc9919440993aa38c8458542cd613d9e01a4827bf54a7be2b065d8df662aafe7de3d4223d3bd20f65853d0df5ad58a115ec8c12342f4e

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
105KB

MD5
d47c7cf1c608a2774a7fc7a6d81abe3b

SHA1
803861bcea1f5075e2cf01395033412dfaceb92b

SHA256
9d48be63d7fb5fc254e4e8f62b8cafccba17b345a1315697b261a1f6ee724356

SHA512
0fe8e1d98b12e35ec86a5da8510daea819e27a793a4a6b3193640cb0e47940795b7a76d9a69279e3301c786152b7c3d3e6af876ae0f226ed6331ff8aea684727

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
111KB

MD5
e61e55a3eac98d8c128ddc35da96c269

SHA1
bc6631420dfc2af2e5154469212b08dc961cb11e

SHA256
a6a52c4bac20b9ae6ff5a67b2548421097c4fe2c24496a10fa05e7e915c31fb2

SHA512
99a3646358d4fb0d9d499e62646a3900d707fa5eed248707cbef0f940c6b9615ed1bb49e029f6501fb343f5a5922382d9675d6fcc6134936308c992261c879cc

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
109KB

MD5
8c744e6988e6f60006ac2f423c86789c

SHA1
471a44fa1609161fedd208df7531d200d0d8feac

SHA256
116418f2222dc40584d582c035e952997bd8f0318505cd30df19e56c9de9edc6

SHA512
1f99aea8797f307a92bbd148cd8c2668b51c96bc53353ea8117a066b63b82da33144d4f794f586151ccf61cfb0c24dfdc683615671f4849929087a62f0f1509f

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
106KB

MD5
b5a3440320b008470578451209eacabc

SHA1
586baafc000f19236ede1a2497261368c9aa3223

SHA256
19da76992ed0cad565a51f8b057e75f05dde24073fc2a069c1f3fa639bbb1cd1

SHA512
70c207c5fb0f2a8ef0a3277836c270a31c0b50a358d06f3e2625ec2dd271de9087c58a6deff3b02b26d9310fdeaf8b2a0b89ce69aac7b6fdc56118a55174411a

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
108KB

MD5
d0508d3b0824f0ca4a2483f69a3b3f81

SHA1
a6472bbeca8854b6af334b5f6162ea06453d5c32

SHA256
cad7a05ccd8c6cddb9d1ad333720b8b739cae6205d15ac2bbd85c8af920ad412

SHA512
b0d1ebd9eddf42a5d4341f3bd94dd188cbeac17b9616d9a94b2cd099ea033d8c6c0ca8e69d84e92c55d1133a5841eab21b7792253fb4226290daa80ee95923c8

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
114KB

MD5
c370576d0d85f91bc2c55a6bef21ef65

SHA1
8d785912b27ed6431234bc4cbf8c1693a7737708

SHA256
667ed375f8c6b2017b733ee996166106abfefbe0f77c56f4f60516497a615abb

SHA512
12d133654063c1d0c4060bcba25914a48340c4b8c6bfcf450e20bb3678fe382d8a5b9b70474e3c4b3dbe738c0a4892c33f49e1d2b9339f082d2e4770b587f095

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
104KB

MD5
e1bf1e1fbacdcc3baa2fc6ab3cfc7c5d

SHA1
3a6ab1f4440e5e6e007a648f56a3fb3e27de6c37

SHA256
c483b1d1852d8edd9bddf0dbf4d362612298bb4c2ce28427bba2da2abab9c127

SHA512
9d517697fc48c32f76ef9d03f48888452523bb9c5c403b3bb071e5093365613f711555d6f86e469558c34f6eb8c1dbd14aba802e22592dafdcc9d6f44c9772b5

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
105KB

MD5
741ee3f5c67bae85fa34c259f00884c5

SHA1
3c2bd519a592d9ac3642efecc31535429b148dab

SHA256
9662c14377e47244cde0827befb1e82a18368ff62b593cc01f7263e8138213ce

SHA512
7ddef56b5a791592cca461bed68d9cd0fd1f532ba5814960a232183bdab0d3627f6acb202a81671ca0f51e491d6131e0cf4c11aab114c70d267b586c1f28c49c

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
107KB

MD5
6d5de18b5eb7521735bdf897b7a99663

SHA1
6543cb83c3c431db4f96ebffa4c88f25e30d7f18

SHA256
dad42951f925163b7fe065feea371269a42059fce09a80941b1ffa3809f0e522

SHA512
f275ab9271dd40e59ce9c595360f00f97064fcaf9392e76c92bcffe793ad2479aaea541f7c3eb0e0fa5daed60aef48ed08b3c13a9d6f0fefe1ddb6a6f46ddbaf

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
109KB

MD5
85fa51de54d91552235a92623314fc4a

SHA1
d55e18827858fc936cea7384bba2ee02b6e8f3a6

SHA256
85d7b7c82702e2607e9eb17532567d4c3938209c3f3bc35bbcecc2cc64bac03b

SHA512
6fe4ca669823eb5c54c9d377114027f2a18bc4e9ad2f57a6711d8c8896ae30160184267cbff9d907662bca62f44f13962f1dc8fceb6a000e325dda3e9aa2c776

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
109KB

MD5
2c9a5d71e985c53a674655076fae32bc

SHA1
719f915885ecb5ae8547138f692681eeb274897b

SHA256
6af72ba4b16a49b6efda86d5729cd50083cdf38581dc3ff9404d21ae43d107c6

SHA512
c7957d6e6d0137e5183392f49193778673c2622650ee2d6f80724e9d46a4355ad76dbaad68394f884c4c0c83d04d7c52f584696f2c2143a00253dad4c4379c52

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
106KB

MD5
e34f5d24006717645ceb4188b75fdf8e

SHA1
fbbfd23c5dcb7ceece7175a870a25d7e01f43445

SHA256
c1558470689cf182dc97b7ca1b5b1c5003142191a88e238b2ad7017bc523a7a3

SHA512
d0b7f090245c779be117c89ca561561826c8cceed78136214a48caef5a5a0a7eaf541bafaa947fae70b309666cf46be567408c62a4784554a1b4e19310cde88f

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
102KB

MD5
a2fb49c3b2635cb16ad19581df960b3a

SHA1
593cbbfb8de7f03a9d1ebca9e84db6eff5806a8c

SHA256
e893affa282710395eeda21e510d499bb455136fd8ee63a8617e606bbed95488

SHA512
38978281a3c30994421bc8ca9cd2b7a49d7aed7ce680b55fdf90bc63321fde3573301622190b803b796e4394b77fa703c930e1f17689ecadc1d5fab8318af4bb

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
105KB

MD5
615ce5e88400cae36a3badbc25deb309

SHA1
1e96ad5d155a32241b8bd5abacf2bb23403b1992

SHA256
04fcc87f1309c3c42a9c7ecb1a9d0b46e952a76b1203a1e5f55d0559ad456bc6

SHA512
2cc7ffd6c2de4c33789d581f04a41d842844ce36538eafc8646151f1c8a47938c11e6887ee0b2840405e8dbe92b68ceb7eec07b3e2e48e1810f028044ca53dbf

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
105KB

MD5
c33b8d44745e9265848aa0f6e9742722

SHA1
53c916bea6abc5acff83917cc678b115f39e1952

SHA256
b4d03b3816624bc15494895ea559a763db1b1c699b83261cd191710dfb51d9cc

SHA512
6ab0a2a7f90b8ad5068a6a2f7be62117acff24953629971be7dac36cce3349ed0570036b7bbdc9ba0a09d52d7aa325a1361816666f94a0389a5160fa0d01914f

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
116KB

MD5
33b793f3e11fafa418e45298c5b9b656

SHA1
2319eac94c7d7d66a3b87e93cd2fdcbce7286b1d

SHA256
992d70eb0fd56602b018424345b94b0f1d7029e7ec89e1f768a35cc064167f23

SHA512
e89b46bfd61d7f7bf5604e79fad6ddbb49c528855c773fd22fba5be3dbdfe9df2a956529c8f53044d0a4f067c719dfd97e276f7d6f5bc4747859028ceb972dd1

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
122KB

MD5
0573c96a6b336af88ee5631e1d4e52b1

SHA1
651b3ce10aaf734305b8adf35d28e3eb90e1fc5f

SHA256
7c5d756cec8cca29db64a7904401f1e8da4807b9841ed366b19864ce4a592e45

SHA512
9829422a7b32ab3798d390b0f1f7f5c9d4c50b478f1e0f2ab414569834697d22cc956b1e30de11f371077d19c6f43b46b8b5ff218406565a963a381edccd50f0

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
107KB

MD5
7610a3cd6c98670ec37e9c0a5968916a

SHA1
c7f6486087bcaf891fecc094ed55b99c5e706337

SHA256
08326c9a7e2e1a9868fb29769500cd49520a6b4c61533b110d5054caa031e57a

SHA512
facb124f02449c316f86306eae762a226bc2441de4a592213077d3ca1f4350ec8597af2b1c4f8e28f379fa8d8a5511cd1b92f7a4a8c9019283e6875ce42f3595

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp

Filesize
107KB

MD5
efc54b11541db03a9c28240782ed35dc

SHA1
4b4b6ce53592c0fec122bcea3615efc17b82a11c

SHA256
b49b6cb2e0ccc50b6f0bd5a68e2c8e993b2d6fb918d89054763a1d5533450883

SHA512
1b25cea0e67d5beaf04605041d5ba375db247f835c0772c30c98a4b0b3c80a0a2283a29a40db876fad98ce121dfefbada8d90af0fe9b6dc5e500c6def89183af

Download Submit
C:\Users\Admin\AppData\Local\Temp\_customizations.xml.exe

Filesize
101KB

MD5
12865d2fbc5da9fcede3b8baf226d665

SHA1
3cc6ce49b6778aa090b2fe64e919f1a2e7677fb7

SHA256
2c0779d5735108c115fccf004f4097f02ff7659e80d85586f7ebb4f326e59c99

SHA512
6c962191c19a99aead43342a65c5ce464c81934679c1fb4245609c171974b96d937a015a147f0463b3f8c1110b21d9b1ef1eb9eccf7a89d2bf97b397fedfbdcf

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
96KB

MD5
9f4cec1468c8efe362eb851b63207955

SHA1
c4310bb223dca292cbad876a709f77dc7e1f0b08

SHA256
267a47409baa7ee24cc30e5e0a9b9d9b5f51613c146a25290c7a686557f2b20e

SHA512
9cfd0113fad6f283ff79d7fde3d105e19dfd6ed8528599287a39317203f3ca1c86613eb065142760eb3bac398613e4b609d0cd4a86b3f8e035239cc8aa71ae0e

Download Submit
C:\odt\config.xml.exe

Filesize
98KB

MD5
0f18df8f01745821bec35135916176d6

SHA1
fe9ec24dea2ae30fa624fabc0c4fc5b867f6f4b6

SHA256
e322760ae7a754b2e80ab0ff022f50eab1429861473ede02f93c242d13e339d7

SHA512
cd73e6a8133135ccbb35a4e877630cf9c84966853a6ea8f3de78f962e9db0dee8db612e743f708855a61fd35b8398c7b94313d206f256e53f06f97a846945be9

Download Submit
C:\odt\office2016setup.exe.tmp

Filesize
2.7MB

MD5
9af8dd6350fa29dc29a2261609628155

SHA1
9eb27875e1518467de292834c1ade77b6eb0378c

SHA256
fa32c666640293e5193cc80fc278b9cbb68810f92f99b05b2073904740514182

SHA512
a611e780347d76f5d55710fbc39ef467e06c229fc8649adcf18c881fccf3c51eaeb8c763b5157c48b9cc86b19f49e711817fbab0f635bb409fcd56caaea77ff7

Download Submit
C:\odt\office2016setup.exe.tmp

Filesize
5.1MB

MD5
160b2071d0cb19fd21179f3a73d84aec

SHA1
05c404259f826742dde55f0cf392bf1d23b1877f

SHA256
24002e186567d506f2ce01846379ca6691a3eba169cbd2e18df4620199169440

SHA512
ffff4910d4a4d45a89b38c8946d924cb632f69369e53f44d5b95c7e98d0f437b538d9edf64329342f52b0cffc3f54a3695b698d2cb8b3aa9d96c1beddbfd6510

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads