f7ec66c23e539348f43f754a919a1056feb0b9c061ec5b061905796168c93deb

Analysis

max time kernel
149s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7ec66c23e539348f43f754a919a1056feb0b9c061ec5b061905796168c93deb.exe
Size

125KB
MD5

6de8bddd510a7f70dd668570edaa4ec3
SHA1

b2262b01824f6b32d2df30ac6fef186082cce53c
SHA256

f7ec66c23e539348f43f754a919a1056feb0b9c061ec5b061905796168c93deb
SHA512

a00caaddfd0ab06c0fe786fafc2a9fc9263ecb4de1236a36f7e141f65bc69c6a738d82c11bc7ada251fdf9ec7dcea33789068c8db58fd6363619dea22c51308f
SSDEEP

1536:W7ZNLpApCZuvIYXxJ75sNpJJ75sNpyPIXxX37ZNLpApCZuvIYXxJ75sNpJJ75sNQ:6NLWpCZLYFXxX1NLWpCZLYFXxXc

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5061) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1320	Zombie.exe
4336	_customizations.xml.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	f7ec66c23e539348f43f754a919a1056feb0b9c061ec5b061905796168c93deb.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	f7ec66c23e539348f43f754a919a1056feb0b9c061ec5b061905796168c93deb.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Requests.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.exe.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\zlibwapi.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\amazonredshiftodbc_sb64.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClientSideProviders.resources.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Thread.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Writer.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\et.pak.tmp	_customizations.xml.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp	_customizations.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\he.pak.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL.tmp	_customizations.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHSAPIFE.DLL.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp	_customizations.xml.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	_customizations.xml.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1320	2228	f7ec66c23e539348f43f754a919a1056feb0b9c061ec5b061905796168c93deb.exe	85
PID 2228 wrote to memory of 1320	2228	f7ec66c23e539348f43f754a919a1056feb0b9c061ec5b061905796168c93deb.exe	85
PID 2228 wrote to memory of 1320	2228	f7ec66c23e539348f43f754a919a1056feb0b9c061ec5b061905796168c93deb.exe	85
PID 2228 wrote to memory of 4336	2228	f7ec66c23e539348f43f754a919a1056feb0b9c061ec5b061905796168c93deb.exe	84
PID 2228 wrote to memory of 4336	2228	f7ec66c23e539348f43f754a919a1056feb0b9c061ec5b061905796168c93deb.exe	84
PID 2228 wrote to memory of 4336	2228	f7ec66c23e539348f43f754a919a1056feb0b9c061ec5b061905796168c93deb.exe	84

C:\Users\Admin\AppData\Local\Temp\f7ec66c23e539348f43f754a919a1056feb0b9c061ec5b061905796168c93deb.exe
"C:\Users\Admin\AppData\Local\Temp\f7ec66c23e539348f43f754a919a1056feb0b9c061ec5b061905796168c93deb.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\_customizations.xml.exe
  "_customizations.xml.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4336
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1705699165-553239100-4129523827-1000\desktop.ini.tmp

Filesize
58KB

MD5
478b1bd3720ebd1c5b33ba296cbc68cc

SHA1
200995023516bbd02de9ee69d8c188339d6fbd6e

SHA256
b854945d35dbb3977cf05dc0f67bf7b54b64af5ab0b35778e2b0bf0a5e16fee7

SHA512
20939ea9b08ed42a9e8a25b772351b181b0c2c36a130a70fe195697961dadef89dc38d3579e446a78066f91cdc2a6c1b179f97e46b551afd27813d6a57e2b059

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
171KB

MD5
bcc7defab05d01a85a7c1587201c3fd6

SHA1
a8fcb4a8fb2ea6bf2fee7f370c19c8b318a4ec02

SHA256
f9001784a23e3a6f692c0cdbc084200b2f47b9199cddf28c2ff71a343853dc55

SHA512
2f5fb6fffe36545517d80346069c2ff82a62b8bda7bb254e0a441b699a7f3bcbee501a26df3b8c1c5f10df288c7ae720df52b6ced651b18e63a8861cc51848c6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
157KB

MD5
04ba9faac3acaa39328a1762b56bfdce

SHA1
8d5b834d6b1331ece2b6424dc618ac0489123e28

SHA256
a66dd2b1ba0540e14de879bbb3626fc9f1b8916fbf14437eaabee2be96ce7a90

SHA512
ab12748e6fcb3ea890dc4d6cef09d3c382a04496e405ff9b9bddbeeef31149f378d78436a1be6db9edbbb9c394ecb219f96229022f75ba1a553e32f7fdad1afa

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
132KB

MD5
9bb16c030ddcbb6635c0251ee9c347a8

SHA1
87bb7a7b824b7830a5e67e3d562fbf0e01367ae1

SHA256
0cd78e8f1dd3569c53003a6a2c15b3a1640b336846eabdd6e9d800b881ba8baa

SHA512
50adef3b0123bcbf60509a2dc141edc8e42765809b369bb072f42bcd1bb9e39fc9e9c928aa9fcd0732cca433604ad6d33abc116177e4471168de083cd3b98daa

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
0a33f101b20dc8bda1506d8e4e6f8ee3

SHA1
8b892fc49c0f33124e7fc2a83a31493147d2ef0d

SHA256
39ff166365c86911a77f816c65e2432d742f734411937a810e8752e1f8454f1c

SHA512
228a9ea1ce07353210314fb222772df6a351fb730fe85a8b9cbd289c01bd3be33106b5bdaf6b42b2716f63ab0ffa1ff62b67689153a191df08cdf6c9e52d9db8

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
bd6546685599d7bd1d284261cabc32a0

SHA1
05d79065b8e241030ea99df615391c87f0650ca4

SHA256
8b5b2a109af32aa356e9255d0ecf328d318279567c7fd5225ce291d354f9ac37

SHA512
bfe6691aa0b8acea899f7db4a2ea03aeb440dbdb0908a613ec9c177803af6b54959bf3857bd0c2469dfb11c84cfa4e5c4902293057b3ab784efc1ae34fcd1557

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
611KB

MD5
8f8d1930ca09adfd9f3e82b15f1567bd

SHA1
a794bd92f9f46662c23ac5f84d3c3f6714cc1a59

SHA256
775515b6a5c6e3a1bbae8fc5a0a1f843139ae4f32fe95ba65d0716048b72f75d

SHA512
487914ddd1e2dd7f6ef778ca2cfbc9f68d0f3c413637b43374b5f2815e314013517eaea77c919bb246d35c353cc217fc057bb768cf094f23503592f56a580f88

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
997KB

MD5
9e7070b2456d9dc660bd1f4079c673dc

SHA1
d7f96cfe277323f3dff307f98960d4f1c3cb13c6

SHA256
71939c6450546c094e342db2809401e236556a7d3dd4a162d04c00b2d06cce5d

SHA512
4f4a7ecd23f602f79fee7e3a6284b5508c89677289d00c8309262ef6f40cd9dee5c40945193c2de67ce855cee9eb7ce9c9cf221573f2c1b3a235605f79ccb279

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
751KB

MD5
b51283dbe3e8c6002f5cf7c8d232a57b

SHA1
c6c062a2cd63ecf13c1d49bc9c9f2351c4265d70

SHA256
7dc42aa9afc77219e2c72521ef668a32bd6df8ede2f1c78f7cad6dcba6955738

SHA512
d51ae55d773ad81d5a0623915c77a6b95f6a217f9ef44f2860104ffc21cbbb051c83b940d637708f56ee923a9a58161787c16cebc5b2de65dcd4bb31a9cef472

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
115KB

MD5
078f06d41d6f87ab8d73f1531ab3d430

SHA1
caed6056f280cdb951187a885d9d4d7b3125f1e6

SHA256
855734aef287771abe5a7d6543abf6a5c014a9150c9e84f1ce5e269538c3f258

SHA512
bc9b7c9b1aaa532d7ff4b2bd0a6a72790ea848cba5b66f0c99905a6e85d1903f50b19caed1f6bf9098a5f9438768455ede4bc8c2ce9952a90b073c238093ded0

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
68KB

MD5
055da83a9e0f61825c6d1fc87edd4b93

SHA1
8c0bc06c566950fc776fbad86564aaed794e5833

SHA256
383f22783cae34030e4424063297fbaf4f7579d31d1ec21ad21d7a470b998818

SHA512
b61ec11ff09b77448c8e8b7c54bb27985fce578dd96d5a46c886c2abb782250f1b92803246fe431dff4d6dcce18dad2c0005536c922be32266979eecef1da923

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
66KB

MD5
7e9e1fe3601acf5fbea3a5b3c604040e

SHA1
b77b133dc76357da9f3b70e7aa4e492116da611f

SHA256
a263c7cf5f82126c26f23583b2dea31e72143964d0e7510f191a455ec69c9a92

SHA512
d34f85a3963d5828a440954485d9ebe9e4cda246cf40b664f3bf2e9737d861222e906d0bdf19750046f4dbaf8f453346747dcf478ccf787993d5b6ec1cf344b9

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.exe

Filesize
71KB

MD5
9a4d432574a214fce36f7bae6541954e

SHA1
6e1577da638c2d90f17aa02fdb6dd8d4063f5ab8

SHA256
7dfbc2100151383e5efcf014d87ba3cfa57131e542452426d07fb22a456858f5

SHA512
3a1db1ffe2d7b551be224ab8614adc011e72b719ca43725b8b64477b88be4dc1b5f999a1c6061661e2959f678242016eb06dc5fa5db040b094e957f314f7279b

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
67KB

MD5
58d572cb3e0a9b01bd1eebf4f4d0a724

SHA1
5b19ec11e36a72db6d751faa8f09e95a54eb8954

SHA256
b4f48428d8f4288b9b8eb96ff8582a5d48653fc4fe2add212fbb47d0ca81f319

SHA512
92613b81e48b21e73e767427a18951f56be384e75cede7b49e94971ce79cebcd6b89b8ffcbc42158a6cea373969fda84d4e5204a434f64ca4faeb98621cb2cba

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
67KB

MD5
5bc55cb7c1ca63fa7795ba139c313404

SHA1
db2e927f1859b8d762e236d6ce9cacfbf994774e

SHA256
1a777daaa4e1e17dfc7584341f6afc44017326f735c3bfc23d1514144b18007f

SHA512
92350c50aa5f667fb07ba305bde6860a61d2d358f6f3bf3ad21166ab1f2567a83d1dbc96b49fca3ae3efa22605436b0518ab056da2ede1a1d8d374bb1affce3a

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
67KB

MD5
72112c98541edcf64c81d20f0e415d7b

SHA1
de0ef20c5bce3eb47a48239d858407e05741f80a

SHA256
69e3e80d3409c20be04f22257d3029e2dddc03b58515c1468c4e07d4de8e2c8b

SHA512
d5a0d02bf00177b480cf8894adfb39c71feb704a7f8be90a933bd96c24659f6787104d2aca81833c0845b8093204c6dea9c43994824617c67d9449b79fe4c4c8

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
67KB

MD5
0df2e4bd11395eae6afa0e68cacf3e6f

SHA1
121e35fcfaad20544b2fcd649db2c81585cfd413

SHA256
dbfc90965c44be228c77b1236a4a94e5a6d36274648e95545ad904151f3da0f5

SHA512
681acc924a8244ac0357a30f496a6f84ae3cf451ece1c98ae299a4d77532c4d738745c6419d8a251a80909745a0e85f3082f9dcb70c13a42d3800e9fe3205695

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
67KB

MD5
8950b4698af455fe3afb37523c475a48

SHA1
c23f8f12c73683f52b31dac6932045a35000d36b

SHA256
e37611ee43b61db843f865e1aa45a249d74d62a25b4820ad6e35f5147cb4c8df

SHA512
ba78444dd44c9322ee4151e501c2f15ad60e139298727f1f1edd0c480cb6e74457ed2aa99a8265ff4b78beb7e48d8a06df787735a5ab53bfb243666878583a9a

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
75KB

MD5
85b805a9f7f96fad22071999bcefac05

SHA1
2705e20b01308b38eae339fc1165df1d6ca14308

SHA256
21bb158ecdbe8e558ffe60bb10f7cf9e0ace5dffedb31a13be44629e957ebbe4

SHA512
a173c51443aa93dd0dcf4f075fcf43a8da9bf381d3973c4be66393fe5a0904d7ddc239da30b001baaa5df7b0c1f0e7b1f73f9f9266d6ada03e45e96d10364d4a

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
67KB

MD5
5aef5ebf2d603f43621ebad85e657dea

SHA1
3aef1d43774a8954b396ae1aa5ae824f30e6adb3

SHA256
b0e336d919730f2bde6dc17a1ba19bbde3cce602f7a5475a4f60bf1669660e8d

SHA512
13f78cbb44ad66821249b0eb46265a6c4830166f24a683a6f4842db2d579043bbf6b631afcbe39d614df97ed6deb0e7c0be7efd3297d6c681245fb9502b01635

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
67KB

MD5
babd333d108c7347185a781fbc02da9e

SHA1
05e5c851703a88e747dd9859584b9bd3172f8821

SHA256
666bc5c050be7a8a8ca861e2cfe0de858964a4d7466491302104752a89cddc2e

SHA512
ecfdd504be2a775cc8bdb23f11a2e562ec297d426bdbfc052b4e08dc35eb557b24e4e3d649fd0982afc334df21fb6601734de67b22ad125da68afd0cd3fda735

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
80KB

MD5
64b74eaba18ec58dc05c277165167e0f

SHA1
74848186a99fed07e4a44a0536ebaacc27ff26de

SHA256
4243c7b1b3554adb445f1e6dcb7ed5da56d12a3e92ef68180c4b4210af945b29

SHA512
4a2593bed896d348491a40e5f824ed00dfdc240aaef4dc72882e70fc232391d03a69fb5a131ca2901678812dd69d380c0644cc63a7b83abf56f414e346c5e98d

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
67KB

MD5
75b28a99fc49c5fbae3b6b2a05765428

SHA1
98555c7f75b7d0b10e98de126d7180bfcfecc0c3

SHA256
605c595f6c97185444e2c56f93d18d20266d7f0447c98a22c9467e05b2ac5691

SHA512
ccd4371ab459b9f7b5439b07a0a02dc6aaafa8e84d0e50965e8f319879b4d6f81064d9584b4e6a670546798fbafdcd9fe7b95197d1186800b124649943437524

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
68KB

MD5
27deb3e71b8614ee86857f97693a1bba

SHA1
2c711ab4cde2a9d8e6f2462020e9c358690e3c4f

SHA256
4f1ae40d88b376f6c82cb8fd0f40038971ee3ae701f49086de094a46026d273e

SHA512
572e2890701e090a0687732ac7f2b2c6bc60294ca129f0d63e6a5cac0e1cf979f98186570327383629cccc9ce2eec6cbe9a33a5b5436b0c7af4ae829ab64fe84

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
67KB

MD5
38059b8936cc3356232a560a2a9ba2fb

SHA1
9264dc8951e6da79ad0d42576a5ea1bf4a14e121

SHA256
3364c418d2dbe6c27f815225e647d571dcdc5abb82b0252fed9619ea9f4c2713

SHA512
263e9e96b1fc138930c3072968e4cec695f988a0d34e3556cce72e7ec93a6ff0caaef66cd96c03de240dae02098b6e1e6e58912f4f8b6a4e36907442d53562c3

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
67KB

MD5
5fe0cf2bef1b09bb57d03f35d883becf

SHA1
b0494217bcbcbd88f763172c11332e9f0af5b961

SHA256
7d9926080c9efb5cacaad479f7349822df341995f060e459f2492fd986c55cee

SHA512
8d0c554dfa39bcf0e5c41ba8593d18d8a3624019852877e66b7b183250547233a71661af601a0b1ae8e6431b0b1efc251be3905fe0a2f1232ac79578e5042ff1

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
78KB

MD5
5b5ae9827d63f1987e35544e58c44162

SHA1
2679b958d421f5579bf7879f555f04b97f65d436

SHA256
1a802dbaf53f87805494560a7c3bbc94c5c48a3dd5fc1961a8e72db771188225

SHA512
b2337585cd95874c8b554661f2027b5262ae66aebc2ca0111e5b54379c5371e9bbe480b5e464585788050a9c5b1013c17591c54ab4b47f1d90f7acd3828e9b91

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
84KB

MD5
fa65212ee677d564b93a0d59bc090a48

SHA1
2c22eabe8d1b638532c70403f6e132fe7ef02a03

SHA256
e67b170eb3a0fca38cf78f0706076dbeeab20409607139235875adea44c21167

SHA512
36a368bda2fa6ce541c5f8cd74b0cb788fe562ae03e2bb8fed6f425108b79707154b267c92ad7a963d1ac79542835495f47cbe9ed3cda68f3216803f647106c6

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
81KB

MD5
51b72640dca5e7ec365581147e185087

SHA1
71839005d1ec93ceb78f04baadc02d6cbb4f7ee3

SHA256
09d27afe2e4a30dd2a5831f9074fd2dab682bf6903d77ef401273ff18baadf8f

SHA512
c8b37046135a4e6693c6e5523ee16e0a3a05cab74cb96cff647954066dd5436ebbf99e5b10d42fc325d1b5ca7a47346622969feb059957c671b15e8735613e8d

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
81KB

MD5
019f42e586ff19c75d0f8b14fbabe277

SHA1
e1c664f10154731dd87c8558e5bcb3cb4fd39225

SHA256
ad23666091b09c803bfd88cb3924d3d560c3eeccd284c4fdb67702d509ec0e42

SHA512
f5f37cf9d0af8c873e85eee7a5a35315a00ada33282246a77cd327ba07277b9a9cb579bbb8b783b11cee07047786de3daaa99d232ac13903a82f2149e3eb6ac6

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
67KB

MD5
277a09c2d446437b38106b0cb48a67fa

SHA1
2cba30357a8f0a0d7693ec75d0d171e21f1dcde9

SHA256
f744f22f0030c78762c70fa4dea50ef0ede189c5e1339cba7694039e5af456d8

SHA512
95367104e83acbd175149e8980b4a9a675518f330055aa0bca781ad168404e7959d9b80acc4512d97f301d76ef63fa8124236107693380b5dcf3b04fc0954e70

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
68KB

MD5
6d9f8681fd21db0595f5d031d263118b

SHA1
10d8b22bf86a210d81ad5b0446904d305b57e357

SHA256
7367ea32dfb7ee164e6eadc45aff91f86cd5ece44d896207dd52744ad22f783f

SHA512
5a46955c32213179b7f340178b7d1eacd8cc0aa4d0cc6553b9b01ef0ab19a8828866bb1475535734d2e41c6f63b64bea758be22ac29ec31514d2d7168cdc4ef4

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
67KB

MD5
37beede68552144633e17f8b8814d61c

SHA1
04040a439015c10e2a54472fa801d33eeab44b76

SHA256
700c9dadca41f88e548523328c13cb0dcc05320560458b6eca532ba8b0a4c4a8

SHA512
ccbd04c766cfea7035c3482746b95326df833e3396a8207f17a6c1fbe8559faae6478c93c33cf7b3af1a1e068cb2dd069cee9f0cabe4a34c661c985032703644

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
76KB

MD5
e36b72a388b671a0b2844e05b09b0fdc

SHA1
00656936b248aeef3a8a53037755b0d66fe279f0

SHA256
c9dc651059e18a318a54f0bead104804d987955599b8c40a81da40a471ae12db

SHA512
9d46db714c942c131eff8606be116d29d193c7f468b433f384ccf39c3b5a5eda059fc5dbf7f689a8216033aa5086a9f865da4f8cd3fadf32c0895436b4a157a6

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
79KB

MD5
232f1c0575e69948e77b6bc249f88545

SHA1
7b46948deed575e4cefaa694f4c511700237145d

SHA256
37d73179fbc09964d6f00e15ce88a3ef8b503d363be79a82866a3f814be21496

SHA512
aee861947b19d4ef578aa9d15b1f8d2a2f2d3d7134729bf5086b49c8c7762e571262c0b5e0e40e19763a0932e64ec3cd36715c453bbc5779eba90ce7d5c769c0

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
85KB

MD5
6ab708f26b88bf453034773ba18bcd4a

SHA1
94debc5ff725f6f0a9ca3fb90b690ad87c8148e5

SHA256
a156b3f922a6935de8352be31a9915421a6a2f92e15ad88920f088501b87215a

SHA512
bde255057eed88cb618122798ea50a186767b2c3df198246de32f2095cbb4e539cecd220042382854f25631a3e3da80fc14428956092afae036d0324ca711a2f

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
75KB

MD5
515e5fad7ba9d6ab91400de44faf5a43

SHA1
4182e3ea0f2ce2f649591ec24e5b0bfef6eab1ec

SHA256
4f287c5e410d5879b9736b1685bf90b905c2c5c4e0e968438c7c76c4d93fc385

SHA512
ef73e59d8056b500abbfd166bd1944d2e863f2404c4d08e9291408a7c2512b5c6fd62c5b4e3d786ca6d10dc0f8b0f6e0fd8cbc4ff0f808ad718ee436c852f546

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
75KB

MD5
fee321330a5d3de2e87197b9e9cb0c51

SHA1
64ead6b54d5e9ed1b8cf7ba25e0b0f21117fb5da

SHA256
eac82da01ca267694a9b45ba654fee513235e4ad700d5c45702b20f60f7eedec

SHA512
53ee854630e8fe96b40a29c4e7d6f0f96a126c1039c31421e6bbd43ec344ee391d136af6a493238a34e00b37b43f63c3aee93a3faeff6a9d20ffc935ea1144d1

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
77KB

MD5
ef44089846b25bdf71103bb14cdf8eb0

SHA1
80293591d2f963cc70cd09b23c2fb7fdbed887a8

SHA256
1d8b15aec3d445080959302cb3570026f51f9380afffebd5f6149447a45a50d4

SHA512
aee3b824f0e5ed5920102ca8185c82c752c9b0f60082e7208747ea08ccee599f6fec14e3d3a411e9ebc2e2c8f278c382c171316f247200b0df565946407a10fa

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
70KB

MD5
c33a561c59eb26cafd4d4b002874f452

SHA1
c3b0b0b01ba7d3599f70331ff294b3fc7cc28f5c

SHA256
2219d0d9301d8735b075e2312fc6a431822c685e625351cc4d269c4108b6d5ec

SHA512
e66fafc18e095507a52fa8d17d67101fd40733432454f587dc89315d168969302b061511ae17790278041de24832ca35188f3eb3236c26bd80805242e5e44ca7

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
67KB

MD5
c4d650851972da4081053c531a45c175

SHA1
4ee6a43f1ff2ea5bd8227ed4825229234121ede3

SHA256
399ba90675771187ff82cc94e8c7c573b49cb3753cd7513408059a968d818ea3

SHA512
01c77bfd42f5eeb7f6392e66918528f8bde1b9e763d63ddc0afa6ffe6d1f0e241e70ffda3bcdf4a6bf3e0c998ba56d36e8b8ccff5a9b561c67fc1283b7a2a0c8

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
67KB

MD5
896c313331ea50fc9887352f39c26899

SHA1
b57be56c4b9e942d2ebfe3236db5542ef4ac3107

SHA256
2865f870d98558d41160ccfd12fcdb84f4674f1774971e78e7676619300a0f0a

SHA512
960f6621230517e161e5c49232c35e7d67c618dbd7f13f7269791d7c50df5b0cf20321fcef044420bf1333fc3a8e853e488ef8de48461ef789aabd8f073a87db

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
75KB

MD5
863d9046702b8bee709f0547391614ed

SHA1
c0b4c933ee07efeeba942575e9c463ae3dbd6309

SHA256
9900a117f8ae1693f3194be85a246f3e5323af6324277f6d410c90c37e44d4e8

SHA512
76a64cc9029745ad3625b8c98527dd7d56e40f02dd586cd274cdbd3f85260e7c381d8b6325ebc5a67d7ba809a9639751ea676dc71614235209a4b1eee0a59211

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
75KB

MD5
3b5698932c1c0c4b00ce227ad88ad2d9

SHA1
e4268b05b05d474d3b773d27cfe5ba4bf8428e10

SHA256
421b7f089d4f904f466a3a00944cf90103fd1debeac4136877b13fb2f6a9cef3

SHA512
638f91097910dfbaf1c05b553d0dbff14d58cd99a7dfb1d03e547002698b0218078d843b0162e1d50456a2131d8500c4a75fe2315867d6d35eb89efea9e31997

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
78KB

MD5
d221d1ec1ee182cfdc62a7c15b2ba009

SHA1
83d388edba9c126fcd5fca8e1c99c1701b9b2a02

SHA256
bbc21b3a6055835138bf50d580cea953e498e3c37290ad9b51ad9e0ef0b55f7c

SHA512
0e42f2657158c6bc170884e5889960967cf9e04c75ee953b14c7d98567dec421c067dcb2f364a7e97101ba0b21b919a14ff70a9b5ae019e11f7e0ebae8705539

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
88KB

MD5
9ce475da19d633f575a66b03e7de9033

SHA1
56f1d632fe267b1ea6dbcd93da3ae2b40d132ca8

SHA256
8b45154c05e49d9192738104072fac7274fb23b76991d4c5b4e11ce9afbda15f

SHA512
779cc6304d36a1e5434a5d06b23ba38673790887b50fede6f80ab58fe6bfea221a941e8f45405139cc05ac52a1caa879eeddac78e52d283fbe5c37b52ba3e102

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
69KB

MD5
a1f0e5757671a9b01757ae0b91f73cd4

SHA1
493c2afa8b020c0bb374cf02b63a2b5ee24087fa

SHA256
623be1b342a433d251979f782a6b34cfe2009712020490c4585b853bfb5f4d68

SHA512
5d40b2b126716a5bc097b9f672230853426776862c876f0131210e9dca6812ee789c04952702c59313b4d0fee25ef0f56dbc555bc07431c113ab3c7159fd7871

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
67KB

MD5
88b3f80d46192b56d12256dcdb93c359

SHA1
18bc9d3081f1ccb7fac3a9a7c1d488c77f71f3d5

SHA256
4afd0a41bb0f14b7f2aedda3d034608752b87ce2ac1f36825e342d0d29d1fc29

SHA512
89dbff3f87fa461e84d39b9677b96ec931245f75f3fb7e7895bd392d0d3cdd165f07be6fefe51211e1fcfd1ac322bc1c22b8692e7178f6aef9b92872a5800c35

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
73KB

MD5
d41a45c3753a59642e81c5ff65b73137

SHA1
97893b163c1286d3bccdec6e36f437ec77874b9c

SHA256
b6e6b7ca2f9aaffac0c13dc84efb9b8bf4d38a67d881e0fe6c401be52b4dc4e4

SHA512
3fc6490ec8585941d5ba989a9182c6b542a71e3d1d86acadbeb3ed666c0cc42225f8b48088bf19491fbbf6b9d7c5d69cf91db3f10442192bfa70fb4ee1343cf2

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
80KB

MD5
0c71f56607d4b7810219f0fc4a4f68ca

SHA1
5bbe6c7f348daa6756a3f1bdb6c7035563ba8c6e

SHA256
09a80af3a31cbd774d343bd98b4b3f2a13ba49c4010ca3f22cc5002c0115713e

SHA512
f8765919d61402fba44ced17e2e8394a172b5220abba0b621344187034357d74b1525cbe95aecc5ce91247bd2878aa9ea2e665baec52a62a61e4b85886bb1e6d

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
73KB

MD5
79c09bf07132eae61e7e225e60ae0173

SHA1
40b8219a3b1c7f6a01562b98e6f719f63a2228b6

SHA256
18c67fcda81def0b2a44ac0d9b9b107aba9e30946c40f2266f3aaba9fa5f0c99

SHA512
b1685b9c8d44c018df44a1b9a91426766d87137247874497e2e30de0b85daf80b42b8a154cfc2540794156d201c3031dfeb6e15277ccc5af22c26562bc2a2bbe

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
58KB

MD5
8cd918c26fd14a652066ebb7e2cc93d8

SHA1
d8239604662e508f7b46cf0c8d3eeeaef5ebd7af

SHA256
22cef5cacd4129b324f68b6cf5367e07e9289a3635c50b01daac5d3dfbf7f0b7

SHA512
0fb405beaa38d4cc6192588d2f622f32d5c467af557dd1c66ddac98dc70f87401bc1d2ed25207ddf551abb61c65333fc4b3d976366e0ee148b830b157a552775

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
76KB

MD5
3e99429a849dc2d98aa9dcac5a89f8e8

SHA1
4b971b30e69753aebe7b21f48bd8fd56c79132d3

SHA256
14dae765397b95eb46741d84492d3b52a04cae61258230927c8fe28d5a15dc02

SHA512
e6c5c8c8d0061d1cd0a597aeaff6661b9aaab2ac2f4e39b82294b57cc127da3ac948c896250fa570211ea696e3e49bc2def45db44b5f6e52b63f3e4d59d9ad33

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
75KB

MD5
5d62ad480a1901acbc1e15bae2bfe78a

SHA1
0c79e4616c2f4238fe3a7301a59d2c1bc8f7fb1a

SHA256
0fc58745f06256e9d187a7e7c3ab03a009e2de0443f15fc606426de6e1eb24db

SHA512
752c03ab0198c8f1ec4b499c2091335a8c34676d3b82880a4101e590ba81da4c6a3afba0873427c973f420b32cae733788963ba91dd804b8dce00501f0591453

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
73KB

MD5
d2a8ff62c262fcb67ed46b55390d094f

SHA1
2fcfb3408fe465f24841f8238a567793657b5b8f

SHA256
dd6eb0d4bd59d1f3d573f41708dc5115ed59caa33e8f6cd9e88944d060e5355a

SHA512
682ac35e7e6396fec0d2c0a189440bc43841a32e39dc9268437570943d67b456a8fdfc48296fdf80e0506c2081e0cc243b75440854fe4f17ff56ccab9806e02b

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
76KB

MD5
b86fd59a0306ef09a2c6b70467797d28

SHA1
dffa4cdfd321979b17f84cc73b820be61a5a8475

SHA256
88aec2f5cab5d511682b5feaf6ca5d2f7306a6fb2d869072997d0a8048704f38

SHA512
a93015bfa655b5b9bb347848655acb201b4c21cf5cbfe54c0b3ed383d045496d0797c0f38943d516f5372fa471ab8e10d83e2419329a93e805b9080e013548c2

Download Submit
C:\Program Files\7-Zip\Lang\sv.txt.tmp

Filesize
67KB

MD5
4c98c79207c91240eca3805309be8130

SHA1
f5c37057df56206a3542f2df74e23fdc014b8dcf

SHA256
ae66445674de2061c5ebf9416d5b46fd12c6269d62e2f130e14fa9e55ffbca29

SHA512
1d6b4e564875ed62ff5c4921d34f8ff062562a89dbd7d30cc8b793a4d0f809d339233a3cbeab7bad1732bc7ca24d71269ea10df7526c935bf9780042737e460e

Download Submit
C:\Program Files\7-Zip\Lang\sw.txt.tmp

Filesize
67KB

MD5
2f4a5f29a067425049d0db53aecd7d21

SHA1
e9e923ee41fc14ed38265438e28bf602c28e5d95

SHA256
731bcc37cb4d3704ef1efa0fa8d0da1617f873bf42152e5d2d1ccb5fc56975cc

SHA512
0dedd53ed57290c5d3959e8efd07189d7d13c27918b727886cd7461f336749942ea5124850dfa43d433d63195605d0fcde24a0692e6ba13fba6327dfa694f82b

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp

Filesize
70KB

MD5
0dcba252d579fb573861977f65aae682

SHA1
ad641a17c586b1459266e598eb3a7443121c72aa

SHA256
1020981d01fa383285cde748d8789a45421c92744825a12265f2865d135c329e

SHA512
3f49f4f2ddf7f505e559f411d834143fb50f4871bddae43f96942d0e3af65c4da3aad0344bdb7419e97f5abd6e6897d234552f1ad8c28bf69dadf826999f6a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\_customizations.xml.exe

Filesize
67KB

MD5
62f3a2af476efcd8c2e4f1b26a93c033

SHA1
cc11a02e9125a0643ff10c6cb2eee59e5882ce74

SHA256
474797dde9f002fb128d013ec037bd26b5d95a35e3c7c276c1a1c6e2b5a5f07b

SHA512
ef023d08a47fcb5f898bdc152ac4608df383931dc94da70b2e14a4895cd5786a13b5640c1e4df9fc4ff1b2d67b7c85429526bd5ea090061ad4c19759836f6b4a

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
58KB

MD5
6578834fa220f4b24e741a338695495d

SHA1
3c06e8588006a9970f32594703ac02811fdb54c4

SHA256
18b321457e4f3a8f75ab98b9e6ffc602fa44af62d9cd0b6e69f297c2981c8bde

SHA512
71da0155ecc110c86dee953714abf315eafd3cb3d6df9df42687a6da16183e38468d50cb214ee24ca6d195c2a3aae6431abe34972e321b46893d650a55804321

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads