de7f0293cffc3b0343ee569ca8f982f21da3fe4d6ab39c42c434ff1bff510759

Analysis

max time kernel
150s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de7f0293cffc3b0343ee569ca8f982f21da3fe4d6ab39c42c434ff1bff510759.exe
Size

76KB
MD5

0728bb665ddc139d24f800154e660462
SHA1

915eaad566cc14c13b7b5dd5ee03e5c8aeeeea39
SHA256

de7f0293cffc3b0343ee569ca8f982f21da3fe4d6ab39c42c434ff1bff510759
SHA512

e5d676081d50aa23788f736b6ba93051e8a75cd06359b6212c53d20aaa19c1a586b3970def8bbb8796f18fdb27701e2240a10fe28e65e8bbb83d1135221a235c
SSDEEP

768:W7BlpppARFbhFA5vj7BlpppARFbhFA5vmRHRE:W7ZppApsvj7ZppApsvmRHRE

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5539) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4180	Zombie.exe
1952	_prpbg.dat.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	de7f0293cffc3b0343ee569ca8f982f21da3fe4d6ab39c42c434ff1bff510759.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	de7f0293cffc3b0343ee569ca8f982f21da3fe4d6ab39c42c434ff1bff510759.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue II.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.exe.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.boot.tree.dat.tmp	_prpbg.dat.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_clienttelemetry.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_FR.LEX.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	Zombie.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogo.png.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	_prpbg.dat.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png.exe.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\v8_context_snapshot.bin.tmp	_prpbg.dat.exe
File created	C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.tree.dat.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sl.pak.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL011.XML.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	_prpbg.dat.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC32.DLL.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	_prpbg.dat.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONRES.DLL.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\SalesReport.xltx.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.exe.sig.tmp	_prpbg.dat.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_WHATSNEW.XML.exe.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.map.tmp	_prpbg.dat.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 4180	1256	de7f0293cffc3b0343ee569ca8f982f21da3fe4d6ab39c42c434ff1bff510759.exe	82
PID 1256 wrote to memory of 4180	1256	de7f0293cffc3b0343ee569ca8f982f21da3fe4d6ab39c42c434ff1bff510759.exe	82
PID 1256 wrote to memory of 4180	1256	de7f0293cffc3b0343ee569ca8f982f21da3fe4d6ab39c42c434ff1bff510759.exe	82
PID 1256 wrote to memory of 1952	1256	de7f0293cffc3b0343ee569ca8f982f21da3fe4d6ab39c42c434ff1bff510759.exe	83
PID 1256 wrote to memory of 1952	1256	de7f0293cffc3b0343ee569ca8f982f21da3fe4d6ab39c42c434ff1bff510759.exe	83
PID 1256 wrote to memory of 1952	1256	de7f0293cffc3b0343ee569ca8f982f21da3fe4d6ab39c42c434ff1bff510759.exe	83

C:\Users\Admin\AppData\Local\Temp\de7f0293cffc3b0343ee569ca8f982f21da3fe4d6ab39c42c434ff1bff510759.exe
"C:\Users\Admin\AppData\Local\Temp\de7f0293cffc3b0343ee569ca8f982f21da3fe4d6ab39c42c434ff1bff510759.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4180
- C:\Users\Admin\AppData\Local\Temp\_prpbg.dat.exe
  "_prpbg.dat.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-200405930-3877336739-3533750831-1000\desktop.ini.exe

Filesize
38KB

MD5
fc6ff071532b86f286e641c35c098a72

SHA1
fc4390513fbbc357f394cc0ecc8360c45224b403

SHA256
c1d745cc57a987c75b65745c7bd5783c353b477308ac3b79e0e6dd6dab8135d9

SHA512
f9b8cd275c91901509c3fc95b7cd80ba56940231f96025328f646fc3a281fa18b3f62d11495faf9940e17b82f3ce382b85dda51e5ba22757feb9ac1660b3142b

Download Submit
C:\$Recycle.Bin\S-1-5-21-200405930-3877336739-3533750831-1000\desktop.ini.exe.tmp

Filesize
77KB

MD5
7439119df168da9edb61b02e1792ef50

SHA1
d41fcea6dd876e0ba4de88e8543bdb1df4c29aa2

SHA256
21b6cb9a118f7ba7cf9d32d0505be402a3af6ad875092188ed2e622446262bc4

SHA512
11eee8f11f2d5b2ba5b94e3f1644940467dfd245b0111fab14342337b3dbaea465592d1f2b1f5e352593983d6686a5ee4e1dc2aaa457210d46232af7cfe581fd

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
150KB

MD5
6228f087e12231cb2bfffd4a48336187

SHA1
ea0f3cb6f0616dbecbacbefefc7c3d8b72cffec6

SHA256
c1eae718bbd1826a93f6b029ff3c4d0a99e350bcc7d5bf9ea947465c1b0a1c50

SHA512
a32422c460e86cdc720d6b6b24400406b917aaac418d3309e91efaba6da0f7b6959a5bda320ea0eb07287f9c0e872785333cd091458369798d92bcdcdb0432f3

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.2MB

MD5
114da9434e260ece1cff5df3da4e4d97

SHA1
4c95519c7c2c514a74f824336e018da1a512b3ca

SHA256
12e5cb1275a093df0f2c356c69eca40ff0e2fc3aa36e59acababbba6ecdc24e7

SHA512
d8e31d5bdcbacfcec1eaa2a57240ede99be90b8d460aa1a5d6d6b0d740307bc2d97315787543794258aac14f76cf66b7e48d967e56905977e413e34daf5748a0

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
583KB

MD5
962e6c92d9ad115e7b175d5d614cb12c

SHA1
ed1c1f73e69440c0e3fcd355df354b6d598500a4

SHA256
10eec042df6081f15eed0d37b8d18e31566a6c231404cbdc2dca568b87ae8964

SHA512
720b6b677bede84332784928348ddfbddc8e7a36ceadfe4e960036a1fc52d2704e59ec9f48270a441e13da862d66a857963f9b3b0bdeb4533edcf31dec6dba8d

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
969KB

MD5
112cd273cb2d154660e7f732e99a85e4

SHA1
4e6e7f1d61e5a4743df2766511042a121dccaf26

SHA256
beb70020e149a5658664077ca2a2b68539fd9cf4672ef9c0252a651afdb88416

SHA512
70eb315b8af10c42e086d831473a8177d821f29786656f4352c9766604010d9fabcda0fd4e6044ef943d66032ec87a36f7a1e8f2b38f489e99908b00d41dd4cb

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
723KB

MD5
d482fabc3beab95c7e0537fde3a26b45

SHA1
8a91af71602df5697fcd117d9e1ec59bf42a4406

SHA256
ff0d086f3832f0d1939d831a51fc0f4ceb5a01db26352558c7f6ce8ce10b9284

SHA512
cd5b21fe93a81bdeb9441b0c3765412b365ac81a6ca32b2067ec6259535d3da8eb72a2cb3ca4ad73b7d37856ebf0bea8c1eef0cea4e40ffdd292d0e7a8b94f55

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
50KB

MD5
5788a7fb155d2a0d72e0ded32a55e96b

SHA1
4fb8d4fb46a819c0bcf04b526f22ce8813a7f150

SHA256
ecd9692174c1326239ff5e5e94ab38600578fc9a9cbaaf5d237e169e5f2d9897

SHA512
75e4220b7459ac6c20ad6d40ad779af41dfd70ee1f55820ca5fea0e3d92991140074149a3bf0364ce68f0ad8b62fc56e3f7011f6a810d1be481dd724eba3155b

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
49KB

MD5
6f04ac065c70745175e2cfc1ca03d3fd

SHA1
30ed2a994fed88f845f741dd7457a4656d37ea0b

SHA256
bf13738ae68f9ac1333ae9f05f23c9ec5172a010c7f0af2c9a40f78c3154d2c0

SHA512
4a014f3b662aa40d149e6905d139db236e1e6f69b7d695dfb23ae1a31de6ef7893b0d0f3371203754583581cb645e7fbb28235e6c03d6296af845c2bae4a7c8c

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
51KB

MD5
866bb9dc4228d238d94dad3aee3e091a

SHA1
243177a44c3f99deeb3e4d719310a56acfeb513b

SHA256
fea18d6545d9fce259c35054c6fa078bcafa089d8daf2bbaa7438cd8c4a45d46

SHA512
37d9485e0615b243055522b61bef9b307bf2eedb180a1808e7fd1aaf024080562d821a51980bd943dd39c0e6cc04c71499320fc13f0967ce88bd21a6f0548d65

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
53KB

MD5
9066b98194b486c42fcfc0180594b0f5

SHA1
89d59196dc858a05d6c9e6d1e63d05d8840f16f4

SHA256
871dab562fff3dce14ea1762cf0760871108caaef40c3953e4247df529be2358

SHA512
5083c5acacbab6df09adfb4ac1e9ebfd866f684f4763b850f846331e769df04a44b72f47fb763705e2978f3e809468d1d1380218de87e62e97876d0bc7bc45d4

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
44KB

MD5
a1448558cae33f887eaaf67a045e3e82

SHA1
117513cb31a9840bbaf71cde8800be179a7f33f5

SHA256
bba682c87ac534b18106151b05ab5497bbc02b1707085b91b80ab9872a69a57f

SHA512
777242ca527f838fa5d2f521c6dda77d133756bcc62619d6f77ec30f9f2261cd134ac7b2e76ee4e2c932d774df935aca045f8b680c1d95851c66e78a3a27fc3b

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
49KB

MD5
5f356f98d352815dae062f6d54b2f499

SHA1
1ab6b020d598e8b5b4c498dc04a62b9cf693c210

SHA256
51353956164691bc816f56d245163cae33a8bab54773994fc71eeae1f1c54655

SHA512
710914172b439248742909c43ddcb68d98f35b021fac305664f93b73ee967962748e2ab6f017455dfe634ceee7f3abf68176ec5c523231f36bbc3a41c72dc89e

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
36KB

MD5
06237c048d28f42c88317af885ff20e0

SHA1
d2b45ca364a7d59272b0e2e4ad697c5726511613

SHA256
58bff40d9c68ac738679e751668a8c1062c2a86388c9b428aaeeaad33546a127

SHA512
12198dd831e0479e8f1ce5e5bcfa779f684a1c69fb5f06688afe382d094bfccf0b80d7060834a97cec68ff62b3ee056a3f3511e4da2cf8a28a69bf3b64e9429a

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
47KB

MD5
5e5ce016de2b8081e75aa5cc56f4cbc6

SHA1
acc72a16c938ad4c13a3da5f3fb0222ea5afa670

SHA256
779a0165b2e9cda72c937f46f0adca6891cabfdd4fa8c453bcea7ad5322b1a34

SHA512
804f68d51da9aa023db41b8212d34b2a8b137b356f060fd83b49fede9ea0408a501360a045db7d42eea05b20a89c9b0938e519ce1af86e12f2d55b4aba4a83fb

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
46KB

MD5
b3e644e73a2d4a1126fc24cbeb0f06b0

SHA1
7e7fc3dd6c333714aad0c67801e62cb8fb99094f

SHA256
b12b13d743177df35775f13b5b44bb8edf7fd2cd4a60d6cf300726fc5f803c28

SHA512
8ae6ae4746f10855f665dbda30c03f44fff2e0072b40b99f8dbe18ef844c81c49687ba778ef2f90c55e2c3d4da4c3383d73e8e6c66d9d6f8bc79600253fdd5d6

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
48KB

MD5
f9114e02c0172aad22e6c306b1cfc1c2

SHA1
861691eb1d6d451cde496fa67a25a6cdee928b4a

SHA256
a69a43bbb5f67d404f69d87fb5b386d3f15dab722d61dd0b0ce9da603caf4b1f

SHA512
2c492873d12cf8220459d5c7ff64b19fe9a24a68ab8fb62c14cc725b74972effde6f95dd721b321b8fb7fbca6644c56056e8e2bcc0acc320686e53fd95a6f348

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
45KB

MD5
6337c16a05a60e8d26f94a43af092f3d

SHA1
fb2f80488023ab76946940f80e4f1f866cfbb367

SHA256
ae5545f83714bded3049273a956567edb2afcbff3ad7e3c08f391c7b1caaa8cb

SHA512
100e1b1373adfa91e1de328ea7b0c271057ed51a108e5fa602756732bcf4b402d93552d78775c68a6314dfa2915a07613fb0349c520cf9a68dd58c1e7b40f33d

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
47KB

MD5
189747bcb83ae4e2aa910de617bbd9db

SHA1
ffa1bb52feccb213b4928c5a4860037920d0ab6e

SHA256
1a497fd0417dcf86ed48215dd306bf1abc908bcd54f2590983e6b91a8f369308

SHA512
445b3ecf7b8b60bcbb94dccadacd07763aad170ca298a0bd313d10eda7822d3cba48d30c23069049e83f2302661264d9f9dc2be6be9aee402ef9d37eaaa0bf88

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
52KB

MD5
720bc0320a148bedf86e32bd3c132a25

SHA1
cf985dd923fa3211fb8490a02ccc1bf5946fc813

SHA256
ffcb985ef830bd9fc4073ebcb915088330a869d8ae0cadebf81a5ed9dcebd076

SHA512
769c3f23043db2bcb2696b50a31c70d654923d663b9795cfc8dbdeb9180d5a7eb9768d187a11a2f4ddc94703e81346ddd6b151a498af10745754c2a97f327983

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
47KB

MD5
6f060eff08434b085e71130e841c067a

SHA1
2b2c7e4a926a59636decaf44312b0b3e45a744ff

SHA256
800fec68bad8076ab45a6ea6b7db7958ed1054840e736131012562f77f697216

SHA512
878b0770f94048e503477731a08da38a3b888ca7c749244ecc830d07eb9f503acd1cf91d8cc0614401abfb81c8823d85884023d53c2782307df709a3b22a0d31

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
37KB

MD5
01768696bd0cb086cd6cf8c850528a48

SHA1
4745d2404c15e9cb9a1d8b46c6e5b6334cb5e78e

SHA256
1153854dd5f50218bac6c23a3146e52bd08665b59a97b5818abad12c994850a4

SHA512
826e7212a15820e686ae8dd51278075f3124dc1b5bd1c3de71e5c13602b24caacaec3bb6ea8da795e61d62efc6be90889db6c68df9f1438ec100923818336307

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
46KB

MD5
31ab2adb26910d8ba9af8b0c7f61a234

SHA1
9f33f7fb32aa8e0cf3f4d3c5276e0eda27254ae3

SHA256
21581576490ba935e093af881af0b08e5ee3278824d5c8efd6200ae4a2a44c1d

SHA512
9dec8fe7fb028ba392e6e7704dc53f3d1134bc73a15ab96a05e0cd9f00927c3f34abb65b95e633cc2c5b9b12366fd4845ab024c9b8eed40d9f802f83ac6b6fe4

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
44KB

MD5
55f00d4d8c45b4e326912d2561682244

SHA1
903774a8b2edf419e33c7b4033e037c51c82a16e

SHA256
cfb181e07e1eff030fea225db1a2e3bb7ea684e43e734e8cc2559c97ae94c818

SHA512
28cb77cb9ce83c08daeb675fad790ac5c2658036c88ca7c2bc002e661d2f1abf4c66627538c497f64221bb87000e2d8057013ab3dba25e52666481c86128c8dc

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
47KB

MD5
cc729c97557318ab0dda662510cacd6e

SHA1
23d47422e8c70a7e5da75ca8187e343ea5d8a5d2

SHA256
d69ede080cbc70efb4b40f9cfb9fef2d71dfcca69318920d36ea82b4f27a5a6e

SHA512
0516bf0b4ff865b0ed23ea5f01930751db0787494cc2e8c0d008705d9ef3608c5bc6f8950da6648562659159bab0f9524357f81c8db518e60b485eef57a33e4c

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
55KB

MD5
0b0931e7fc0c5eab19e2458800e14fa9

SHA1
75376e97e611b7c787d26cedc73155b9291da701

SHA256
5ccb4f1e54fd954c3a1ea3216bfecb5c7f185cc99bc7caeb14c92f2498a838eb

SHA512
f44fc4714f42fcc312fff96785e242034a0b0c61771cf413e3ca90cb39102b554835d0e1d95090c8b8016c6dd940d719d76f5d3aeab8451eb1745847e7511ebb

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
49KB

MD5
d3ebc0e8038a9c917bda889b9bb34dfb

SHA1
f173f680de52a25c8fc9b6b53e63610ae582e174

SHA256
dc7e95108b9bef2986134ff1195c91bb41da5a30db53c899d4d715c7eba37b50

SHA512
28d99d94131d70c945297bf3f4f3abd78212fbb2e5f7b6b69dfaae0b609eb3311927cefb586617c0f07e1cc894345ec1eb2956be98ff5e337510b0636f80707e

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
56KB

MD5
b5b893af152e5d2d4fd47c6163a58666

SHA1
ae07ebabe898bb3d8b8fec2a866beefe44107dbc

SHA256
cd64d496fbacfb77f9caea0270cc88f13d06e13491e3c3eb4b26b13edf24e338

SHA512
d65891a92a3c4e99f8f250c57b76b28b9a7993ba7f704834ac63044df33ff78dad2a707c5307fa14a7aca0c6283e778e40f4367fda02cebd972fb9db66416674

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
47KB

MD5
0cedafb81a8c4bdf12d8b7853eec7cba

SHA1
80d279080227b75819b17daa23723d011182b797

SHA256
20d6f94d40ea208636168067c80cd5da6695e465fa3e4f63d1a60f1684d4b4a2

SHA512
98f56fa553fd74e2ac9c1e73882782b8e4bf7552b6ed6802fa8ac0b9f1b639b9bb3cfdcdd4b4656d74c8c12ac9b97e8ab0eb6eecff86090689d1dd566df185f7

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
39KB

MD5
0a2b35bc4bf48bcefeaa52a5f1db8f16

SHA1
b5820cc654ec343489adf2690f06a5036f455069

SHA256
733dc57dfacad87e677a83fbd7ef61fb0dcc0c6642c1d7cf2cabe9bde4b2ec69

SHA512
57f3a3794b5a726f13e9c2f4f4275a4c594a6740dba412255952a95df71e5fc6071f3b34456d9118fe42e2fb3ff68065efa45157f9c6d814834239e61412c6e8

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
48KB

MD5
b936898daa404cb50470630a4307ac27

SHA1
9f80f71d053d972bf4e4fbbc361a3f4f8ac0e213

SHA256
95e084f469c337d9e80ce84b08a9e669e989193ea625b9b1a34a98fa98225360

SHA512
d5c73c7818309a891cbe1c98b2800960cd0ccdbf4c9254adb2384e6a2660ce49daefa864dbbc78623f87d0bbb13b44b82a8b51fc8183a1187c1a26ba33b72a97

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
56KB

MD5
fcbc1f3d452c1825f22e107e54c65b18

SHA1
1e6109a15181428017d1cdb3fc483b3f60470865

SHA256
e73074934af98df40e6a5213924f053d3286568a00052487778970f0f5d5af13

SHA512
637e0b2bb4c774fde2cd87555ccd61bccd8da4e5452d2fd8b56a707b537ca3474b59d95018c1739f64739cd1ac8388c6263a6bbc4c730a6f00ed0f38488b062c

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
47KB

MD5
f0d86a28160799617760a0485a15ac5b

SHA1
3a438286441329c9f2b59acbba547a8e6b9e9bef

SHA256
14369394e7927ffc3058cc70171b5cdf56a25a475193682475131b4ea342d40a

SHA512
e1c3ac4ace2e0b148ddfcd45f11fd36fd40428b81e75ce9a79725a28b00e2abcbaf62125af5a9986e9f56f12ec19b56a4a1c0770472e46f7fcc80e2f9f2d9ad0

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
51KB

MD5
f8893aa0f15c4b9366c1d9844a07eed3

SHA1
d2059e1727220156fa708ee2664561ed9f90e13f

SHA256
273c25f8e03e4e3a22ede35f707e164c89d62d3308f31599ad7a92e0be8b54b6

SHA512
0acc3431664065c3e31c8423ae3763ecfd16599998b1cb4d742a020bca001dc1e729dd7c2e8a653689f5e2a96e0086406c51c8422aa4cc9a72150bceb105bec0

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
50KB

MD5
0a9846f40a417f6ec97663e7b13ba2e5

SHA1
b3f775e26259ee057c2d5da4bc07abd183261f9f

SHA256
596adcd65c342c839b4bfd2ef1233d2dc1f882337f2960611621d06f2f95c416

SHA512
765212f4202b70494696473d31805101c4755f4f661d099477666198ee43a21c0abc22ff9890584ba5875f9526ee3e7ae8433c4343044c0d37555fdf3c5d76b6

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
48KB

MD5
c8e224fbcdf32e89ec77bd16808d9e03

SHA1
7c960e93ba73a67997aee0035c49bb804217da0c

SHA256
a66850e1484a9dab6948623f08cafe3244f6e726685f2966d037732466acf1c1

SHA512
02885805418e81d16a155e7f3ad4cb11f9550da21cd4f3e4651cb886dfe7a865b7731de0f5c27f0f33a62d72c9623c9e852d97a744f01195a5061bcaa8499226

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
47KB

MD5
3c449a0888a3b9ac939081b4c64ed2c8

SHA1
04486d6c93d74dc62d1ded2a5b797dc8d904f079

SHA256
45ec766f6c3892807bf17ed7c07bb1a616eabe3ce474edae5fd02ffdb691e6d4

SHA512
9540430fbb1e1eb5bef8b7f75cf82e02eb116b9ed44c65ce120ed3aa1aaf1f4c247e6626d15832b9e504199b27569905348cf4cb73993ca840c17b9d80db2a85

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
44KB

MD5
c04a8826b80fda18e34548d77219b9cd

SHA1
3c2ebe54b79ce51e50f82eae3a4f7b5bb6604121

SHA256
1c8e04ecf81f75bb930b2a9569c0371e9538d9be808cc366ea15e555a3d6b520

SHA512
5c02dd716f4cb4804330a34ac24daedac68bdbb5480f0fb0983a9f5e00d2bcc52c32bca8a33252dbe3a428bf1875f8ebf232226b1e6580c68b14c43922e408c6

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
52KB

MD5
311be66fd47a098a2357ea126343d7a0

SHA1
1c56940dfc2183a6430758af564322f15c4ec7c8

SHA256
a89e94605a7a469b212555868a6bc80a57aca8de662be32ad049abee64064242

SHA512
eef9b4044b51bda7350d2a1c5f5276878da41d46082fa78c4b6a197672f8c6288e0ad7200504a2061d852b3e5dace417b4b8191738e213d824c816a1ed5c71fc

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
53KB

MD5
ce500fbfdac7f368bbce1491195ce5fa

SHA1
606ad90c08a80c80503bd72719a35618d41b0731

SHA256
6dd279e4fc787834b3696c611ad8a329c3ad9d5002ba0d71c43e08ac0c06879e

SHA512
bf81ff70684f7342a1cd639926edbab11852c2656cc9af4c8d264a63731f423638992c8afaefd4272253f3684b3ec4e3143b330a281eb2503b7cb8c58193b1e7

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
47KB

MD5
8228e8622bc1009eecc20090574b72cd

SHA1
2759c473ce7d139458d9b13ddd2f0533008b088b

SHA256
cb8e1c86326b47a47c018214ee3f499a7a44e28c8770fd2d93af5459d67305ce

SHA512
511cab528280c8300643707d867923e1426816cf7180af22383990146feef174f98ad7ea1d864a5cc3b7ab0b43927b63266e5b98fbb1ab3bd59a612c9508df3d

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
47KB

MD5
d92608968edce080f37fe7951bf1c6c5

SHA1
91dc251e170098eae26ae221591fee18d86fcbc3

SHA256
81a6b1fae27ffa0fde76914bfdd9196bcbd090f164e9ae8cf453fceb08bb23e7

SHA512
0968d371e709d8d79d16831f2faa6e33c3a766ca7dbb09e15b1239f874a3df2e907cdf0955cea8d732620489fefecae5293075d03bf16bad14c2ae510589ec0d

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
47KB

MD5
2b55abad7f19845924173c1a5c41ac79

SHA1
5b5b4448f76d21cb5acaac8862e2491a38b79c49

SHA256
40af19a3a550af7eb9a1243f6ca43e079d5cd21425dd1653807f19ac29a3ea4f

SHA512
e36406dceed36753c7d51feed9170bd7960e81c15144c58e6e96f53297e9860752af29f0f432fc33d5981e0957acd6294cab86c3426f63f2e63c0f4b5be982c0

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
45KB

MD5
b2028e1ddcd49a15ca328fc97e87ccab

SHA1
4d6541e0109e3de3db76d911bafb23e92797b836

SHA256
5d13d7cd1dc4842da96c0ba8f3ceefd93b316fe9164e03446e154b6b3270efdd

SHA512
8eef418539e08f82a07fd45c54055421c76ed8250722dbad08bbdf3f906bf91762670398f3f7591c4a3cd7db63663eec0f5bed1a7da802100c2c738628f48d56

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
52KB

MD5
380388adf1365f890f71b65ead242957

SHA1
22b347356afb2b3a00a205171c72ca6aa4d560e5

SHA256
547c48f588d8b05453c07c1f28e927ba58d9e387a97238718750fea3312fcbec

SHA512
7ab21da5a91261e611c11e58e01090804edf8e946f074c864aea978aa8d8ad7e8c8b538b681033c3b5a3baa32ffe8add605d1704d689656c9c2201974f417f6a

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
56KB

MD5
bd74497dac5d3a150bc4d50210ddf9c7

SHA1
b902fd80cc388b5b2a43faa172d95527f4954f32

SHA256
95b920deb15237cc5f00cb5b7310ab2855d380548f8c7c138bd52d2d8d2e55f0

SHA512
64eaba4c1d4a44ddf8dae4dffb600a2c3aa13bfd1ec915e70c6388148eb47adadd8618b5b07194fe56b8e7215587d9b991457835167923150f101244ae4f69ad

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
57KB

MD5
8906fac966463bacb76233f05900dcd6

SHA1
9be1496f9063953af81d86c5a1e3d53aa4e9224d

SHA256
ace069653c5bcf017f67f4ca01893ddfc59b9870a0a1533c659460db9d54330c

SHA512
5eb9119ed0bc8bf214e20e795c2b4603811bd43192b4ade3beebe4acdba7232c6ce3ef22d3d42b8b5d26ffa96923d0e21ec6483c9d68193a8582e5ae06d7cafc

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
48KB

MD5
14930f455a85994b6e95ce0ecd1e27d7

SHA1
2508c0653c0bdcb6266c4dcba5e4b0da13611ea1

SHA256
5aefee81e3a47728df18148baf449dadee81833c163218a1978c5e73034d970d

SHA512
9da6935cc1d83de2dd95dba1cbf4402a2b5b6d8b66597cf4363cb9ad45a08036824e9b12255bf923cffba7d2505a0308e5f3c52e85ca829b1357b21358ad7fef

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
37KB

MD5
827980879f78c88a5220d2990fbed481

SHA1
a213e0b54dee78047dfd59cc88dbb3aeea203515

SHA256
c567f8d2cbb6715b6b5304a532e9f5d378dc1384e6ba730a45b7231878d2c709

SHA512
ad854e7f78fc277212a9c6e4e9d9014992d2f4ac6d914c7725bf494239918ac0c84e31f085a83398de8bd1f258bbfa3ca191c55c1c8af07b988d48dcec133eb3

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

Filesize
50KB

MD5
b0a51b78b5afbccec6f41d05c400d3ef

SHA1
37416fb0ff252d2af39d248d778ecf67fd6cbfd8

SHA256
a9467a50f20bb93abd9913ad0cca3c592b37f75fe29312fff3b56eed39eca082

SHA512
8b1c7cac7efc70db049837c09bef94c707761c8c52d3e4869cf56cf5b017fdcc9dbe00c1422f721d51f5b98474d549fb61f767b4b401fc80b89705b2032cec4f

Download Submit
C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

Filesize
44KB

MD5
a3250ec7196f87cf63ff7abca94a44db

SHA1
2d36075781c77dd8746daaff9a4a1a9a24848df6

SHA256
b12fa075e50f40b45c0f26e3f545175cb97530c5c22e37ed90a832c5fa01ae5b

SHA512
3148272c1c28bdbd8110537f2cb7bd4d752b406ff3de4dfa04e7826a4cc74330d9fd779102e4447d2ebecacd3fe622771217f7dfea852a8dd0a344970a79cc90

Download Submit
C:\Program Files\7-Zip\Lang\sw.txt.tmp

Filesize
47KB

MD5
a3d00af6dc4f2a4c252f7b7208ae9766

SHA1
9c0fa4eb71ee78959d7db741f2f12d657abbb04e

SHA256
a4b7c429a01477a635ae3b3a968859e39b8f106701b6062296f77b62a10876a3

SHA512
aecd623259f4a5e81fb31b38864742df3eac46b46f6720cddcbc6d06f16509ab80cece74ca7519976cf2c263e26e454e9185e9df5faded2f6fe3a40ac72debc9

Download Submit
C:\Program Files\7-Zip\Lang\ta.txt.tmp

Filesize
51KB

MD5
4256c7cb6b532de522de8dee4bd13387

SHA1
13060cd5b1b1a4a324322831a735ff5ea4a5eff0

SHA256
15e85c62b43b8c5115065a5cc24c9d7a6683c6392187e738342c5e9bf5bfb21f

SHA512
2bd14cb59d5aaccd5f0bf95ffbadb6306eb6b8f3d6d251a7f8eeb47840166ca580533e31252abc689345d7b21cc9d25bf8916657d1084ee9096220ed036d7b4b

Download Submit
C:\Program Files\7-Zip\Lang\tg.txt.tmp

Filesize
53KB

MD5
0345afc8fbcdf2e9ab30d65042e27a94

SHA1
381eaa546006ea60453c152ec2a9afb5d290fd46

SHA256
369ffcdf620bc7b7f8525478876aed6d0239b190616cf58a15380afe5fa020e2

SHA512
556e3b222834737f4515a038111de2e5bcc1ee5dbb4152ac2d23bf28ab39ba5a1aeee3070dd41f6fd4194f79ecacec0bbf2a72b2d8375b0f6943d0234dda9f30

Download Submit
C:\Users\Admin\AppData\Local\Temp\_prpbg.dat.exe

Filesize
38KB

MD5
9edb6fe5a61fac335a4ef48d25f10ec9

SHA1
84a252bb041d9264214114c19ad171c9f85c6b33

SHA256
059ec5ceac2a4a59268220fc9fef366277de75fae3dd8bd50765941fc3ce1835

SHA512
e8d534a973c7424fb7814aade426d04f290efdfacb465fb33a2a74146634d1d933e0d241b2dca82c5928910e0d418bcaab70f8877c854ab53579f55e6c72bd26

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
37KB

MD5
25681552592f3e23d2c5a076a554cc57

SHA1
0029644e25147e2e498a2f7b70a791d143f1680b

SHA256
8a07dc2e16ec9b95d4bad738233e960c8f4c23cb427625f49f1fe49954f69807

SHA512
e171abe86aba42ef4d40320244d9760b5d9db5f1e3d40699d016b51681d96f522ceea9e7713f8b82377229b1275b5d55a9d085f3e097c632d95f9bfc413da1d1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads