5e276e9357331d500c063cf58be594dcc126416ce74850524be4c529a1103820

Analysis

max time kernel
150s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e276e9357331d500c063cf58be594dcc126416ce74850524be4c529a1103820.exe
Size

161KB
MD5

22cd950d10bf532712368da3af5860df
SHA1

0201418f5d67a372e1cb95c456156e77e4bb7c29
SHA256

5e276e9357331d500c063cf58be594dcc126416ce74850524be4c529a1103820
SHA512

c74c8fd06764f86c5129aacbdebd670114b133067f605fe397851973db115ab1f2997eebc2baae66a803b40c981e33bbabcaa8758fb114140943d37d59da3129
SSDEEP

1536:W7ZDpApYbWjIoPyPoLzV7c6Sho7ZDpApYbWjIoPyPoLzV7c6ShT+P:6DWpfDWpr

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4890) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1340	_prpbg.dat.exe
2104	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	5e276e9357331d500c063cf58be594dcc126416ce74850524be4c529a1103820.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	5e276e9357331d500c063cf58be594dcc126416ce74850524be4c529a1103820.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\default_apps\external_extensions.json.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	_prpbg.dat.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	_prpbg.dat.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	_prpbg.dat.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	_prpbg.dat.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	_prpbg.dat.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	_prpbg.dat.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Input.Manipulations.resources.dll.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	_prpbg.dat.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp	_prpbg.dat.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp	_prpbg.dat.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp	_prpbg.dat.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OSFSHARED.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	_prpbg.dat.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql70.xsl.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp	_prpbg.dat.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp	_prpbg.dat.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_100_percent.pak.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp	_prpbg.dat.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp	_prpbg.dat.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp	_prpbg.dat.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 1340	4368	5e276e9357331d500c063cf58be594dcc126416ce74850524be4c529a1103820.exe	84
PID 4368 wrote to memory of 1340	4368	5e276e9357331d500c063cf58be594dcc126416ce74850524be4c529a1103820.exe	84
PID 4368 wrote to memory of 1340	4368	5e276e9357331d500c063cf58be594dcc126416ce74850524be4c529a1103820.exe	84
PID 4368 wrote to memory of 2104	4368	5e276e9357331d500c063cf58be594dcc126416ce74850524be4c529a1103820.exe	85
PID 4368 wrote to memory of 2104	4368	5e276e9357331d500c063cf58be594dcc126416ce74850524be4c529a1103820.exe	85
PID 4368 wrote to memory of 2104	4368	5e276e9357331d500c063cf58be594dcc126416ce74850524be4c529a1103820.exe	85

C:\Users\Admin\AppData\Local\Temp\5e276e9357331d500c063cf58be594dcc126416ce74850524be4c529a1103820.exe
"C:\Users\Admin\AppData\Local\Temp\5e276e9357331d500c063cf58be594dcc126416ce74850524be4c529a1103820.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\_prpbg.dat.exe
  "_prpbg.dat.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1340
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2636447293-1148739154-93880854-1000\desktop.ini.tmp

Filesize
81KB

MD5
ead96efc0a9943b728a8d3968aa3634d

SHA1
d19d0cf0788fce858e4f2cb0f66283db9bbc6174

SHA256
b746593b679bb89263005bebad9c6ed0b83175de98c998438dd4ebc92f7de6d7

SHA512
8098853a27b27c34b4cbd4f9d9f35fc09631007fdaac4fc2fa377d29314f7d6f6fd90474bf68fa8e11d048458c025d9594d75870841c534212afd4b78c7c1a6d

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
194KB

MD5
de59ee1e96607bee5d74fe32bf0e8528

SHA1
f53dd422ed38b9ebae6424de0fa88137033e7c14

SHA256
3fbc3317effd5616b1efe4741ced0af683f452c562cd81c1363e107ddd103941

SHA512
fe92f25463b14deb4c7fccf12548520ab21cfd9a6f878513e0d96510d3e441bde45ae402c64800f9f824ff9a90e94ea8a4208eddae363a5fe5cca254d09444c7

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
146KB

MD5
8ab53b42bd999fa328212096479fca43

SHA1
321494020286302a5acb5273bfbade5092fa1e9f

SHA256
a438c89ff10a0362bd34f04589cc8d993efa5f084c4957c321ad3c55e76cb264

SHA512
76e83bb7733f459ebad0dacbe53e8396292db2afadc9c9da130973aa53db7f89871627498e5fbbaa0e0426bd107f16ae491438b2e6649eaaa8c07b5de64aeffc

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
625KB

MD5
84bda2041fd7d9d30ee50d63d2e3374a

SHA1
f608cacced38e1d81eacc6f117695845d5cc6dbf

SHA256
895e04003738ce863ebe4b311bfa5669dd28cda5752ae2ff4aa22f014f91b011

SHA512
9d88e39436ede9bf0ffa9f2cd2a35f84b0530fe4a25dfc456cce88ce8c286e8f790322104d7011d207dd9cbe7de893395bf9f0f70d94c01c035312dcba933026

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
270KB

MD5
d3de0c53ce4547ce9dae5edfb32d6d3d

SHA1
260fc18e23a0eb25552ad859d4f94aca7f6d7c32

SHA256
a64aab4b08c2321b8165829de508dc26e95243ef634788a1b0de46b8d0246cb3

SHA512
4cdee7cd7bb1aaf1fee98b8af791f464a7e62bf41e3a15bc9ddac37df3fc0024faf79302fec33ce9a087bcbe6a1ad10d1fb9a26a30ac1cec2028f6f223c49a5b

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
936KB

MD5
08065cd4c4c09169c7d014b5843b2978

SHA1
ac2b04ab78c8adf56d457e3331c612604764d3c1

SHA256
2724e4da4213c9348ca74cd8aa1c66b957d4e8ddf0a3b159e848f1b4a463f666

SHA512
6df37a1a6cd7dd3f2d19102da7f4a240b7d10cf843c298938af701c19ae9b5b7fcce04f1610bd1945556dad94b481f2950b9a43c5456e086e01ef3061a7902a7

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1012KB

MD5
c8cf71ce70d1a8eb4567dff7eefedddd

SHA1
64d67059876ae2c92959ed9f047f2b0187128310

SHA256
daaf89ab5360751e728d51164534fe4d07d251cc2158dcad60dfdb3db8fedff1

SHA512
eb0eacea962ddceefe9019f4f18341f6117babda0c64ee18551f80435efdd1ab6f545d46cecb1620a3ffe00d36db4587c2ec35b038f3846429dc0cc2527abc2e

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
80KB

MD5
b2da7afc3752d9deca5b2195ea5918a8

SHA1
e47c36f71dbfa2eb08fcde7d6b9aa1b9f7e6b62c

SHA256
5e8a1cc7d59409aaeef509d51bb10425fbc1c86af80f0297983988b2ba88fd1c

SHA512
cbdf4db91fb66eba573fa6e58d79f6d7cc01ebe7ca7a2a21aa36ce8b791f62cf326d1bd4f9b3d0a609d9f97544bef004a7bbc8bb923cfa1e0d947884c458f8c6

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
89KB

MD5
9a7fdab6c19dce30c73cb79d75365d9d

SHA1
c6d32368b84846c2428ab6743a2b6d781182d41b

SHA256
e39450365823287693020dcf3cf9c43bdd9a92441e1fc616ff64b41c58df2de7

SHA512
c502329a85ca36be0fd645117b15e17367bdb5b3abc876e221e7fb57eeb4520174321488c37e6a448cf549e0965441e49d11bcf9ef4a7a807849dbef8e980655

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
94KB

MD5
45965d6a3f2c36aa5f56bd7362468bbe

SHA1
787e4ee4753ded580c76a8b0c4b2d40eada7b938

SHA256
3e3968e2c2a4a9121baaf03567b3b00f8a106f4f94cf0d9bc9cb6fdca900118c

SHA512
9034577c2cac3b6a2048829526b66b4a0c9e31e86f1c4517e8356a46023076a1b2390f2aa3be7e8955ec7e9e0576d71442ea7b055292b140796119f10ce05107

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
85KB

MD5
a1f34ab193c95bc629fed4110d7032fb

SHA1
0b75c54081d18cf59438661c95060a99df798e20

SHA256
e733e85df23dbdc44d4ed0b3b04cc48fe8e89196b64e26947a7faaac9a4429ba

SHA512
76d35abd704977d9c7992f0c8349cb0e2aa5a88df49a5a351bd5989c2b161b2792db53082d6096e751530f6875e2aad9b92b9729ab4a5bb7af69b215f9dcd96c

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
89KB

MD5
b0cccfbc899c479fad7e6bc729d1671e

SHA1
f75830286deac58042588011718ed7ee76a23995

SHA256
02b2344d4eb0fee8ef356cf758282de6417c12bd4156d977c313b4bef5bf8592

SHA512
b06c60da70b11f73a015bc5431b47fde211dbab81213c73b869e2b319606ded8c53ec57d015024205e6b1031429fb3b365694d4fb2c8a95193ca59ccaafa56dd

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
92KB

MD5
d030ae013ac71eeb211d7db558162964

SHA1
a6f5f7ff7f95be695bdc0b70617682800adf68b2

SHA256
e3fa2e969b6840a4c2a4f281129951ca1982d42d67dff70be194655911beeb14

SHA512
984d0aa1fc48ca6b94ad3d85bb66bfef9c525d5e4d4a166d7ad8890f0144c7f944ebea4d6ad656f558f0c14ad1e8065d18f44076143e240c2c5555418a672f67

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
93KB

MD5
8879c4d5f31b4a51a928a9deb3d15251

SHA1
e6ddc8e006043034f05558e1a7d21c94d00d5dfa

SHA256
c3611d283799e1f92fcdaf07c1d1c276f938031b32b3c55ee710ea638968e3b0

SHA512
b37ba7a6f9fa400715dc298b5d29d50ac9820a749c2c30b565f1155a7a915ff3365b60857938a36c0e7f81fa64254583d609354497f3a137d84587ccb972a239

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
64KB

MD5
9e69e58534821fb54e549e55029cb677

SHA1
35ad1768652ffcc679ccb1b69d9104e744e96116

SHA256
dbd06a7ef19b3acd9e084cc8cbff1cdfc6f25634f3eb6143671375921fdab43a

SHA512
db1b9b854b30c4c9d1af39ff37302a8f9ac2da11c9391f0b9a4e40bfbbb873e5c15c9eb600751089979ba35857b4a869e44024b91cb11b0001970855d84ccb4f

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
96KB

MD5
346c09b660e4c0a5db2290937c7771c4

SHA1
d97e50656776f75613cffba17a9e9e6bcefa2f4f

SHA256
63a0005212081aed41eb1b865b6630e179504266018baf13f88cc6e832794212

SHA512
6f40823ada1d0484c5de2bdf5eb8a0f6df4426b5bf6c8fc529ab50b588583294c831201212e0914916be8d2ce183cd3611286d708b9270e08d3e43b20b7b50b7

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
86KB

MD5
58a80ea2aed0987b98de6aaedaef3363

SHA1
16cc85e60113707e179c2ec9206ac2435d7fcb85

SHA256
7da8ac2a0ba3134ce39c8a0bf28912eb5004976e32abda3896b6caecb654f322

SHA512
382083eea8119c336521aae85d30011a62275c695eb0963c78a8c360a7e2f4c654d86e1e1fb76deccb21f2e098f7476c2fdf5977956c3bc50fde2d840b1217db

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
90KB

MD5
d0411f2a3f7fcb6e668173d78c25b158

SHA1
aae6aa5ab700093a8e005284d2f4a682e801907c

SHA256
dfe5fd46b8c6b46e40d3b0167d8232065bb41343d94ed0b761fe0714d77018a1

SHA512
e9ad0f0f2635c5163856597d7ddc89155c1e6e97e6db51588fb6bee430370c6c5aa7eef55f162ea72371a5c2930e68ea0f908d17eac0f1abfc0ae74b47fec645

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
86KB

MD5
a32c9f14636ad89e93d2b1c8ce1045af

SHA1
7f707d407f1387e45acd4e1a9c8cc2a739dc6f7c

SHA256
e4141b9ff73c96daaff7b9c3b74dc727e5746571693a1c459e5ec21546a44711

SHA512
a73a0c2f942531c3bfab75de2fe101ed026859a69b6f5b9d4e535fc48e0c7dbb0cd39d75a41a259c86f92fe3966e1fc5ca33b615a09d9aa344f50dd81999f220

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
89KB

MD5
5850ce546bfb2670b0a97cb7cba4c801

SHA1
5f13707e45bb0e683ef92ac5b992cb3206d387bf

SHA256
be3c7d9f80919ab0fd596e085b8d902482840a602225200a79222e6d6e247a58

SHA512
0aafe1adcbd9160ce2cb78f55431581b3d34afbb1af59ef9644ed43611fb95760629a0e2e861ed159ee1037886176c7b5d03da9a967c2aff0b336038103f7569

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
88KB

MD5
7c8f2aa6e725f04a3cbce990c8ce1699

SHA1
96d215b903c19263eae5f3fe0a8200d41554f640

SHA256
ee2594e24d3e7c8935992e45ef90bbd8d2be8716784776b27d8141fa07136b9f

SHA512
69178fa7887d22eb788ba310906a21a63685fcb0fc66df27b609023bbc38b5212201ea563e06769d42601014d8ca72920a824a1de1743a24b07680b25466a95f

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
90KB

MD5
0f869cb6fbaaf539c356353494394c83

SHA1
efe0883e1076c93b208e57e082c1eadcf10a5d93

SHA256
85af4c29998daa130c1d306ad008edf3a25a6a5a402efc9624fc9b68ab414f6e

SHA512
052f957ad421ef139712a9a1660f37b2c082b2f667debe2dfba6731ce0b99f371b033261b9893b29b3c18885ff4550bb3436128999bec4a11b76aa150996d977

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
81KB

MD5
3b6f34f56163273a4e9be00f2c460661

SHA1
7ec998515016bb44dd7c1bed4300dbdd8ea75038

SHA256
6e9dd731fd1949645e5a37daff1716c7ae81e6629c1e00c82aa6178fbc9c5405

SHA512
c3c9686a6535555c69e8dcddd369563091c9a1a76277d5c5c4414320eb920013c05dd8bba31a37cea6ebdc8c79fb91f1e98046ea5d5624a02aec56e198bcf0d9

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
89KB

MD5
dd2ae7200cd358b7e31019921a2b6fa0

SHA1
0a92202867e097b0edc4f28158390589ae6318d4

SHA256
86b8c6a7ce34353923b4cadf849a2fa495cbce789e88c7526ed24f87ede9c311

SHA512
8bafac86b0ec5635f83b8a779bef3855b2b87e906d8d4bbc3be778b9ebf2a2cd267849d69bcb1f4eb2c368145e543a7c04774926178b30fd706aab0e924522ae

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
93KB

MD5
f8c6cf9dbf4bc501152346b8079577ca

SHA1
27ea469ad096941c3575d2361f65ac8736addab6

SHA256
cab7ef49b49e73b7c49931b9c1ef285f9ba1a8c3fdb3d570c66afea03dd14dc0

SHA512
a958285954ddd55911340d2e448126cec95ccfbcf482e2928e6a146e89e08349143588336e7aa0472da593150d6b560538b2007dd39398d0831a3e374c7c1494

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
89KB

MD5
d50f70f5c839e77cb0775ea4bbd7a52e

SHA1
0af079194ac988e591bf31906beefb49c0c45766

SHA256
e86cb8fd4c5a50bb4dd168b243c0f52755096daf305855c1f5666e38b8c7215d

SHA512
65ff32b8c94bdd14ac7ce39c357c01f8b7c05e74ca0bf3fef832c34f3dcbc936583480583124eba69034150e2d213169a838ce4677cbbca4fe38ebdb3d148f01

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
88KB

MD5
872d969fb6aac1de111789c5adbbee5b

SHA1
4834fa9b7a0d8222bf3ac352b32a794196a7de13

SHA256
73655a600159d0eb1df92d9f453f6bf10c82c325b394c35afd1b8eac41ecc07f

SHA512
8e90f76f91c0cd629a655f139b872ee678f7bf7ea1acd6dd0cc0d33dfab35293b7281ecfa6cab15ffdef4f4137697f0f9120caaad8ba428e826c3262862d3ebd

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
86KB

MD5
657974faf3a35159e2928b6f33ee64f4

SHA1
b3f49638bafefd666a5fb3aba59713a68e6e2946

SHA256
1ac43b55de0c9cd015980f64fe3568b62dfeaa22f317bc260a30e81ca7d4e2f6

SHA512
62fc24dcc05b8984f6c3dcb2bf18dbb13b38def28a77731a73df354e6a892d0491c9c36fa929219ce27ddc8cd3f63ec0d2dd460e5d7c441a001d30feebff10f2

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
88KB

MD5
c3477c6c4a73a4a2173e7f3bcf9e0de6

SHA1
5b042fe1858e79d99a6de9b9fddfbf581a725d96

SHA256
afc40f5fa4c1070dfcd364d7569899b6cf48d5363987e74396561c6833e1fee6

SHA512
aae5c559507fc52b3eda739bfc2bf031dc79d58480d8c857f1d80101e0aab4c8edaf989381b1749f42c8717bbe4277370f2a287d6069615291cb1d69784bf0fd

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
90KB

MD5
1ff0e25560abcb01a4e12971e6bde464

SHA1
a3d54948b3016824be1d4fd4ae892c56f8e7fa42

SHA256
f2f12f2d7ff4ba136fd12e979be5a2b7cc7d8ef6a58069a12949afdb714481e7

SHA512
17eacec15cf4fc4fb4f35e118fc8d7ecd066e05178cf7939274cc9f88bfa8c0ef12adf81caf0b5e83404840af68e4b8c07887dc58f2d7dc0efa6fc67966aa2ea

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
98KB

MD5
0bd44cca636b4a7b0bfe180c82f2c11d

SHA1
cad6f573721ea37d0a6812bf2714c5de06457a80

SHA256
5fb86c13fe2cb5ec050500b3d86ce6df80a25047fb525d8f29fc83e04275b897

SHA512
2b36e0804b59ce39b585c90ba55827c1be0e27130b4b076907ab4a68d49b681cebcb3d2f7356c37a3029aad8da12859940a6755dfe5d6d84903b63a53120cb5f

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
92KB

MD5
2574747518ba7c626a877757226a132d

SHA1
2f8153bf019a43e402c334ac8a15734bf661c063

SHA256
a63ec562507318d23268f4ab820a2a30f0b1b6d59090118fb6e6f5481a581066

SHA512
c19c32c7727d8a3ccc7a77acd70324cf3e76c9e4d835b5cb16d4ee13c14e2595cee28688a550734490dc138e3b584f8c19290e1ea1ff37631413d02c91beaa42

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
98KB

MD5
6f221d2abfaa6f54503d25127f33d860

SHA1
77bd6c3620ebada26f9a164e7750a49d79a9fee4

SHA256
27635713d7dda4439e788fc8e8147dd46c8422ea1ea46fdca5f15d94787a8974

SHA512
3c800225a43b647b10e29248ad3e9953552ff97b13a802a36910d2e1eb8c18ed6f70da9c13d5084c012d62aeb525baa726398a7ac3160079555f2c960f7cc9ac

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
89KB

MD5
e064b003c031975822dff1bdbf29a8cc

SHA1
4e83c8d9132b29bdf1969dee62e86f5bbaba8364

SHA256
9a3986b22de2ad8baec29ce11d94c3680bc1d1dc6a213835bf44276388042288

SHA512
c809e6067f7b7e0a124320ab72e6b5bb561174f0e642555f929e620ba9254a9569ad5560cd29802a615e3efa460a72b9eff540fa52705de4d0c9758490300ff4

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
90KB

MD5
740ed6830585502ce83d2bdcf07dd615

SHA1
47b7a833438b3fceb9c22ff43cd0925b3201da99

SHA256
ec7bc87625e646218c655d53b3abc358678e25181a7176486833391fe4bf5a03

SHA512
22e60d73ad72fd3f95c93732e05de092af3f9cf42e9456e3691914c7bd18b121de5fdab65d11486d551427c982f5705b97f91a04c9bfc6d11da2d312040f83b3

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
80KB

MD5
5e56319e131e2ed60daec2a1029dccec

SHA1
a47957d06207eb267ea7e627e0da367258c1677a

SHA256
50bbd14b7d389fb4e42b4047caafaffbd2197c98a7afb28044f6ac4ecb3891f0

SHA512
ee13385d77558488e51ee0dabd83af6cae1cdd95d6a86d74938831aa595f51a83a62b332e1f9b2208936801e22af05f0cc352945109552d6fe53255ae9a5a862

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
89KB

MD5
21ffcefb5f93d4128311616aeaa98c57

SHA1
e764c8409718af2a6208f7c03b777fc85dadc8f6

SHA256
7a34cc0734d805f9a666ca1773cfe547bc9dbfe8d051b06bb32a30a335877e4d

SHA512
3676a2bd08dc8d84be1ff11d2b552b1b982eab4fe35139b6ee3aad3a586fd175a6d65867809fe6e6c492bdfea1e0f4fe44308e41234734dd292047fdd6bef86d

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
93KB

MD5
35de7d0f7dc432eb9d45ba1afe00ac26

SHA1
66c915b094b9d6434fb93a860720f84e125826f7

SHA256
b968365de91c2385feb250fe90ede986817b9a81c994818179105846a1d99059

SHA512
6388fb830ccf6a385d8013ac4e0591416c3f535e1ceff21d69983225519eef94e52323118bb0dd06f01da830749dd834269b4440fc6e0b0444fdf75003470726

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
89KB

MD5
612732614f05e54970cbf338578a8ba8

SHA1
7a2c58cde56eb14957b18a0fba16ec600487e238

SHA256
008deceea27204df4926062975bc6acc2b9ba78bfb44150c91a2587b2479edf4

SHA512
c01401ac1c1383fd7d9af8c599f9a707dde6189c78b2ecf110be1e20b82183e25a6b60b62c824c96c1ea3290c1de2ab1754dc4578ebadfd8e414067596231ca9

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
36KB

MD5
23dd8bf78a00be2f2a85522732692ba8

SHA1
a81e4ea81ad731d8883816e89a4716b8a8f497cc

SHA256
8a362cc9e0a3798dd99e7643054fa878a4f2e1854c56e2d2204726a2703e8255

SHA512
d786231b6d47f1a4301f8b7277f034b9ffa6fdee8b87e9f9a7e2bae98705d30c234aafd6c44e749018dc886eabd6645bc8fceb4840d8489fc79dcf9e16526431

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
92KB

MD5
10848155ea72018b88c5203b299168e9

SHA1
792448d86fce3f8ec8f9377c0c313e627e689d44

SHA256
82e64889bb5b9a5b6b708e80e841dd344568ebb7e672fa787499ff57e70e9917

SHA512
64be116fe12092360d250f54d2d7210cf28f8a39093c26c96c532a8f2cf31df286758bf6c3765af6f7f514acfeacbbd5a10de01000ba5aa0ff64018fcfa01fcc

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
91KB

MD5
43a71ea37175ed6e45b1b4fd57baa210

SHA1
f401fdc34efe6a1cb705f307857c9fc0fa36af35

SHA256
16ef5ec76e2372cdbf188136e86c306a6df7a9456e8b2683334c114e4c5676fe

SHA512
745f84630faf31a515528398a8ff1528cb6599cbaae67d8ea614b7dd4fa9ab3ee89cfa658b608362d60795a1c5d474c42400889c4a3cfd349664198bacbd2b26

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
87KB

MD5
78fb4687e01aa69f81313ab9172033bb

SHA1
d3ef2547b4365dccf2f928a326e8a1d94484f8bc

SHA256
1201494ec60f234aeeabb017bac657beb3826c1eb533aad48df55aa41a2cf614

SHA512
07dc58a619b00f6e90898016314b41be4ced93a5b9121f644c76b6f99150c7c0cc26504b9ddcbd6de78ed8147a5e5b8c88388fe6b8087623516d7ccef9edbc3a

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
92KB

MD5
916472a268514d9aa7a963e23fec931a

SHA1
ef50de1241ed220fcd61108e319f6d19819c234a

SHA256
3e33672b7b44df35849c08613f3faf7d7b7bf6303b2a03a038075630104465d1

SHA512
6eae499be3d49708f2a58e412f44fb7f1b6434965bc5b8cb6aa0b15a537662f1b6c1a92765e82a8767f0750e03eaa13de455aa32dbd517c5201712e8c6ad156c

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
88KB

MD5
d675de911b7d2188dfa5b377d4131352

SHA1
41a62532ffd0b052041f0937f1c91a3bfd1b0582

SHA256
cc49590413aa3ce208b4bd21d6376f5b9056cd74a5308984a79a4c77475ecec9

SHA512
98c0d8370b24bf8a5ecb2eedf97957a0c7768b2c3ab72ad98288a1fa8e460854ed5df637f378855f40455becdb341e654d588b46b81f37361448b110cc7507ff

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
81KB

MD5
0862c7a7ab647fac0b6f72d444b74fc2

SHA1
fa4f86df51d27f92df09db134a218359cd08c403

SHA256
360399658b45953614326536dac2d43dca25f5ad1b0cd2c1ba0195ce5330b9fb

SHA512
571a2ea37743bb2d31489c4e4d872249e38f81f0b28cbad9f5d9a37418d34dba5d78578c3196704e05163460599e3cf30b29b19f4b8904c005b8debcd093ba4c

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
102KB

MD5
3526366d744fc846c4c318cda2f4297d

SHA1
4d20a0a8773c8e9f21a55f27a992ea09139d611d

SHA256
37abe0bd9b540180846bc5ef0db825b52fa38cc06317474eae75c40570b16a4c

SHA512
75f33a62a3bb373dbeaad5c47b15b6f7418b192d7ca23df2366c62249b69e3f502ea41943b725d8079b1e8d3e23027a2da7c9b9361243fe31c9ddc5da713c25f

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
86KB

MD5
05545e0454a1b5e28d78ac50c72e7249

SHA1
5f44a5c9b93f74ce9efa56c02bda66d30cafdc82

SHA256
050983d16f724215852d5ad13f29468de7e800d03f9f40a199495ba2b5ea10e2

SHA512
f3a554ecb25387a18dd58b7f3404c3c8d57ecdacb0abf33f4da5f8066e2edb9d2fb341a0831c7e09be79f048e6de394940afd96bc1165182526ad7b2f822c09b

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
81KB

MD5
568b47f1cf43ed7cfa6110082d88eb10

SHA1
bd62488726a9081366740aafdffc4be547b4477a

SHA256
55f24a067e94080f6e9af0bd67b35eade4cb72aa5778779564acec4560c434ed

SHA512
26252f6452727dda0e0e3d2ab47ff8bc5b82379197f76425f3b28a49f31d2a5da3b38593aa176a4084440bc2e86aa17b40a48bddd532fac0aa92f909b6ed1e26

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
93KB

MD5
a8caef43500d979164da5933ef36a1bb

SHA1
5449ba06f82e2151d56bb5b66898c15748ac3abb

SHA256
655c8fc3ae2222e36fe594cf5c69be1b7d8a92b5f9d5633c797c591aea304915

SHA512
3fb0c72c9f8ff61a42b8e52005a0464419d957dc3d41e431a0beda9e365dfa2048d2fa844e4901b80a29c6478adfc9f33bd516fdf07249c5c5555da3b9de8337

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
95KB

MD5
a6e22c6689c60fc6d775fe99934928e3

SHA1
e64a0a3734b745cd5c03ebd6dd70a658afa588ca

SHA256
5128c33a7a586f46962291122444afe106ecc0dc826f50bf4274d4c41b71d6d9

SHA512
04990c345575414f8a9397d8f6183aae375d22c976bc8a554d9e2a41d8d4b56fe5bce7c7b29865fa72fadc82311583ccccf2ee89424e0fcb874160d60a0e8315

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
91KB

MD5
e48b3392cc19648c4a819d8c0d54c243

SHA1
bd2ff0eb7e58dacbd6b2fc06ae2351dc7e4c757d

SHA256
cdefcb8d38a2d4307a01d5b29ec97912349e29cae6f640da0d8f9c2febdf6311

SHA512
9aa3ce3b95415b878a0a028b8ba067743aa0be8867278fc2fa87e71a83e8759fabdf8bf9b8116cf4424f39c7fa43d5d5207e939ad95406e744bcf299e0f4d3b4

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp

Filesize
98KB

MD5
6802a998a9b59f5249ec4d3d841dc1f4

SHA1
07196ec0894cbef98dbd0a19670ad6f7376f455c

SHA256
46f1113f569770ab943efe4274f6761f30e970fe673e8ca60c469cefda5e8dd5

SHA512
407745fc641da0ea19b7cabc423060aec5b3dd48f5b0ec233c6335dca47604808d71e81f90e59f746fdc66b8962ed378558781fc5a8502227cbcb178791a4ca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_prpbg.dat.exe

Filesize
81KB

MD5
bcee70d6a58761a30578483dff7d8b1c

SHA1
ea52f87831b11c36872a2422932d4b4a847c8d0f

SHA256
5b4ac170179e549e4d2d704d36fbb039afd88b3506ae74c07950e01fd3c3d890

SHA512
25bf90d781fc4614d17db362b4f5c1436af93995608f908aebaae2064896c8869243cb564164576b7b519c5c73629dcd2fb282f25e22c535601f68c7faa0b05b

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
80KB

MD5
1223b9afec58440fb01e77cf89d11032

SHA1
ddc18f9c415916cbcf1b0ff7c140fd9147e9db5b

SHA256
d4350c6e4e29c92482c82d115a6a643c2242329ae59566dfafc68ac4d919679a

SHA512
320a0e039c0cc1cd7aeec2c573a0b567946af7c7d2b67d132f9f93d2a93a6c69ed131e02d00b8dd2e4ff91b748d8ac11b86bf218bcd7f7403bc4c73b5264956c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads