fcf21787fb5761207fda7df8146d91142b7d729aebc682a227635732508619f1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcf21787fb5761207fda7df8146d91142b7d729aebc682a227635732508619f1.exe
Size

173KB
MD5

d3a237a14a32d16d65284d8b6cdb845a
SHA1

d16b94b45f6410a027a5a8963890de544158109d
SHA256

fcf21787fb5761207fda7df8146d91142b7d729aebc682a227635732508619f1
SHA512

4eda8bc30b8ea41e5f500834c0236c102c25a13327b76e800786b41301e4898f9795b8324fb57ca6f43359bc797e169f77356832b759f8279caac241d1e44f79
SSDEEP

1536:W7ZDpApYbWjIoPyPoLzV7c6Shd7ZDpApYbWjIoPyPoLzV7c6ShK:6DWpEDWpF

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4763) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3492	Zombie.exe
3536	_updates.xml.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	fcf21787fb5761207fda7df8146d91142b7d729aebc682a227635732508619f1.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	fcf21787fb5761207fda7df8146d91142b7d729aebc682a227635732508619f1.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp	_updates.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp	_updates.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp	_updates.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	_updates.xml.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\th.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	_updates.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp	_updates.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	_updates.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp	_updates.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	_updates.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp	_updates.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	_updates.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	_updates.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	_updates.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp	_updates.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp	_updates.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	_updates.xml.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp	_updates.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.tmp	_updates.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	_updates.xml.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	_updates.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHEVI.DLL.tmp	_updates.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp	_updates.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp	_updates.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp	_updates.xml.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp	_updates.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp	_updates.xml.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp	_updates.xml.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	_updates.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.tmp	_updates.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp	_updates.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp	_updates.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp	_updates.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-100.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	_updates.xml.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 3492	2108	fcf21787fb5761207fda7df8146d91142b7d729aebc682a227635732508619f1.exe	85
PID 2108 wrote to memory of 3492	2108	fcf21787fb5761207fda7df8146d91142b7d729aebc682a227635732508619f1.exe	85
PID 2108 wrote to memory of 3492	2108	fcf21787fb5761207fda7df8146d91142b7d729aebc682a227635732508619f1.exe	85
PID 2108 wrote to memory of 3536	2108	fcf21787fb5761207fda7df8146d91142b7d729aebc682a227635732508619f1.exe	84
PID 2108 wrote to memory of 3536	2108	fcf21787fb5761207fda7df8146d91142b7d729aebc682a227635732508619f1.exe	84
PID 2108 wrote to memory of 3536	2108	fcf21787fb5761207fda7df8146d91142b7d729aebc682a227635732508619f1.exe	84

C:\Users\Admin\AppData\Local\Temp\fcf21787fb5761207fda7df8146d91142b7d729aebc682a227635732508619f1.exe
"C:\Users\Admin\AppData\Local\Temp\fcf21787fb5761207fda7df8146d91142b7d729aebc682a227635732508619f1.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\_updates.xml.exe
  "_updates.xml.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3536
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-701583114-2636601053-947405450-1000\desktop.ini.exe.tmp

Filesize
173KB

MD5
91804ae53e7dba9926861de17d822004

SHA1
597079ad3f3f9cc81335701ed86badc27c4f9adf

SHA256
f10770a1cab5ee3057ade1b6da00ca2726eeba3f21388f2b7af08cd9ebfdb69e

SHA512
3930aa36ff858b5df66ec47f437bed01aaaf4d1a60813b51be0baab7daed4e3fe75d2074a515ac1499673d464a1b97cb792af3c8ab646439ed47351930e65ddd

Download Submit
C:\$Recycle.Bin\S-1-5-21-701583114-2636601053-947405450-1000\desktop.ini.tmp

Filesize
85KB

MD5
c1506dc301713c29b2c59e267cef8674

SHA1
13d58a1d1d2688c2fd045962357fd92cc030d54f

SHA256
750d0d9ac9821b838bbf77f49fac8aad35e1be67f5d88a57f123847a62fe6460

SHA512
e057f1a1530df3989cffafacb55f3e66fdf87eabc787d652cad13aab41863e5438556e08ef050bfcf4dae60e28c3b2eaf2cc78f70bc8e7ebfe5cb36bdea6bfc9

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
198KB

MD5
58f09b57781078143e4f330253d1bafe

SHA1
299dee01cede0edf97b2e1721c66c063e873b7ef

SHA256
770bebe4cb228907fb09d14f9d1e05c701e13fcfc33270dc33f9507e50e7a6cc

SHA512
2a0ff2874cacf36dc32ded4b75f49eea0b683cc40f3ca2d932f94cd33bd3229aca591af2e9eca00a76fe5ba176c6dc782babbc1485054288b1c6a64cf4913da9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
184KB

MD5
f190d0eed8b9620351774cc7f3b07ca3

SHA1
1ee62ef99e23168f65ed58de96539966615b838e

SHA256
fdae768865e06bce8ece5ff3111c968c2df80e20694f4dc923e7224c949583b4

SHA512
dd1d5cbe3dfa53ac5ef278351bca4e9192003b6c6a355235d598b2fae9a02f9162c7da91954bcc40ae21b1a3028ba4570bea847d41986913a46d0f3205e104ec

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
150KB

MD5
ff99b675b17685695817d8b05268349b

SHA1
1f0d4cfd03a7857f11b7cce4c767334701057cdf

SHA256
3b71dfee3ae74f1c35416c0cefaf264ee4c29e943a08db8ebb32893898967a8f

SHA512
07fc4b23fbbfcb4777e92106cd5643c2ce1b25ff4dfc164ac5c2032ca4259591e24e58ad0c045576684d4602795a53b6d591fafb62fea4873bcd9e3dae7e277e

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
326d2eaba913c59b4178380258016ce7

SHA1
315afe21dcc3a725b6004ac07cceb07fdcc4bc6b

SHA256
1b9fd710784aa58accf23b8811bad4de457c1dcd1fb527b9c854f9cb96a2b4ef

SHA512
2cd88af119daaba30298cabfc7356e24c188aac31489ff0988dc776a577a93ee5a6e7598075428b9daa4684bacdecf2be1d6330dcdb40cb5289a1e08d014c00a

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
631KB

MD5
cd1cace31cfe2dad080158ea6b5a75e9

SHA1
d251f0281bfb42aaeadd2974086519a2279987f8

SHA256
1c896feee69bc44b6ef2c31c6211bea04db7fb328b508a60e6bff3f60abefa25

SHA512
0fd3f2b0e3008a1eac66e0a43659825f3679dad67d67ef3b8955ead63c5b5837cf0c477bf265eddaf20300f61a26d388c57b66960feae030a72bf210d4808bd2

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
276KB

MD5
186a52b3e268aa07928d8f398c790199

SHA1
ea2c55f4b406238a0ba8f8f9808f14b6fa8f13e4

SHA256
5298b687fe660342e14fd9ab481d6ebfac116210800ce934fd35286a63629980

SHA512
5508a9544f6510804b71bc6aa75096fe42b14c39268a3f2a1c681fbb26ae8c8408091af323ce7fbbadbd03e8bc8d0d71e2ad7f23d4356468e649f6629ded5b65

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1018KB

MD5
1de0b1989b6b61017c3fb36d7f2dd742

SHA1
858ede4eebbeceb3b6634aaa7c461ecfc8148b62

SHA256
b7516db1e76bfa2fc9eeeafbb3f941095cb1e7603c1961dc24bd745c0a6a61d6

SHA512
d89f0ca9081a1fff3f830ac5bbdb2102c575d45c762a12239023a32d3c6e123f3913ee6194a56e994a73b4d52739b2f94de10261d442392f40655fd03e6eff37

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
771KB

MD5
cbb8e079d48023d40d41fc1b37e7ddde

SHA1
2df78c06e716dc170e3cc83b6d9fef882dd8e275

SHA256
6929e82f3fdb90f9ad88760f04948897478f4061aaa28535836c63f70b59d124

SHA512
a97d9483c2bb56c63b9d67fa47cbaff52245a661d2540f4f3c860db055315553fd81f639af51423f6b54d31f5c02677fef8249a6a27abe5cb8ad0e1d735989ee

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
771KB

MD5
3f46c63396258c4f228925afefd1881d

SHA1
f769087957169425b13db690d18981cec9af8dc4

SHA256
0377b3d7883397deafc07d8e5c8f4684f31417886e66aa24c4aa3be8504ad08d

SHA512
8d72b9c6163a829fa7cfa7738032e154ceb8a774e958e32c512533279176d2cba10b118d704a90c7b6ee0f4142ca43cdd3d057fd6e00de4d1cd0c0cdc52e9cfb

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
87KB

MD5
f372d6c732d8fb6f047bcef9dd53fe04

SHA1
d189257871e050b156130b6ea4b857619de4227e

SHA256
e2a8375116498fdcbf7095b4927694d6e00d8e03e5e5ec8ddf4e04167738d067

SHA512
fafa09ec80ff9bb793d4fc0bbabb168026b02bf41af17ffe1fd8b744da20661891399a53e6965d951c9cade138e1913471cadd376c6ad799f1835da3f138a2b9

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
95KB

MD5
7021f50cf23c8c560c6afafb7ee739a8

SHA1
c0459b25428aafd024a3067466af9e58d1853fa5

SHA256
565f561d5e5080975df02bb4f5533dd4021e381e2123fc5b0a44e661958dde5f

SHA512
4afa06b3e4ff4b1d861e66e92833d9924a5d896ec7f132b82b659283882e52eba2867c8f638ffcb1aaef69a19b3b5ee047de5d80b6a3cda38a077a1830d3e202

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
98KB

MD5
1653b99778f5303356b2ff82d847cd3b

SHA1
0b31b96a9a6eb71dee34f31ebe34b4aeff9efec0

SHA256
3e304c60a2a1ca2aa1c6bfdfaa8c49086f86531ede60e0e0d9721b514e5c5a6a

SHA512
8f98c89cfd593a4f16dd74126d63a510e3a6a6eb65bab6bfc881dd1a046f8a2be917f8de9d29fbbbfe4da9f2ee86e78940c37b8b728343bbdba7f75b8721d549

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
100KB

MD5
e7de9779b3b6db23edd50868d9bb58fc

SHA1
cce168c280dca7f7626b6f35365bf71e1ed17456

SHA256
efa147ef54992376c42063dd5bed58beed7dc1520983730ebefd07332d129e3c

SHA512
ff9ab605825b20487420621e4091653653191250e3f8de005d9261b007c3b29c3c6db0a24a77712574b6cb3afa04c02e81fdab03c2aa770ba8748c918b346cdf

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
87KB

MD5
1a79c5ba169c13f30d47a8080b9a3295

SHA1
86c5d5daf4d338b37c5c123fec074bfdd637fada

SHA256
50575e55ccf7fcbb448912368b95b3e04f2f69e05a3f0c795850de739e65fb2c

SHA512
96d7a239006c125221ce574d30f22a5ff63991f850792fb4279ab96516510b029fc72c76d194682f887c2452d4b668a84c3fdaad19d5e567bf19246bce2e8a5d

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
96KB

MD5
b3521188f0014258d2e7bd3b18001792

SHA1
92581a61f8bd81fd6df43a2b033886d4505439af

SHA256
3726eef948f7fdabb39059dfb14f8eee49ad3fc75a3fe030dba2b16797649dff

SHA512
13498f7c4fac8ff7cd6ef64e8494db09213bede709089ebb24ab3d90c54babe190e87863c793b9c634432999c5204673d9941a338623b6c8717ea38aac5e376b

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
87KB

MD5
82ee430be79438d9d9fc10b887a8d566

SHA1
7096b558a64607adde3c3cf6a1190dc3b045be7d

SHA256
8a00b7556f9603e8ec547683d4fd949d996211cf7b9454c8b48dac863a65981b

SHA512
c3c485cec7933503dee4275188e16df16cb1eca3ba166d65708cf0ceee9f6cd52c1dc0d588df3263a01c03b72c4912f0f1ab18a9e92653b5d1608a79edce6c06

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
95KB

MD5
6b886302b1803710854d673c0b490af3

SHA1
175123c0e233a543912bba14aa4eea466cccf43d

SHA256
8b852b0ab0a9db23cea4a09d1899bb6eae8d5873864f2b154d7da20d829374c1

SHA512
74af7308eba27030d24c870d02535963372cf58a416d4def6c81b2067fc1e9c5bbac692181d6133b128501bc7f472a921ab8222e05468fa1bf0ccfa8cc08d280

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
97KB

MD5
abbd01d07c75d5b31705a4479a6e928e

SHA1
bf2cc622ac87c31e3b895aa3e985009e11e88ca4

SHA256
325a2569df05f350861d6575a423d70a2db967f7601fd6369421519a9eea9e91

SHA512
0ea9304c925bcc259956f242006a6f515ef44a6d0b9694a176e4fff40153c09d8f85db046809011285c3bbbffce04735a09bc9fae5a57891ad638cb352e99f22

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
104KB

MD5
0e539709dd00135ccd3a6991024754c3

SHA1
aefc18f9ca094c8b06cb3e32a78264ae26de58e3

SHA256
e20ff41f57fd14eb012b3552a9b2f7d14746ac8235f30af4f8972ccd8f2793d4

SHA512
b478e91aac477d5acd7183c3377d711879e002ac66a7a76c009cc0a2d99e4ff90fc5be1f57dde29ad349a0535717147b30fa59593ac7a9dc0243388204cff604

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
95KB

MD5
38e23a985981e12dd1623101dc66a049

SHA1
6b7e3802402a735f96127c945d46d7c34b340ae5

SHA256
5cb7a4a60f3a2391514d1500881134591e337eb3538bc5a0d2b0802d60165e82

SHA512
771c302786cae4b5971cc46a64fb573aebe72cbcb822015c16db034f40202dec975bcd29de2934efe152596e5649687d8ad5841038379998b1d558acbdc77b77

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
96KB

MD5
1427fc5584b548b0e896ce38d444f185

SHA1
e0195ef767d689884169f1f71cddec27dcd11ac1

SHA256
7069065c76ae74d0f5e62fafd70be31bfa3b99d3eee42055cb0492f3ef93e4dd

SHA512
15c5e8757a4177fb93ad941868f6e20419d9519b07a6fbfb8f6865b86a52f7e52f697d916ff07cc1b223f8d2d906c2b764a2a7330d398f50575ba1afb3a6da2d

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
95KB

MD5
a22419ea2dd2343ce9509b2d70469bbd

SHA1
3b64654ad92b094653f8612ea24bc45acefcfcb2

SHA256
08c446dab2d82308ba6dd3da401c6800220d4d8bc0eeefd0eb0aeaa4ed9d5085

SHA512
f71f2402352c77a1f01d2b8bc6325c637665c60f40ef3f3f676b3eec2e22cb168bedfc3ba788b6cc42bc56897ddd2fb562e25a3c2d5ee258df5f30267987285c

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
96KB

MD5
32c126a6ef74e0eced8b6dd4d9d130f8

SHA1
0d87a512578dfc523f9d3a9c4a328f13865f22f5

SHA256
c07aa4cff76e981d2e2789706630c65cd473b4b3e00822fb2a0d8d44feef2d82

SHA512
05c3c52aa96bf8c970a1cdcf1b52925bd8bef86812549fe64f52f9b6d6cec5efb4d9e900e8b73c70af894caf7a0a01968b79e01e73fdfba7cdc4302c0069e377

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
95KB

MD5
75d5c63d8e7e1271ee1145c0b65a9b69

SHA1
0df8adcc7de0cdb06e30158a489e4262446df39c

SHA256
fcdcb4794b0afb6132e5eee2b0bad5277d47ded14491849674e617bb897a7c1e

SHA512
1c71e27c985827bec2e92729e05adcfbc96f94efb8636f5c737c57ab33ebca59b9ab909961a33cdd0a0bf0de74214e61ae72c4813aba1b78ea835641f890bc19

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
95KB

MD5
410f6ced1d79d6f2243920d2df8678fd

SHA1
92b549607a723fb781c7b89a51890aed61c2504d

SHA256
cc6faf947bc122ed4a45664cd4e00ef409ef715147ee4f3c6971a938ebba5a2f

SHA512
07a433774858c272d2f8b6b1f59e1e80a088258cd2e8f79a18469be1714ab55ee8717ee3dff1900407efc87a9caf901d7d8aba42cfb3234f6823073d986e07b4

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
97KB

MD5
23862cf2f1c5626066cf575e82075dc0

SHA1
a09e6f64e06e1d17c9f77d4220236d0f338a9a4a

SHA256
bce20937fced93c511d993ddd2d78239b65b6a73c0dcfd3c761837925af3f1a7

SHA512
c15582fb2c065195c8464f2e4c270f2bd50880808c6098257435066e4d2cb39565590e19df0ee051a397feff2edcc552cab355a84507a0aa6309ae7daf6501e1

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
98KB

MD5
d87668ca9ee42e92719344dad4e17951

SHA1
901b0ae4d92dbc80f1cd27a0c1e42da6a42f302a

SHA256
7cadb9a9035abde4bba72a47ea54132a4801222fbeea4d64bcf5c5225b8ce1fd

SHA512
22e5a9a87ce294db3dd5637aa26be3add03afdeda4c62684b042668c707e4e0d92878a33eae44dd88e36d5a331da65d5d0677bca9f8dc3858d96af980359bf0d

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
95KB

MD5
85f0826af4461e8390be4d9a5fe2b3b7

SHA1
11d01ac61199001fe0dacfbae0b13c210744b230

SHA256
7b3745e76e9e63da0dc69c384d71472dcc56de4e875824cac7ab3f3a0a281c36

SHA512
d47363900d24db8fcbbac4ec6f5422bc955240f0046483e24fa2c8738e4b38d9c4fcc652e89bc8b10753b30f0575572a65c2b86730c54d7b2c7b4e494c6be893

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
101KB

MD5
baadc939571f6954cdd8ea419c632486

SHA1
485760fbe739fb2f8a585e6b93d166f29f4b3b8c

SHA256
9c246ba93436f1448900a31b8c016df96f1b1bf14c4f7556ccc7c0ca181c9765

SHA512
2fff5e2c9ac086293c26e0015c6f877e1cd241180c091b9db64310ebd8c20adefe5fe1810cef9b3abf2b5eafb7ae7f4a69095db3d7ea6ea9dee5941539d8b4ec

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
96KB

MD5
80a97f7c9cb1f4fd8e3d27997a3ee6de

SHA1
d00e8fa92fbc86a0b72c1fbd8d749547be39e218

SHA256
dd47928afa5db0eb00004f15466b8622f59b096de595419649606a1d4d55509d

SHA512
5739f4f702e02895166fd8236c3c6e16e52fda84501869f2672fc69cd29f959f0ec602aeafbdc21fd269100a4b6c882ea8b235741a744c559b2a5831dff9d8e3

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
103KB

MD5
dfddaa3bd5b494f3e24e75940c5b8968

SHA1
cb52e19d045631fe1dc9e979ca34a2f5aa0e8a7b

SHA256
387c53b46085b9459def330fa7366f49aff066ac925de2741870fca7234d8a08

SHA512
3b50b47222dc430ecb2adbc12c6ba1251fcfbc3b5ae530133d2e9a0d595df26f1db20509b06cf94e54f37d6ee764dd7ec71d22fe7bcce1c420ad3765a1233525

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
93KB

MD5
ecf670515d49513f7b5d5e64f1d4f8a6

SHA1
08ce58e115500791e21a84536001e3a603f91fad

SHA256
7f59e62d9f7c3fa1d280eb01a35458f52705572b44a3cae9557c6e2e4ae56a41

SHA512
bad91044a1bb3e3b94ebb3af0d729204bcc92f244271c3fdfec4bf04be0bc84e8c8792acd59f79a0fe463cc1bc5513f38ef03b960c54bec2b9bebc9c0849fc27

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
94KB

MD5
a59e18a43d74ea5b34a331008cbe0b45

SHA1
c88f550a8c19d8651761c02d07fdb03ddcc1fed4

SHA256
2bec1c2a359fd203891293b16df59071cbd157bd17b35c492830d5becc453b4a

SHA512
62906f57b6ee7d67d5318e29f0d658528e3c47da54675373d0491a08271093391d1fd35f4b4c9965e8546e19c755b0abda0c2f370dcf25e648a445150d02d0c5

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
96KB

MD5
0d43df911dfd0ded519ffbb2c6f67f38

SHA1
12b8bb32192057de16b4f2d91a7c6ddfb7d40a61

SHA256
a8b2cedfb77e95d78c284c50dff462bae73f4568112cf0d985aa1d0656c8a3d9

SHA512
4557b3e6b79ce70bad897bd48803b6caf342e0e12d654850ccdd67480aca7689fa9ae17e7e55267ee4f5793a0b242f5b50c8ec9536ed169ed3c6388f5e6143e1

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
99KB

MD5
bd3b5161b9a27cfa65326975a572abd6

SHA1
6ffb19ed778587d6d009da452abe3189fd935c45

SHA256
9acb983505951eec175bed9ad93bfb8aae6f2c57ff1e779c8a99008bb2fc5669

SHA512
a1c63f1f7db24f4e9161a957ea7b47a14a857425f50a5785375e3d1e0f4d634c46d2dc27e190764f6f1def4ee7f5301e8613f265bde0727a75e28f3191dbc780

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
91KB

MD5
4072cded0c45a5b933798fe271a276e7

SHA1
17e5fd2d3754ab5f534ce161651657b46ec2f288

SHA256
95d7c1785f81f91407511011ceed1ef0ba90b4cb0f76a4a22066593104d41a24

SHA512
7c69b61c88e10b7f2fcd70112f6fd290714593c28a3bcb2dd39a2223834768246e71cec72342b8d718f395a5e42d7170d80862c8d48d0d9c7a8567133d907d69

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
97KB

MD5
44c032eba5509e8707ed23a37cdb82b2

SHA1
801495506ccc369cbe752c52e3398c5d47bbb259

SHA256
aa7df5907ea2928c6a3d2551b025d2a175207a5d1810e1d3e2c0a846f0b9766b

SHA512
d807ba70efb0364e5b45c111ab5b9fd55e5f43cb1fb51cf6e5d7bbdf34348129b445e4c239e2f1e0d82509835a1bbd9f3a531221a02c3090f6cb84c78a1f7dea

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
93KB

MD5
504be437666b807157028dc217c204ee

SHA1
94ced9b813cb67fdb87e7bdf2067bc592612daa3

SHA256
289e335833334d3e30a2f15a9cec8fb7bf2a7f97168e8566bd631b98df82db41

SHA512
c800a52d1ab34813d485dc3d76236ca6b3b67648574099f1c45c36ff3a408ecac57f13f66a2d7209998c8e2758b40267562b946aafe2d535a3c66be70e28feec

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
105KB

MD5
d705bd636fa9dbf66a7fe5bd1d8bcae2

SHA1
78fcde35fef0d7e8a3d6c98ab08b0e1997569a58

SHA256
04df11afdc707fb9863f70e719ab36a9299889557ffafb3ee2e79e715f152996

SHA512
692acbba7073e496813cddb96b144ac4ef724c3f2cdc4c63946fe78570c6303b4532b0e5727a7ec457f9e87fb0f33465857a58625b7e5d0dcf7309e548573f43

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
106KB

MD5
7c5a512cccfbf286ab2a8bd8c7c89e16

SHA1
2135232c673cb67b8cf8b09332dfb810bce8e4fe

SHA256
c355040740f469cb76b8657afbf87c256f178f70e62aab0d66018250d472dc07

SHA512
4d23e53ac1e955b30796228c9806667fbdc52edf13c39c312f49161f68f35b0119caec860e1c02e39d3a9c4c3c484d2ce46bd457e5495700dddbb91265d20d3b

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
87KB

MD5
acebe708e14816d2e1896d38180a4f47

SHA1
b954344962f1de0b7dedc40931e5103f3d9e9f25

SHA256
78bd1fda807596bec59b20c5ba7cfef3ba524146cf7e408d134cd37d415f7a7a

SHA512
8a6aaab46950a14eeb320a6d8f96ba1958a44a1c86fdd498728d808727002e18bb7be5b7fe1bff2727cadcce6f642a397b7c67c2869cb75229b1a54cd9f9e0ab

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
93KB

MD5
8633e1aa6b02ac17f8fa0463cfdce38b

SHA1
e3676c07eb362b67ac527645fc294f6d3710081a

SHA256
da79ddf2d3ffcfe1b69c99de1bb120212b08a85225bf5252d02a94578f421819

SHA512
40a17c71535c3fa845ac1537e6e70c1364e57e93ed24f748ff6a265b28901490e4b9aa4a445ef801c4264038087fac2d936c9235f6f95401ed5e6cb41cc80e8b

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
100KB

MD5
c9fb6b327b88b51f12d3789bc6fb05c7

SHA1
4f9c990e66de6949ed090302b615da67a52eaf63

SHA256
0ab7f36b9a2cdbdce2f1ac63c46439b82ec4efcfbe64461bc91f5b2f8cd3003f

SHA512
0ed01e0a67308ca81be0c18c7e8e1bfdb6f158b09196481505bc5b20a2b6c58227943eb5b638c06daae64a0f70bc66658a03e33e3156a7bc49d78d69fa6eb317

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
97KB

MD5
01f725729c0ddfb17a14091bb6a98d0a

SHA1
bb0b3af9d9edf0657f10ad5b2eba58f957d1827a

SHA256
a6856fc2422e9119910c3c6f03bc5a485e2e17d3172210716fe9220d38426b97

SHA512
117fe7960e72ee513f66fa107c348a9ad6153674685e610370d4c46f766b0b87ecf5eca871340873939242cca33075719cdf2d67e37d835480d3d7a24f4d0c8b

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
102KB

MD5
827820730edcc8e6a38f481dd1f1949b

SHA1
789955c10ca9e2f6d2fbbd12505eb5afb4aef237

SHA256
a9a4dbab8e359be3f3980987f7b387ffc68aec29e1e9e05d7be21c044b9a0f2d

SHA512
1e463018ea6e9f52d3b5c0211be5b3297887aed3d9bbe9da7c349a8e5e87681306516b7e3314c5926f34252753c75421aa512dbba7bf8364145e522fd541ea09

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
96KB

MD5
82297689229cdb6a0ca9a85bc4bb80d5

SHA1
a8b34e1b2bdfe602b5ea2d3681051525597264ba

SHA256
8ee3363cfd3eeb78a981edd1764783bd1a7da219fafdabfcdb0b0fea26766563

SHA512
d37b1951a5636febfefd0220463c47735694fde88eee10cbb5062f38f0aadd7bf881f756013db5192eac661e03a5b676265ac951b5110c733da0de28a055db3f

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
97KB

MD5
0e5e4d9d7931abfeb1125230cef18966

SHA1
2fab5ce6cb3574e19406427ffbc8ffdd7f1ba11b

SHA256
9d2bd40c154ec61a42ccfbfbc52ebcbdebce86d26fa4d52bdb50a7c30a9891df

SHA512
6fd736044118e553f6d5973aa8e517eab6f4e7f708c37112401d8563f4eaaf9df079120acfaae00bc07e36d30ed1700f90ef8afa6d669ced268b6ebb9419d97b

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
106KB

MD5
36645ca868c807f714782f8d747bcfa2

SHA1
ffadb5af37e8887c9293921cd5070154a6b1d523

SHA256
e5ced836d5a487091374fc105ee78f9a114105c6ec8592ec1de7cdd6b2339d94

SHA512
cb8e7538debd105d5a65ba4079cddbe452d50e63be68ee6761f5fe93d84f2ff8c38189be698466654d499458bc25d25efe2406e0d26ff72fcb2d3661e2c6cb48

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
96KB

MD5
3d8d7a3196262f3e8418d0ddfa62ee8c

SHA1
d48ee91dc22e0ae6116c7f092fdb18ef136f8557

SHA256
cea3d0e3a029a42a2131020504c5a32c8b4e5bc3cdf4ba78d8e5b0ffbb274cfb

SHA512
63f3e870524a89d1eb896da2478477835f7884b20c3bdaa58229fa09af27e7cabd35ecba3994058d071db47c721d39fabee2aec8e4ddc95fcfc040b64a511051

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
96KB

MD5
9ea4e54546f275b23296492c1d39322b

SHA1
1cca6bd31199d31d70cd19122f3aead3c4029fc5

SHA256
9a5d82933e5a405fdf18cb354ef0cb2909e05a63f0a4e3708b690ea800a7e3f9

SHA512
a22c601956f821913559859887b20ce838daef35312af7365865cbc177423a6d7959cf0db1bee9fe8cf1e5b7efe2d95fe4373f69a10535e13f9cac16e5306b91

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
93KB

MD5
3d3f68ba20e14d3f9d56864fba3d8efe

SHA1
d3a09a56d0249281f501888124639437ca25eae9

SHA256
1fd83a5ae08ded90b8bcfa3cea4c234a51e9ad340b32c2d9aa3b60207a31961f

SHA512
be144e166a6f923a78f33ca3b3e9d3f505721e403708479fa0437d42e082a1da69182159510dc3ecf9e4c6e8f38e689f3682e406092793e2965e579bd615e6cc

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp

Filesize
94KB

MD5
de6a86865067069cea31582b1c23fe2d

SHA1
76e9844ebdc8bb8b7ead9f11e04f0060604223fc

SHA256
3255ec0244c92eafafdbebac1298edd0fc4ece0003141a834ad30375890824f3

SHA512
c20d361f042649711941ab4ed6aec91b540df4130801c4eb6b9e2663a978335489eb97074b273977deae1823a3a18f4929b00d6e6c06a628144ba1dd74fd68d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_updates.xml.exe

Filesize
87KB

MD5
8fa1402c8cbdc620f2eab93e46e63efe

SHA1
f7ec69b116c126937b5c4a71a92a23d91f5183f1

SHA256
ce12df29af43561a82137132b7f1cd513a3569610a3f980804d08115d0ce218b

SHA512
839211a98225b02987ed62109a238445533f72b4609700c19f8bad4335a8343ed3e18e293b7ae0bcbace93b66eca280eae794563f362b85b7507a02a0e89bccc

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
85KB

MD5
4e6c702d7fda48298c72f38ee5302862

SHA1
37e326628330167d6d08bf718ac3fbcde9ff9993

SHA256
5024786dc4755c971ff6b4f05728d9878aa83c7abdf8a45961822e7dc6865ace

SHA512
d30196708d8d96df6d26f9da383ba90808c745e3b3883f1ef21149045e98488f5b93ac70a2d8acd4bcd60f6ba01046347bef6ed46b8545f87b92f26387b0c74e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads