62ea16a1e6f95f7bf5948e828f1159a7c42d797bb808fc68bf413d238a8c1ad8

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62ea16a1e6f95f7bf5948e828f1159a7c42d797bb808fc68bf413d238a8c1ad8.exe
Size

148KB
MD5

efedc27ade16708015d7ad8991fa73aa
SHA1

42ad5cfe8826aa855866b80a680c1e94e6d0e232
SHA256

62ea16a1e6f95f7bf5948e828f1159a7c42d797bb808fc68bf413d238a8c1ad8
SHA512

837a30cfcd7214208d89fd8572e6172fb1106bfcdc9438d9eadc608a91d3580e4d307355a5f24cc7dcd9be4aecb8fd6d26f73571ad5d27d68453f6ea05aafbf5
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBX:PqFF2Ie+eFNqFF2Ie+eF+

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5073) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1768	Zombie.exe
5060	_MS.GRAPH.12.1033.hxn.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	62ea16a1e6f95f7bf5948e828f1159a7c42d797bb808fc68bf413d238a8c1ad8.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	62ea16a1e6f95f7bf5948e828f1159a7c42d797bb808fc68bf413d238a8c1ad8.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp	_MS.GRAPH.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp	_MS.GRAPH.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp	_MS.GRAPH.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.Common.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN027.XML.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp	_MS.GRAPH.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp	_MS.GRAPH.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.Primitives.resources.dll.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp	_MS.GRAPH.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp	_MS.GRAPH.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	_MS.GRAPH.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl64.dlla.manifest.tmp	_MS.GRAPH.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	_MS.GRAPH.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	_MS.GRAPH.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	_MS.GRAPH.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	_MS.GRAPH.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp	_MS.GRAPH.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	_MS.GRAPH.12.1033.hxn.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 1768	4364	62ea16a1e6f95f7bf5948e828f1159a7c42d797bb808fc68bf413d238a8c1ad8.exe	89
PID 4364 wrote to memory of 1768	4364	62ea16a1e6f95f7bf5948e828f1159a7c42d797bb808fc68bf413d238a8c1ad8.exe	89
PID 4364 wrote to memory of 1768	4364	62ea16a1e6f95f7bf5948e828f1159a7c42d797bb808fc68bf413d238a8c1ad8.exe	89
PID 4364 wrote to memory of 5060	4364	62ea16a1e6f95f7bf5948e828f1159a7c42d797bb808fc68bf413d238a8c1ad8.exe	90
PID 4364 wrote to memory of 5060	4364	62ea16a1e6f95f7bf5948e828f1159a7c42d797bb808fc68bf413d238a8c1ad8.exe	90
PID 4364 wrote to memory of 5060	4364	62ea16a1e6f95f7bf5948e828f1159a7c42d797bb808fc68bf413d238a8c1ad8.exe	90

C:\Users\Admin\AppData\Local\Temp\62ea16a1e6f95f7bf5948e828f1159a7c42d797bb808fc68bf413d238a8c1ad8.exe
"C:\Users\Admin\AppData\Local\Temp\62ea16a1e6f95f7bf5948e828f1159a7c42d797bb808fc68bf413d238a8c1ad8.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1768
- C:\Users\Admin\AppData\Local\Temp\_MS.GRAPH.12.1033.hxn.exe
  "_MS.GRAPH.12.1033.hxn.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3452,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
1⤵
PID:1080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.exe

Filesize
73KB

MD5
ae1577f77e923e5327b52fda59074e80

SHA1
f50575ad5deb806b8f15a1546017a73178fe0cdf

SHA256
54576da53e45d1f34e1efd70c0ab6c2ac5f489dd1e4b7b8360e701d345727b58

SHA512
8cfc967ab8f58e96184a0eee4e8d1a5445847a634f58f039739df1bf48dabd46beb92586484d0eedbcf8a0e86606a12cc3a8eeca39dd8473e48c3cc75dff08c7

Download Submit
C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.exe.tmp

Filesize
148KB

MD5
96146d222729b56d2fdd6829c3de2eb6

SHA1
ab976aff9efa352eaf99f818213b40224e8bea51

SHA256
141e8bd0d833340b8879ecc2497412701b443735871051391e5dc0be68c437cf

SHA512
b3092b810d94ca2661f9dc3c3fa9c7ca5e1c21f8d064657eace0553094d2d60b33b0238269785f32363be1f15eb511ebae5c337949a5766ed169d3d516967911

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
186KB

MD5
38edd3a58502dc9aa67c6f72dfc8d025

SHA1
bb58c7904b9c7b28b3c3f5016f445b8822338f09

SHA256
f2a2979f47c6ce4be0c8c5495498e2be52f0731bc784b339436fbf2f1bc2765b

SHA512
51c4e9c0fd4ed81a724eaace5853cf6bcf32d1b7a09a468247aacfc354b7be74d5a250c08651ccac8f0805d4e6a5db66a83dbc14015507a2fd4490da9cc73ccd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
172KB

MD5
86dc1a03b287d1a84309e0154ed8aa14

SHA1
d8b686ffd31ebab272edf869ced038771567d112

SHA256
d73e5f092adb736124c380cef111ff1ad15e625ba7e7a18a5bd92861eee5a720

SHA512
23c9cb1ff2a0cb988e724cf398423661ae6b8098ec1098485ee160711350bbc912775fe35922254c286d0fe4389424ab142929d6703cb4aaa83767dae9b8ea58

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
f9847be954b841f55c33a7eeee658c59

SHA1
ab6103fb97fbd44bb6a8195f04155a2e4803c84f

SHA256
8fdbfc4a4b0a4c431f821af3c1a72fd12af83d36b449e8e985488cc45edbda68

SHA512
00acc33967e8b13f5a7efada5afa229f5eb7a9bc7a2feb72eadb29de18d839dc35abf48cc242688d069d4590287030c5df7b2789d7e9e5884feb219bd7087c5e

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
69af25659cc619cdca7996100baaecef

SHA1
287759e581cfae8848d034517514fc33ffca7f4d

SHA256
05a254955d79e427f6f1986a2abbfeec04be18c68f8e86a425fed428d8c52bee

SHA512
e34b55a367853ffc1f2c4b88e16621db0cf87a98ae9dbba8ef99a5eb719fed726f22797fd2a403fff5e2fa84d23c7a58cbb1ceeb00e9b73ed263fbc97b35c82c

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
618KB

MD5
b75b1e536b3940ef6a4dcfc5c68c3c99

SHA1
7c337fa8190741b8b54a42cc19b7f55fe24af064

SHA256
c18f9e818c4eca83c40993f9a73aa28bef3abe035b082cee198cca10e6d54b65

SHA512
8661b779286af90db9cf143bf7168689c63cbac488825423b52adff2d9ca94f82550a417fccf468c042c18df0c6b5cb000468409586c6cabd270ac108700a971

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
283KB

MD5
8a6a17a25071d6a635f68aa4c098b05d

SHA1
8e970430b46bbe688352462b48a6408d048996f1

SHA256
5e5b969e8b21020d6703ef6709be97fffc7223f5d8518d480565e349f26cfe48

SHA512
4448561975f677a0cb0a91b6de6c32d18f9fd35f6f1c6b7d82bc418783e9ab23ea4e5bae2ef22213eedc31327b7e35d526962aa024039c85c803d8175dfaa7e3

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1004KB

MD5
b8a08313091489e539f5bcb9ab39c33e

SHA1
5c5f814fca7e3ea5f4740844290aee0a4cf39626

SHA256
3b1adf69fd313defa502023514c9247eeffd48feb1eb1e310934fe29cc1c5ca0

SHA512
f264ae32aed784f70ac9eb61bdf34261b0b15a496ee417f409f380ae3bf056e31d02af9b1fac5bf62dc530bdee611d0215742908061dc14fb8461d115e99f0dc

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
758KB

MD5
b054e13eea235c16a47072f330c2b173

SHA1
8880cc33dd66b89517977ae698db3b6bc8738e9d

SHA256
3b8eabdbe0e29fc0b5b5c80924cae406b2753f70d4fde68ca9b69e0c008f2bfa

SHA512
579856bb0aa7e69dad79efa61fe1685201c8f0278e4507cd0fc2991a9169263a61ce01662272f837aabe458612f612ad639b767d9d5ea4bb2b1e0aa1c680787a

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
84KB

MD5
a987f11860e251ba9244b8932cbc2f73

SHA1
1dca2b2d6330d78535e4dbcc6db0986e61125e81

SHA256
be38d4b438eacd0e9801ae86703b5521b17d476bedc897bd95177544b03d2cfc

SHA512
f9d9c6d319efc0d30e52b463a530e8f41966edfdedd655a4ee3ce251511373c1dc5946cb9823e7c77b40c8c1d34173dce7f440c1115396a044ebe16bbf9b5514

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
81KB

MD5
b9fa3aa5c28efd381781f180eef9141e

SHA1
d7c7e442a586540877c611563e5f5864fd95f800

SHA256
732feaee7aac758473e34ee99de7f6187585dd192a613fa352ffea2f89b3c7ee

SHA512
02d84c5bf2abb0acc67bbf6cec0ea9fd2413f607cf07f476ac8ba687184ddf69cb0836408f31cd39cae92bad78f796fd73568de25a4878af55b86edecc949785

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
86KB

MD5
53ca59bb47745db3f4a78c290903443d

SHA1
b7c5f5fe61dde89c1263bdecc4aff2c219e173d7

SHA256
9904213d4da953216cc503e2746591c74e9538095eb33863c0a1b86627c155ab

SHA512
8d6298a7236d113ddd9f57690c9ea49526f1b6a713724ee9b645ad2bf2ab5dfc862843ca3d5fb4bc0c553e0f177ff43cccafcd021471dd5d11d4c00fd1fe3318

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
86KB

MD5
ce8c7d4411f2ddf6a6d0d9fe51fde4af

SHA1
7fef697f14a7c03a61d9e52a7943c6b074c286de

SHA256
20535d12a56bf3a17bddcaa4b090edcb5d27baf904c799fb394304bba2e86d2e

SHA512
5888882880621c068cec8fbe3b4ea4685b8c1522f7f8b873e1053a284c04edbd2976704931b88b2e4f364ee1554245975488cd2e59d0d0d9d6d9dcb1c082fa8d

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
79KB

MD5
efe76041c5cf53fe14aee146a9a7567a

SHA1
8c9a919be4fd041c5c0eb2eb1f7816521e250835

SHA256
04d4d254d680ce2fef8a36723d6edf3b65bf64250173d4f14fbc2e3f5aacbd05

SHA512
1615599a916e507ef447ba5cee0dacbba3956556a3f29d286f6438665df8d812f0a214aaff51c288542818e9de8d34d25e50ea9aa581391251af4835e7f1dd0a

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
82KB

MD5
274732236a49104aa4f4d09cec4dc0c2

SHA1
d8de9ca7b0827fefceaa9e8dd755a2c6260c6ac7

SHA256
e09e8f4fcdc833f0feb3dfc6c4be0688e2c5710f43b39d82aeaadfe6f9950768

SHA512
10a08732332674773c0c8187fb9d53c1fb2ad948db2b769afde8cc96fa2e9507f951918f10e3a868fd0dcf247347cb03c84c8908f9d73b20f0c99675cd9fdd60

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
90KB

MD5
c8f23084dac67cec8c3990f05fcf1ca0

SHA1
b0ca88f27968f876a62f8b8fed547b4fe89bd79b

SHA256
33d34555b63005872ced120138cb01af46c5d2b94b35efce3abfd20bfe2ffb41

SHA512
540a5e3a11c8a3006391b4c6dac0f17c0fa7d6f6b6e6f7b5834c694a1dbcb6895d09fa99a2057ff4aad0d7b7eec0fc089bb718e404ffc13e4d1647334d862b63

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
82KB

MD5
9bc715ff6fa88da73c0a5ccd777d4520

SHA1
090a1d50472522cb3e04743a34de6cc945439f80

SHA256
bb65de2612a37979a1fa44432d84e266573d463a466b0681a314a3789c60ccda

SHA512
7b860810bf6f53d40fbde0c0d6803b436ca508e20c0619610090af7037e8dd70416ba2fa8824566501ae7ad1a8596e7d31a74dcf82e8e75f945b731f0c69d22b

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
79KB

MD5
27c9a37dbaebd5b994ad4f7650f4d010

SHA1
8cd4b8b456a6089ffcffc8909c004d5999840f4a

SHA256
eb1e8c462d67db2247b09f88474a2c5f863f6fbfd9335bfcb978eb94737babf2

SHA512
716a3c458d77883c76943b4e67a5cfe2f0709fc291e314d75adf755fba738b2547d08dd8d7d4cfc3ff5a41f75f2d160c3071297be356f26ced1890d2f1320fac

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
84KB

MD5
1dcba0f93c1e0a09ea9f1206ed245e33

SHA1
ce11a24cd4b5ae7aa5360f0a0b0a591910fffcd4

SHA256
35f57442cc5ed9865b3e16447b779e650e9e220166674a3e9da6c2f45f2c952c

SHA512
38c87fecb6a80393819e7d75a07f783e2310ed5b1bca746e998118f2e8f6ddd4937f55f8e1923b29ffb54f16fe63eb74994ef247376298e1d23a2b43469cac04

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
83KB

MD5
50295fab95b6ef46d64759c19e7ee7b4

SHA1
84ce417147b4febd503e2342bea4eff83bb07793

SHA256
0fb90361c0a174a585bd655c4f8355a5a4121fa81a007d7f86ab9e88672d8f18

SHA512
e63ea07064e8ffd2c9414236f376194e45542e3346e2d8a44d583c77d08efe29ca0f70e2a011c692a2592648d7c22c0d87de5cb88d369dade21091bfa6c1e40c

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
81KB

MD5
b0865bb775fc50a28a105c1c90491ff7

SHA1
33730f5fd5ee0aac3a040695106ea632c8031107

SHA256
6c6edc144d397a383313e653d3a0772b999a4409774b0e856b520b7ea2dd96b5

SHA512
c1bff201b31e911204a72d6e86c6bd3443b1cd1af20aab2e472631b480b3590cde215c4d20cdd05397535261325e853a6965432aef36c94c490eb31d4577e390

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
87KB

MD5
425305420088ec7befed30d588176933

SHA1
f9e6a4a3e9658b8e557e6dcc2ed73264644f5f9d

SHA256
d3663a9f2d9975e67e6fd51099dc13848a02afd75dcd94ca3917806d9b00eb12

SHA512
5ace6646f7e8617ed3eb9ee752b5f5b2ab3d0b87c9fb0cc35bd3eedad2f06b6bda7a91fe0d50b42e995b57367395f0e78a871c8eac045e1ad64f07681b083dc2

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
81KB

MD5
971b0f0ba462a7293a6094487de6320a

SHA1
5615019b26721c6451754081bbd73950ce0ec314

SHA256
e5c27afac9807177eeaf827564b9bcc02ea6a34cf88f0b91094d7f216ac325eb

SHA512
79c2c5be8abf159eaf8050a7d8ffb2c4ab44910af04cce3b40f1311a3cfd4346117ccd888eaaeb77f0733c0508da8fe2a2ec3a40fc334a3bb42f80c09db2d4a8

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
83KB

MD5
cd55f6f4d2a85597becae54c1ad06bb9

SHA1
db084267123b3a920b98987b7e277cfb278d8ca6

SHA256
c0d4a60455a975de7607f0cc66183b9a0fa9a2a0332ab4694a27d7a2acc445dc

SHA512
13c9da104e2178b0a27dddbeca0bf426fd42a03eaedfa01d3b6d67bf98d4b6cb83db932c1877915a7787f7b4985ce9005060f0a6c1b9741053bd5a914d92efda

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
73KB

MD5
0f028e02252fd9f5842df809c6c6965a

SHA1
7f071929f1fe7a31e46c7d1293e76199262fa9c7

SHA256
ac05f643f4851e8f2ed4937c5172e63dd889040ba601162e76c39fa9b02ea522

SHA512
8303721f28f5f42685fd7a6f67ba41e6ce1d47c98c50ae4352572a8228825364de375ee70699b908a05ae630820af0d4428fc5f1dbc6cfc960f1bbc33025d272

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
91KB

MD5
36c8c490aa64f6fd45284373d74e4bb7

SHA1
0f9f38d94bbaf638e1d9b82269148a597a80146e

SHA256
6daf4385910c2903e9d91933101b2eda6b531ecdf53e406d261a965238fdb1d1

SHA512
65d7f11287cde97fecf8ac628ee3784154928a3b086feb1c00f64bfd38f562cf9e49e1cd8afc58a3976a1dd952f2f83e9334c269fbdd8a333625233d4ca78746

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
82KB

MD5
e0637e60b9b50a33f326ddf1cb94c3f8

SHA1
e0b162967642d5c08e7d44debdff648dbc6badaf

SHA256
18eb928412aff0dd332730a4c264dff3cd99026cb3ae20742e80b4d118853349

SHA512
54b92edb75f2be4fae225549fba63ed8838086f8862f8b97ca610bf330587e085574b25021de4a9d12aa8d1a5e4091bc81dd145da3ccb9ea43a7a67e87a50b17

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
84KB

MD5
e177a7d686e5f6f954afe8015a38c7d9

SHA1
d50f05b7b9d2df17e0f9e683d3ef1e74ff4c3917

SHA256
6dcf2a2bdde0d2c2ab283ee6a027fd8bf77750f2dcbfd8a4b53690d0c6ab193a

SHA512
822af356f2df9d12c5b93e48232bb499e59de6ea6f34cbee009bb5f737c3d509ea0561b5b59bf5e517a9d9a3f00f183c538e2af95e876ecfcc73bee11e917721

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
88KB

MD5
927597302832d8609d3d6fd9b15fca99

SHA1
4efdb9801b1d1890502515cb9baf566c641b17ed

SHA256
db591f19a13946867e91e46319ab1fbfc727a896e4d2f4ac0235229bad07eef2

SHA512
df7c919cc1489e8c6b3f654a4601d596217cd9a29866e10a09eff21dacee84fcac5c171f59223e301abd0025d86f22fb1e6669e64013fe64b55e5820ebf0a26e

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
84KB

MD5
1201213dd3ca85d11eeb9374ee068ac3

SHA1
36e063c7dfd512c1ec112edcfc4b5bd5885d4841

SHA256
5ca7f0b49dd46b09208e9ed752e475fde47f0da516e60ed0e2c0114775a89fe0

SHA512
804ace15fcf2881994e80d4d22fe6670641e558a8abeaefed777684249c08e9655930c65636a6c7484833c830a10a364dffa69d8c3871e315288a6dcc3273c00

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
83KB

MD5
8a238ce451520bee5b34794f6e35d8e0

SHA1
19fca821230b6d1e8cbdf20c53febfa9c54109a2

SHA256
5fe24a6e028546f08acdc19d4791c1e57d4b87b57b0c465301c0f3582febfa8e

SHA512
411da837e0cd853dc70298c68843208e6d61d91f6d15c41308c983652d3e4a22ea34339edf6e7f4ec8b72aa01cfa3e9569c20d2e96aa8c9c3843e4e067a840a1

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
86KB

MD5
6ed294f5a1b2ede4ea7e37502ed6666d

SHA1
ecb00b4e91dab10c002c6f2fe47235c1721f648f

SHA256
ce05fa75e922c87cdd6ecd9d569cc62fd64dde8df6844434278315abf009cb07

SHA512
b41ed4e51e2ac04f84c98545e5a5be0e13063dc7455c5ceff03f3152c3c32f1e3637e0dfce594c5330d96767e6b83c6be143a354411f5a9fecb2e4dca7294ae4

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
92KB

MD5
2007317a5a3cccb0a896cf7e576d6287

SHA1
5ee1f20cde4ffca7e0034616d935e60f711d2501

SHA256
a8c8d320ead91b91a2f0713bb708f51ead4d6904cde76e4bde57906800e4e74d

SHA512
d6f1751919df630b18c5e9cc8487a2c47320139088ff5c0a1bc06e5cbf0667d6b3bc0ac54bf37c1af2badbd476232e3ffa5c45441c77bafc5ba81c9b34873f8c

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
81KB

MD5
ae493259b62de8182bad696567ceabef

SHA1
a7217430719c0a4dbf7c77e7a4e1102d4d08868c

SHA256
3c17c7e48c6c554496eafe5cfd640cd8ebda2162fd7c8d91ae6f3945eb089a21

SHA512
929f148b0f672072afa5917fb42a0d627e77698689d249c61ad1c4573b6b08eda618d06d9571a8ed44b762547b022c39e40de3249a4bfc25afcbaea1c3aa89ab

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
82KB

MD5
d6a744dedb1a75ff3ce0ecc770731bf7

SHA1
efbb7ff3d571bed47cf759c4994dfbb2117a378e

SHA256
bc7d1a8e3c44ac96b76b5b425e366035177ea8a07f2d2256f15d83397b3814ba

SHA512
d74f836828b8131877f05a3d671890f3fa86890cf7f18f86f443228b0ba5be1290797c599f05dd2d35bebdb7221b3a196f806ffb01b520d736351dabccd7601d

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
86KB

MD5
531c6c776f3d76bc567c6d54ec11b5a6

SHA1
52c9c8886fa3a493bdedca6f03a8c819fa37a85f

SHA256
38829ceb59d2279d87fe76e41863aaf479fa8fcfac46cc62edf09052a387c2cc

SHA512
1c4d132aa34322683706ff175a4efc4a8579f1e5e3918c3135411137212f3be5e0e1fbff4edf80f22e22f2306de0a9997db71db835ee004b55516216949189e2

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
76KB

MD5
41497afecbcb3fb6f716a1cf59aeb525

SHA1
8bb96648b580d095470a3215ba543571c2a7abc8

SHA256
c15cc5bf76750de9adf3c97147add45ae1752fcb89ef713acf69cfffcc7f5f71

SHA512
e52ccd88c6bc9a0d64de4bdfc4e13acbd85db6dad5582e4fa193a83ec19294b0fa8a53319b13766391ecf0511bf68bfe703522983d2283fb865660c40b6d7538

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
82KB

MD5
cb03ec09a885c90f4d1515fbbadf52dd

SHA1
9e78ca44fdf11f501ed9b26cf23f21d7c1116fd1

SHA256
9b7d59d01878ad6cf2c4bb5be743bd614dd7666983808a78604c9df9ab5b9401

SHA512
064adabd5d19a4245cec62bc7e53ca7bff5089e12c657f53578ee0ae48e45f30ce9f070443f42edb0f3f102f7ed9f4132719a0b4b6e35a9674625bffd4a12fcf

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
82KB

MD5
3f9f04ae1406f095c95a44f85c5ca093

SHA1
db5885c14aaab803ad4122eecaa39f096fecb473

SHA256
cfb0a03ec384d77e38f1f3dedc12669e8faee1053fe19cbed8d03ce386df1179

SHA512
46e1ea2845b8539ecf1c7610f22dec81ad8d9d10f1f32dc21f6f53211ed2234ffd8dbbb2f3ee99e0bfa0b785955a8a098ea521000b1235e58425ecdf9b80fc73

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
95KB

MD5
012e6d43f732e63ee7122ca3ebb8ad10

SHA1
6fe1af75adf9cfb52c8cfb9716c89b6d7c77c636

SHA256
053846842ea4c156265679b596903858b500beee18d3015e75f76c100f6640b9

SHA512
898c5740208fe7f2eddf5f1aa3bb088400e671f95f70d3d35d92c84f8b6fe63eb8c569d4d011b256475e68486f0476dde350fa139eaa6935e14a70221f9f94e5

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
85KB

MD5
cf68abdd78579151488adf41cc5445a8

SHA1
71865c025835d9c78b47f6dd65c27bdb3f813002

SHA256
446c505779c50841fbb84ddbcd9caf7f713270be4cd3cb8d6b0592966fe550a6

SHA512
ce654798ec4050dde3a9b093ed8bcc1524eb2170054bdd083039f79c2a3f9348c19dd0b6a17fc15f59edee0c3a1d9f521e855a4801a6b1400f152b1b8f455b30

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
80KB

MD5
ed0c3c58fdcc95bf32a38ddcafdbe06c

SHA1
da374da04d82ed11744cc987769d456ddbe1ca2e

SHA256
9f9d3d9c4dd51df419b629bfb476cef5d2785c28bc07267048719f1b379a1d64

SHA512
dd40cc81222f83ca2bbd97313f0c077dd12826431f3dcb10342033c1acf607c86629c64a2c7518095109d3357e3a6c2999d51a55868458997d81d3d111b18ce2

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
74KB

MD5
b2f95c98b6f248dbd24dd690acdad956

SHA1
e15042ff205ad53bbd7c226f0c08a315a6b7d9b1

SHA256
5efd3dac850dd0d83459d277b020e270fe12238c9eff922630f0c4d5d00ebcb3

SHA512
e8bc77c57d2e75448104ec02205aa27358f5d31c7332e3ae503d8bad5cc13e7cecbf79470184c5859639f3cc78f760fab4366e3de3daa7bceaaa257f561ba4b4

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
88KB

MD5
3ba1130aa7191448d37ced52d8a77921

SHA1
a4594263fcdd1aca25ca5b9bd520ea5c7ea59fd4

SHA256
3ee0b8399608094506f22c0e593e0e3db7ee876db3d724fc09afe15f4ea88ee7

SHA512
002c03c2f8ed1088496c912947e78b0b12736a39828fedb3adf6852648ef7a68d679dcb858c795b396feeea46b9da2ecddf9ec3b7981daacfece0a07a1094d07

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
74KB

MD5
a864e80f3df3e592956a12cba2a55f88

SHA1
5f81e8938bac15eebf3f855e1843534cb94ced48

SHA256
81f637378d586c0e15b3e973e47f985ecf6a9cc4bde24ded0585d32c090bb32f

SHA512
8c9c9c05d4a2ccfc5aa0503ba061aa69c9b2ee2ccf73e24874c1b223fe8fa61124d4baace42b077993ed2c9817deff9d1ad676eab73bde725d88cb60e17759d9

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
84KB

MD5
45524599555971639958b35d9afe25ea

SHA1
670d41bb443be7fb8d4ece8ea0d230137604bc97

SHA256
11f3bc7c321299de856822510b8a342b5a65fcf070f4025c47e932dc572f6d12

SHA512
974eea12ae307082e73145a991c453bc6b6b2752476630c7f3255e10b5faedfe34ef441fc8d7075157717e665095b0705246c6b593b78617ac020476b9f338f2

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
83KB

MD5
72e59a79969066d7eb64656c6cff4840

SHA1
8d4713eb48afdc6808083cb06b2bc001fcd00f70

SHA256
b787348b2d467d6b33d5bb765e46799f167340ec32c7e1e73da096746cf19354

SHA512
4749390cfff0c00837d326d0a574d602ea698a97d752083508a49cb6366c824e3bd15e96a1a60d245b5d89582fbfa4c21e8edcd9df666176cd112542be6fc7f5

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
81KB

MD5
b111083d190fa5571f1c50bf743b9634

SHA1
9bdb7bd1586286e42643800c9bcae5f6ee424263

SHA256
a386d1375f724c50f5071531a08d69e55dcdb7dc24f5f6bb11dfb4e14f099959

SHA512
828f3df9784094f294eda8ddf989744f916a70e770e20be78556ebcb69dfdb94ef0608533c73e17e3e35c60d3525499c0b5e65f6e38953b91047e8302206d312

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
88KB

MD5
fd7ef3f0385b7c4d80cf6f11ef65b771

SHA1
9b4a6ba738b24926d7c5d64e6742f3f7248acbe3

SHA256
48e2e349a2324a454da3d9fbba75ca8c0bcd7bf137cbffc7686818dab0e358c0

SHA512
b7d56e777df9967557b58c9c1007894e51cf47b4a42a57a02749926ba4edd0f1776121bcdca29e7057e97d3d72708ef5f668c05758f6db5269128392c3c6c19c

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
92KB

MD5
208bf5fe8bd82b59afa13b8003255826

SHA1
4835ae6ffa7f4461f3f189321432a45985fd0348

SHA256
a8313c17a19a173ae2b16e451a5543c6d7114e5b3b0f09ca79398a0c622d0d2e

SHA512
44fafdd7bd6406d61e044a50796c782dfa524efc85a2c0f9d5d54dfa194b275f00fc7cbe069aa5d580e3e8c9150ad7678a9207d6e28bf1b66540e33049155578

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
64KB

MD5
af2283ea8da4d387d22f022d6c805bc5

SHA1
cce2966002344b01e9a2bb3c5eafcc122e596acc

SHA256
72074b32bc2e3d54d58161a7e61d429ec95cd671d12d2c23cb37bd394c21c182

SHA512
3aa88c5d1a1a308f21df01fcd393c6e5767cccbea997971a7c30934b55cf62481a468ced23279743ff7d66e950a7ea1f44dad738ef83b9cbe0f5e5447a5f14e0

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
83KB

MD5
e3aea0bb6884b4596b10d1f248020ecb

SHA1
17e5512bd643349e52e0c1a3208dde59ff558599

SHA256
c07f3df5ac0d575e44c50d353563e2d5de97b49d84f8726992e360ee52360101

SHA512
7b929a41ca87f667c1ad6161fcbd11d91604196fd1e5b102f38a29b9f0e53e567783771ce91daa053d99d0582adc6c917845f79d1bf8de20a8ed79c5252bebef

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
80KB

MD5
0f2daa47b7917d6d4d520124d230ef2c

SHA1
087db050b3c2d3820c8dd789e1143941ace99baf

SHA256
0405d5116894be6c6a7cf9bb9b58b89070c6bd2d55a0c503fb86f44cbc6c424a

SHA512
7f89f21133254951f7e8b657768d4bbae0b4095d5f548549b05e3db46aa7c8c42630a6947deef2b8f075507d1d5e70c38de9af065e8addc0fa97fe705f201ca0

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp

Filesize
98KB

MD5
61bd6c4d9ebd9456cdd98c537f86fb2d

SHA1
28f6694c4d49b2b159ebff0aa276f210561c049f

SHA256
f130aeb59f319d3d7274056c4f6e32726c76b60fac28db609c1669067e33d10f

SHA512
db64ecdbb1b266b3d7b8feb667c161a53ef9cb97d995470b3d92eac2c7f55d8d6ad80adbe90136e67a0cf511bc77fdbc1a15c263a6ebd08bcb0c56122a3e8957

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MS.GRAPH.12.1033.hxn.exe

Filesize
74KB

MD5
1b1925df26204ce0679ed1c3b4fd2c1f

SHA1
4b79fa1b111b79db3dd8ecd646d5e2f13debca20

SHA256
b562468dde5c465fea2d184c159e4a00e32a9d946311dc5f0812e1c234771a4e

SHA512
c5197be0c846c472b6927d634bdb950ae00943b9d8127aa3d3c6a4d239a4ea751b2a52de21288ebaf3f9b1ddf75687ecb37df7e431fc0b5a210dee358e9b79c2

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
73KB

MD5
31c8aafbfc4ecfe736869213bb61fe6e

SHA1
47e6d67b7d76ed67e2c069ae52bfb5b859dcd941

SHA256
52120cc0a65d259ebd547040eced5956e037e7b660dd42cd43809b68d2070507

SHA512
6ea49660e908315354cc9dc2fe32798254d78da0bfa98595c9d389acf88de2c596667e49b30b9ef6faba41a51ea9cd50f1aaa0c29dc96d029491aeea5a7c1b9e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads