52d4bee3f235b07e109a40ec41cb0d328187d641006b9b889b1bc5c26f4a1d64

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b54648f48936c6e51f8790fb25c3f080_NeikiAnalytics.exe
Size

203KB
MD5

b54648f48936c6e51f8790fb25c3f080
SHA1

3382e65d6e942c74e2402dcbfabd0f3a133765a4
SHA256

52d4bee3f235b07e109a40ec41cb0d328187d641006b9b889b1bc5c26f4a1d64
SHA512

28196c71100e16673e70a9cdbb102b5873ee73e34f062d2ab4e1777848de1c354fd285e2afd7e48f2f220070b47b37ed872d71595399d9c38307dfd0c7e0fa45
SSDEEP

6144:RqKvb0CYJ973e+eKZ6guqKvb0CYJ973e+eKZ6g7:vvbxYX7Z6gmvbxYX7Z6g7

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4868) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4648	Zombie.exe
1420	_desktop.ini.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	b54648f48936c6e51f8790fb25c3f080_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	b54648f48936c6e51f8790fb25c3f080_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\t2k.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTest-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp	_desktop.ini.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\AdHocReportingExcelClient.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 4648	548	b54648f48936c6e51f8790fb25c3f080_NeikiAnalytics.exe	83
PID 548 wrote to memory of 4648	548	b54648f48936c6e51f8790fb25c3f080_NeikiAnalytics.exe	83
PID 548 wrote to memory of 4648	548	b54648f48936c6e51f8790fb25c3f080_NeikiAnalytics.exe	83
PID 548 wrote to memory of 1420	548	b54648f48936c6e51f8790fb25c3f080_NeikiAnalytics.exe	84
PID 548 wrote to memory of 1420	548	b54648f48936c6e51f8790fb25c3f080_NeikiAnalytics.exe	84
PID 548 wrote to memory of 1420	548	b54648f48936c6e51f8790fb25c3f080_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\b54648f48936c6e51f8790fb25c3f080_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b54648f48936c6e51f8790fb25c3f080_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4648
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp

Filesize
99KB

MD5
39937800842a49c5df59b33ece8463fb

SHA1
3db637fdf95fc4a8da56de43216e31c8e1be9194

SHA256
76da406f9cab4eccd89c03d2cd33609231042f9e77c65f7d343adb3e9123e752

SHA512
6572133884f5dff79efcac817bcc4a5931b38fd33357d9f93a9cc9671e8e6f6e669e13c0af158280905d669a7a6a92299d516fcd2e39a1b15f4c56741c047708

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
211KB

MD5
3b75e30fd5f81d1f0e4556cf84c89858

SHA1
10aa2f926f907b64aa9e17d79ea5aa3102349d69

SHA256
171bcda0ab89ad2ba85eaee8cee3a4ab0efefd489c5a849cb06053423d8dea6e

SHA512
b1c76cb363d906517a0d7bf229ef5bd74f29212e561afb508fd764942a76cbdb460cf07b6bac3f24a979ed541d23993bb6b0c4933dd1c3ca04b4ffd8fdafba98

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
169KB

MD5
b3b5cab9d9aa186835de2fe873de33f8

SHA1
40feb91303de7273bda807718f4bd89da8267d0e

SHA256
ce75aeed65b4396cbc13cdb5fab90741fce59410d35d3ab3ae5e8fbdec919ae0

SHA512
7aff368b4c914b48deed97ac8a48ddce098a70e24ec2538f9bb50bb798ecf136fc52e38f5ec4f9cf1a19678734678fb1456f68c1ca340a9e4b8b3fef82073764

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
ac251036de2c9fac5c156c1f0890ef1b

SHA1
ece111b96948e71eeeaf404aa5ab24bb18cd2b9d

SHA256
2741469f19242cc84e60ef59b31e2e9726e85b7fa10640e7c588463475afee90

SHA512
e74a61e32264181fcfda183479673bd928dee5b8f3ff5686358f3c0e650586883b6e349c153d0d646b06d27a2b2b717a7bfbd118a89bc48ebe866a91db391da9

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
648KB

MD5
1c44522b74cb9343dd974da22694d0f9

SHA1
26146a28c2d2bb9ea7fbf8d227e5f053f7038275

SHA256
d8f5aebd6541e10c74ff88dd15b65f3788e781236d293cc8ba34e178a716c1af

SHA512
c129fffddcae6fecd0137583972fd9ce5797fdc5677569772f6778f2a31d775138b1b07e6c671bd7e1041c9aaa8aae1523670aab38d8325c15d9dbacb2d105a4

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
293KB

MD5
ec87efc16ae4b2c45256b7780f2ed4e5

SHA1
00d2834386859490cee121f662589c8ea691c6d2

SHA256
85a2791c5e6c4cf7e8e23756e6f4d8069398fe4834fa17438b0f35914c2c07ad

SHA512
a19b932586017ae75973dcfecd5ee6a6799134d8acd0ab5520123a08f15640c9f9d83f46aa0c08be3e4acf50e6c202bfb5bde640aba0283fed8ce1f6424a7462

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
6c6472109a1663e7a199f29ced860f1c

SHA1
7fec8a65a6bb22be6ad2c5c5a245047b85e5b19c

SHA256
aa774070a3b0c7693e539a07956b074b13634174bd7ec593fb41dd59ef5bc7cb

SHA512
6cd553ed76223a3d5d16502e52dcefbac36c0e7c7153954011f80611a16e89b1931a71006b46d3b8f96da1554157f9b09c77fff4a5b531b1c58bd7a67aeb20a2

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
788KB

MD5
30ca8672760f0efd8b139fdc5702dad6

SHA1
3f78f0177318203247fe04584a1acaf44e1e7cee

SHA256
4b72cf2d80bf86ec73ee1f3a0dee2d0b10a4d6467572d1c9bcc4017382832f5f

SHA512
775d75c92a9c5d56f9aa7f8134d37be9ea5bbd1f868e7aec385a224a561de7c8eae129d630874ada4bf4190bdd3690c49b8c1ddb7b1df144eda3b0367fa22e3d

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
161KB

MD5
fed649d44e4d3039e6fea3872d9983e6

SHA1
21e0b77f252763796675436636f740417fda48ed

SHA256
a82d44b0932e87633d0445c61f3e41913026e681d781d455e7330af9441fdfa6

SHA512
b2f92a313ec139868c33559b7a87f4dd8167eea1c1c79b2948b5d92c84a113a80c1d893a8c1c8ee127364db39e053fb56d30217cc1031a01ef68a0f7da04c536

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
114KB

MD5
3a72377d5f75099887b30a16e45b6e61

SHA1
87e22ebc12495355f86fd05dd0b2c432024b4725

SHA256
dbcfe8c81f27484078f5a27bb3c3b59d61f5682be11dde6fc1806c2de899c98f

SHA512
19543fd3fb717c073f6d777cf6dfa7488decc6b8a3c3ca92c151b9e979c512725e75e508230a2a9d519c044ab659bd58d5c33133a8e85a51803bbd1a63149483

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
112KB

MD5
412ff7a975266db5498f277b1d550580

SHA1
e558de2bc5a6b5ded27cd7df0d4aa8f43ae881de

SHA256
846f316c5f7107dc30c7ed62000c849a06da40aa4d45c84605d28bafe07225fc

SHA512
c93fb4fe287d39126d678258958490c210547a3e62591bc929f54485190d63b4d732ccb69c5ea88bc4e6ce45beb147a62bc188ce4ede4fe686befc6af0e07877

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
117KB

MD5
f8b527e0cc19c191aa2f44c994ebb643

SHA1
a7639dd66300b283a0d1b287028d3dfcdfdf436c

SHA256
a144cb3a3c534fcde4ef80046e81ea65c9bde5b01bf7f1389f593ddd62ed54d0

SHA512
87d38e495f683ad7acdfcb67ea1c868d1667d2cadc8711278bb868626e911ecb26101c442206740b8920dd61001f6444a25d8666ca139b26b9114b3eafac32d4

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
104KB

MD5
e991fbdf00eecedfbf4a7acd46870e94

SHA1
3e9297d87178d12935a89b5de131a1fde112ca85

SHA256
2214e1dec101098c1d1c24f887f302240a8d1e43c22a4dea26d3e9bdc50c59a0

SHA512
529386b2869ea27e6154c4d1a7f298066317a02e0b2f676f1c77aff4871fe131cdca011ba82792f67d7d75aae93675c48c86afc9aec61c390a774a716f90b3dd

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
113KB

MD5
1c081469974a6c78378d7b2f6406a763

SHA1
102d29f5d46b9014d11c1e47564e4200b1325310

SHA256
26aad9ba86ed9bec6f2197163bc088a709f0734c5bb9934ab3118db2b4357b19

SHA512
9494925ec7ba481c5b173e98ae1e640af1bf26acbbc419d8ab353c151b8a6fc5e5bccbcaf1f2eee34a566d809f0f9a7bc2ca2a5b24e52eee7acf28b431912367

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
99KB

MD5
80ea2eb9c4a5d93514b35fe987ddf9f7

SHA1
b382bc2960e520aa6c9304748ca1eae2f250269f

SHA256
fee284ca5726d75e91e81b6d1a011cf08628a2951d8aa7e71c34fbd19b5a2a85

SHA512
bbfc7d978b338531591fb946d5b3c13f8c69b11ac4846ca5032bec55ffa14ef369337847b9d813ef9bb48b0b6285fc359907e64277bb63505b0942b0d7a7a44f

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
115KB

MD5
04fbd3b758666d21294aa71e06e749e8

SHA1
32c498820fea966253d75d7aaf720567f673605a

SHA256
57f0f7dcb190242a530582536acb704f61693c50d31566fae1ae48d6e3453023

SHA512
a5ad92fe470dc6fce05b3bcb49c6550cd3ec12dd5457e71b6b250f8580a575909e980b170d623c2c821c0ffe73c3259c305800fd25cd364fed788a30d997a068

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
113KB

MD5
afdda8e13ae4ba391c884423f649ba6b

SHA1
a8f036c00620f60104b7a8f8faf27a77368565f9

SHA256
476ec137c7ab0d26de1a7b382fcf579bb9ece14625e53b958679c39daeda088a

SHA512
b0966950eceb3dd1c9aa4c644d77e9e982b86d7c37c11d066a1dc6a42046e51d9420d4329fce68cc96c112552a46f17b44d08c1fca9c4b5a6632231306dee5e3

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
112KB

MD5
12cbe7ec8a9652bffa6d09b1962b3dd7

SHA1
fd8033f84cb2175aea66d0e47f0ec8994e7c15b4

SHA256
610530ff53527d388e2198755632a413577b9caffd48fe8b4a00c8e1e73ff246

SHA512
12cc917abd4407454ba5daf94ad6aa852c07c57e626b18a35c96f0c76a0687d6cce8d0cc7e9ea4438690581dcd2de6075ab97200e10a096b886dac2c39b430c8

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
113KB

MD5
d0167cbdcb265e62e653b8a098b9540f

SHA1
d6a02e652ce7a0253e373c19eb7e731849266d91

SHA256
27cf5e4cf89cff214ed996321a0e1b6861b3838178c5825ebea7aa284586dcb9

SHA512
f83387cfb52eba9a93bc35dc61e43146eebb93cdfda7e8b3d1f85c6e13344db0cc104b72fed484c8fa016ef28edab41631c2dff52d42f70115a65396acd4b6ff

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
112KB

MD5
0a1addc5bb3888952773dd2c6380bbf4

SHA1
c7cd232e8f1a87714fe60a54b00e5c37eb0c119d

SHA256
7418a5c7cd9263ee47e0ece742cd833844c003325b829ec2690b27ab49322158

SHA512
4e57c38e705f81847606e12e5427886a5113cc13134ea7ccd7dc413bc72cc09723fb336e3b4f9cc51cdf055f7534bd165e0d97c26eae13e02157c7ea98a35e84

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
109KB

MD5
a23dfcf3c0a0d1e9a23abe2c41aa2f5c

SHA1
2361f5d207498015fa923a43b70634a784ea05a2

SHA256
cc4bfa2db80d996975137ed96dc974a939d82e90358ae99e1f3d6f9d3f5b4120

SHA512
2419a977d6bc5253ae3905197e1cf11052aa47c671d01ddc6ca5c2893fd9b20a0597121ed1bb58b75b7251228209b49b9dcba9eca66667672347bccbf4f0ffa3

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
114KB

MD5
b28833108ee0b43907ccf96fd29bc730

SHA1
7a8663084a273b6ab2ff9d70cf05b2066880752e

SHA256
53294e161f3879a3d4472af404a966fd962e8fc0f43897dd2c7b3bb55a811dde

SHA512
470518fc978cab0365e6e0b07e2a83048d287d1acc12bf1df22720a1025f377df5b0116ba706a461ed5aaafffd4bef9182704ed6cc031439b88125c865a1e8c8

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
111KB

MD5
5babd7475635a0e2cbf23998b482dcdc

SHA1
99d8053ebd71f9b426f26b7806a23f175beaa653

SHA256
f11d76a1f3bbca67666f0486cb7e051e6ea7f163c84503150590c358fd28537f

SHA512
d28b0975c720878bf96b3a697cda34f27ec84a800bbae3469a993942de666c03250d8d7c4eeb9180f6fa0848877c5011797fe87da91374526f0b3bb0fb0166d7

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
112KB

MD5
7f62b45a36b0ebd440c49c5dd7d83851

SHA1
ff3772a35be9c3cf6a113605de51e801a37b27c8

SHA256
4fe7dbf028c573af66a768e7f4908a07c6eacd82c6faeee3af4215e61cca606c

SHA512
fe4aeff839ffced5a3159358d5a8fd6c603308cb05e47cc2a73c21af5c18958e0384c76b28eae6aad989b6522594c6ce45475a76dd6b2d4b51fe5e82becff79a

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
118KB

MD5
a213d75b570dcf7c7504b08c308cbea8

SHA1
cdf733bea901019a3418a1ad3ffa44e16c7b9b74

SHA256
9b05666b4e91f3a95adde3b36561c5badfd75425cf59dd587a160c739bdde974

SHA512
a1b0f6a38d8027e1dae262f8d71b2afa7b7de10334ae99da23d66fc28701fda402e5ab2caa09a8209c58560d322b847d159fa70d9001338198ac703cef5390fc

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
113KB

MD5
8196e7330c6ded49009914a4cf99fa2e

SHA1
ef31742180a396ac27639708ee122bfad56a376b

SHA256
3c76737ea6948e1024e6a70bdd6f97c5318474c09000b1db421ecdcac68affbe

SHA512
f497746ee012bf3bf19380d28f390a8c692bdc62cff4b49b43f0b9cf8ff5575935b8156a2436699b080e93ddb0d4746de68668ae1af7129546ac428b0600cf30

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
108KB

MD5
4a9f22883742b2bbb907258bb26906da

SHA1
87a08800d47bd6cb5cd2fef31d7f563ecfab6608

SHA256
56e52c2506868975d83cafee08061721b5abce878d391e8f9ebbb90d64d16592

SHA512
e9bbf6ac65883c2c118f13d96f5c7e3369fd72dd3cc22f5259acbb0510851ecc18d2ff2bcd7267e2cf3d256705953767d186996c4b48cab532bdf982b367e263

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
106KB

MD5
b0e7ea6ca8c3506660dbf8d66752f463

SHA1
e9831c1178690ccbe16db7e2264f5bff86d39f50

SHA256
4f045b23b8cdeafaaf4f90f45cfdcfd33d9149e0e2735b2367a5f00027dbfb9c

SHA512
fac81b1d3235010c9c738dab043bf500b011f7ef897c0617d94626dd31615fa6de479938668b88ada2eb8557771f532d803ffafa940b6c88f4b4c53bb34a0e6c

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
105KB

MD5
7556c10bd528172837fcf9ec268768ea

SHA1
6a499b4d8bfdbc93eb5e127fd8d247af740dee7e

SHA256
29b1bfc2c4b7813ad1f683d55ccf3d1cbb75718ef21a3195772a6f41369fa7a7

SHA512
3c30240cde563567b69c7afcf94298e1e04577052e470e50a7eeb4aa0c1570468632cba08d4d10608f167540f117c791648d40ec3fe2f39da633e271a6dcdd97

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
112KB

MD5
e7251498bf37844110195e18f4aed6cc

SHA1
b72661677a78d752d76e60f10e03abe3744bd400

SHA256
7ab8e23b2a54ae1b27cd5422ecb436dc69d85cb71d5f4bbbcac32f3b49f7549c

SHA512
fd0e42588b00e83227190e8375545e07780e9ddafb5f5c460c9bcc40571e2a7816d76183e5834e5384dc8dab40d44810ddfe0664fd3ff11ee9f8ce88788c746c

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
115KB

MD5
243723f39dd2d6485aa7eb0f240158ef

SHA1
b2d3fdabf0578682aa7e46b842d30cf02d7e982f

SHA256
09f0d0e50ec4559f8838eccba0a7e2582584aacfb168e8993e76516bddfdd62b

SHA512
b7f096d4faac16856d2a345cabea1c3f9d3a37f64035d65543eb7db32bfeb5b909035966ec22581945692dc9dc363a8c9c2a5bab8eafd52bce4505e358701dd0

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
114KB

MD5
0c5b00442e603cc08209d727aa893ac1

SHA1
8eb0fa977d9604ca55dd80337bd5c76585ab7e36

SHA256
5652042e12b31d14adefd9e6b12bcf8dd20f9b5ef08ef9e11dd2cc641ef3d30f

SHA512
f9382785215b4b4cbede605cd99542ed18d695daa8a4a19b7ab5bc7ce6a3fff06705f2fe640c5a9ab52d7318de349eab1d810b445015c7ae42ae456f97a032f7

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
118KB

MD5
123156b38566b9459cf00903a7184bc1

SHA1
5fda36b160b404877dad4e25c47e36de10d52c66

SHA256
185e41fbc8a47deca370ccc92f774518b72f69b8e9327e895677d4b889f66224

SHA512
7a6374985120a6ffa51d0ccbf779fc5321600e1bef38bb874c1715225d8f75966fa3b3832abc6c146f54daf63c6883831ddcbe2eb1c60403dbdc3652dec77d86

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
113KB

MD5
d2357aae5371cc100cf1ddda90879f60

SHA1
c13f1d1b61878f12824bfaac315df32068f058a8

SHA256
fc82b51e3665cf3a2c016105760494aba0851b6abda0df0438bfdff0808bbbf5

SHA512
0b7137c38f04df27e13108df78406028e8bf76608691fe1a005e305e5ef1766fb0ded3664c6e465862628497b0f788143215bea1ed03ba193c51e6ef42b02dea

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
113KB

MD5
7ba491eff5a64d6acb43edefadacf23b

SHA1
0448e15976edae1dcecc0a12f6dbe0ff9e2cb935

SHA256
95e79499f66f2f29f15968f5de00e0a7adbe8b296dacd570aa77fa776d156fba

SHA512
17ed07bc09fae32605c9ac57a477fcb9bbcceb4b0b12ea3a5f161652325a928f26183a9dce41feebf92c137f2a8d9f55a96f48b2b72a0b3d8d25a2f0b1051bb0

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
111KB

MD5
9873ec534bc043150f06aec11efbc845

SHA1
88c0efe8582f5b8e0aa019b9fae9d7f94632eac5

SHA256
87e526d62ff624459167764c67e6977382c93cb993f402b92c26dc29a6cc35d6

SHA512
dc87f2c342a837bdd0540af81df1d4b41f80a584d5a1b6b898c5b1cf2b567365b2d81fda09299596e5e292ecc7d42a29403d4aa1523e55c5147a452bd2dfa4c0

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
112KB

MD5
78b9834a9bce49043ff77c51ec139fb8

SHA1
4abe367cfbcb4e8d84fedbeacf1b9402b308bcde

SHA256
1a7284c6186fa6b07fd91975995ab71bc61b2ad4fcb120249ec28f91f440cf13

SHA512
08c629776001ee0b93be9cc164bf458d6993ca61ac1b8a1d61479150422defdd20a6f894fe33abd91a697776d7e56cd2c3211e4e52c59a131e42fa23d6ba21ce

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
109KB

MD5
1185b76ba4082bb97988f0ea715c7d22

SHA1
993fc155b8f7fc8d4c9b1117fa78b69975dd5073

SHA256
59c99a8e42db4aafe582b6b688f2230f214101b082d41eef2935cba8b686daf3

SHA512
3e93be5f80e8739a5966b892390d05d7c7b37d37c265984964c2cff840a37950adfa6e407adb1b2cd805b9ebced65db12cb8267a5b667f484e6732aa16210f1c

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
106KB

MD5
79c171cf6d516c34c54ec0722159906a

SHA1
c47e4fe12fc037eb6dea0b02230b7592e7b0d1c9

SHA256
bd0d12cd27cc0916c014b3c407a6e0624547a4048e098a8a0beb53ba29045518

SHA512
3d9f0f4e45de5e6a15f9ee601baf9081153e52a6b9c2cac529b93939f272691bfc90d6ae4244411c03620653f848025cf0593f63b00647405aabbf16dbe596da

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
108KB

MD5
2c32d58fe7df0cd0fdbb25815eb40f6b

SHA1
a816eb78d504c01e2094fe43098cc1c6b5cf13e7

SHA256
74e0a63f70ae38341dcd6396146d319ea73e32eb42364b716cebf67b14f6e70a

SHA512
c70a9c5be08140d8c86777287f793782f403399e53ee4c68d3dc492a2bc13d33a1b30e094b7827beff62d0df09aee5daa6a3bd9711b6f5571d2f16d15fdb5228

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
107KB

MD5
9c2b9784a70dd11fc58b4bfb13a7049e

SHA1
9da37dda20cebb2b0d9f7dc31af06749b2b731d3

SHA256
599e2d6a7c7a6aa091fee751ac3fb74c5d4213500dad03f021ccab7f87bac868

SHA512
ac3053379d8d8f3aa33f6e139cdf47e6b39ef96591b4bd1bd53aa8395af2adc9ddcf63778311193b0272581cf5a1848a76d5bdcb00067900eb876016cf1399e7

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
107KB

MD5
155c33e6db0f9904f602cbea6552fd56

SHA1
f47218966cb4d0792866983d8244392c64fc9858

SHA256
fab4da257faca1abd6a6ee91888171c07f73e8bc77012c1dc99556143f7f551c

SHA512
f856ed009e81b0f7fddc43251c1a70c7ebc4e27b8356159e9e9a25e802858d64bef1b9f6a8d10b93172c6573c3825107a37a0037d6eba03e2394692235e59033

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
118KB

MD5
d6af7148527e399fa1ffa712ab01d952

SHA1
52dd3d8fbbd4ba9d45944e7ec6bdbab49f38abab

SHA256
fbc8b2754c6f984064f770aac7d785f2b35251b16085cb550d3b52df0588ac69

SHA512
8b157cb608fcd667ced2637c830b15a8d04cfb2c218cae951ad5b63918be11b8dd36796f584f61cd5205cc1fcb6191001ebfa3e559779238585ce18da754eefc

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
125KB

MD5
fe14667b77c2f28a1c9cad33d856550b

SHA1
df05d17c45c0ce7065188dffb3e77569d0115efd

SHA256
529df6e8ed7e4b964e4ba911ad99fadbe665e968d0b709acd08e882840284f80

SHA512
8e312120981413579ca200ace98d641b3470ad4d28752ff31a0e8fd7b50c4fa195e37aba6beea79517ee3ce683ac6abc00d54455044ac1cc66eb2c3bf5105a55

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
99KB

MD5
c817fec9cd330f5c68846d6b84fbdda7

SHA1
6cc3e5c26a73a38623ac5cf05b28ce85f9154855

SHA256
6e3e0871b1de282a77916515fbf9ef4b3391c6d64d7d1d54f09ddaacacf33661

SHA512
435b739b83683b2f4f74d3b3cdc53b629e36d60bb97cf16d54db3c9e6befc512252ba5fdfd0e4e9e8dde87636acccec7354913627b9aaf4877fd61fefee62bd4

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
110KB

MD5
8a5a77bb342f8d25cd86119d2888c6eb

SHA1
93d3096db5ba58b7441ef47b3b8329c047fe314a

SHA256
594601c68c59e121176e0549ecd048fe46e6fd2ef1ee255088484376480d7c3c

SHA512
9d891d7bfb6fd5af57070f419fd33a338b68f60d8e50499f6e8534506cea9473452288de42ef52ee457a061acc16ea3fa00d69dca7058e8cccfd678ae6d0253e

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
117KB

MD5
f3f932cc64353aad6a5c6352a438df9f

SHA1
90bddcd68c7a86b5dd871e31c4764ad1aeb13126

SHA256
eab0318878bba66f2ef6b9776c0ec4f2bbcfbedcd42cc74acffbf9b8c5c7b2fd

SHA512
f8669d181e2571ce626d23f6ccde04e49276219abe156fadea7ab7cfa12e8e4c1ebd9850386659e6a524d37e1985c86dc9a437be4759b1e286755831ea9880ea

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
113KB

MD5
1107d2b77ca4cd12121989ede834807a

SHA1
622b71396fabcf60bd399b32ca3f43bf50ee78c0

SHA256
aa83b6c0795d70a52e03032c269b549ddeab551e5ef3ffd3dc639e03ae904159

SHA512
be34e47471719ef680046ffbeaa9bf6d07a9feb5f7f21a6cb96ac85e1f2667b18a1d0aecdee4fdfe55697c245ea4eaf32312e1d0683f80d8bfff316c1050a3c0

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
114KB

MD5
3d60b1713716549f321335c086391517

SHA1
44595195908f89af7ddece524ca314a1cf10aea4

SHA256
2e5ecb5d43d67df524a79b0febfe2b0429a3950e9e0c2c6004d430f0fb56e282

SHA512
54ff13d6f7661a11375cd6ac23c428a92c95c8564681c968c1709e157671ce9ad1c541129a862fa8763c29124f8b05121611106a8ed13096e485348092b69831

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
114KB

MD5
c4758056a6b785698f96c30bb5b66b3a

SHA1
54fdb2addb046e6bacc0cb3087c051cd3e2d25cd

SHA256
7e55d6141066ab8b2371c5fa6b0c7871ce9f87aac5b3bcb643d8b95c3fe33a7a

SHA512
2406784c9be9b478833e656cf51f1faf0270a044cbb8302e543e5c5be74953e58c83ef71383c5a4f511d262ae7956f1bf93da905feadf06dca4a6fba998cf81f

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
114KB

MD5
540e26162ed0f390bbe26ff4d7b5d9d1

SHA1
09fff1ad843cb6dab8b79554dff8ce670ae86126

SHA256
084d764d89a586456b2d67c0894763b1149c520f7c341541fda233c9dcf93c97

SHA512
12c330a969d59968beb1f9377ea3ec85acd4be2729cb6edfe359f3827ed2add90fb24f9258d830b0482df69c8b01b06713807a7df3eee3ab83cc09d07bdc8f1c

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
99KB

MD5
c5e98ff67e587362914adcd89c8b9d22

SHA1
e5cd28b00202fd73093c751fd2ff2cd54e1ab212

SHA256
bede1078f390850084788f3a9820ad1044393cb281836daaefbbe29f9fc4702c

SHA512
9a1cf87a334de129db893db5d8cfb14ac4433ca735141c7809d9fe71c097c59ad1c6344897f7cd9c3f8dfcaf427e2c27d1d655757056e065d43874bccb06cf8f

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
119KB

MD5
366b332f266a666684764401b2e57582

SHA1
20c5c8f581d80ab18c06c01962584d2f9c6e9d93

SHA256
cf257d2f68005288a4e2e6c0f2818d875136dcc3757d4baab23d7197a7a100e7

SHA512
1cad0edaaba709ce21712d8a188263eceecf378970936a4b9773e3fd1be8ba9fd36f0533441ce9f69f33ff5dac1c7e8bb216478a2678e715a49562cc9c778b4a

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
123KB

MD5
0c0466c6273946c07af7231fdc8f942b

SHA1
49eb6dabd25d601bcc3d8bc72f8c8a9f4e1c091b

SHA256
21a81aaaaf6d7f2e1c2e8bdeeca28a135806642c64e09381711ad84b367aba72

SHA512
e881552203fb60d1ca6abcecc93bf323729215d922a907d7766a3ce6affda6c723bde7097d410c40797515fddac1e9a503322623073f685568116cd0ded412f8

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
123KB

MD5
b9f06adfee6f1bc3deff96516e3f4121

SHA1
facbf0f59020fd35dfb32d2bc59a34be109fbe1b

SHA256
b6e9802b08044c92b303fc67ef334246adf6a48b7307cbfb64e36b64d5b99214

SHA512
9cd86abb37a95c0ac3e312bd7937f2b6269638f0b35ba8c8128888b9d4707597d13d9fabfd33394f82627a1bd6101ff4170b19b1639cbd8a2668d478c985c2b8

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
105KB

MD5
ea20813c98a0ade8490da319a8532d4e

SHA1
0d258e83cec6625cc7defe40dae11a007f21eb93

SHA256
4b97c19eabd4da78c844247e2aa7da05b5a8286a4789ac695fc8b5d937a70de3

SHA512
a1566506a70f8c7cdde464c3db7883de870818ae39be30e89311e2e15bee9e3314350124379c2bef8e61e067e4cf60d8137af95ce7a6ac8e08625b97b2572df8

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp

Filesize
113KB

MD5
863da7a6f844e620edd5acad427244e8

SHA1
3a6c7873e714c6a5b3af2f30680b5fda67ff3296

SHA256
d442e65bb70ebc7460552aa39921b7194346c11871b561e4f5f3a18aaacdf4e0

SHA512
ab8565294ab53b57c8464aa6d564c36920efa8946ce5b3d28a452cf795bd0f0b1491701a88739aa44a2911404b3e0a01c1d7277075a937561d33c80185155079

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
104KB

MD5
744e894f8fc8e68d63e42174204be6e2

SHA1
70a01380d7f2866be9e55844047fbe1a205cecf0

SHA256
a95d4edd8b6dc5085feeff7105b035a3ec480c052701e5a9729f5ee6fee642f7

SHA512
5b907bff62aa7ddb12db7ae0ae1582a2c226ad87f066f2d01d808da4043ed29bdd1cf640ff097ccc843784c6854dfe06512c22b6cbc26a061bc822429ddbfd68

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
99KB

MD5
32493fc260ed8219dd94ca8e84d1820f

SHA1
c12c157ea491af1df7fea3c5f6a7dff381d392a8

SHA256
81c626ab2c9fcfd108837c2814e0ab8d711455cb70de7117e1f1032ee3761bf1

SHA512
643dc86298275f2eaa222c35e58bae570198b0f180567271df2a070ec253fe8bc99f816c5b6ef89b54f3e0ce9910cb367534546331d299c64a5789ad8ee4e87d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads