c8c97eac826c09e2459a19375f9e8aa330509c7f83a652eb07241802ab8d7bca

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7314d933115336fa4a0ac86f5da24e0_NeikiAnalytics.exe
Size

246KB
MD5

c7314d933115336fa4a0ac86f5da24e0
SHA1

83672d20c508df70273a0d280fc9959708c9b305
SHA256

c8c97eac826c09e2459a19375f9e8aa330509c7f83a652eb07241802ab8d7bca
SHA512

368d469a9afbb514c72e38ed50d25f7dcc7a7b2b3b3cc740b201790b4e8983e90371bda6b70b28742a5cbca6c1348f7d19ba90c945ea79c4484c829335af6426
SSDEEP

3072:6QWpkzlfFpsJOfFpsJ+n6jCQWpkzlfFpsJOfFpsJ+n6jq:WYw

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4851) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
5000	Zombie.exe
4440	_$I0A4OP9.au3.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	c7314d933115336fa4a0ac86f5da24e0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	c7314d933115336fa4a0ac86f5da24e0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	_$I0A4OP9.au3.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp	_$I0A4OP9.au3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.tmp	_$I0A4OP9.au3.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp	_$I0A4OP9.au3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL048.XML.tmp	_$I0A4OP9.au3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	_$I0A4OP9.au3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	_$I0A4OP9.au3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	_$I0A4OP9.au3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	_$I0A4OP9.au3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp	_$I0A4OP9.au3.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp	_$I0A4OP9.au3.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\tr.pak.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp	_$I0A4OP9.au3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	_$I0A4OP9.au3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.tmp	_$I0A4OP9.au3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV.tmp	_$I0A4OP9.au3.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	_$I0A4OP9.au3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp	_$I0A4OP9.au3.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp	_$I0A4OP9.au3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp	_$I0A4OP9.au3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.tmp	_$I0A4OP9.au3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\ReachFramework.resources.dll.tmp	_$I0A4OP9.au3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp	_$I0A4OP9.au3.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe.tmp	_$I0A4OP9.au3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\meta-index.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_$I0A4OP9.au3.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	_$I0A4OP9.au3.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.NonGeneric.dll.tmp	_$I0A4OP9.au3.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 5000	4408	c7314d933115336fa4a0ac86f5da24e0_NeikiAnalytics.exe	81
PID 4408 wrote to memory of 5000	4408	c7314d933115336fa4a0ac86f5da24e0_NeikiAnalytics.exe	81
PID 4408 wrote to memory of 5000	4408	c7314d933115336fa4a0ac86f5da24e0_NeikiAnalytics.exe	81
PID 4408 wrote to memory of 4440	4408	c7314d933115336fa4a0ac86f5da24e0_NeikiAnalytics.exe	82
PID 4408 wrote to memory of 4440	4408	c7314d933115336fa4a0ac86f5da24e0_NeikiAnalytics.exe	82
PID 4408 wrote to memory of 4440	4408	c7314d933115336fa4a0ac86f5da24e0_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\c7314d933115336fa4a0ac86f5da24e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c7314d933115336fa4a0ac86f5da24e0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:5000
- C:\Users\Admin\AppData\Local\Temp\_$I0A4OP9.au3.exe
  "_$I0A4OP9.au3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
123KB

MD5
d4df2b3e04990afdfff379b099bb56c5

SHA1
69f4d2560daf4ea1706e3d0ef8ad21f2d188d619

SHA256
ad66d9185c71f5d719adb970255ae58c8a8fdbbe089943a25c62053fddfd4d18

SHA512
723a31b487b7e6ab16a0ff41f287ba67ef87d099cfd6d92cd1b419ffb80aa397b169ed4b1ac3c0de15e30bc4329ff8a20ad3f2318bd5ccccebfc7a2e4812fbb6

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
188KB

MD5
e7c7c3a8ede178cbfc65b3c49d2ca0e5

SHA1
327be7827e9332a7d946d00ce81ce3bb4662c219

SHA256
66ee24bc741cde04b6acf22b0b9188feced98a536e7078040aa1f1fecf7365e2

SHA512
bbf611de6bfd33bc1f59724fdbd7ec29e6cc3d783926500ddb459bba727fdbc7faa9663dbe71375a7fb11932d3a94be04fa34c59d73c2fa46097c561e8e0b4e9

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.4MB

MD5
0aadb92252c982888ddbb56dbf6fcb13

SHA1
5b374a46c9b96ebb8609368ab404cdc0e729da98

SHA256
b3a92eef647e70f47122461c0db62a29be4e90559070a17d7a795a72bca9fe04

SHA512
ab99fe7dd5f08cf92e2f16c1c1a6485b28bc0cb69784f2e10ca152697986d62b379d6fee7a7709cae773557df0d26a6d06a582d7ab0f80a67c9326c40b484f39

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
ed94adb5b1bc09f18c9b9772af3fff37

SHA1
040572e9842b09bea1e0e26778489a5e18dd9d0c

SHA256
d0a640ce369e7f8c9e131604bfa52bfa9a61494e0aa31f2208c7d43313b8dc24

SHA512
9ffb45eb8d89476a3b13fe764a928fe4cfb58b3255d79b115cfd9ec01b249f12636bfd60499597b6fc17d6de47cb69da059d972300a6a0e52d01271d409538fc

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
667KB

MD5
3a9cd0d297db2ef9e78401909c275b75

SHA1
153b50711a2ed402312580bb7eaa459a0af27f73

SHA256
3197fb7e93f2fb9ba82e0499e1cc4d5b34ebc1c84848d8ecb5a3558de9e50e33

SHA512
fba2e194852a0926a70d2cfb4d6660a542d6ee4020043985fbb9bb870bd373dcc793363b6ffc11fb9c98b1707a14f5a0eb0a706dfe473ea8cda6b10e17941b66

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
332KB

MD5
46761f53e6265150f935aa5e805a0f7f

SHA1
4d4da941773f07403f0d9093a2c35ef828d0f0d8

SHA256
41c31f84e899d1c7f18cf96ea7e2afdd8f3c6d2bb2588a41fd2b9fb9aeca41d4

SHA512
c5a91807d883e5b0c0983a8ba70c9451708223a9f686b4cabe5009f5e443b1bddc1a5d1285f1a5e980c6ddf6398d5796173910aa1833212557f6f20fd5116cf1

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
311KB

MD5
219f2e9ea4e0816f786b9b994388ef19

SHA1
c16c793dd850e2e81143577bcee6b91c5007c64e

SHA256
c3c29631c9078ffec8c2c8c84401a73252fc35b767217ef90ecbada8ca044978

SHA512
c5e7c89664ee306201d2efda30a85ca189fa55430dd5ec2e2d94c127234caa974675740d16f932464678c2990cd0a8b1d4425970275da9e1c2375e136f6979e4

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
311KB

MD5
0d00b4a85de235ec3af058c5ff730d47

SHA1
202127e9703ac165a92d74323af50d1eada93421

SHA256
fa3963d081a7561a69cfee3dbfbc16df057b239eab49d80d42ab61eddb57584f

SHA512
c2db593530dd6b31f818212c0d36812d4bd629a32e972cd663fc604bddffe87febd049911cf682fc33cc6fb10e43bc320846e039bb1c2c54b6bb99c3ee7764e1

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
d80f6caf6d0d5602234b0ac5f5d6f475

SHA1
fb1d574b312b5dc8a0d4f1553caadc666f210b6a

SHA256
ed5e4a37ee8f660a7caec4ee33cca674daf722b0d20db578a08c9dc4b6e95a5c

SHA512
bc51a2e776772fb3b677d1d31c9291a225baf190c65ff61859c9c57209a51522f385e6ac51e9ce2f9f875f27e50a69d865fbccb883d15142d8105184639503af

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
6026dd981c3a001fa5a57b20cadd5912

SHA1
f0d2c9b3f91b724bfb0be1bd63feed1d3b8d0d65

SHA256
448bf3330c81c64f248f80f34882b068b3f9fbc8d169f17b53ad7eb3e14acd0b

SHA512
fce322a8392f5fef4d3a7d01d9397f8f8e089863454b552491cbf9334d8be18db33eadd05f9d943ad6a9f7a9cc831aeb231e00aae5c9781880f05e50f940f7ae

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
133KB

MD5
65c1dcfe7c0d05dae4f8bf15de3b0928

SHA1
ac334d7a380353454783d386f7757f1578bc9e3f

SHA256
a1a052d07f28b794bdae45a43def2a938f084c7417bebeff46ea93924e4fc1d5

SHA512
01f8edd6e25f36ac4d1ae0fa0a0451a1e0dc736ab3edf52d3fcc297537918ba2cbdd34aafcdccff5439e083420ab67aaf432c19b3f50f6b33621ca3308d8a676

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
130KB

MD5
c1043063459718c612e59bcfaa4a9204

SHA1
18cca25115f33b29e17843a83e15014be43aa825

SHA256
f566ceb9a9813078bd9daefb5b1186a38316555761100c3132320562d050a9a7

SHA512
1fd29c4230d075e0d9d3859eb612e94ce25eac88128a36380cbced4a175c78650ab327bd8e68c17e1d6f3da6225c0d249934219df467be03c00a284992f69c89

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
135KB

MD5
8f495320ab79cd3932225bb4238dee2e

SHA1
84f57121aef6279000d91b233ada0a1fc0fd191c

SHA256
c30b9f53a553f1bf48a909d16a1f1022de7a1fd7d51d15de0aab9971a870195a

SHA512
b374fe4e5d4663d86342857823399bc61bf99f787e84ac0972010d1ee4ffcf0c3d417ac99e41b7b072fc8056787ace338cc4626a114f9832a55f7ab133828d8f

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
128KB

MD5
9ed9110099d23303b9c8e7f83a3b71a1

SHA1
80483f3aa319950e4db66a42378895ba96833808

SHA256
bc689b1c51078a67e44b1b17b38365a1630cdc8c7d6be8b62172bb0d78d41d1d

SHA512
72f0286811dd9e0ba331603b67d7a8b80282ac3d1eaa20c891e2f6c5f69195158fbf6d478d5243e26ab3aee19dc21e7956b1eedb7dffa53913575b463ecac76e

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
132KB

MD5
2d3bc2f248822b5dc773ad923ef72c9a

SHA1
63311d073b55d35c7e0ae4767c6b73b3522b3ddf

SHA256
ed1d18bf966fbf394c36f7532959445d842fb4ffcb0784d40cd898b56409fa1d

SHA512
a0e136fe2d90fac35af715bdce164953972c4ba54a6551750ad9f1051843021dfda27053ed33315d8b07d36c6b6c48d15f10db502b47a907a3d5208a61deb175

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
134KB

MD5
d3d4e2ba5fd87220a6eae04a6e826cbb

SHA1
67b9e334e6285e9fe98d6adf4b496679e0e7cb47

SHA256
d395dadb82b2a92e6a86e88c18971344b44bfcf004b2aab710ef4a963e40a9a4

SHA512
b7197d59611c636e66002f28ab6c98c689bdce1832ca683e3ab965b7b1d3032b45ef94ada24d1011c830ac89519afae9dad3414a4b5652e473e826b6430a6938

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
134KB

MD5
7094af22bf62e9e69d7a2f2ddeef6cc3

SHA1
04be15163429e9b06fe3714ae1245ad670d00adf

SHA256
9392ef15059a40c6cd351f88ffd9a5b7ceeb2a3cc0b20d5bfea81bc9e1558d73

SHA512
2ca6448722e162a76c90409a3e02695ff09a0de561a0b7b18c7bafc60baccd83fc645cb1769a059a890f703e266a2040df89d4bdb1f0691188be5c67a9a2aaf7

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
136KB

MD5
fe0a16a66eada3cc7406aefd5644bde6

SHA1
91b5fc74aa1327f3c0849b705556ba8e2c6b291f

SHA256
c8aded381b72f8967929ee5269ab6a26f33b0601fcd02798b20b8e22c8387517

SHA512
36063f15d423989366cf8acdd3b2f25825d41d0da113d2c0eae8c28ba550a070ac113f2061bcb7567cf7651d3e299e360e7c20c1b22f8a5b5d152f7de7ee0f46

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
137KB

MD5
24c00c66013183624c4fbadbbbe3a85a

SHA1
6d023b01b64f80fb20b957e82c01150f11450ee2

SHA256
ee55695f81f2c4f3b553138108d5fa5385d22ee5b90cd908f002308a84858d9a

SHA512
c6f228173b00a7805621381cd02beeb16151cb7be6f50444ecf7acc9f2195427f21a9c85625d9c10d80e1844cba525c9c2ac0017470cefa604802e1c16faca37

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
128KB

MD5
670f18fd4bca83af20a38eec74273036

SHA1
66ad5116a32fd3f295209ff0ad6c08d64d3839b4

SHA256
a56269bd94038842b4035469d159364398785366d8f4ee0f5eb87e0d9d5dcde4

SHA512
6ae0b085ee31c2d446f629ca7d389bfcf5ed4a8f9fbf4ee8bd443d032f18d422052aeb6321605d1d2a6aff04678b91a50043d45719213cfc326c47dd0665efa6

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
132KB

MD5
f35dc338cc4524392ca31d2eadb1bb71

SHA1
e1a465f4026ff09dfd6ee7d65ff724d8a7ac74ed

SHA256
d1b1a63c1ebbb3a2020756b12e13283778ca8f37ec1a0b13774048cbab76a963

SHA512
d70fecc659d0b86a068b8e4bbfa2d3ad3b2b7d890f1730dd41fa30de512f58c2d49d5c825837fd759aea592eb9f284118aa95d6dabd4e507c252bf3038b5b99f

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
120KB

MD5
ab3f63328c91fd1060b7bb3740984e35

SHA1
fe444bf84c4081382abd438cc5c1802924fb0c9d

SHA256
00468e5cd5353fe92136556e697335c90a8ee502397dc01542e9b31aba7556dd

SHA512
99f2ed53c70acca50f5e1d530ef0c5d51ec275c18f2dd45e58e28a57abab0bdfeb91947b92cf72af60d112bbb58cd3fffa6af9ba7ef0b28636e7b25499f50c88

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
130KB

MD5
1091e19075965de0cfeee296c0153fc2

SHA1
e1cc96be1ea83c32da34cb62e04f51d52b8ba6fd

SHA256
4d85d8e01b413729eacff753df4f36244fa79c06b6634eed3de8e3f0abd07972

SHA512
77c6cb7238568872a195023d89e9b36add38c34719854d73d88956dea3740ae94b548feda394a24704477a5db96fb92bfe081cfc4f06a26f360beb2b44672440

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
128KB

MD5
da79a9f73be866fa26058bcc58b4ccb9

SHA1
9a7fd4114de4035dac4fc2092fb2399225bced79

SHA256
75e76b7213277015ea103da4e16155e2fd8d5a26c408dc2802df398e2a46d01b

SHA512
53c9c0006084cc71cb4fa58b915dae0535434ae2e204e7faadacf7dd2cb162b865e166030836a6f2a4174a950b2bef1191ad215d3ad84ac8167f6ee16c372e9b

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
133KB

MD5
ad196d9f5d8347476dd5b8ec5b530e8a

SHA1
86f3c6f77c2090d727a621f441b95e6a6930a6a3

SHA256
055257fa4afa79bde3702a71e75fcab81d1c5e5774c54d42f8fd9b47bdad0190

SHA512
947306e3680c53e4558f8da27c5b359f7dbb4786713a8bed015ddfecf79ea134b35b4238aa70c82bb4b64a304649e1809050fc6b0d57d000bfb9e5b380307470

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
131KB

MD5
e96e4dd72278ba922156b7d75e89206a

SHA1
b050f99519c800391cdcc8468b3a4b41ecb62277

SHA256
c001beadf03dba89a3827631808e5b35233bc746ebca680feaf6b6e95e630f93

SHA512
c2ea1ef211c2fdcc1ba3da00cb99ecb9143d2b1334940181df256607ac2628bde2f07559410c14d01e9284018dc902a3279f8323c8f094634bb83e6de7733e3e

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
130KB

MD5
07a1fc09da2f03be0c730106e2c753f5

SHA1
2ec30bcead4f6e30411022b99927191987795bb3

SHA256
f48ac4a81513188c85508cac47e941cf38ff34e8ef1991ee82e2e0bc4e1a8de3

SHA512
5e4c1d4a783834d1ec2f68b28c462daf45e2cdcf4e66ac609fd698218702e6ec547f5299f8d3e84d1fb5b3a30a85773569252c3a56752293ff13c1b273b0b0f0

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
136KB

MD5
05001faf50746c68aa2a6ef878415bbb

SHA1
89abc01fb150cd55bbd645c19421dccf526b4e63

SHA256
79324e8309d7bff4c213189eab34f909c09ff2bf3b7d2bb79647f76168171000

SHA512
35f22cc421a3b6aca0e0775f08510b38776e31ab13dad82eb5b7d928c19229a2af1f827a6503b8a2a85e441b0acb1fa94cdfc3bfadb6aa360b8d018cb7aae4e6

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
132KB

MD5
2fd81a96a9c32d9192786cd0b1cf8c93

SHA1
f4e476075423d53c8846793f246a9c251c544d61

SHA256
4cd0e309c4f2e6e0ed00033462f87640673bd58ec95a2156df68f1b6a8562d27

SHA512
9bd30855a296ace7ca1b462d76f922644cfda9c65b0c4a4459274ddf981cc92f875ee0c2c2391d4cc6992f80d41e4727a58f7eefc9e2b6631d7c55c828aa3e58

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
132KB

MD5
8bfb6786fbe93205982d464b5179135c

SHA1
58eedba6aef5b3d30d6ddb87660a2d1e2ba4d7f3

SHA256
96b9e1622f75291a3273db501767216a485e0fda6b9b0551e2d20bd370553282

SHA512
ece56c3ccd258d02f7bd7ff2b18798934679cd880f29652c2f0a6fe289d4d4c4590acc90c9a0ccddb6b9e0d1a209421039e35471ccad5d511d680d4d27dc42b0

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
130KB

MD5
5304462701e41e4edc4f443f4921c856

SHA1
3c1cc32acf8995d92b86c1e299dfcb288113b182

SHA256
859a45a849b6686d8a17160f70041624089dee90bbb088c1a51c4e9ae79f6ff5

SHA512
238bcdd52a5209d4934129b37c68c93db580136c2ffb995192e59c1b739cb2913fdbc3465e95fb906b48aacadb4176b0dadb2c7674b72e8b5a2140bb304d4217

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
129KB

MD5
d16e4dea9d2e02ff47afc435fe799cb2

SHA1
250873ae9686af8ee604d69e98e6ed2bbd95dc6a

SHA256
45dd11e3a59f2efccff575a37665f4ec2683eba2b15089655221b1e4dd783fb2

SHA512
ef0b63cc798f0d18e7c273b90bfb4c4af890f5a158b6239641d0eb60afd63179d292224ce34388673a8f016dd4e1c83e765542f7c627019e6f2d23f9f62b58ef

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
131KB

MD5
8ff7c04fecc9aefcc49ecf1c319e82d3

SHA1
5d1b6722de2e47ddb64912e5f391446a3db66567

SHA256
9ebdc5860ee6b4c4242a1253167192310326354cf2275cf58276cd18c5b51aee

SHA512
06a0e875e067f72b26b85a6f496bfb61e6c5fd1438d61e1eb37c2a7ed8f9911040dbcbcec8cf766bc1fe2ef99ff8f87e9adef5923c359e8833c4b68d0873502c

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
132KB

MD5
f55f079a69a131591254b1f30195a692

SHA1
346114b95f371e952e89ef25c0f65248bbbe1929

SHA256
ff3f151f036f4ecdd5957f613d24d0be5e2b6e10e72c5180d48f64e6ff74e939

SHA512
6ad74d1437ff7f8b4a1224dbe29493618256c43b675e2cf5d4bd751ab23de1f07207249617a2c07cdb14c7696f432ff9c1930b7bdd2e471e7889d98014341dfc

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
140KB

MD5
b85c16dcbab7141e33bf364071db8e68

SHA1
4660415135eac71ca2e4a6caff8e8842df5832a9

SHA256
90536c852f6bce5767ac953bc767e79c6c9f17f6e2f049defe5ce764e33d9f89

SHA512
5bc9511b59e1f3443a3554a971342c1eefe7ead79bc2a485283628937738e60a84fa0416e8d1b7515034a39e8578b5573ad101f29614b4d003d7cb8fb0852686

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
134KB

MD5
bbf997715de46e71678bc82196f131bf

SHA1
3bdc7280458a424037ccb045f558837a4aaaabbc

SHA256
f0a86b651059f7c48762eac254648b180cac6e1725bc1cc7c1a68e95e0eec106

SHA512
6660292efec014cb6864e18f3c261138b4244f4da5f8765d7ede92fd61a56a5d67a82cc5f11d17d28c13349e98cf08078515ecc010d13e80dec2931d49f78c6a

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
131KB

MD5
fe69294032d64af8c656937eebbfe56d

SHA1
0c54ddebca842f591ada21421e6cc9df4f6dfeb3

SHA256
4480b5b754a0fc1feabca85a786549fcf37c43ee5c9fd200427ce0ad5852da5f

SHA512
d40b01fde54948a0077d9041042101b6320926e76931c8abc139cc2b458f3f738a8bc968ddaff39517160ed30e7f27482330d930b03c6dcebf7271bf3a7df6f4

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
133KB

MD5
57c3eb6168d1232091d6ef756c1b5348

SHA1
d6bb1fb5d9ff39c545b0e067f7721d11bd4c1cd4

SHA256
b82dd46b4c1b71b85dd53130cce62402d81bda86fc18460c501677a8887ade52

SHA512
dc6b9be565430af1b7a6d18e73f2e3ee64b39aa6e00a9d131b13255b0c96fdcbaa409e33fc3f543b7db2dbedd6901b39298b008603f074cd7d382d0ab2b14f71

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
131KB

MD5
124fb66d21ef9c0906661b9a9422db7a

SHA1
23a80f16ab5444a350374334ef04d5008c266f3e

SHA256
935ea11dcdd664c40feb08c08762df7f7703ad70b97cb6a7c8fcea4469a38175

SHA512
813df900b40b9496c96c31bd009577669d26d95ed7358cdc1619e5ef66c5084a104158fa59b341aac5d4c1b531146cf113742883c4e3d92f8c56920d27454bf8

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
131KB

MD5
3cbab2e5f9ae9700c64403247f06acfa

SHA1
0a6f8eda2810a053d399e2f0ad0b1d385f031310

SHA256
6374bd0005668184cac50cadb8a136aba2a34354a23f582f41bd507e6d0d4f84

SHA512
1d9442197460023614cda68b6e0c4cd20d0be54bc4a7632ef1e0b2b042e137d707b3d904fbeb4c101f3c7b2f2a5372d4c11feccec18ef054518ebdc1bd7c49af

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
135KB

MD5
431483f417c2d080511a8f5969470c13

SHA1
9f1021e377162afc18a1e162b5953d8c675f30d0

SHA256
704e7f1eeca9f5860ab094485d128daaad39b5da5e99255df0fe606532b606fa

SHA512
e955082a01ca46e9b39bdf04846c2f8b521e6a629972ae6b2828ba92cd425adc7ad4360cbd7915111307e05f471139ce534b99a8d231988f17a68655f844b4d8

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
141KB

MD5
1169e39463d105566f07eb1b6257b3e0

SHA1
e8a9cfd7c5c89543fa7a1ebd1169ef16eeaf3e70

SHA256
d4e84a02739ad172b71d6beb7c9fab81b25dd33c8f066f9de25f8dde85d65427

SHA512
07849878968cfe785441ad48341f9a388fa1cf5f36f9a356896ca6633deb4d985875e1394658bf323f91c0a016866b92addc83d1457195e780ea2621f7c15323

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
131KB

MD5
51917530fba32cb24479d2c29b3afbb9

SHA1
22c961712e614c0e557e4dd51438923ebc4b7a45

SHA256
d29915524faae3d51ac5edf2e55bc218214a70b0c5d8afda9f960b7a1b9c9bbc

SHA512
93fcc1ff14e7d7271cf8078a77063f8a5ec411bab9d6250b8b12f5e7abc9050dfbda3310dee82e6af566f99604ba32e30e35cfca61de0eba342d76318c5eae75

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
131KB

MD5
a3d62ae893e984f3e69e9739411c5885

SHA1
41cc602c56608fb2fe0abcc1cd455c5ed63d3bb0

SHA256
608797004ccece0f87739cf676adf259a72d1157ce606c3351cccb54035fdbb4

SHA512
0f610c562aff9d12fe929fce26a459cd6e55f23cd04020b4e6208627601c600408f3e6b59d72bdd161cc5a1c72972b7a3bf69750ace29d883a451175cf259c0a

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
133KB

MD5
33bab7420a23fb98b9e91d06c222f780

SHA1
b5b4bffc3944a7f7100e6a6a1fac6752086d23c7

SHA256
35428509fafed4a1048de55228e52496e6616207c4e3aba19652969ae08980a4

SHA512
7f336073b630af2f331974dbd5e0bd0b6630de758ea2029a36d1499f40ca5497eed32011183061a364e570f50cc704d37ad166677c0f89f4dd15ec99bbe8b54d

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
133KB

MD5
b487c74c286d9ee451d3eb27e6ba6f61

SHA1
989e84cc21f073e52850f6461036320c7390b8b0

SHA256
a89aa910f0be5feee19ccf45353d927727a7853759279850cfe5c72cd0bd3b4f

SHA512
dd35495d16d4d36a34f0bcebc1adf33f18798acb30160acc18aff69754dfef9d1b3011750c799426f7a2d00349dfe26568e3979ed112ec4f6cde92c2e99918f2

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
135KB

MD5
bdcd56c790a446a640997e283ae57d11

SHA1
2d3c18533791ea2c6e6f5f5bc202bce0393973d2

SHA256
369639590fe8462f19d7880f1487243dd861747293e043a4df9dd3eb4b744adb

SHA512
c275fd586fd471a72ce2d72647b140e64b6b339843419c155a71d13c186d20a0a43927faad0ff312c62babca775315ce58186eab0723c7fce561aa7d9fb861dd

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
128KB

MD5
14389b7273e30662164bec93b1a98ef6

SHA1
b1fab878b4e2b33d740bb8996008efdf3872170b

SHA256
80ecc715e90a334a7b300ab0278bf13ed30c1702d1820c4bf900bb7bcd5a79c7

SHA512
fc25a49d9daa90d210d643ed48ba110b239fbf33cf0bc53e128007c53603bda8c25bd9198d8889aa04e1e4b7b500578c7cc22641d32b94c01bac1637273f9128

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
130KB

MD5
05e9bb18f955a620047c779786b79980

SHA1
f36c627bdec4448a38f30d50cecf11b0ac191289

SHA256
49d77ad77c7c32f178751763e95a9424af2e84cc04180c5dab0b37a263fa1aab

SHA512
c3b52e9e8334df0976d7689d6699e7bba4abb37f6470255eaf290e06399c58af6316c53dc613dddce823ad72324a72d880d4b737f6296bd4b543df84fa29b54b

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
128KB

MD5
40233427828bc10736b90486e9690267

SHA1
044bcde7d1bf43938e5c526787eea1d70b39bd72

SHA256
374fd582d3dbff755189b2e8d1a4742d736265d38bcece6cd9c0bbc6751ea5dd

SHA512
dad083e0705f1bc08e0f5ca05c9d02e6daf393f3262e7ef938548614764f4d11748d6eaac6c010b303fb2535b42f67838dbb59efdea277a4133bd6a8f64ef611

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
131KB

MD5
98bf37846e9caa96783fadb1e84e8b41

SHA1
c43665bea7dcb6adb953a54de37d2342a9135c3f

SHA256
742bd7d9ffd179f809db65d233ada7f120fd044c5969dd9b7440b7d17b7f79ab

SHA512
d9c14cfb34f01271d8e6efbebb52e1c32ace5c6f8cc106b7e54c10a23cc521d80da9f8d6af540a1d2d0d5a1ba548e1d4202c9acea63330efaa083f63be547681

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
142KB

MD5
421535dcd09d97a0b9312698465e4af8

SHA1
cf34a7643989797757206bb542b65410c0377f61

SHA256
da4df60895ed8f0ab1ee5db97b2c5c4fc0a6a731c80779e110b724aa9ba82666

SHA512
104d09bd68cd70ed5a3456cc5925f901679534f2cb8444c85851b86bc287af8dd5f60ea43e8eb1e6f85067643bdfbb63ea7e4c3050826539ccb775b01b1410c1

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
144KB

MD5
4bbc74662fe75ab1edb167204f6267a5

SHA1
be778987fd7da4dc43ee5fe2498649c606a7704f

SHA256
5ad5e1cc4ec3ba364241fb1156371a3f864178edd41bb264802f2a9684b82cf6

SHA512
54f39b8d475adf37992e9b3309f046fba6b8865dce241f343733cb38a87fc0cea8293ca6946f83ff2d90d005b7abe041c881e4a53d53e606eac224f7eb2698dc

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
133KB

MD5
a84b297b565c3413d2d5ce0ef7bfe978

SHA1
cea20d4cb9ad7e063bf39e678ced3970593354c8

SHA256
ae0d98b2a85a543157075f06cd6d0fe55f860e381b67af0b048183ac69036d82

SHA512
8a081c7803818232d24da47be0dfb46b53a8506209c666414862361f35443b4c6bab3348ca43b5bb7ac4297d4f9d0d27a2fe402a0da173a663cf58ec9e49eaf5

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp

Filesize
133KB

MD5
8872300f0f76619e067c84b34ecc286a

SHA1
6db1639d44995f6789ea356e9d0b7863858ce2e9

SHA256
927738b8987a54092bf86c0aa18665efa0d668187baa8c0d486163e8eefa96c9

SHA512
ab3e0515bbf698c6af59c0befc9caff9a0c007271f23183ab9da317ee8ea987772704827d443f822a6f9e0c89d2d9529a3d46b31300e8bf32a165c1124948f20

Download Submit
C:\Users\Admin\AppData\Local\Temp\_$I0A4OP9.au3.exe

Filesize
123KB

MD5
17c5724fde5bae0e2190289a36cbce1b

SHA1
f5b1c5584cd2221937e14dfb6d660c877241d072

SHA256
80cb58254be93bf10860eaefbbd29bbfc8175d0b8fb487ba342a33d049256c74

SHA512
91cecb131cf7614cb48dcf2323f7c8291f8325d8dcb28c9a306ea51df07bb2036a726c700e233f63d4b6f096066d68cab0f14c19a011ccc053f95eb8f3d32f56

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
123KB

MD5
0ec6965dd527148e8098fe9afa8fbd1f

SHA1
b086fb06a30bc0df8771ad3d2420c91bdf830958

SHA256
6cefbd5f80d0e336ade27653c3dd386a9facaad06140d8cc45d55bd336b63d55

SHA512
4b85271b66d8b687c51919891dd996f575afe907088493d1c1b6d353e1353bb6480ae6cbcffd373628a1a9aef009a68f3b8bab694dfaa57befbbca2b5c932bfe

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads