b9fe29d1be8fbfc188e1ed2fdf2fdd55328d706813272f138d24ba8d9fe723a6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67e8deeaa6d109bf1de174dc06669b80_NeikiAnalytics.exe
Size

232KB
MD5

67e8deeaa6d109bf1de174dc06669b80
SHA1

75edde5c3a7fbe7c09fc6c1bfc957927ee9442f1
SHA256

b9fe29d1be8fbfc188e1ed2fdf2fdd55328d706813272f138d24ba8d9fe723a6
SHA512

f01908a671182d3e5cdb4614197cda485b21ef4e7c3997e0ffaae4358e64ab84fa7ba7115dbb14f2f8d61f175c48d71ccb460837f26c9da4e2c28d78212b8253
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXB85c5N7BlpQpARFbh2k:/7ZQpApUsKiX2677ZQpApUsKiX26T

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5041) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2288	Zombie.exe
1880	_RegisterInboxTemplates.ps1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	67e8deeaa6d109bf1de174dc06669b80_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	67e8deeaa6d109bf1de174dc06669b80_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN114.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.PowerBI.AdomdClient.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\v8_context_snapshot.bin.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-140.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-CN.pak.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp	_RegisterInboxTemplates.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnOL.dll.tmp	_RegisterInboxTemplates.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\msipc.dll.mui.tmp	_RegisterInboxTemplates.ps1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 2288	3828	67e8deeaa6d109bf1de174dc06669b80_NeikiAnalytics.exe	83
PID 3828 wrote to memory of 2288	3828	67e8deeaa6d109bf1de174dc06669b80_NeikiAnalytics.exe	83
PID 3828 wrote to memory of 2288	3828	67e8deeaa6d109bf1de174dc06669b80_NeikiAnalytics.exe	83
PID 3828 wrote to memory of 1880	3828	67e8deeaa6d109bf1de174dc06669b80_NeikiAnalytics.exe	84
PID 3828 wrote to memory of 1880	3828	67e8deeaa6d109bf1de174dc06669b80_NeikiAnalytics.exe	84
PID 3828 wrote to memory of 1880	3828	67e8deeaa6d109bf1de174dc06669b80_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\67e8deeaa6d109bf1de174dc06669b80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\67e8deeaa6d109bf1de174dc06669b80_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2288
- C:\Users\Admin\AppData\Local\Temp\_RegisterInboxTemplates.ps1.exe
  "_RegisterInboxTemplates.ps1.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp

Filesize
116KB

MD5
a3f627ce7efe0eea68e77f456231a2fd

SHA1
832fc48de3fae11b522fdc4eecad9a3a4bbf372c

SHA256
459c036bdac00e84a5236faa45b34e6e32ad999b3fea0eb69329aa08fe40840a

SHA512
01f6cee6e87e826d038545ef67473dabd8cea81f2a54ec641a276978c4d9d0326ddcf58fc7b2a26e9b827018d1551c66dfc566762dc1f3892daa8a44c88eb703

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
229KB

MD5
2d700d33dddfdaf76b338fe4b12db2d2

SHA1
a7d02a4232f82a507bf835fd2510c169888ca990

SHA256
6faafd42a0bac3c5eea548bdda5c783df11b7980866961024c26e5fe1a5e801b

SHA512
b47add4797e28975d92f5123f6cdb2d966ee5d34c857693bc3951c86ecf9584a35eeef6b7776227f80c3b69cb18530bc0f8b7e16d83ebec9765bc914ffcef4bd

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
215KB

MD5
6948cf8beedab855f5f171f76d9ab343

SHA1
4cc2c9523bf29dd868ee76548c2ed527835ad213

SHA256
ddae04a994ec467d631837896cb7a029aaa717faf5708bfd42caabb37e255d94

SHA512
eba5bbb6b4888f60ec43ee82ea7b8d1f3ef36e5bf537e3a404f54d4959de21d1a0c8b4fc49640e05065ae733bc0006f640553f6d97db9842a86ee17934e44fa1

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
975afc686ed697a485a7ab8cafd64e8c

SHA1
dcdd2a9079e9120f3220037ff28805842287abdc

SHA256
15b126cae5f7fe7c33784beb07063175501cfdcac3ce7d7d63f05e541aa5d09d

SHA512
570fb0ace4645e3119788004aeb017094eaa4177588745d63252576d6b2073a974beb56ee3f00b0e03847a3d38adb84a9114fd000a0ecc1ddf4207550e899456

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
659KB

MD5
6311aa4d162b5bdc788b1592fe335ee6

SHA1
b71b05f08427541d93bd7e3721aae8e97b5c035e

SHA256
0df1f3fd24dda1f65e129ca98de683ed9e2b8a55f0981fba9310d859f90476b4

SHA512
e7c4d686516ebaae74c5e7bdbb14a259ac0ad43939fab65ed7818cf7e227920977d45ac5a36f2aefba37711805bcf7c3bbb1bfeb6fb3daf451281ccf4894a550

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
564KB

MD5
cbe1eb06d5c4c93bcfa8c799010c87f6

SHA1
d7a7d88775c873b078c7aa57441e8d92e70bfca1

SHA256
e07f8696e9289e8b3b00ed16fceecb8aa4dbf02b0e8599d0f5db990949a6efb8

SHA512
11efc04a97643a4554b82308088d804ed4a62733909e8d0b422cbcb46de0f37ce2ba98b46a0aac29899a4d4993d243b6218182d66c28b70405e554ee74d4220d

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
fdf4f888a87f904bb9024293b84a1be5

SHA1
4190d2873353acb70c379d605a8bded878884fcd

SHA256
981e7d84fe6cb1bb48b5e96605f88ada818a3c82971ecd2cfbc6219f86a18769

SHA512
762dbdb830cbf71c11045d85cc460110b942d499d8b5a14cc53ec0d6fc03cf00443146d58fe3f4cfe5ffd5d80a956a919dbc64831c9bd30ee86b8bc0e4fcbff3

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
129KB

MD5
02f9a40733112024f1968340c7334266

SHA1
94aef50dbb4b81e5898f496b652e17b90083b7ec

SHA256
d14d79816698f0d65983b5e5166ce80e327c536e75c084bf4547813070e2c1be

SHA512
944bb1088b9f24a7b2edc02387fbd85c6040556ca3f7997d5297c6e697efd1f4151d1817d9d7e6f6ef0dc9245dca78aafc9b7beed73438163533bde8424d98ad

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
121KB

MD5
c3e96861f4289d0e6d98fe2cae58c496

SHA1
ac04c5d27c39bbd97fbbf887e63a1fa8334f9e0c

SHA256
8f16fa2563bbd2bd1da17a5a98ebd1d2bf494f673853f930d6b70c5a0a029043

SHA512
c990ea1acfee5e9b3ce6add930705e1766ab4595dd130935483318ee4e67f888536d030071ca77a1b7969f00005cc6616437e277208ee7e897ad5efa0406be2d

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
126KB

MD5
b3f66ea39ce80b794cffb898561baf6f

SHA1
8967a87c6a741453641a9f6fbdcd150ef028550c

SHA256
0b3b02f0d20fa6c9ee290c9577c6d81675b48787787e46a348ca6e7d3a28b5c4

SHA512
09b709f4c4deb80abf1788a102e03dfb047a34255d751e2e0a2af8a158e157971c398001eb957f288e71fc9a01ce4d868bcb8606d3a44d2bebfd4971c0ad1dad

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
127KB

MD5
cbfeebf935fb57047d69539cf9bd6585

SHA1
ae1e2444efff003955467411d30699308c90bcfc

SHA256
24495e88ad9cf29f9c7cde442f1fd7c801b2761caccd548042cac18d997660df

SHA512
f804a999f4bfac9dc7c1b0b187e3d6a8ae2b15edb226c5e8a0ceaea25572242de01d2c9ffe74c1f194bcd6abbcd1a9c82ab97aa67b704c65edb7ef6a3c5a9c01

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
125KB

MD5
cbd99f5eb177395b4e549e59cef11211

SHA1
8c5d2611deb88a073d2e41e04d07e593f3dbfe38

SHA256
4600928bc12b954f0a9c3303307ca8a7550593895622608a2a35ea28d9ca9543

SHA512
5a841f00bba4226f6f049841d8163627b71358e57561ed191ff11d4dfa6edb45d6ce7dfa6b0f8b47eb8340adccc60059b70d0e81e35c3bc004fbbac9a8cdea68

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
127KB

MD5
c6e38c67d06060b60ae07bd4266fff53

SHA1
6fecec2c1e20357ac7c65d9603ed73bcd3ff01f5

SHA256
a3da4b3c8f9f5dfa9c6719a6133fd14f37961b76d81744f738d9828c09d26e4f

SHA512
7daa59dd00f21d65e870a70de72c265def083b7f844407467a84187cdc58c5d11dd0069cd705568bb14fce46df46041ddd19e20dfb469b39a7368754b2878449

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
121KB

MD5
81eb17a514ba876ee2f7001fc1388907

SHA1
e031c8712dcd342c4c14e038d56123c9fd3ad1e8

SHA256
18029124e19881bff51f8f6e856bf398b70088caef96f9188cf25227fb41f652

SHA512
4d25bc4ab333f26a9c494ac78d9079185ff13f1083cb78ff2a470c70a6a86872ddf441fe3e9510efab97d136b7c5c27ae3793b0c23263c8324646906136e063e

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
123KB

MD5
a89c25950e1c4f66c2fc8975187b49e0

SHA1
483827b7e63a84cc7942c4f4e34f1fc1b703fa9f

SHA256
8d09be13ef878a81523c233e3abff88d68a3d85eb19de0e0b4513e52aae88b59

SHA512
40e5636a7561a1cfa0a70f6e7636c4d361943b89a162797024264b08f242af94bddc531cf895b21a26ce10a7c5dfd276a75b52e6c6aab03ae34d46a0055f1805

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
131KB

MD5
c47f1dfe8ed93e3ff00d03b7d7520a02

SHA1
0e33a63b804be3070711e99ac701a73dfe00e53c

SHA256
82b64007404d0c7a97323fd623a4f5e2e0da8946aa859a6401cb57c464464051

SHA512
8fba950830f3b73f328a7244457a273d8a4d5133502454008a9bb3023308ab70fe1646a0c4367592c61ded5c0b6033b4a5e41eab024644364751a2cbc77dd231

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
115KB

MD5
4490fc42f033f074fedd15618c14d40b

SHA1
3bfc1214b01680164870a7a4ee4b7961e732df47

SHA256
e40531ea57a38745d95a3d4973bd84b0e76fdf053f0ca601165b47304d90a6c3

SHA512
61f5748a7603d82584af9f9d96df8325663c7834dc3ee7afbc6eeaa9c90b555ceae53ac82606f38693597ae8195bb5f16e6c185f8d51f0da397199400260fcae

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
115KB

MD5
884d6a0599f8ec43d04f92c918cdf82f

SHA1
3cf223ec8f14497a1b0502b224be43523b276aed

SHA256
36b45ef1a8341e4fcf285c2d0986995371f41a737491b3b1a1a92117a95c211b

SHA512
e8b84debbea9cfc0e46791c589a1915a5fdfdb479abc56930b639f1a3e1b9374ca4567e6c53bab217eb7cb580627c692802bc50c2c501ceeef4ac78dbf68bce1

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
125KB

MD5
625a10cbf3882b8ebf571a098dd3fe01

SHA1
a2f74960046a202f2d47f585f0372bd4c3cbccbc

SHA256
8a9dabb17d046f0edc445ac6bfe1f2ef675ccb1bff3fac2650d0303ee2f17599

SHA512
f0419ac1f821e9cbdd78556b75015e7b2f5f744ea586a680a75d18c889b174e3c0f4707ca9275fd62bfb78aa1047794b030a0307c4b9f1217f9cc644c5c9c8cf

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
126KB

MD5
c27124ee72b63b4a3c909043aecd8480

SHA1
9b0d0b5318291c29a4b2a07cc915d9c0ef232bd0

SHA256
e2235ecfa3ae785597813b42d18abb3cce00b06d965f3a7a14d4ea4c2db406cd

SHA512
ae537f41f35fc10fc613fac5e510614cbd7bf0390c97ecaada71f58be9f96737b06078026f86f4200f4c04a6176aa852c63f42dc9899e342cdc19b8570ccaf51

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
124KB

MD5
e7a319a91a45ce068753f56c20afda3f

SHA1
7ce5c9633fdf4cd3ea1a2a607f0d0b50d49908c8

SHA256
10757d1538ecc07b064e4045595f55bbed26a6cc134bf00c8381eb3af46d12e2

SHA512
a48a85bc8d9bd1b36e9499ab0e140eb6cf02f89f3a0a30742f0e65c353cdd569dfef088729adedf59ded15ce360b3a4a682a749781dca68ea4cf5a75481f119f

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
123KB

MD5
d785b4140f4c68b7439ae388a30cff99

SHA1
34ae0eff48b507cf0f5527dad57d804df6c96283

SHA256
fbaaa4b92275e5e4b8d8f64ce596a069deadacd1955575c3cd300eebfb61b527

SHA512
10f1361ab166a182a084f409035f24169e52c63e91e3b1ed9fc79c184f5937727c5204b437c9cacc8c52247c53e0ad98d2ca22aec9a9705841f8294139adcee2

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
124KB

MD5
676dd401cfa1ba7291d1dcb09f584c1a

SHA1
e69123d580467d12dc63e30ef8cfb5189be34022

SHA256
d4b820b8b12289c8223c3da52ac2ec7c22cc5678a49e730471187a5b1abb873d

SHA512
fdb2378958571808d10c02c50dfbf62e29b21c58632fb64691830c06541397b01ecadb134b0d84020b6db5b1bcd3d0edaf6cfee245e78f8d0d24fc5dfbd389be

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
134KB

MD5
5ddbd109cf80453c5710efe109e47bf1

SHA1
361608827d7cb39314bc838cdd1c926f89b65305

SHA256
c3559883f4fac2c53f1ad38b119988f97f58bf549308e8e2c97d550ab3a782f0

SHA512
bf8f696e6404f0dba59808458379d849029a5f63135385207ecb10fe88c972e386859c170e25a3a9a6cac468e4c007516f2cadc83d724789efe1e37eb6910fae

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
127KB

MD5
24c613f8fc0a5039f57aa31dda949656

SHA1
cb3744a63fb0510e90251faee2d065bf44167e23

SHA256
912218ded9211777ba2f4c28405a32d15a6e873af3c8cceedb97bcd1e8ee564f

SHA512
9996de3305a3e04e0d51b191892ebb448532e52def32ac534a31d0e2acf38ad871de7d855d595065b255ebf468b4d1b0464a1b1c1c9baaed8b54bba3a9a43b76

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
134KB

MD5
cbf2020157549086f2ccaf66417bca8a

SHA1
f299125c97138b5a01fc211a1fdaf4a6d685fb37

SHA256
42c356b22053cb791ad2797bf3ca5cb3eebff9e10864de9240561fe198731a28

SHA512
99c0fab813026a90140910890499748b6312b74cb4096d04ef2de46bb8a017b98e23a3f4205933ad2689fad9e5e58c03014baddf133616b6024de068d5e7794f

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
125KB

MD5
a914f69572ad338bceaccf0d3ec6d40e

SHA1
35e4815880cec782770018952a02953ec281ab82

SHA256
a1dbab610459864b1d3f87e75302ed74d38a8907d55f7a42005c46275d371de9

SHA512
46988fc92fbef9b2107f5379a881b0858e57796325d5d59b9369d72c4c8fca40abeb3c29c11ad6cd451f1f035a371b3cfe773e3a082398a65ba4a23b9ef341f2

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
126KB

MD5
81d6eccb188ab61aa210df644370e8a2

SHA1
7cdd09d9d8ede9980c79a309a23d0cb0bbba72ff

SHA256
02f4e0823d1657cbdfa45e639884253909223751586897c162947a3a1d4b9a41

SHA512
f9420ed0fd8aa669bb7158ae5a314dbd19a8380a0a29bdefe6b10e007595db387b8cd684a6c2d1a8db93d7862d8923f009a99aff02cfccf44e30ceff63592d81

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
116KB

MD5
97ca09494737aecddb95ae8cdac497f3

SHA1
fea19c21b8a96cc24aeda4e9bbaca42ebabcf081

SHA256
669ceb27e9deaa970baf4dcc8673f6b5e9d02a81614c8f65aa3307517b626850

SHA512
f6422c955358c6c0b7b694679443361a154fe47de0dbd36781fbd4fe11f9faad7bdc3949d5b29f0744cfce1cf8695ac45807eb09fbcd9a2a797844674c781ee1

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
125KB

MD5
6c4a2a53c023d827ecc5d77401521b7e

SHA1
26e2d69ba74210159dd6172864d088fa9993aaa3

SHA256
0b2bed273006e6237cc4d7b7e0a6132529403db4b40642bfcb4e087b255d6005

SHA512
d932d456982446afa763054406160b98c7e787441273f6370ed044f2f01d3446ea1d9fee818adaf9c926449c219c2e01f237cb013a6ff476506bbba93e99398c

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
124KB

MD5
46f14e6f1d51b2decdda54b9d7cefed1

SHA1
cd09f2e4878d23202fcee109edfb7056732f24aa

SHA256
1d4dbf0c802c919a93ca4df371c81169c0937e4f0c5046e2f74b003920df8f8a

SHA512
0f1f1db61761e659c79985395ac6daa0e583d62cd63927bcbec1c49e4deb84e2b4c67ced933efef19a2c79f576ae33002ca042dbe209241e0712134dad5cc67f

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
126KB

MD5
97a2086ca58ff7c1d983b7d436483dde

SHA1
4c08a5d2480ffb77f3c3b0a9bb4afa678193f832

SHA256
5bdd677aeaf1b64c73dd78fe9003aab1ea372dd2dcb69a5fca5104a8fcb7cff7

SHA512
666a3f05f36b918a3ff9e82025cc0f12f9f5aa3b2acdb38642609a04dc392af74f5c4ae45fd533bb1bcc7e827a3f4f7093792486ff1a3fdd21675de6cf8dd416

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
52KB

MD5
d0bbb3446aff371911001d1498c8df1a

SHA1
03798d105794cf51acc4e47586b2db0fb8b2a898

SHA256
e79376ebaafe6af72ee17bcd74a991edfcf01a180cd19b9f0787e645d3136a32

SHA512
ae39b2b523c3b2fd5682b2be5581d7b09648204f567c2574bc86b87d7918683456c77dbe4112cf54fb0a6f2e243912e50f1350858d39ba93eeb6f0ca31bd396e

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
124KB

MD5
b6bd1d0b0c618c21e8db85b2501af6bf

SHA1
240b42bee91ff76a425677cc574d8a8b11346a61

SHA256
0363c7fd2210173ee122d59508491afd6ad815f45d91f3b84c5a11fb0e82da42

SHA512
309200224b09eba31f692190c18e006591637682c5c0516d9c75d4f8fadd23823dd57eef280c8159f1af678a2cf56c494b6b8fc20f19fec7bb561ca532239ea3

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
127KB

MD5
ba37fca6c9bf9dc65ef02d919ad19830

SHA1
5d7b40ab6d605e49dfd0b68b54fdc54b98031918

SHA256
550bd59a397fde0adf130f19a01feb7e7898695efdb7234ca871fd2ed4728b75

SHA512
cc5469b600806f5df29e2764ea706c082a8cc5a9499c1052602a0ca7c85ff9cef279bdeb30e6688ecffa07273a28a221d2c12f19bc82720d15f87db34d025ce6

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
122KB

MD5
a26289daf2af3773e2a5776d3aa75cd7

SHA1
cbe39455cd1276c6eeb3496f90433919cc77600e

SHA256
910ac2316e334d729755db2465aeda9ae7e7e789d42e6cbbd34d05b91b5d0295

SHA512
49cd61dd5c073514f98c1a384c73fbfd765429a1c2999b53148d1fe99bc39f2d4bdd02066f4b5ec00a2abc413b25bae2e7e6656d374a52f5ad5bf17ee99a1da6

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
128KB

MD5
a9941203997f3150b75f8cff981d87c1

SHA1
e2df96c0ceacf3560d7feb8212868d456716880a

SHA256
f7b42f85f0241e796bd2e0363bde711095de71b946cbc8827f7cd66e63a3b299

SHA512
7c95d20f09397cab0f139658fe3473cbde79eb6f98a08a31a16dbc9f073fd44228083fd40e5216a7963f8d3c6f46b0405555bf6722b88bb17a510f49c48ec58b

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
126KB

MD5
ca6f5d61ab1446b17b35fca2e337772a

SHA1
ab35305b89af48986ebedffce8e1d92d575c35aa

SHA256
b5989605156b7fff8722ca2ae65ede020ca5b00a9b3a075f41a3a5519df91943

SHA512
b54eb637bc8eb3e6bca7af9af805ba90e9e8640be433ebd7fcad08922111935d07ce7dce8530fd5eb0c81c9c84d5198a7acb2dae3d4b6e7260f4662be9b03ffa

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
122KB

MD5
92af44c3b92f2851752bb6410fc21195

SHA1
4d79598086465f3a675d88c7276d620388b67b29

SHA256
2e4322d969fc20a9fdd330d1233a9024ef3ec774efd952034b79eebc80912efe

SHA512
02b46e20ffbe3ea860b77187e5aff328d64de1b3c271db093ee8f8c87410d0c4322320bc30c0e2298b4d9a00334126f894f023deb5e430435712a301c205127f

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
125KB

MD5
c22688132ab775e767ecbc09e8cd34fe

SHA1
f1f8b679c9ce409ca3b45b325753b5696301d547

SHA256
3ae1566e15bd71159d6d26def016bd9d097c74be033a57f817484413e341aba0

SHA512
d53b70ed9db08124c3c8790402648bf340056b700b839fba5a80e0563177e560f32f396cdc0a057c34e59fd28cd0dea2b8cce20b9d8ec541430c1e73f4ac021c

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
136KB

MD5
925448a71aeb7181f3499c3bcbebc4a5

SHA1
78fd624c713207c78336eb5e2d01cf304e3e145b

SHA256
1c4a930d19d4b6a3093cdbf9144db1ba80a7dc7120aa11304b0bc93174a3bbd0

SHA512
37f656099972c3392c7972ba3e2444dca628b654d2de30020eb1f5567bb7272b43c1df507f8f8614bee86cccdac003b307064826d749a383c2bbf8fa460c138a

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
136KB

MD5
6ab9a939b3116cdad581fd2703fa6bd3

SHA1
59f3a9e48e95f820ca414bb6803e732da85fc40f

SHA256
78a1f4c37db3226c086e0904c9ed300165e5371fec4c2af9e522c8f4ea8627da

SHA512
a421374c44fe101e5b57c75a24f8c34c5cdd240ea5357c5be5468a344cad86f804c9c45caa78aa32bb434b5eb1928763596dcdd5760d17b947ec58a2dd899977

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
137KB

MD5
dfaad23629caf59ecdfbf500848a97df

SHA1
b41fda7e81e373b1219ca1898becc5697e362144

SHA256
ebbd9c9e65e055e005213a39b5dd652ac7df816c9b24dc056e971513c29ca40a

SHA512
f9d907fd0369beefa940ce1e4ff12798323df9c48778712f25cd277af2502264a09d233e672504e5149b7dfb1b95494de4e2319a61730040fc396293ef0e5814

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
126KB

MD5
9b6f5216bcd3a8c76a554e886013e526

SHA1
c1cfe1b0a030d571b143a477efd60f0698233cc4

SHA256
d947f9dd4a61c772109152c3f021d85a9e32b18197090be66c60bd92513a6d55

SHA512
643f7a6a54c3015eb10f22f99cb24bbe4403f0c48cf52e759d9a89e73d6aea80e34d1ca7343798209ad8ee6c5b8a12637039e5e08098aeb38f360f8609964015

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
121KB

MD5
cbee0a2695a9272976cbb3d1bcca5124

SHA1
41be70a8a5a801b85135aeefce05cfd09edf8711

SHA256
1af028cea065d705e27ff17d9ef2d979b1509f7837223c738c5e04a63fa0f859

SHA512
acc39b93779a07b5cb706a6eea03766fc806000c1493ebbadeb537664dbe29d76038da5b7fe172bb186ba10a8dc572435db542f4e61bf55d5894f79a4352f944

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
129KB

MD5
0aa996fb536c38cdd203750435560c21

SHA1
a23c5cd03cabb349aaeb2e85cbfe219178e0a961

SHA256
04d3481f83071748812dd8cbdb77130f9e138797f341e39ae0e56244d814692b

SHA512
5d754e8dda6ce725c0fbdc878004bd663e38349b502f922ad701e6c226c2ebd83dea3313ade1e207987ee487754986ce5db204c5d564ebdd43a5081733259329

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
116KB

MD5
4a83806bbf915177f184d08e750e07fb

SHA1
c43dac0b54582b0462e629e5d78833c91e98f5eb

SHA256
b2f222225cf8065c71ac48864b9e61b7995ab54329b65723c6fe30605856b225

SHA512
7c322b89f0f74640004f811201fa8058dd731f04b7a77d682142e6b565a004e53e4bc5070a1650b9d9c0d2b5b90c1f98d3d334f66645ef67140725feef1d1c74

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
126KB

MD5
05e3878a776b48671921719f3533ff64

SHA1
4b30a1cb970d111654e1a17ce33fc1dda01b6d7f

SHA256
03c02523eaccee4a8ae2c645237f2d3a2b7af480cd6b5ed38e370d80d1a535d9

SHA512
61ed5d38a789712c40bbfa3427748298ce06c1828f48ed64d39fef41250445beb6eea610e226c5083e22f1232a4ab8661def22464d93e3835a8cdef782550d7f

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
126KB

MD5
4ca2633aee059f655ea9a027b4acb687

SHA1
0c161d5b4def07f823be8725c48d2d8f78d94347

SHA256
49dca29784a6fe341befb2de4224f3c76bd8ebf669d1cd102b7e8e22c27011bf

SHA512
c082ae7eeb68d9921858b12fdc211fbcc17cb32918b291cd6c1331829db7f62fc53a14f2fc28f2b7bb8b55dec748dae1aca56767de06df7af1d0b642fdf88864

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
135KB

MD5
93ef997fc8b5bbebc688561acc85cb56

SHA1
2ee32a366b2c35e034276e9368c97134a8a08841

SHA256
30bf44e595a7989f747df9f5868996bd2671c155a479a5694c9e3beac43e56d4

SHA512
8a2bdf873f73de23701577ec997bcf134e29c2f37e978bc15910652863ff3d37e0c7b45728a2a41c5aed6fddbd6f55d1d7cf302f3185ad6c7c97506c0aeb7cc1

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
135KB

MD5
738c4c5bbbebd6f3fee78265ecb2d000

SHA1
3f3e5097b1cd59736ec58b0fbaaf66b13d6a7c3c

SHA256
223c54fc342d314c604f3d510213abdf403f7991a0a8bd70f1234b6ec301dcc0

SHA512
0fe59d43ac0314a327cfb3c0d9ad404a4bf2eb5d05f073062ff98e0580df0dd458024866bb2e3a8ac6fbd2ae7fd2c8d17bf34c083e40c1511eb474d1ebdc641e

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
125KB

MD5
8daef4b412468d49884dd9a5bbc149d6

SHA1
6d1470598d87aeac86a6580ff622db00990070c9

SHA256
094b8da9498fcb333158c623bea51788bae0611c64a6bae9124731383319b4a6

SHA512
9a588ca4c55de43a15bbe840df3f28ee7cd554bafba293dfc7d14a899cb5cefd79fb09417116d709eefd1a6cac48678e9133b5502d78df80b508053a40fd7114

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
125KB

MD5
1c147d74bf6705bed4b8934eb884ef0a

SHA1
fdd2fc2588e5c43be42c9dcc0b23231154b02805

SHA256
0567042652a324b09b73a470dfe69c3e562a34ff65c33dc829ec34f4291bf169

SHA512
d65d386366c00b88ca180bb63049844943fec0e84fe9ba0534c24ad6dfedb29d99cd24a8afd12920b0e221775ca10bdaab1d5025ee5377353f8b8b9a075f0dcd

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

Filesize
128KB

MD5
92767817a4239c5e008fa310fffd02a5

SHA1
18ec9a0dbe21288c7a4a470d048ae6f10569d1bb

SHA256
a12b0d49950b51cb033939ce746299a26d43c1d9e94667f57347bdbf828e4a8d

SHA512
b90508cda0bdad2d77b8e9948e6a42671a10a4678942de42f1f94ba13e48f5c12dde6b940bea102cb1799a51b4069c3cb7ae280cac509c89dd0b10dfbd197f74

Download Submit
C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

Filesize
122KB

MD5
7dd7fab5657b4fd1eac6f4647582deed

SHA1
ecbb368dd73f6772c1777e9cf8068706769ece89

SHA256
448f00c2126b15ee8360c2747acda895adf45c97e0f87581e37fd8b360196e79

SHA512
ef6661d61b029b92593af7046507eee3090240463e8c6bf02209fbdae44144b02574b5857fb4723cfa0fd7b7e1ad2c5550cf66f11a8985b5ca1e213b4b5ca2a5

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp

Filesize
128KB

MD5
07f8383adbf5896e7028965b683f7732

SHA1
d603ba98f43f84419da8808802fb837088be8824

SHA256
bfbf6763f03f7a865023923a86f3c1721b3e16d66f1b5837e10969c29a95d53c

SHA512
3bb2a3b844da264a0052bd53914c7d5d2e36f2524e92b6df7584f772c6ca00b75a6c3381062989401471545f3eedcbefa045bb5b9e2734460ebed39984db5acc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_RegisterInboxTemplates.ps1.exe

Filesize
116KB

MD5
6cdcbc10b166d08a4eb618e043c6a60f

SHA1
28c1dd078eb1eb0c4ef90ef90f15df3d19ea89aa

SHA256
7e4dfbd2bc12a8654c1261b6fe221584731095da6f871949c1f21bef98feece1

SHA512
3ddd34a974fb92744ccf1d6fc3f3d4034ca31af234dddfc41b032b07c12918b91ca993b7e712e182717434ecabaf8f878f48578b6d00e6fdde9b9982799c25de

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
115KB

MD5
1f06a9c48915bcf578ed6ca3972ad9ea

SHA1
80a093a0d0ba1e3663dbf76432c048ba8a946d32

SHA256
fb98ede6bf4f678f842ae4b75146401734d0a3eef4db775154b7945c17ad0047

SHA512
4d2a0d09d377d03b4a6bed412dc83efd7fe202c51ce619d0ce2c3628539efe419cb0810afca65d510d0ab76813f97dd8e21c192ac1480c13f64e71ce264d68f6

Download Submit
memory/1880-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3828-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads