66a153172656ade296964de90044752705517c0ea0eb69d56405ca20a612bdc6

Analysis

max time kernel
150s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7af64141386ac345156d5f2918ea5240_NeikiAnalytics.exe
Size

161KB
MD5

7af64141386ac345156d5f2918ea5240
SHA1

7806b2f45fb0470e9354c1e5d1053dd192cbfc98
SHA256

66a153172656ade296964de90044752705517c0ea0eb69d56405ca20a612bdc6
SHA512

80c60df6ba998a324dd9424d72f577f2ad5058704e108b9065542be383f2e5e9b256879fe712fcd1592c67fd220de4a4c2e0fb90a96f627436aab976597592b4
SSDEEP

1536:W7ZDpApYbWj2WTWJe+e/qXW7ZDpApYbWj2WTWJe+e/qXsyw:6DWpaWTWJe+e9DWpaWTWJe+e3

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4756) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1200	_user-192.png.exe
2680	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	7af64141386ac345156d5f2918ea5240_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Zombie.exe	7af64141386ac345156d5f2918ea5240_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	_user-192.png.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp	_user-192.png.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	_user-192.png.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp	_user-192.png.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp	_user-192.png.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll.tmp	_user-192.png.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp	_user-192.png.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp	_user-192.png.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp	_user-192.png.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp	_user-192.png.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	_user-192.png.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	_user-192.png.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	_user-192.png.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png.tmp	_user-192.png.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	_user-192.png.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp	_user-192.png.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp	_user-192.png.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp	_user-192.png.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	_user-192.png.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	_user-192.png.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	_user-192.png.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	_user-192.png.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\hi.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	_user-192.png.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms.tmp	_user-192.png.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp	_user-192.png.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp	_user-192.png.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsFormsIntegration.resources.dll.tmp	_user-192.png.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	_user-192.png.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll.tmp	_user-192.png.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp	_user-192.png.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1200	2932	7af64141386ac345156d5f2918ea5240_NeikiAnalytics.exe	83
PID 2932 wrote to memory of 1200	2932	7af64141386ac345156d5f2918ea5240_NeikiAnalytics.exe	83
PID 2932 wrote to memory of 1200	2932	7af64141386ac345156d5f2918ea5240_NeikiAnalytics.exe	83
PID 2932 wrote to memory of 2680	2932	7af64141386ac345156d5f2918ea5240_NeikiAnalytics.exe	84
PID 2932 wrote to memory of 2680	2932	7af64141386ac345156d5f2918ea5240_NeikiAnalytics.exe	84
PID 2932 wrote to memory of 2680	2932	7af64141386ac345156d5f2918ea5240_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\7af64141386ac345156d5f2918ea5240_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7af64141386ac345156d5f2918ea5240_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\_user-192.png.exe
  "_user-192.png.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1200
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp

Filesize
83KB

MD5
d9e9b8c7809fa5a3a6c46756c88286ad

SHA1
ed13a820569a84350c1e554f64a0d7b00a12d4b3

SHA256
aba43fc3bdb8b3b323dbe21475ce43e2c0e7d59938af7fd1c09bb027a9295a13

SHA512
8b3f3fca4f8e867c27710c2cb6afb8382647c22d9caac18060663b341e19fe30248f71d62f6b3adc1c34c0324f3090a9cdaf77880e565e14565d8dd28465b9d2

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
195KB

MD5
6a02a5108ffe8e2a570fb24d8cb26f5c

SHA1
18b498b9365b0a28d7e3ae5482d9b9ddbd3f2b8b

SHA256
be55d99dfa3756dfe5e51a710d89f62bbad725fc2e2e329ca2a27ae74fe61631

SHA512
35bfafbc92bb7b7e94270df042c0672d87db04756730298a6ffc5f34476d6eac2dba208a4e458d69f18d11002a0edca046dc2b686888a8bd5430c0f3ff72a273

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
148KB

MD5
5a627676abcbfd4614860cc48f5fb465

SHA1
4457243d022d8723a01efc1b542a9ebd2d78e0b9

SHA256
578a93c9bd8d6a08a2add65db42116ac07c69de122af992780b7652ca0e52fba

SHA512
e88ce2729939c2002d597c9aa836a16beb48c09fed7b26d4d11f0504338ce95b773dad7c83ecab601116a55ea7b90425165f4f513a846c04854af11fc8e67d46

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.3MB

MD5
07cf02dfd4d58db5bd94721631120ae7

SHA1
91b03ac0445c4cb709aced0366a11262ee4aa9ae

SHA256
84d9e0fee6c52c07278a30c0e5661569f4f3ba1f122ac0f717a834a3d5c6a5a6

SHA512
646e4e4c44a4eb5a70be9217543a9127356d04803058915e3c2d623d6cd899aab8e7dffa5ff04965edc5c83b445ece973e4aaf0c49d457c3b227404d56436a90

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
622KB

MD5
12900d9c10b806d1fac35bb7bcc1a2aa

SHA1
ae67b3ca16421f3928126626ad89e5e9d46d7dcc

SHA256
73fb87696f021a717b7b6b9e604093c9a95fd2e692fcde5680761fb049b8881a

SHA512
281f86caf6bd0f3acb73d4d78a6ced5488d939bb3cb8afa5e50912e435fd8b4bb41e1867a7d76ae6011872810575b464a2e98d943e0922e6d6d20917b036a065

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
292KB

MD5
87a736f84cd9508c4f0fc7f849a65e83

SHA1
1c4b1cdd331fec3e260d82c9ad6df694dec3b50f

SHA256
34375d21cb6996337e0245465e1845c1bde158524ec1fdcb68d3e7db0265a409

SHA512
a2972788238b9428555925f57652ff0e006bbfca689f3863ba58244f0a12535075cadc1aeb0740f68ad266e2e95a70f14dbe2e92eecd000cdfaa051fcfc86cd2

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
271KB

MD5
c918f3fd8a2adce12dcf1d5d57df00a4

SHA1
009e9399db2b25981ccca3a7797d2920cb1a4071

SHA256
ca8507aa3472a47a532a8c87e68746ee9676febf2d6a715c05fad0b1d99531fa

SHA512
58af1bab38db8e553efc8513b811931fedf0771bee536adc7959449d00786e065e1c1a8787efac7ef71e22e0b6db6cde743ca5675b6cd9783a870a1327e50044

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1013KB

MD5
3c879a4860b7f945b7f6594e50a26945

SHA1
4de3b085883d9ca464bce4afe60847c871c12b4a

SHA256
dde56fcb9029586f011086a4cd4d1119cfb868263b2d32f768a49c279f05db94

SHA512
599ba7436b928ff0d48441b15cc7f8ca732cbce7735ab2808001ce7748b4be5c910331e30dc27f046db0dc17dfa973a9f8ef8038fda308cf1c51a8abf019bba2

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1013KB

MD5
4fe11304473370e407e72b0db9f1d02f

SHA1
1d4c5a813fd2504c043ebc9b3b532fdea341fa13

SHA256
77ce880a55671f902936b1f5ed4191863cff7d510a797c589accc5117faa53b2

SHA512
c717e7e675be3296716bfb048aeecc60de2c9ea2807b2ad2f3e09f13f99fb63b13ec9b89019df86ff2341152c21f650c2282348e94a6a5ab5911f6893b5fe477

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
762KB

MD5
a3a9cec4a374a5368b51cb6d49926b83

SHA1
f3576c23ce6c4cf8dfd146bcfe78b31b109e68e5

SHA256
6a87aa32cb06b975fdc7ecb4c7bfcab2c74364a8db7f6e5378db6c072c0135f1

SHA512
8335a3bc94e2d64fba45807d627fd02e8010dc0ed44f22a3b1819f476dfd02191d0ac94267d6ed00e05e5a383333634e9f22308fab9cb7369b9b8decfb6714e4

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
88KB

MD5
49f580c5b6b5e9e933db646964035401

SHA1
348d8f341882b5e07546a7ab6bb39319af69e1dd

SHA256
77a519b2c741544af830f7742af9f73e81e2b15be288b493dee993d0e1c28a17

SHA512
aea9a6cc92cf6ea98123841cd8af6fdbaa5c60de92097dfbde0054ba8a5987383edd2eb4a6aa8d5190195a165bc02ea548a33ca35fdec628ba69266dabb1c6f5

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
86KB

MD5
15dea34a38ca8ca1c356824b351f27fa

SHA1
a740ae70c9a5706f344eb8fc4ef995ae558c9a2b

SHA256
04007df051b80f282429d8c4efcd9a5702c879cdc7be381aa4708771748186bb

SHA512
47ef59fc2932fa27bdaf39bb0faf4685d37a38d4783f16ce85d3e2c4d9effd8cc7d667ada4aa15e3ab4cf6346c3aabdabc21dcb28b5a32377fdef343b50452d4

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
90KB

MD5
4beaf1c9c8c91c06c60fcb7699f9ff9c

SHA1
307b20b5846feb1883ed2dbfafb462615557161d

SHA256
a783d36327b221f267de234bad1c32bc14fed5db905dadf05f094b90e3469d1a

SHA512
05405226b4aec557bf93d25de05c4426e5939fbdc35de1d66e1fa2e2dbf9912fc81011e9015cb0a34ef423134d3a8b8c95d9591cf1b7792410929b788589348b

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
88KB

MD5
335408745e63871a4b955bd122198307

SHA1
223cfcd5efce04dc7eb03cebe3a1a6b10e688547

SHA256
b187ced8150988b11ec15bd7a26ec2703396d288cb92646667ea9ef707d3ed2e

SHA512
88ff8c41b976564b95bbded071b796ce0ea5d77200daab18a8345f5025f59d42035df81e57dd72e33ec2a649acecc7f022850decb471a5d73b29c2f9e7b59a82

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
83KB

MD5
e41f8e30383cf28e3852d79a17745e67

SHA1
21694ac8136c1353d15679903dfdfa42f29509ef

SHA256
55f810d1ba2b299ed1ea609f0cdec9cd73829a233ffbeed0ed62403353310942

SHA512
871e5a89525a5729558c022dfbb2816420a134708841e415877992929a920d0c978fbd06350a00046d23b0dd843b5d0d0e69014bf86b1f2ac872a73b5d059c94

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
94KB

MD5
542cae45e4f6b16d1dad3780a8f0050e

SHA1
8076d4e4e23f3fbab4685fcbf51d444d42ebddff

SHA256
142c43ee1f45e344b4d75445767f9a6dc669049a97f613a16be535408ef5fb49

SHA512
e4456b8b06aed30cec50c307400c3f3882dad5966c26736859797815f90b2b4f129b986c631874bbfaee19052a036fd8d316078e038b7922fa6b607c26cc9b98

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
94KB

MD5
0c174b4dca9e06c471c536a73405955e

SHA1
50715fd239c3a2b44ef30ce3cb098c3b131963e9

SHA256
c5edf74de5aa083a64cbd6a68c842b3e950c46a46e869bcc0767906a071ebd77

SHA512
4dddc0ce3712e6c02ac3cdbaf9417fd374537c09cba3116f4db4796d7289d6cfd85aa0e4b2af3a1101c8af525911a5c8e631d631d740876004d75f14f7c03ded

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
94KB

MD5
5610269a1df029a828ff293ab2b8fc44

SHA1
0c8f5958766cd0628ff17be4a87b25f58c4b9ed6

SHA256
213d7e059183134cf002a8e061dc5785e528d091108941b91e3e5c4f33651351

SHA512
d48da3bb63ccfbca5135b44da4102b98383d934fe59c4d17ceef5a9553a074d356ff57e581f64c15d963eb9929f242ff73f534a8aea25ed61e74bfdd3e944b17

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
95KB

MD5
db13c708c12526afcce54e8ac4b34996

SHA1
666136544a86e3bd1ab58566abee2ae769c68c24

SHA256
ce6366b6d42d28373716e95a24190a646c65b6c8db1abc9cb007ad266fbf3b39

SHA512
c13feb129ad8dc7bc58065105e8c0fce50aa1ec2bed32da6839954502cbd6d1f5bcdc4399f2d9c2fbe3a42867e85e6e4d0b43ec3dc69732c74f624c721f4544e

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
97KB

MD5
1c8de9d1d8af6ff710e35a533032d22a

SHA1
e89b4d9b0f5f37d86f8b46d7308ffcd8255e50e1

SHA256
e90503e6d40068b29c5abf20c5b107576ded3b94765324c0e63b50e83a892e75

SHA512
0296ae3f4d6a1dc335f81e57b2d79197b9ea12e152079b06f6d52b8f7fdeb64c41fbce64f3d35ec2f98a8702b3493d8590a3e45754cb7956b545b09cae3f1f71

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
93KB

MD5
4c1d54fa0d1e9e5827a694a2971f750e

SHA1
6ed99ec0b401feeaff0bfdafd1c8bc8e1d50621c

SHA256
1de1c8a1e7f04d400de86f9882110ecf3980eedcb013555f05db9acbf9c95f3a

SHA512
9becc6854e7dc22b1f87628c324977c3587dd79327003a11a9a8320be126d974234839e0f8a55c47bf82eb9701a966ef09a2d5677cdb6a60e5b88d8891b9a233

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
92KB

MD5
5aae61323ea219fd805eacde9704895e

SHA1
a13034e6507781eac0b88a3a202f3defdf797bfc

SHA256
cfe470ac5f3d0396bd7c42d8f4fa73d61028f58a9c479516eb28d5da366e1bf0

SHA512
2469fe736b875dacbe45ba7229d224bc89a8c141fca6f8e19a0293fc7bbd83e6db1756ba76f4c5cd34b8252e97316cda8d2055e0b51e27c741a511e248023109

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
88KB

MD5
94c467d7afa157944ec73cd87bb9d1b3

SHA1
58d89b96d4303719da532df77d97634a12835ac6

SHA256
1b8459a748db1ffa7e3749e96d03ad07a68a7696dbe6f29eed8611ee7bd04bcd

SHA512
f0b58e6fa9e2bd0c828958196bcf81e1cb28d4c3865dc083fe1f55d9e382cbd2adaae3f1d3ece109ad3e3dfcf6196113d4bfde15a51d0b88eb6813a3f6421481

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
91KB

MD5
5fcc2935efd95f804abbc02aa0d15de0

SHA1
093fd148b2547009d231ff9f926d0064a16498a6

SHA256
4a865731aebded1a7fc3ba4908ccf2812e463055a214508818656e60eb307bb1

SHA512
2875c8b2b8c3c0307298ae6f49ac4ed36e747755eb30e28f23aa64c0defbdc0ee7ae81b333882e15814cc92e0013f2c1c867f13f7567091ff0e5d603d8803b3d

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
90KB

MD5
47beb4df816520c8f77b74b8f3b646cb

SHA1
5c0762619b950d07b64286847512d622c882504d

SHA256
1d1c12d6460484195dc7e9fdaa91890ad83e424603fb30571e7cf4d32b1523f3

SHA512
0a9f243ca9d28c57dcff064d1f1bc2883e9283b5186f59beceb2bb25a00a376ede7a8fcd754e8bb54218a7e998d903367fd48336ee5e9ac7c76e137becb6ee4f

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
92KB

MD5
fb5e5c7968cf7f22d222ebd093c66b9f

SHA1
7c8a0900c4b09a92d291657bf7efc8b26181fad1

SHA256
e0e57064e850c4cf47d467d0d57179d023dcbc6667b91f7f9538a16544122b29

SHA512
ed1707633dd580b2a0fabac6cd3c48fc5a90391dfc7b5276abf1a2a226ec9ae9723050d952a50a9fdc69200df9f0ec5c30ea4884bc4690620f51801d3204b734

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
90KB

MD5
1bb774ab072b334813e00c5767260a85

SHA1
44168621c193b52e7295ac0d008279f121fee4e4

SHA256
b42c976952a09d60a52077837b8052b9a5f0ae778ce31677b7ee3ee0c966f6a8

SHA512
970e7ecbf8bbc404c66ad8f3a880528adfc1cc92bf57dad6d5b2069b51708617ce323bfafc585ef99f7336d6243c65bf25b9ae607ce5def626077ae96d4a1db1

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
89KB

MD5
c900c8ae24cdf12a1bae66df9d9bffdf

SHA1
7dce26671218056daf6d5febb387cdc47a10cdb7

SHA256
733db46070f8e81f74fcde5de11f6fedadd8dd5ce4d4d56659a9e90ab7fb0016

SHA512
8b04382911a9d579384a24439965365429f326b34a6c6ee6d68e2dcd8653c4ce47dd3a6c6c1150a929412039fd2025eb64b329ec1a16ed22cfe3116b6bfcc282

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
95KB

MD5
4d53469c14ed6310cde307a29b6053bc

SHA1
b4cb5de0a4ef93e04f4ae8421373f00ad23469ba

SHA256
7fc42b2cf65833e8438da20b4e86f2210b17847b47409c53eb07eb4e38f7995f

SHA512
e573f1f94919100645f441868b3e03ae788e1d97b55b105c3889c91400e4d7ee946da88c995581f1df9cf2bb56ca004f9425a12c0e29f76e31d3dd64654b2e08

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
83KB

MD5
b645b5a08141868bc2c211a3c915628a

SHA1
96def789c35d7267b1c6eb59dc9817192379841a

SHA256
f609a9214ce5b26668a921bc7b31c6c5e5e1df283d34509e96282f3d7ad48990

SHA512
37ca4a539f61e908680636cf7ec447d377059ca6afab758ecb7c50ccc75733ebe89b4305664218ad98cb50a6e0469363806a47a527cdf3729c6df25e14e36a60

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
86KB

MD5
969ca97c3bc8259c1ee7fc695cc2a391

SHA1
89a78f5c089b789547e78eb7f27b39b7923f94e3

SHA256
7459ce76b7eb027955a87e90f730b875f51f55d588eb66ba02aea76e30daf71e

SHA512
78f2da59cd900e0f6ff8fbc0031200b9c4c29feb40e000786b1320f4c413249a8ca25adf5146c8b656bcdddbbd3c78728214c878720191b854cedf73dd4604fb

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
91KB

MD5
e2fac05e37e83f2ee9c185585014bba7

SHA1
385025a13ceed69bf35d5c4bf08f8deb0c83ea79

SHA256
3b471422aca5b09495b25d7d6632fcf927559300a1f6114612e9c40fb032b647

SHA512
00705bf13b6f849cc783cc09f70413274e0ce966a4e0fb67863fcbc534a24a98cfad9d41629b2243a19b8e170a63fec7a11d5e3c6a59d3b305fab82b6a043235

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
88KB

MD5
a1591f11a260d968143772917b6b933e

SHA1
37a48ecddd5e4aa43ea1d51a24ef3307516470e5

SHA256
1d57a9c695e6fb8b26f8817237c3dbbafc67db25268861f9a328f574d3269f20

SHA512
935e5838f3f2bc386cdd07e925977ce95fbcddcacc409dd3c9869e41ab99f67c4919697f1597b316709db46149695b841e690eff2cf95f6b1daee3de413063b5

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
83KB

MD5
8e3334800751a077400e64b55a0cdd7a

SHA1
fbee3bbaf0d82f044a6758d9ae7d97890cbba4f9

SHA256
2b8aab222e68eeb0997cf9c4fb94f35a59a68e332b7cd81881b83b4fc548931d

SHA512
d459fce9c8ef7103a1db6a24ca16e4b4f70eb82fdab51964d3bcddd6c14f55cde1bbe0e60ee133f724f0eb3c38870ed7bc17e326645b8c35cf1eb2ac7760afd9

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
90KB

MD5
d5187983e4d307d42f6ff906296d857a

SHA1
123f47117ff2ea17b9f47ef6bd444ee0f572b68e

SHA256
93bd372cf465bef92696efd46c0de856e9d8608b12fccb7db0f48f235e68f1ce

SHA512
002aa0e44a3e801f92f03716ab71261085126835a990f7c464341f1e11a4db70b1882d788c3602a607666ab188c0903293ef2c62d9fa54bf9b543b29ab8cf9be

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
86KB

MD5
e026da2394158ff5cf19434af6ff9c46

SHA1
b962439965cb47e09fc8396f844ed91c822e9cd4

SHA256
3f29704e8f7eba8e584990cfdfdf49e7da854124164e24f614d08210f0da44b5

SHA512
8fd20163892b4a1365bc7c97d2236696c227b6b49cca97eaa689875612efdb1fe9e84bd2f7f353f24e61c2096df91552190cc5c4f4e8b54886b8932791394635

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
88KB

MD5
25830aa0f095399beeeae8883b8b16f8

SHA1
b2e5323c806ff8e60a47a5360a4f7408d60aae9c

SHA256
ea207c495c43b43bcccc746ec626cbc5e16a8999245e4ef32481efdd5fd9696e

SHA512
d4877b56fa63bcf0e18252c0fd0db00e202a325c551b5f962bd41686e5dd9635c18bfd50f07c49019f218957e01ea32923d05906763e31f637fbb82d5b90850d

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
93KB

MD5
8eda1039a3d83de14cc54adcdd2cc016

SHA1
700d47cdebabab2e280909b9a4076c901ce4cdd3

SHA256
7fb96cc05972e0ce224ccd4fce02b16c2c15c1edb9b01fda7cb450afc99ccf9e

SHA512
3b28d5a7d1000e6695699645c62ddce489ca03da4a44092c6df6154548df6c73ce7bb833d4c0924e4da87e310466ac36c3259c25067f8768fe107f50cd99e7ba

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
84KB

MD5
9e6c38e23b4c1946768ef2ba3bc40845

SHA1
8fc181df9dccd4d4d605e642248a6173e4e239c6

SHA256
3ecfadb50da1803467c83e0bcd4d2c22ff968e7cd9117fc53d1fcd67dc77c9c1

SHA512
0997044a48376d191c150f96528ca163906515c091fef2e4d2dfdc72f42ea228242b75b188250916217978450b4a078ee069bf759ab4163a0af9e193efdf2396

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
40KB

MD5
11fe331f0520a9b809c1da9ff04a5ef8

SHA1
c3d398f80ec0a456ccab66eed1384b1a3e75fc9f

SHA256
6e5b0d3ced52af2989638e1f4c80173f4fc6d4400d3e831eae55ec5aca5c96f9

SHA512
b30d3ec6070ac6cff7b49ca95bcd1e4e3e19d188aa2df67cdc9428bf8805a1d676d9c51537fb53548a2ae2bdcde0415ee6a9f02a771752febee69f31cae7d482

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
90KB

MD5
e88789567b30f474c70112bd31980c29

SHA1
59c34926943d7bd25526e22e63669d17a600e3a2

SHA256
f77e07417dd4fccdf6e31191d2db967f51bd03f158893e74f19496ed55a7f246

SHA512
443afb81da283177b4d49265d9f17fda91c17a29161f1c499967197b82507fd026b20a62e56dd2c00e66390e30c0a4308de03e18fc9f40741693f2e59aea0362

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
92KB

MD5
e19cc23d6038c481f642ae13f331275b

SHA1
9ebfee799b4ac88f4756d38f71b875ccebc08bd6

SHA256
d483b8e3825ae1976aa9aff39cf03cec93e92d627a14338ff2db23b079735ab0

SHA512
9861cc9bd362706614af5f2e7477dc48d227a5febf38959ed2f72bb1da95da91cb9dd4bb059c802af5cd6e084bdf746d848243d84560f09c53e468a4d07083b7

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
88KB

MD5
b5c657972c15ee0e007891cf8f7a72e8

SHA1
9a7a41dae15638c30b4b7e671ed3f3e2d5e39a09

SHA256
931ab6667da66e58ee9110ce12a788a217049c86c601a3b3dd0cb9af9aac9a60

SHA512
2df7d563b1ea60de346a0a1c50dbd3190d5d187025859998c5989a63282c8b7a12a04c1575623ee92a2e042bdbc0d7936c5b70efd68e5c56fbb152dacce20d82

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
91KB

MD5
a4838bce218fd102bf19c849bb1f50ba

SHA1
d6de101a4b5042cfe4576cd233b87bc57ed94b61

SHA256
ce7a282e74ee8c816092d25dd06a2379b72d991f57a91e0d1488ee5444a27a8c

SHA512
538a4cd5e02109cf9795804cab9e32b650488ca9c34e4b7f6af7ac7bc7c3dc97aff7ac64635ef62fa63a82093e39e08b31b4cd196e7858f86c89e5e825e257da

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
102KB

MD5
b56212d183ed34e586c23a2c52fbcb8f

SHA1
13587ef6c8e2d1ff84f8e302a813b5012126259d

SHA256
7d81d34f5bc2d020d87031ef53cdc098b4b218f95f02936ee2c599a981b84707

SHA512
96cde5a4b655dea4c1a0e2aa2da0a1c46797d89b39105d64bc24191c2af327e2e3937ea059c1087f72d21c225647fb97038d584d88aa62e208a37c0996e5d718

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
99KB

MD5
24ea7bb18628af564d04559ee0ee1c75

SHA1
ad62252880bcea8a1d8b5a75dc60fece813526a3

SHA256
a3922986e9ffd5424600c1d676682886fbc041b30455da2147bd1590472948c9

SHA512
c12d412ca593c3b613d5e209f0f91b46a2ae6f3a1ecf5b00166976f282950b32635f7eb428d56a0d198a16475c48d592c5a7817a22cb39abedf6014f64fc296d

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
88KB

MD5
425a496b4334303128e4d8fa9ef5bcaa

SHA1
4f40a3751d354a3f6e493ecc378818cfbadc1852

SHA256
8d481187df0fd063f1054da3946fd52d2c0193f923ed43643eceeac59f7c4533

SHA512
c221e3677b2ee05049795b7b16cb491240ed8fd26695c8be5d39cf2862b82de5f764b3ac1c644fef2ced30408af522214bd6b98e7d35e0ace5317e596e2022ca

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
83KB

MD5
b0810869342b04e92310091b1a9a94a3

SHA1
e9c0c734251ecd5b3a2032970e1f959fe7714064

SHA256
3d53c5054818663d6b59a241a863e71343dc5650706037d67432602baf2320e3

SHA512
c14ff462ec10e7588f048fed499e1269f3e13650f1d85c152b0a1c3aa770c74715660acbb059d8d28c3a6a80e6cbc99983b122dcd18a7ba430b0c3f94e84b697

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
89KB

MD5
f09408a9f42fa9f32f4c51571f4f95bb

SHA1
a3021d4b4f67fe62e7d7060aadb9b9922cde12a4

SHA256
01c0af6e289d093d5bd360cc652709d2b13237deb1dbc76ec0a11b39e3b76729

SHA512
fe67decc573218ba4633e45c9fdadad039678580ab8f412e71f83c65909a7287505e86d70d19f1c0e186eb7bc898cebec8192e5c275aa94efdc9e4d0a949b927

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
96KB

MD5
dda7b821ddf6df764b7797ab80918d64

SHA1
530d27b23970d58ce9782a99ef9369bb852252ff

SHA256
bfea750bcd2d9de0a9762acb7d2756f60400e5e5f70a34a297c1b5aee5fa7d76

SHA512
c289e5e670304f9b76aa0058c8072f06e09781afad72e931e4c3e2934f2caaa588f91432da43f49a637c4552e103dcb1fd1aaadaff1dbdae8df1d1b53d2d1c22

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
87KB

MD5
28dfdac60b7c6afdf03fe6dcf15f50ba

SHA1
470472b5f1bf24ff06a4deeb90796f74e67955fb

SHA256
ceeb2e991c91e3a8e541414c73d44996b1869db1a19591f9e624e27af8bc56c8

SHA512
fd9390a4fa4de39b99eab19220ee177b3bda8d1e5b2cfbf1ff0b3211e7dbcc9b4f04567dae478d87f6ddfe6b7ca1cfff54761ddc8106a98c306b538a4c666e7e

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
83KB

MD5
81c6f8c5125345b3c6f01aafb8f3c7f4

SHA1
78d04d2fecd1b6ae882304de68c916c5ee0939c2

SHA256
9a013e5026d3fe7e9a876c212927adcfa9a8ace5eab27f4b522506d9a80477c3

SHA512
6a2f320b1f7c127507f235033ada3c8bb4163bfb5a9eb34c4b35ebdaa83f097f8892959da7eddbc27e0e091bdf8bc2f7066b956e39a3170f5cd0953b882bd370

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
92KB

MD5
0332bc6eacafad15221edf26ba542dd5

SHA1
fcd4ea0f3ec89a25beaa188bf44844eae8da593f

SHA256
c8d86299502ceb60e7b68011ab606ee00d05e9a305798b38a20dfd7749dc4c11

SHA512
022cf4b5593eab322534b7930af0f2dea8dcba58a85a04a45ec306cea3b487e05737591814c00b15acc766e3b14b92eb912bcdc95eec2eadf46c4c663c4ed8d1

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
92KB

MD5
1539805129561c16e4c49a9f50986aa0

SHA1
6c22c5ffb46bfd7ac370a5b390b05e6996c3e71c

SHA256
b140988c35068e0fa17595ae291d8666e12e63f870c11a1a5e7b77e1231287f5

SHA512
9400b5be3065cac95565fcd725e7c3c058310418d1f5d7035dad6b1044cb46e6a10f4292aae38ea8d969f3137f9b80f54c7b6288824624a961473da94e7aa191

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
83KB

MD5
418b1a6203a33c3c811402b8a458164e

SHA1
925c55416e08dbe6a3d2a17c27261162fcbb601d

SHA256
9d00768ff6946aef0242854879298b95b323e1ce029f15b37a39153a947ad000

SHA512
af9322dc481bfcc09283921975e544fbb5eafda9af8a778428e9c16e4b0d817050fa98fdf661abcbae3dc44cebe5764b688d478310d9f975a6db82d2146027b6

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
88KB

MD5
180e1a4acb365305b45688b218a310af

SHA1
b715b7934498d93f32903a28c098c21335d0ca56

SHA256
dc76164c046f7d4a13fdcb4e7223520bf0daf1212f430b0c243dd2d8bea4a80e

SHA512
3d8fba0e6cfe9317a154feef9cd45a1d32e16816ba9dbb8aef3bb2f7b1bbb794909060ce8b4422c8bde34b1e306e977450a1e6685503921cfab4891418ad1ced

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
88KB

MD5
18e741bd8203f620052761c30d6c059c

SHA1
ff45ef18c8a69c6091cf7ba828a07ac10f2df456

SHA256
87b0c45220b14392706bc24e91f0ef7bf4285cfb283501a8868262e5ef7ea7b0

SHA512
54adf8d0f4b05396a6b31d1df58d8c50707f9fdbdfa52edcac11455937477e66798e1b2e361148ccff71d09238d2da2aa0daf5dc9d8b8c95da9e9eb7faecdc3d

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms.tmp

Filesize
89KB

MD5
5d21994db266039d2db0d81cfa96136f

SHA1
38c7b25197279aff170ab6e67e4cd23e337ed9cd

SHA256
d159cde414dbf42f63d82828eaf0896b6714953992ad85cb296cebaa744c4aaf

SHA512
eb27f8417c6d5776330e16e7f5231459b8ec6bf2c4331cfb64a719adccd090c6900064bad394e06f61be86ff14261f54edd7df6b61557d7d361e523b67ac1450

Download Submit
C:\Users\Admin\AppData\Local\Temp\_user-192.png.exe

Filesize
83KB

MD5
ac5c184859e3827c310d956814be41f4

SHA1
7a4325b9323dae9af06653835e144ee0c7f4c28d

SHA256
e1fc03cd5bdb1eb1cc142da0fb12c72ad2e147f97c5b55d67a30403ffdcd3bb9

SHA512
a0791371a01936cdb92805726f62ad21e0f68c674ffe2721d25e064ca1f761a77d17e681af530ba458ea734a90758436b38c26042455c683d303fb34d16d44b5

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
78KB

MD5
adfdd473b9c77fb57c66835221bd4e87

SHA1
c6f14eaad90529f6f0e9407b367c156dc795dfa6

SHA256
2993a843c00b5872f00ffb197189df5d81ae7145aedace4f47024f41ca1eee20

SHA512
261fcdb33b03382e91bff89bd25f849fae4c633efc6b2c6f94724e59a4960f893873c8fef5e87b60ca12ff122a72efbcd9f77c73b9902092b85f5bdcfac3db1a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads