4df1f3c26e4e01599bdcb841240a616d2cdb7e6de8767d6eaf7ed9cfb3e7ae18

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

197013685a01486764e20bef86eb7770_NeikiAnalytics.exe
Size

260KB
MD5

197013685a01486764e20bef86eb7770
SHA1

820cfb42dcda7a243f9e3b64d7e7ef8d1533bff0
SHA256

4df1f3c26e4e01599bdcb841240a616d2cdb7e6de8767d6eaf7ed9cfb3e7ae18
SHA512

aef480c44543235c1759e537038ea0dfdbc7703d5c4ed6de46cd595d4a5732fed1befd00d3c0c19e28f5e4bc6d1a456265e4c588013a95e3ee530c83cfee1f5d
SSDEEP

6144:RqlIyFESWu0SWuGSwxOqlIyFESWu0SWuGSwxw:tydy9

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4763) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
5000	_Show-VSInstallerErrorLog.ps1.exe
4076	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	197013685a01486764e20bef86eb7770_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	197013685a01486764e20bef86eb7770_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	_Show-VSInstallerErrorLog.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\WindowsBase.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\uk.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	_Show-VSInstallerErrorLog.ps1.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc.tmp	_Show-VSInstallerErrorLog.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.tmp	_Show-VSInstallerErrorLog.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	_Show-VSInstallerErrorLog.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	_Show-VSInstallerErrorLog.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms.tmp	_Show-VSInstallerErrorLog.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.tmp	_Show-VSInstallerErrorLog.ps1.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	_Show-VSInstallerErrorLog.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	_Show-VSInstallerErrorLog.ps1.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp	_Show-VSInstallerErrorLog.ps1.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\mr.pak.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.dll.sig.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	_Show-VSInstallerErrorLog.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl64.dlla.manifest.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	_Show-VSInstallerErrorLog.ps1.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.AccessControl.dll.tmp	_Show-VSInstallerErrorLog.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp	_Show-VSInstallerErrorLog.ps1.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.tmp	_Show-VSInstallerErrorLog.ps1.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4076	1948	197013685a01486764e20bef86eb7770_NeikiAnalytics.exe	85
PID 1948 wrote to memory of 5000	1948	197013685a01486764e20bef86eb7770_NeikiAnalytics.exe	84
PID 1948 wrote to memory of 4076	1948	197013685a01486764e20bef86eb7770_NeikiAnalytics.exe	85
PID 1948 wrote to memory of 4076	1948	197013685a01486764e20bef86eb7770_NeikiAnalytics.exe	85
PID 1948 wrote to memory of 5000	1948	197013685a01486764e20bef86eb7770_NeikiAnalytics.exe	84
PID 1948 wrote to memory of 5000	1948	197013685a01486764e20bef86eb7770_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\197013685a01486764e20bef86eb7770_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\197013685a01486764e20bef86eb7770_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\_Show-VSInstallerErrorLog.ps1.exe
  "_Show-VSInstallerErrorLog.ps1.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:5000
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp

Filesize
132KB

MD5
14e658469b0d136ab2c4c425f2615e2b

SHA1
27e04ff9a571b93eb1bffe791f469c9a95ec7057

SHA256
864d02b6fd397988ab1041394dc15fc46c943344c9c5f9c26b9d51f59fc3bdf9

SHA512
426b6d446f5f540771a36b40b4bc30d4799418f2bb89e3927bc01f14160aa21a236ac3d5be20d6a5a7dd467d3fc156f82213aae919649e7a4b0a38fa5219ead5

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
240KB

MD5
6c2c93ffb788661312b6452144d360de

SHA1
f3fd77e44c7c6cd59de3180b02f61d6a12a23b25

SHA256
654fd54c2efbf93bdf0f124e3cdd07e7e191fdd13c0c596d490a32e89222eb61

SHA512
6c57013639f407875c2ce9e217f33543d4339637714130ff8ec8ac0ce3e284ec26cd26ece30e05cd2b1484dccfb67c820b5ef98ae04cc7c9f1dfa658b45d46d4

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
240KB

MD5
da40526af91688fa286478a9064ceffe

SHA1
8c8ccee588050ab5ca15b083fda0769dbbb77087

SHA256
cf4a22d1fd06ebf4998247763e7278982ffddfa280fb3ca9ebe2d8609366c48e

SHA512
0d774e6632b7a61aafdc97461f2441f3fee26dfe15c919433a9e08104e921a039f39a6730154ff25f8d032c96859846ef5b88a942eb7362ba811f0b24165992e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
231KB

MD5
c42a168623421c979442039c429d894f

SHA1
c5bc633c965d376f533a7b975103aa9f0ade3f5b

SHA256
755f4f692b2ec413391858740217fd231359f2f233f44ce25305e1b0c734045d

SHA512
48c4f23128a1ae61fae473b0446bdd8babf824a0fbaab3154d6c9928e91ff0dffdab8a7886071c9db1334418811f650d5abd117ed59d3125eaa54a0820065f73

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
32d81cfd172c4530a5e0d22a80d8bee0

SHA1
41eb7766681c8e0c172b03e4fcc2ad2336ff303b

SHA256
8ad4b81c323242ffb242dd8b6bd7d04cb3441822b65a3b6f1fff54f60fb56411

SHA512
df748c4ac7596842a8aedf9b24e612b488213aea127b6ffd3aa8a4fc5a3ea09ffa0be18b3574fc54eae66f9ea23f23e0742cbbb4e3a78f4d947c689f79f0c65a

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
676KB

MD5
a623f0a36ca0bfc0ca2aa91ef295acec

SHA1
e884f076d15ee651b3b6fb3141d0f58a7d4e86ff

SHA256
bde1c9c508b5462e977f53fb077645f9cd10f98505d71939f676d8eb2b4ee825

SHA512
0278d60504fb47a3acd5e41a6effa894789ed098892f7803e9e64ae74d13d22e7fe82ab7df91e10d153bb3efcf38362396ac68c08b60274febd412a390bd8af2

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
341KB

MD5
d7980b472c57679d0a5ae316f069cc58

SHA1
74701a92801f4be25d39c0bf38b7100ddc0aa388

SHA256
c8179fadde37faa5e9ad0a7d4d7c79a5caafe05fe86e9498960d3a2587974a90

SHA512
51b45b5fa6a5bb536c031b24c3193d9e5fd74883543e20a64f0ede4c5de41af7b379bd28b2e735eb0e3c42fc65f2fcfec14250a19d86fcb6826ca90578e2b2c7

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
6a4aca284833f51d565b8f36813edcc0

SHA1
4ca118f12615cde28d71ce2bbe18845a9591f897

SHA256
7e378790ab0af28e6e738ba541ef5ca8ccf65336f5bdc0583ed74998f9fef957

SHA512
d7716fdc9ca7db3b6dab1587ee980cf036760238083750d8660eff9ba183e402caecc9ce02e78b28328ec42bdfc4d3fe1bb6b702288047ee668eb88765e4b2ef

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
811KB

MD5
5337d3e5574de61cbc1fa91a9acb7c0d

SHA1
3977d8fa0e759988bbc730faef79496d9553ebc7

SHA256
f1837fe85aee323285723add19e4ee9bbda848495f1a0183cf3810190b697fc7

SHA512
eebecd1967807f245d63f0befcd232b1fcbdc7fa45f4c63e1153d012a13230ec7348c1194a9476c84174d015bd880cba42964b8701625ece11610a018bd9ce55

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
184KB

MD5
9d52d5d1db4143249ab7eb1d347a29f9

SHA1
b4a6087a07576beadcad12a8115dd77b4fe692f0

SHA256
252ad736a8ba4eb499e1542a23efbb69af2f1ff1955b52e05fa2d20d08a7b7ac

SHA512
0565a23281b4616cebb931289e8b8b24befff7f9ebdeb95aad256358d1babf6bb9a4ff44647abb524a90532358b493a77a167af00d2421be46f539c9dce02489

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
144KB

MD5
e9f7702dbdf387d2537da681e2f785cb

SHA1
f409a1bfdb37918129af06431aab75d9edba458e

SHA256
28f4a8e275a03f06cb66c9fc1ec0466d973b6e8b61365d6ff672353d37ae560f

SHA512
0215b4a71cb9d7404053c08dc6a58855f5a23b08707032f03c6831e81ccafee82ce4992ba2c274460868c1ead00398fe3cf41a5c337f5c451b58c1bc45047756

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
133KB

MD5
1ba0c283c18da7436292ee4d44267869

SHA1
8829cdad123d7ca59c78e85f24236a1076cc8428

SHA256
cf94fc35b7050b14868b2cc27d90a9d5b380436d873ae328d85ab5b75324acd0

SHA512
606d09bb1e23c224a7be327956eb11b02704631160d00a036a182bc396ae1f6766f2b70fb8f1a19dca0a223858f6ea8d9f86e4c069fef5d04293213ba9f49720

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
139KB

MD5
c8e1ebfd15e6fc2b247970dc99896db4

SHA1
6b46313025ebaac152b56aa1d28bb989c05227c5

SHA256
da542dfa9d1a009562229acfae809b12583b6005b40f0b164e2843aed02b4ab7

SHA512
3184bc189a2ad83188eb9988148bbc8681dbc472623300cf86726504f661120d5e8aa39dc2ec2a122f98f3c51cfcb0204a615c25bc22cd181cc1de2fac1076c2

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
140KB

MD5
832729b0824d808040051c1967eae0e9

SHA1
40bf01c4f3dc6714c92a85a1969440a8b334ed3d

SHA256
e5c589bbbf978cc6c50d2b1a7b314c44b0d91988232b4027960514a0f0ac8304

SHA512
d6680f0344ac537e43f55c03700c89d6bd89e08cb2662be273e558f536c840949dd085c3bc0071b1b09bd01a38b14c5a55b2b6bbd167df75deacea90e1f5b8bd

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
142KB

MD5
7e6edca3cbcf97572773dd538d2ad175

SHA1
4775f14cdb41fbdfd18b2e1c88d9a288f4e587a0

SHA256
99217c96f5d8085b71b201c68738a251eec5b43f8d4727b62e98a9912c0808c7

SHA512
f61043a0a92a81069f04f658403aeb2edaa8f1403f02ae9d5d33c40107e9ff1031a91b5a1df9ab6c1a1bf58695a865def651b916bb40eb2e3b0da3e15b0bd79f

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
137KB

MD5
bd737b53680242a17282a351e15a2fbb

SHA1
abaf07af83731fb0d2c511d752935c161615af76

SHA256
c665fc9a546e78ad008e99770240d356cd8353df96146349285d36fe02b0ecba

SHA512
e328892fe85135b8bbd26ecf7120f119791cdcaddbd62b466a23d537b963ba38b5feb86fc0694eecd5c232cb209e28b8032160f8a331101969c7df3dd9a3d676

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
141KB

MD5
68365e8ee29fcad6ce2ff326fd8a8a5c

SHA1
9b99075b66f99e5093de60728fcc7d8bda5c093c

SHA256
de9e3fdd3f866108a08b959514d65342704516ef3415b959feb684b67e6941b8

SHA512
209392ac41e74dd0f8963d0e0ea4c8035fb945a0a62685d5fb088cb24ac783c8556defe82f46b523fa294b3111de4f28983ef8b057011e242c93374beb1cd45c

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
142KB

MD5
9a651b0d7e2f64a9182683a962ea5186

SHA1
10039b2e30600fcb348bc74df1c48968db4bc2bf

SHA256
8d2a6d20e5af1bf8832928a31230dcf0b3e242ed5a0dea7db0f2f0d7a1a0b14d

SHA512
fb231d71ce72a0ebead872645bc0cc6d6acdedeebb2e4dbcd2b18f601c3e41bb0047af053b16dbe7c22b95742c1059da0ae52491e4fa2981f0e07fc32661ae46

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
141KB

MD5
b864d62d42b124953582094b37159083

SHA1
0022c9ddc61eea36a9aed067063bdccd360f0bfe

SHA256
b5f7edf4c13538c7a427b4465ea0f7cfe9e89d349da021a713dea920f7828fad

SHA512
e74defd536c3ebb3f361104d493ffcfb436c904382cced23baf083191b2258b24f8b17e2db109e6d3f95c00ee5137b7af8d5fb409947e8d6d9aa996092b8f1c7

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
137KB

MD5
9fb689b0ef9ad3cb8430c8eec46f43c4

SHA1
2ac9a11192a66708a13fbc5a437afadac4a9e1bf

SHA256
5bc9d9ec2fc51a9a0e339fa6302b08ceb5c130d8fac1cfe43da2488fa88f351f

SHA512
f8b755ba69625ba36c5c61e8db443ad1a9ba41c1b1ba70a7ea2dc119c39daacba4ef6193ef65991f514cf1bbdee5de0130a31172fe64fc61c5ceebe773897469

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
141KB

MD5
895dd484e8a69d34be1f530564eefe18

SHA1
d71d523a9e1aaf721cebfcd890abd6aecb5f5aff

SHA256
3a6ca5d4c6f529766d77642c1dbd935e656eab4a8a5e7372faa1107d177a78c0

SHA512
877f13e843dbe436c674d3abf3ffe2021c73136fd29838551c4b87036d2a605fc0f249d144562f9e1b8dc25f91adc900ad590b2651f82389625ad50e28a247c1

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
148KB

MD5
1983b86ffa42127c46a4bf5b7b67e085

SHA1
f77bdcd99c6c3b541f8ab83165aed960b0b93bd1

SHA256
5a65fada2d17479eee18d422d3aff912dcfafd784cdfca80bcd834271985b22b

SHA512
565821cc569d85bed7cf0799f604777156d64bcacae7dabdf626d3af0afc723cbab1613212bf4a7c5e9d548245f7ff87f815c80f56eba8dda610b3a691e91150

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
135KB

MD5
9c6159a946354ac72b3f0e2452823ba8

SHA1
235832e30865430b09a13abea3c8467e55d1340b

SHA256
2c0e792a19ab95fbe2f122b11eb47476e3242a744e6407732825dc3fd6a47273

SHA512
00e211f02e1fe8693be2120e7293ff362ec6e007fc5f89eeb85b1e31691effc47eb1a5110a3fe1738fb66151fd163bdc707f717620bcad0d69637ee5df9988fc

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
133KB

MD5
bed59ca2952e90c744c5a539bcd8a3b6

SHA1
d21970d91931a0d0297a02860e9fe63f13a356b2

SHA256
1edcd3393b472fd571f4ab208eb2e2eb685ff177eb2b7e30bbde8f4ca30530cc

SHA512
3daf4464bbc9066bcd3e4aec9885afce731c32afb2e263cc3115381bfc5dc4e69ee6c1125efd18d5bef23a06c81afe0863920bd83fdee2ebd06a192db5e226a1

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
137KB

MD5
24cb7cb6d525e7bbfc8290baa9aea655

SHA1
788bf7a261d3fa07b1d30ced85f8d2be05023ed8

SHA256
a4ddb3c6ca4dcd3a8bd582b9914896b54756657d48c958cd70e065ad4d0ab10b

SHA512
5560a14907e77f325d20bcf9fb4a1f44c3f394fbe6467a8d1975bc20209053823347872c699ec1e07a282ee6302e474b0eb7c72166645d6f738762e183856dfd

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
134KB

MD5
9c604874cf9af7132d00138fb99ace9a

SHA1
85fa14ae1ba81635d4f1a758a6ea8a70db185d9d

SHA256
ff757ba5d53d768a2d38313b5cd22ab0223ca622b369eb14d6eaf28375eb0dd4

SHA512
b465341d5703ba7ede8ad47edb0a5c7ec94551cbd98cbef0c2ad2fd51292e8081c8be49407caba52e7ff59383a4efbfa061b4ba9ce694992ffc8821797b14b67

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
140KB

MD5
7048713d1b292784c5ad041b46540c2a

SHA1
81203faa469f9fa508c9f571fbf3aaef75430620

SHA256
31622f86321f5eca49aa1f30a1ce9c7f1f8dac77e53a7c596c0b5ad8fd4c66a6

SHA512
b25a278facc0510fba11bb736c3803938c8a69862fb38350626f7fd35f3d83ed5980690ee292d1d92b65395b1457a02bf9f71e9f70776836f58442e1384ea57d

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
139KB

MD5
26eec367ecf7289a9426a7986acffa9f

SHA1
bf634caffa889f36ee562a91fac469bccc2621c8

SHA256
5a6871da6c59854af539b2120fd87a17530b25f36c1e618dedea74ee62dc8958

SHA512
e335b2faeb50a26424b16c9be0501cab3cd473238e947cc79485127fb3fc969fa0b04eb032cd586c6c8eef3817c234d1e6be4f19483b22d384449d8baefa305a

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
145KB

MD5
000d5a7849c844e5e2bfb845ed6300a6

SHA1
0ae3a4139bea3f531e6b73910b8e24f2e10f185e

SHA256
dc60039d1dd3f7a23f60a8f924efcc16476fc94ea85491023f5f67c8681bfec0

SHA512
d907e9b6355d8b8525644b49301591f5efe4e9da3ced1c81bf10ac46d902b5c4d305d70cd4b5febfc0871b06e71301faddf54383d4f180356580938796d591c3

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
141KB

MD5
90c6f85fce223a511f62b00aed293ce6

SHA1
9a2aa8f34a91950feecfbeba17a87de82a5dcdd1

SHA256
f8b8851531973ab817456bb45ac0c0f957086e3971364221b7126e2e734b4a4f

SHA512
a34aa5b8d491348af82227d44733417d103c8f1452aaedf605805dcc794ed7de64dec99bf40b7031e9f1eaf7524ceee4a947847e196dcf2c61970b0ddec1fba6

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
138KB

MD5
e737b76bcf2e554a5e398fdabf6b6c13

SHA1
4cf110bbb0188b07bd93b983fd149d112b6733a9

SHA256
26e70672f7de4599daccc9cf9e61ee41d7e896ab75b05ee4634908521407f4e4

SHA512
da16bbb306b589dfcd607e85157edb39db2d7ebe04e6b4ecdcb8732cf52d22a94c618142045bfbfec0d1d0d0da6c37d88ffada293018d673f6f5b3a14609a2d5

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
140KB

MD5
9baadc5b7b260e946a54367abc41e5af

SHA1
23e1100f40bdf7e7fb538affad43a5e42196c10a

SHA256
55e615d404244f5c2340a3c3121a1d2af6328fa17e451fb0e766275ce6b98902

SHA512
06955b151685d21cb52d93ee6f91abb461e2c320ff04a47d451dd357de5daeeafa1c7fa6c7e0058e5c3977ac705cd29670905e22b3849f6014dc7bed42e80271

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
141KB

MD5
fe0aa741eddcd7fc29188dc50ea81335

SHA1
43b5a4697f12ca31bf197a67e01575571587ff9d

SHA256
9f368598d71c784dc5f749553a592626b8dd5881a550e8590b6b2e1fbc4b319f

SHA512
5c703f73d69180c8b4fc21d38a0ca317ee903a7205fff03c37a850561dca32c1bc9c92b8f40ec2fa23a6799e919465b79b4618ba8e129d312bf072af197f66ec

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
149KB

MD5
2470556fc98a2f8f5b5927e0c70ea6d1

SHA1
56b88d8fc18428ee77e915f26c55ebcd15af2145

SHA256
732afb5d717e8509b60cb7fa83f3c496d560f27d768fb60cb195edef33fa6b4e

SHA512
fcb6afb654aa09eaf68428724b290c345be478d7a815c6b75b0d9757afce7f2e691e457c8dca3de868283e05b8eb45a129a293b5e143284bb1dccf0794ec89ce

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
136KB

MD5
6eebcb574767ba1288c278f1b8ca8e18

SHA1
2c2b2f1b7f6072a65ed7ff0b51efb000769bbd21

SHA256
e933fb083f902b42f4745b6f8f9b76cc718d430f107577129291dcf51a70abb9

SHA512
e9e2a51deeb8a577e75d58d6927c4995bcde2f073213bcc6a75a6f729e410663c1ebf0b44a936ba4ab29a952b3ef2226f90b7f391fa7d01367c7e86bf8644d96

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
142KB

MD5
defd90fe96e31411409842b05d685a41

SHA1
0548f74be7709b490c43a07f6d54716100ecb495

SHA256
eddd4d12b2b4abd5d5c231e08240f142ae2d31cc7096d07bc02edf71ee3e0914

SHA512
4da0ea69c1ab8466f3b79cd2b094dd2010d275f9d347bf0acbefe623e51eab626b21acc826260a5bc05ca7873a2d80505ff7307f529c97176bb681942c48d531

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
137KB

MD5
d03957d3ca02b23143f86ebd5c60c714

SHA1
537165e8f550b4eb104427d5f433872bd3234a43

SHA256
467aefa16a801ce9d8f474570c982fd24897ac8ebae6dd34870393af2f7cd478

SHA512
31c2ea92e347298c19fc1156aefda02ff02c6d4e1e47b5d6b373317a0d74e1750761c44f2e81ffa0ef7a9cb192b0716251c23e2d9df604777e6edca16ce9f2db

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
140KB

MD5
32931230dc27606124f2708b66781ca8

SHA1
b0adfee59abff5e1232e2ed332912112f5893da0

SHA256
e2d903b1e7091c3b59ee2718ef24ed9dcadd0463a77ff12963ace0bda5b3f709

SHA512
5f3e601d287b3b64769e7f64029135d808199f5702751f8cb4d589a3938b240dfd922439409094f2fdd988c2781cfaf42b3847ed7d78fe1cd0f10eec28d9716d

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
141KB

MD5
3e69de44d51353299ceaeece8cb896f5

SHA1
cface3b631842f81e95232a93931822bf37ac8b5

SHA256
1ec88ad84157ef8ab6fb08f79fcbe62cf3b4582f66cb7753bd1c345144fe0b8d

SHA512
4e4633deb2d05d0e58e53e5055a2446bccf969ed8a6526fd770fb13fdad12dd61735cf8447ecaf77ebffb338c55cf5f98ecd666910551b42472105c4d70ff7a1

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
139KB

MD5
e9b621e7338551fc2006a96e1cd61d2f

SHA1
f5e9e1bf038a900536dcb5b8679ef1238862062f

SHA256
8806d0553b4ae4d928024e7152a0606b1d1d2f881ad713f031a2374ab40588f4

SHA512
8d61d3113714788f97a20673c378b6dbe8ccd17a37580ef6b70ed5db323ac65c69c229dacb4961c322cf4064999a0cf7e5a13f151cb27b51e727507c75640816

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
145KB

MD5
725f1a347b8ea84064fcb39dfeff5ad1

SHA1
bd600d4fb43804785ed1edd123d4d08e5b8eec33

SHA256
47bfafc856795764660b437c47e492618be2220a9bfee83dc6681efa103449e7

SHA512
b77dc677bb56d871c00386258af4ff9f9842ecd1ae1cca90ec8e920b4143cb12e1a8f534c6ecd8d44484088958221f0838745fc7d1fedcd5747a9ec93524a4ed

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
135KB

MD5
675f1e81388554193bea87e2f3a18644

SHA1
23cf4aae266159a3701926664ea792becbeaba3c

SHA256
d5099a5ebb50614241f9d1fd49583d8ea0e624f5c85a947f68bb428cbfcba075

SHA512
fa2e699a12c66da85e3ce5ed23321cb60f0926b327fa730d3474d1e7a6f2a2c05e9f46abae9ed6617e5b499861405e67e3fe4117e08b7d5717daa28c56250160

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
138KB

MD5
334af5c63fefea661387313d23897608

SHA1
c659e17886e35ccb02c0738a26206c55f0b9ec67

SHA256
e5073f5ec9468217da8377a4b07c086e348d251413d554a08c8247e7b38489cb

SHA512
018abe79de4e5f81bea41c0b608bea18faeae481f8834dc62a94da7468e647f7a30e715a4e5d8dfbbd98467bfaa0e58535d336fff2e0b4942455b82797a177ba

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
138KB

MD5
9e266b2e61d6637fb0e5d0a00aec450c

SHA1
da66bb398df465f8513333d6338e4dfc02bf4071

SHA256
3e9dbba331217bd46d2108e1df4bd39efa8d1ef9c5f9a8def0383b941e61d313

SHA512
5167751a791a1792c969b998a00116efd987a05c40ab0058e481fb1295c74590748252236ab917dbef8d1c8c2f9eb96f73428cf3ad0f740e1abc5ca54b682065

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
140KB

MD5
b9628d1ea55421482d3165f67c98774d

SHA1
1a5bb13e7ba7308b6852514fb9a4daad06b55def

SHA256
8d220b959cb72581069e07aefd05ce663c5c71a612cb8517c49d515b888b2ca6

SHA512
e8258b3252cabd486b67f48c28fa2cee6a11a758b8e066c895cf2d9feeba371ad3db77086b46ea324356728a0a911efcf340385bd669f8d7959f68fe8f3c2e27

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
137KB

MD5
31ed0679dd9c6a2f7e6cc110d4283d32

SHA1
888a1889c251e75d7fb0080ed60741954496d51a

SHA256
3126618c7ebd22bf2e6fccf7351ef9c3fa9db7fe5781ba650ac0645ab7c8ee4f

SHA512
01c69ff46e1539274bc7cbe497a3892b917bfff1c1fa210a1a092181032a4d0a131d657d80df8f600f4ef7df81fed440c9af17407d6ad6f13df432b7b589ff9b

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
144KB

MD5
b856b61ba0645b89f9af1f32dc42ec0c

SHA1
1b39cc49e514e20c3c1574f999b97aa583de2412

SHA256
8442aa90aeee0f7f518f67109b42af2ec0aa3cc5cd8b944467c9b3a164a8e8ea

SHA512
b72a57ee733f8a4506427ab93542098694020ff1f072269435898e3888afe6f124b45f16e895801c9c421e84a606506166e34194630cef89dfbac7c5c6a0d8e8

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
139KB

MD5
a4781d7fd63cc2b11e4267beca0d26f2

SHA1
b1d18d547b9ecaa9fac0a0e7df4d8555fac61a21

SHA256
bc4da6f6f7eb6a1271bb44351f0e7b16c8a0120b757b13d27d04c5ee7cf895e8

SHA512
36e194b361773f017375194b6d3818a45c75fa555405465ee02c132df59399cb522bfa9f407e62e9700408977607ada5337aa0e2b3c4e50ab92104a5f05cf6dd

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
141KB

MD5
d8270b6097e337fd2bb3ab1f8a5f5fae

SHA1
b03e520a8b26ad7399430010c6878c2b97fe9733

SHA256
7fe518a39cacf4985b78d684415378ec9f2dd3a47bd78ea7408372084ba86ee7

SHA512
29b0d81a2de763ac2db6f2ce5ffc0c0953a310139f492b1d1a8d34b0bfbf63b5d75e6d3d0586d2087d8b450b53a44745a0d8011a2a1a94d650a43e2727555177

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
137KB

MD5
d82ee8da2fef15524b28267ee1fd2772

SHA1
798ade945c40e7a258ee411e6af2f4c02c8519fd

SHA256
b4b4d9885344d298b383bad277901e153aaa29fc6aa2adae1d181fc1dde20424

SHA512
27998aed1624e7823e9fbed0f07f33bf9a5690976e96b21ed1e6af9a2efd764f4c047683dfe67f57a4a49e207afffd31c968828347f87da485aad03aacaf2f65

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
136KB

MD5
70d76d47bd2d78f87d197f9fb3a63904

SHA1
3dd1d2f92afc9d8feff2b83180a912aaf6f65733

SHA256
1f5a20f4d8855d11beba506e19bf3c19cf3796acbde4b524ce6195261e7f719b

SHA512
2575688a98c42fc10f1522010924a36f786fcbecc359b44f4555f575d8a2b1ca511241bbf237027e07c53b38072063049470d3d533e8d58251a6184c7ad5480f

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
136KB

MD5
5c25a1852d29c12ae9de51959f41af70

SHA1
5e0b792a86135993e90f221a39f612f6e8827208

SHA256
680535c1d7ccf41897fbf7a571e77799cbf4f5b8cf15a924fe167e19da00fe01

SHA512
a7d58f15c45f5f4bedda58b315ea7e69b96d6999ed54f9e18ec533f17a0b3343320345cd2dff347501bb240dc431626ba5d816275b81ae5ff02c50c6b9bab5d2

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
132KB

MD5
76b1f7f88f10d497fdbae8f5869402cb

SHA1
f58fc93221819fcb24311598d35761443e8f02ac

SHA256
83f0de6fa8e38c0a99dfbd9f7c4a259bc471e4745210adbed1fa32a052722078

SHA512
6573eb321a689f1b09e421254f17c07af7b506ec28985dba34535db9f61717dd9061668dc647170451a75fc15c41e15df4c89985f2c7a8bec2a456e80692a511

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
138KB

MD5
e730a926bad12902d863a37d173de1a6

SHA1
650e0b792fd31d30d64bdf075c23e92f94181c2e

SHA256
335e7cb03c0258d17e1c19c26ec1aca08b8dec9ce0bb946d8d9efb6a96cf3ecc

SHA512
28931d4dc1c6d51cd48dbb3e60e84f2b7b89d2a26dc72d1696d71a6440b2171236742380def5e31b2052fa66fadc45247426a7988c0797cb088f6bbec74308b2

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp

Filesize
138KB

MD5
4d3f1ed5c4c7b7a0e7faae7fa8270dd6

SHA1
3aca4a6ad0006f3ddd37f682bf968082664cfc8c

SHA256
f1cda3e45d6315965e1c13bb4712c5270ff5bd24be95d71417694478590f34ae

SHA512
8f7cc10afbf472aafffa9dc95e134ccf500fd8ba0b6d0ae01355d3b4037cf4f7218abac4dc592705453cc019b0bb55a86e2f7ba01fb903241f673623a36a50dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Show-VSInstallerErrorLog.ps1.exe

Filesize
132KB

MD5
e646edca602e799d0bb85040fa97f035

SHA1
5a5d5abcc3c4b0ca8e1b7f1aef27174163c11047

SHA256
687c72475f3ea81928968241304721b1c68d506ad711f5b5ab5745c29617dca0

SHA512
fc80804ee01167696a7e89b7a9387bb670ca50c7c66c2ea2a6cd23f28f913193032d0d60ad501a5fe8e99961570a153982edaa37d3c529d8a60f089450a0a53d

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
127KB

MD5
e592c8b2e51f931f015581df19ebd8e9

SHA1
5ad97d4681f1cfae434864b9266b1d4e0e447f27

SHA256
66a56a1f9a63f7a66ba6b48513535935e7bd8080e3d65d18403132086bd218e1

SHA512
ecb6c737466188e731c2b80b2205d068e64efa54cbc59ae152456d0b06177cb990de805303df626baa6bd321c06f891fc2d6e6df65da2306946399c3fbf41395

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads