2359d30e199400fed2c9664fd65504a6fc2c8f28cd7352dae8e601cd33364dad

Analysis

max time kernel
151s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2546aa765bbd0cd257eaf219b74fd970_NeikiAnalytics.exe
Size

95KB
MD5

2546aa765bbd0cd257eaf219b74fd970
SHA1

99785fc648cf8d6c85b3fd75c44b3d520234f61a
SHA256

2359d30e199400fed2c9664fd65504a6fc2c8f28cd7352dae8e601cd33364dad
SHA512

5af3dfac1112935fed379636003489e5befa3549893284815f2c58ab7f11b5bb2d8b108c0571401a5ef01ffccb77d2664e00a66c783b6647172952c31028c97c
SSDEEP

1536:W7ZNLpApCZuvIYYoYox7ZNLpApCZuvIYYoYoI:6NLWpCZLYbNLWpCZLYI

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1149) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1596	Zombie.exe
636	_KB3035131.nuspec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	2546aa765bbd0cd257eaf219b74fd970_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	2546aa765bbd0cd257eaf219b74fd970_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Forms.Design.resources.dll.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Windows.Input.Manipulations.resources.dll.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	_KB3035131.nuspec.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	_KB3035131.nuspec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	_KB3035131.nuspec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.CompilerServices.VisualC.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\UIAutomationProvider.resources.dll.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp	_KB3035131.nuspec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-debug-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.ReaderWriter.dll.tmp	_KB3035131.nuspec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemXml.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Aero.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	_KB3035131.nuspec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-math-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-runtime-l1-1-0.dll.tmp	_KB3035131.nuspec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.FileVersionInfo.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Principal.dll.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.deps.json.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Debug.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Transactions.Local.dll.tmp	_KB3035131.nuspec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Controls.Ribbon.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\WindowsBase.resources.dll.tmp	_KB3035131.nuspec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\WindowsFormsIntegration.resources.dll.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.NameResolution.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ServiceProcess.dll.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationFramework.resources.dll.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\WindowsBase.resources.dll.tmp	_KB3035131.nuspec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationCore.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Controls.Ribbon.resources.dll.tmp	_KB3035131.nuspec.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	_KB3035131.nuspec.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Principal.Windows.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebClient.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.dll.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.DirectoryServices.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationTypes.resources.dll.tmp	_KB3035131.nuspec.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	_KB3035131.nuspec.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.Primitives.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\PresentationCore.resources.dll.tmp	_KB3035131.nuspec.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1596	1504	2546aa765bbd0cd257eaf219b74fd970_NeikiAnalytics.exe	92
PID 1504 wrote to memory of 1596	1504	2546aa765bbd0cd257eaf219b74fd970_NeikiAnalytics.exe	92
PID 1504 wrote to memory of 1596	1504	2546aa765bbd0cd257eaf219b74fd970_NeikiAnalytics.exe	92
PID 1504 wrote to memory of 636	1504	2546aa765bbd0cd257eaf219b74fd970_NeikiAnalytics.exe	93
PID 1504 wrote to memory of 636	1504	2546aa765bbd0cd257eaf219b74fd970_NeikiAnalytics.exe	93
PID 1504 wrote to memory of 636	1504	2546aa765bbd0cd257eaf219b74fd970_NeikiAnalytics.exe	93

C:\Users\Admin\AppData\Local\Temp\2546aa765bbd0cd257eaf219b74fd970_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2546aa765bbd0cd257eaf219b74fd970_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1596
- C:\Users\Admin\AppData\Local\Temp\_KB3035131.nuspec.exe
  "_KB3035131.nuspec.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
44KB

MD5
4252d6e569e568a2ab2f8cdb4bcbf2cd

SHA1
f95f1e423a5c8ab8eac8062f39408ee7a001183b

SHA256
ff9d5be722cfda106a1dc0bd50135612577a93022f2d9ba68240e911d84689f4

SHA512
a22c719c102424c26689715adeafbd98959b8db3df7ad572498d20143fbbe8d45be49c99cd2adebff01dfb7e36b3ce25e81492bbb6fc4d51cfbb4f4b2b0a70cc

Download Submit
C:\DumpStack.log.tmp.tmp

Filesize
58KB

MD5
f26b93caf2e9b34462c79fa74a20aee2

SHA1
68d6f6c670c9be7168f2dfb5d8a7f1196df62d58

SHA256
60b356298c9468a94b1156dca91f203dce042ea6aba396b6e4eb8c01e536f2b2

SHA512
0818782c0b0e5b731b4229294a122abe3f54bf458720fffa9c3e05269899f528c782069f8934e656188e1cdaad48f6fd6d5a4d7caac0ce7f9d99e7cf5a10cd02

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
48KB

MD5
6ae56feef0728160704d81a89ee27be1

SHA1
7e267e2f1a6223ea588ba38e8103448859cc1aaa

SHA256
b58383d89be46b6f741f4628546c2fbceae3cb7d9f306c8cc8e28a88eb792cfe

SHA512
4aaedb27d626cbee3e39703c1193eec7c509dcc72830f0cc6004a944cd4f3fbfc031a47ab53bcffc795abe7a30e25a810fd603d7a6c8c37f79362fa6f1ca609f

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
163KB

MD5
1169d227a6e9fd2808a05b1d88597647

SHA1
d1824f3066e002b61aa447fe9aa0b4e175afa5a0

SHA256
bf0e17209210008168abceff72e159d2bcb6f299fe8d85163d0df352c399c96a

SHA512
46197f3744162a7bd950284c6a9494bc82f9da5ebdb7187e6c0554380e112e6ab0f800595f8338d20d7f2547c6f09bba89e9acde61a5e85b9ccd6390e6189355

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
44KB

MD5
a7d329d37e7d979ad768246693640f64

SHA1
8cbc0cc299e09283480c9ce73529127c8b52d61f

SHA256
7572e41a820a3f3604fcf85c6865c4f37716eda84cf77365167f05ad22e4df45

SHA512
9bb7eefbd97d6936a954f0b3d63884d8b8e5df1229641412b772addf7cb85c87c92c081f72e68e67f445a98c67a577891691339659448fea18f619cf880b5eef

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
ba54fe67d9bc5abb869e692dc6e3c383

SHA1
8fbcd63ab938c7f508ccd7d63b2fad8fec40bde8

SHA256
dced416ead8ad33b80ad79491140944aac90d7d59cec9dbdd520a826978c30e0

SHA512
bf4badd69c1453eee141c7f01de9ac1e4373a62cc26eac384c6faa7509a5a9b49594a536d138e6193447daa4c71bf527c79174910f8f58acfb6e0ad59e121b46

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
512KB

MD5
f746cb4b2c83435a71b8da30bc5207a0

SHA1
92bfb3a83c1670d1fda791c7e7be8f54e22c4619

SHA256
3c3b024c426c0d8adc8dd9c69eedd23621c62f77e4eea348690aebf9354b1304

SHA512
a05e36ba511b29a7a7e7deeb02486418066579202cc17a68d276ff9ed55cc361f261af5e6b2f1aaa5f471f7e1b16368053273d5d27f3533dd032561398a04979

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
260KB

MD5
60fefb91b2f5628fea17d28737e28ad6

SHA1
551ffc9386e692d67c27cc911728d1b7b2314c82

SHA256
dca281526c712a9e103cf6a8a4c4d728fee1ed52bc05e96a3ba7693f78a09c6d

SHA512
32f69b839cc8a8ac30c7a6898443ccb7fd3d4ee5ae9838e2fc57cdef8bd9b2d267d7f01f91c75fc2889d50e4ed4d755a7186b8e0cd18fd528379a9f2b542e73e

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
734KB

MD5
a120209f47367ac78c60a629c590a1c3

SHA1
df2cb7ade2d576b1adec933f820142218d660e46

SHA256
2778b813926430ebd2b4cb3eb49799233e60a8d29633693cbd08ccbb3b52513b

SHA512
cccafe667502355f31c4dd34b5b9ef430d980634d662c47832cbf4b2f7238ef73e3f3cb6cca658ac23c63a4188c2c2f9d1e445259fea5e7f458ad6f4ab33f24f

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
107KB

MD5
ea4accfce331f89cb56678380aa4940c

SHA1
00930ab9705127b210d587c162c9df0b226a64b9

SHA256
b6369f206fd17d9fa5ee756359d7ed6727fc89a23b67672638debc603876a76b

SHA512
3e733c4b866dde56cb5516e9224b81ac4f2f7a3240c6c7d613a00f0116a358a3d11681821413c1df38f6efb929f6237e689bf2afdb38f10b0f91e54b636c0528

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
107KB

MD5
0b08170dfc719defd2746b46f56fafe5

SHA1
5ff5bf7e8e74d7f2b1e35392f4cd0fd5d8f84ee2

SHA256
fe82871ab3f611aeadb0e9e0606e02125e02561b82089bf07a01e7d741a5203b

SHA512
582ae3858566c408bb52385da4faad7eaa0209e281e1a76d481275dc58e15584ddb6e475d7d88fe766ce24f43e59d5d591698825491f21120bc0ebf89772c910

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
60KB

MD5
3ae1c86cc7f76ba6d3daca4186616c9f

SHA1
782bdef21f2c3c7d155e5d02c9045f7a6157dbc9

SHA256
bb4f4cf256700048403e725d5c0cef8e4a11b64351e996312a739ae64def5a3a

SHA512
1e8a2f41c0e4b0ab0b9ea7178535fe6f7be318d8904ec64b1bb768c5f0fcefe92e8bf4e0b8604ffc9def6415fe04fd53dbeb2be07133d498dac5f997d7f74327

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
58KB

MD5
5f49154846e24a88117c7071db7ccfe2

SHA1
2c85751565bc1a1e4dbd9836e0b75e5e86faff01

SHA256
a3251be08a2fc1ce285292ec9c71a3b53eedd987abcf6674eac7464a9cad0df9

SHA512
7d6f09f9e58c8abd39a69bdfca3d6d6f7ebfad8f5e0036072f97adbf113d1aabaad2420b4a3256c9298c0f43c24a293a7ff8924a9aa17728eb3b53679d897a2e

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
63KB

MD5
a5ea518b0a49164214a157f474df7734

SHA1
7f9f3124dcbf41eba6c5ba79d0a57b280c83f615

SHA256
734f123c5d12c3919393b0cc683709b8b680e02547e0117df3e3535d4a3be6c0

SHA512
0d65bd4ef824cae49a84b922e96ac51918c1502eefa0c7c4038b63b87f442c3c941aba0b1a2e53c654f3f4899e916d4cf419cca810661573a42262196b35c6b3

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
56KB

MD5
d26908c58604c3537a8156212ce33c1a

SHA1
d78cc09fab89d5acc380f92a6a8e25a7fa8b90de

SHA256
48917a6805f1445d4745e742e1781f6653e9c5d83211f161292f2ceeca499e6b

SHA512
80089eca7d0ac92cde76353b1b6daba3712a98b09a33e12a8c732a75aa8867ab60dc7ad0924471bb5ae5fbf7c836d67557b0530c0fa185de585256b87690e961

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
60KB

MD5
27e44152daf7240c1f682bd82ef11c45

SHA1
b0e25d49b1a5c8ccefba3a1cf8c236f8ef3e761b

SHA256
cccf314e2bb15ad824ce494e30f3c622aa854cb25b5850592b05a27011b72c47

SHA512
1ebe79216dc12605e107a63e9f17a658cc948aa0f4f25a193940fbaac1a51ef29bdc78e3130bda41fbf369e584e0d93149b8781d08c4b3203506ec59bb4da9be

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
61KB

MD5
45a1153f021d319c269967bd3876e69c

SHA1
b8dec717d27995009c37b20ebe202e4a4ec51519

SHA256
df7db453144767e80f32bbc291983fc9f3ba4f5f1d5c587995e8b8d2ccbac004

SHA512
834c4cee4c8de5159c679483e55d593c54858875de8e1c192063cbcae7973ad0174fc190809851223e396682a1ded5fa571ad2500eba7973501e4a42c8e4b7ac

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
65KB

MD5
471b67ae8fefd961d0172cc82578378d

SHA1
ac020d3827a08aaa6ed84ef2fbc1ff11bf5c1b79

SHA256
06628fefd5407a0979403bf1577cca865e1f1b5c76f31a05ebc9648c1570af95

SHA512
1116b3c4f09e9de455492e22d97c8327476370d8769427f9ebf6453d0e855b94064de4d5e7ec22d4d7d8e98c9659dbac41a24f47f05e4008daf9e09d057d39bf

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
59KB

MD5
6a2d232e3b7a404abf6a5373267f10df

SHA1
aa1cf71e7b50a40bf5041d778ecb47726f8d4398

SHA256
a5e2676ead44c8b99a2579ea905055f304052afe59ebcc5743fbc100d5356c20

SHA512
d64472930a571cf99ce750e815b836ce85143389cd34078e58984eb20b386188bb8f00c1b76921ec43a439f4777b09128b6a4d9f7a7ed5c2e2895ca1ee03a4e1

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
61KB

MD5
454d4494ab4583b225c19f551cc81546

SHA1
6a80af623d710932b8beb74b1379b8e788245be0

SHA256
271fa570aa6104d8c3135b4305c95a84ff734ab47ef752eaa700c5cf703d0efe

SHA512
8e2267ac15aeb6aa6f10652cd76d9a111fe2dee9ed0fd0be6773a690d8d6ced17551fe97e10095e1481223bf91bf9ce0684ed3537627e0d1b75008d88abd7da9

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
59KB

MD5
d51543b9639fac67296e34786ff824cc

SHA1
8ff7b0e14d3953f611fe741056949bb6cf4a1269

SHA256
0b2fc0f884eaaaf3583f99438a0bed70f8cf9de9c8c1c328d44f3d11d1a4d270

SHA512
66960bb39a140e8d643ceb2e6fd72f89ff0ed7330859a40da1bd1330ac0b21d31f00c8a2f1bf2be86da5fac52eabdcad7ae26ea59a24bcd5741c983004715ec4

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
58KB

MD5
289c82e76c3e648e76cebd41499ee889

SHA1
d65d07d034a382b93bde43ba2f8bed5c6b54a4c2

SHA256
b39bd4e62327fa59609c0a0995dcfff0c8355cd4bb8abd6aa194e1a20cd71d3d

SHA512
fba6de409b8ddf087e75e0fe708c1befeb9ab30ddad8840a0e6d4f88b9eff0b9ecf9c5a943fd5389e334ced7bff0eef1f66af1a5827c0eacc38e30d60a463683

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
67KB

MD5
7260ef47d051e4745cef253af4a6637f

SHA1
37555ca85ed90f4282aae11a83ea434e4641ab60

SHA256
9d2f0ad438906f619061a047cf77108fe491a0b2550170a8b6bdf4e404ec10e7

SHA512
a5a95309edbe55ca6ab3b648df9968e11ce29c82f8da337f45eba0bbfa7f9d28cae54583fd1db75ea9ce5a4f0332abbe1638194aae4475a28993327eed2c7b79

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
58KB

MD5
2d01f3b679d61dd5d8cace19a2831cda

SHA1
5cad29dbd83ae2a47f41ec547ca27913b9928f92

SHA256
a26f3bd22dea17bff17463c070737b4a66461622ce4ab070a93cd0a7751d343c

SHA512
3b6721209daf393dfbe0c243209c769b5bdca3eccd94d02e4890683b24a6d9605ba8fd77e1753aeada25058e1d1c71a5508216304b5b85d9a049318119441bb4

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
55KB

MD5
fc01e8a0e5ee52643bb751736c1f4c1a

SHA1
edf5b2790610cb0a80abcb2881955a1533a3a79b

SHA256
2d0342f96754129cda49ab30ccf044bdbb0ce41a7d14333d7d5320f9bf3628fe

SHA512
b57d7b36c710c94afee3c3e26a93fa648a6b42255018e4f6ceddcdbc8ff821e96514a1f1d07a685da4415aa20db809c4a920ff979b1dfd61042d78664340aa38

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
57KB

MD5
e66960af768e2db9d421cf6f051c19e9

SHA1
42a5dda4e3e162d6e19b5f204cafa76dae58e28a

SHA256
a5f9cac13e12f3e381f836edae67c1c5ccfaa06c478aa0bf159d75aebb9cb7aa

SHA512
982e159745c68c9a5856c4007a8d60d93962ddd90d23901e7baf9667a571e310db69c35d6dda9734eda4b8561a46efba2726359afe4b3d98216ec532b08162fa

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
58KB

MD5
3f0846784b32435bf6cd5084e5e951e0

SHA1
0fdb41aea054dadbd0d1d35cb2fa0d2bcd2fef87

SHA256
8bf24c0d56b940d178218912abcfc362451236ab943f26c5dcd51155e91116a0

SHA512
13cb2b8a3ac428501bf64c5bc3ab3d63900feb2ad02dd7cbfe6c1413e52c1654018db787f5d29bbfd1bbf552e9a0f6d8e27f7412566cc6dba1719724bd3d3cd6

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
59KB

MD5
fb57c4a1a2399d9fbec2440f972179b5

SHA1
940e75062869961281f7101e8b1922aa4979ccca

SHA256
fbe82e80468fbe0b3f6b4325c456795c36f7e1a4a3e3a12aed6e98f5557dae69

SHA512
e7750a583402a9aa0c4e6b508f5c4ad580d987f296b76fd06b75fa378ca5ed5d52dc2380dbd4753853aea80c028c78a281d572404ed0c18ce2ba9d53ae5e5155

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
60KB

MD5
c94568b990faff968cc1f1c3da62dcf5

SHA1
975d03507c98a6c6e1685b68eb7bf6d2efe72125

SHA256
836856b172545a8168a4171dc380f7d13d5d0d9830f95cd35ece4bcd36f5aea1

SHA512
26df38ead1d69f385da25c414421286d82c5a2338361f9fd6537499a78b3b793820a104fcf8422037742d9129f99136d30c95d919c748e54662e59800917a515

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
57KB

MD5
cfb05f0ff3bf5c007445ae54907bc026

SHA1
92b3fd5465186ff4f082452043348ee7ad074349

SHA256
eb13473f51b6639f14f4155963463a2d47e2fb73210f4b5fc3e4e8ddec6eb599

SHA512
a1972d2c78e61dacf21c6717c04aba4246da051cdf957fd39e0891d9df23a64dd44e17a804a548921ca5cd025e1bd36ee6642b63b046fed2bad4764b9af92267

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
68KB

MD5
c3c622a4df32ef6d93a0ecc68207ea72

SHA1
36df2a493536aba848290c1fa62fc4f52a7f7899

SHA256
ebfd27890807ddd5dc37868e95009aac2e2bac9b296b7bf5ef1b0cd6b9ec01a0

SHA512
82238def968fd83eba8fcae393aa9eac55be6fa1d3c475c77d298407f2905b2ddb3f1a824a0170fb0cc053e5f016978620db52064cde52297cc37df5624bec69

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
55KB

MD5
3bc2ef18d630885ca8a2a96a6115b17d

SHA1
e166d36d4a29b16431b3e78a3865894d17fe6e8f

SHA256
da6a5b6fa089321e78ff74b20ec925d24bee56963462c7a8635ac3679526d6a1

SHA512
7a29378fc4b67f0d505ecff0d3bf25a5d1914d667d8319f97b39839ded17c7fd0a96b68fd15fa408e8baff59bcd4b3d66d7088111f8075914b7879f2ff7bbd5b

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
53KB

MD5
d082fb2554318e7dd07df5cf7b2e4226

SHA1
4566e9ad066e4bbf88f30f02070fac5f14f04f57

SHA256
e9426b73a424098771fdfc591b60838f9f98f7b836fcf518606a492085caff57

SHA512
db771a9a4fc3e28ff6d58155bdc2abde1127bb07d1698f36874d282267077c6d79c9a022b3fc71cbad40583a854daab1a34c6b924c40f70c67082943ae9fa006

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
59KB

MD5
39b61b47336faba367e8020f83fc7e4e

SHA1
ffde74b21674aede5312edaac8db55d467a10d61

SHA256
f17b85b566894b31fd7f641b4cbdce1d6226e630d5612eaa137cdd24c2c58b47

SHA512
47cc3090649db651fda58dd3d5fff1fb2c03eee5b3b8f4a6220c2b1bca59c0b7f674f81eeec386633b9289c2f3b2bad2de0c35c79cebc3903ebf20b0076eaf34

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
60KB

MD5
e7e14c3671552b7f74e89047ecca3d96

SHA1
665c5af571b966f182727412d3fba5b2eadb2a6f

SHA256
743a41a0f905f24894d8ba13611e102b079b3ca7ba07f3b89059a8de55530dc1

SHA512
f5fab19d3c79845f712c8b66c2d2a725efc5fa087c38d826d178a358aee551e5ff7594b4a9792105ad9b2ec9fec15e21a82004727d8cf6e665a18927c72268fd

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
56KB

MD5
56bd8f8fcccd0e9a3047d2a150b75e2a

SHA1
afb6bf5fa1882c80d53db7e5943dbd768a78f076

SHA256
aa14df92986878b60fdda6e48f031a183520804d11d960874647cd223d418870

SHA512
e079bc8e15a61b00a3df7752bc8da5185403cc416b60a01f35fa0aa3c9d9327d9276fb4df23c077d9711e41e2d7046ce6d1ba3eb8744d2e180c9ce40af28137c

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
44KB

MD5
69874db0c98cd92de45fb5d5a06dd231

SHA1
fae21d5a2205ff5e6328ca6b9a6754e2b7d5f2cb

SHA256
0846e70313e3564f44d038092dab73442f2f70fb6f4d1677149dd39b5ba805a3

SHA512
a7453cb279a26cbf1bd5bc00c295d8371b5317f81c3a64bd3c9eb777dfa7e89b949949ff3636c19892581e8502ac6677a6e110b86f2c1070f885927a14b5dc91

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
59KB

MD5
40912a971e43b2d3333b33f43b6cd4aa

SHA1
177585131ccb721200a29b2fca26a4e191ad958e

SHA256
d2c2db8f5e81953fa617237745b8b0c1739f44deb3fc6598b12a43c6566703b9

SHA512
db4380dd61c4009fecc041509e750c2128959846de7a840b067237bb777c6afd1795223a302b8d11725a6c690a42b0e5ff2e528d9358c061f71e404fbf256ed3

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
55KB

MD5
4783ad5b28af3c67b89215b06cdee0c5

SHA1
274c4e0b69cd582ebf86a7b27e3ef7f18ce8d850

SHA256
1a4cf44ee57894b7f568dda4604f8b6b842d66aec89dd9856b19676c0f0a13af

SHA512
1ee53135fadc0cc23c54ab24c73690496331f46f0a9a7007d24612ae63c05da665f5e48dfb2b914c5425ea06917bfec9778c79978e26d84a38110408e21e73c0

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
62KB

MD5
0dd112e2ef754ac97ece0a20e2c02b92

SHA1
cd442878a9813a611a9c24e79430c12fb730bd89

SHA256
61885b643ca9b723d4311f5347b8409bbd476b5394da596219d0a37e7315f2e2

SHA512
bdb7636359ada21a85fff495addf29d9064b7bb0cedc3a8c872b77d0a3e107bf92918e0c1271bf79835971b5d9388e411660bee4a51de2491000fc5583dbfeea

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
56KB

MD5
5e86ea7294b03fc2fe8cd2926548222e

SHA1
cab6fed88c227fff6cf0a1fd3aa244013103f5ad

SHA256
69a363c4405f1cd7206bbf7bac75e07f38d87d5ba9008ea0f300f052f3dec4c8

SHA512
8726a88d63ded097e73a456a7b37a39bfd70f0ba4dee43f60a8bb8ea733e56433dafdeba7482e9eab6a2d1e8d4ee252f1a863b5d8bf2ed710c0e77c99822c3f2

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
62KB

MD5
3858d5d8921105e99059b7b5763c8b24

SHA1
0ca2ad4e5aba9dd26efb1cb92ce836e515ce074e

SHA256
3ed1df984eebdb1298c01625f4358936c9aa9f409e45306b1c66309ba4fe2c0e

SHA512
e37f5075b62757aa0088b58969d53df4f64b9c79efd7054fbbb9469c2c2f1f24e51019b3aa42dfcd758f1ccb0340b8518b5a70bcb424bd764be395191dedbe67

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
50KB

MD5
9490e1ea56788bdfde6c5f362c57ea10

SHA1
1277e7e99f1d040093580b8b6a162377e835dc60

SHA256
e632d3b405fd642b09347d3a35a1ef0f7d81028079de326971880b032cef9a49

SHA512
4edbd99f6a6322ae695a4722268a33cf71bbcd4977bc32e849b5782685e741a234427d7d9bb03d306aafb635613a08fff26d36a560f5b9152999093ee8b1aaf5

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
59KB

MD5
0d26071fa4316c40b06f2a549e4c5a41

SHA1
65e90176962f4e45feb50e6e414fdaf0594fc283

SHA256
b59151ba8a905a03ac9ef4c022ad396d7fc794d6967320ef7a22e7e211824085

SHA512
0cf20b1c2f8a2b4c9a495e544862f74e5feef84bbfa1d1ecf35056ff9f78f2313f6dc18c60e692d47dd2f8293f374763981af2597f5d5a96b7dc655dd2e257f9

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
59KB

MD5
ead450091160310f451392958c63b54e

SHA1
29a9153fe9becf2fa6b1bc873fa668f69b5563e8

SHA256
1d3e0c26c9dbd327e14e1745f38f40c4925f723c171e76c24247209256afec78

SHA512
3525a922de32d86afb2b9021ef1497783303ea386c20aa7fa41abdc11824cb371f5d9d814bd54e1ec3ba690cd884d679dd759e3378f0806b8d63a7c1bece732d

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
48KB

MD5
028d3d9daa09f66f3b3bbb63aa5e0bd6

SHA1
58c4e21fad7563c6726f16fd5149d383ef8e20de

SHA256
a155b1b77641f75675b51097febfd9bfe68d09801445fda6eda894cfda03a6ab

SHA512
2ee4282ff252398d8f1994cbd98b0f41fd6bec0fde3004adf62a0cd944d159291559135461227b1d4d44af2b54824ff79d5a72c07b8f2794998e4b5f269bc736

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
71KB

MD5
15c31ad101075d0e41d1bf1e42ea331e

SHA1
2330b65c029326b1abe4fe25f264002bfd7b976e

SHA256
79a43d11c526935954ffde7ee4472c31553f203a2f214ccd8f520a2ac8d94ea1

SHA512
f1fc8f85274fbb361d2de45423d8a7708ef346419a8121d1bccaa0d2872a3333143a8fdee411733d8ca46fa2a6409100acaed7f4f961ef0043213b5cac6278e0

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
56KB

MD5
4dad0b79f4d40460baefe447dda2dd3e

SHA1
6b6740b1b043936bc3bf1a4df813240f294c3536

SHA256
2053d5f4b2933bf498f0087c3bd778869db395bd3766931d3054eeea0d9b51c1

SHA512
2c83da948391db51f5542a702e0488d287f9dadcf95b214dc4c9535e575484759eb3b537a858771add10fc5cd5c9ff8bf54e0a72eb847d552af9fd0aa0c3d703

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
63KB

MD5
db9584c70c610a0a30815d8d5e97100d

SHA1
8c0f7b9fad57dc657567e0824d01d26c9fda472b

SHA256
fa42243c8b5232fbcba70180b72fccd4947e61136c09db6697ef8f0bc2795af3

SHA512
6a807921698e6287cb94de56e30fffff590119dfcbecf11e3efc8e64db7dd848b8602731b9cb5ef98c9bbe82fc114a922def1b985863afa829b3eb66278ca1ad

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
60KB

MD5
d45374f116ceccf8018da76244a1909d

SHA1
100ad5fa7b55800ae06c90e35ef96f50875f6c98

SHA256
2164f11d6d865bf4f208d39820cc0e96c09b284adc307f8f3a2a6637c7610af8

SHA512
f6e734a1111808531898c333f268dc32c3eeaf5c1b33db1a59135d0ee5b8b32ea934ed1007cf2faaabd3635815b73ade644edef175c98f6acc0f3ddfa2466879

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
56KB

MD5
fcd0a56513d22380087effb445913064

SHA1
f3d60f74204fd80c406693217a39aec8e2047cc9

SHA256
b64da711da35fcb31cac0b262101480d564fadde42df7b88bcbd8e5682e82e1b

SHA512
172cc8cc488751f7ae506290e18d5265b7979213ac99fcb86ddccf8987bc1a67b5eeee4010a7a7824a028c15673a2302671008319ac7ebbfdd742089ee225cb8

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
52KB

MD5
7de013dc391653ff9ff5054005bf5e4f

SHA1
ce6119af2187124e8fa24d6ff92b61fd96bfd9fe

SHA256
bc1fb2b971547bb784ad5dd80bc6b0bf5fffeb3efb7796bd142b4dcaac38d116

SHA512
52c65ac3c2333366b3babcb93e0bcc1559b299e28f183227f021cc6723c6d8ef80651f82578885c3cb2d4039ec7648c4194cb091d5bd278bd210a22a0ae33358

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
65KB

MD5
0541513a5ca098d29643d663b2174bfb

SHA1
61b5507cedfcdcb4b6e3167b834b5b74504afd44

SHA256
ea97c94554da9702fb3d9fe9f61cbbb1b538650917dca22d0b01be3829273c74

SHA512
a0cc400d9cc40ed9b6184177c49f4b4af099d0e1b07d4bda1ebabb897b19ab729ab17bad8006e89b8bc85c2dbc0bc8db81935fe208915e26c30c2fc3342f7e5f

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
59KB

MD5
e3d7bb54da75456a5f0aeb32791da411

SHA1
e4afb0fd16abbf5287f4dd91118db8b358c05f25

SHA256
f1db495ef6c826b42609575df2fd68c6a8f1295bfdae793b5a4bfbb6f23b5fd1

SHA512
2a88539266ae38deb995078abf85c01ec7555b84f4da6d5aef58ee4ca7ba9307c627518cf8fc89e1c19da76c68f90d635868a0e0e4c16432059fbfa127a873b2

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
59KB

MD5
5646f15185356df44cb0ce15478a7a7b

SHA1
45e6f2346b899a682859952c6b66c327763e59d1

SHA256
dd2e7fe6c85c008145fed7623f2364029f9a3c631f8c37f052c47706edc32692

SHA512
da1e9139607ae61d6f9f40516940c70d670cbdcde7c385bb8d005f24199babfc8f1da222f1b66648d4136846b86a28db1602ba3300a660810c2dd9470444c093

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
59KB

MD5
a29d438402a0a12b7b626b4df47581d5

SHA1
b5f6a1b8a9eee1f0536e9ded65a0327c5757c0b8

SHA256
75220f36e01740cecb54985ab689b0267052a1136f0c33f61c6cd753b473e5ea

SHA512
8f30345420788bae54f8363152d72cd7fb59fa3071e452e6fc6514eb9c93be004ef0a0bfc7421bd22bb9872aefed9480c5f3f3af97a8a41af2ad3f27c3a66246

Download Submit
C:\Users\Admin\AppData\Local\Temp\_KB3035131.nuspec.exe

Filesize
50KB

MD5
2c38a0d36c4a24749db7e3031e674c0d

SHA1
47ca0f4e5fd929733916634af063cd99d4133d98

SHA256
795e4fbbd6f359b8ae003f2f6e00b8ec83984274c3ab4d1f25bfa26e6e50a177

SHA512
c937a0c41b6942a51a9b1431d801b3ead910201204dbce9c3fcc157dbb1df3d22ec8911f319bcc3338fb82b348c8fbb789acc136f9db1f3b9ad0748fec59ccbc

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
44KB

MD5
71d3eee3b8314c23cf94d51b102751b0

SHA1
f30947a064b5434c2c4e1b8f14d11d07072b89b5

SHA256
95c250dc8745cb69fe08e8cca3a2013720be9a3871fafd65c28c94fc9621cdba

SHA512
c926167e57f943cd886a7c06c41f6b86a4e468075801eb48be1e1b6974134accd078871d1ad6605941d2207d8eba65d0f7accde759ba15236b9ebca27468e015

Download Submit
C:\odt\config.xml.tmp

Filesize
45KB

MD5
86032c5508fc2d41a150a917690cad17

SHA1
a106c135a6fcdba489d6c54450fcfc129b85dbda

SHA256
4fa401eee92878e0ef22ef41805b9026216a54885b7a2a3a97da2f8f422405e1

SHA512
0f44c3b89344095378628ad6171c22d6c67d838677013bd103c0a644a1c8d2fc1a40ab0fdbdb598e168b1fde41a76cc1640b18b5e390e0b2da95c7aeb4101620

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads