8d2ffd0a60467546b192e6a9a734d14d2b9aa8ce26099c3d865ffffefa3666b2

Analysis

max time kernel
150s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55e1efed695b6feac51297b7270da840_NeikiAnalytics.exe
Size

187KB
MD5

55e1efed695b6feac51297b7270da840
SHA1

3361f4bbdc13b3a39bc2a470a054ef7444386c5a
SHA256

8d2ffd0a60467546b192e6a9a734d14d2b9aa8ce26099c3d865ffffefa3666b2
SHA512

ed22f661905cb13eb2f4e2027ef0dd34971852b192eb63d6d2370ff0fd4004c4dcd36a113a7096f11404645085f83756e97cf4abe8c00b8d3cc232d2c18ee7a8
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXa+e7WpMaxeb0CYJ97lEYNR73e+eKZ0VX8:RqKvb0CYJ973e+eKZ0VOqKvb0CYJ973J

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5073) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
6124	_Module Docs.lnk.exe
6024	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	55e1efed695b6feac51297b7270da840_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Zombie.exe	55e1efed695b6feac51297b7270da840_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\da.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	_Module Docs.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ucrtbase.dll.tmp	_Module Docs.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NetworkInformation.dll.tmp	_Module Docs.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp	_Module Docs.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT.tmp	_Module Docs.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	_Module Docs.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ppd.xrm-ms.tmp	_Module Docs.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp	_Module Docs.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-string-l1-1-0.dll.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp	_Module Docs.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\cs.pak.tmp	_Module Docs.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp	_Module Docs.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Primitives.dll.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.resources.dll.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSVG.DLL.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC.tmp	_Module Docs.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp	_Module Docs.lnk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 6124	1348	55e1efed695b6feac51297b7270da840_NeikiAnalytics.exe	82
PID 1348 wrote to memory of 6124	1348	55e1efed695b6feac51297b7270da840_NeikiAnalytics.exe	82
PID 1348 wrote to memory of 6124	1348	55e1efed695b6feac51297b7270da840_NeikiAnalytics.exe	82
PID 1348 wrote to memory of 6024	1348	55e1efed695b6feac51297b7270da840_NeikiAnalytics.exe	81
PID 1348 wrote to memory of 6024	1348	55e1efed695b6feac51297b7270da840_NeikiAnalytics.exe	81
PID 1348 wrote to memory of 6024	1348	55e1efed695b6feac51297b7270da840_NeikiAnalytics.exe	81

C:\Users\Admin\AppData\Local\Temp\55e1efed695b6feac51297b7270da840_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\55e1efed695b6feac51297b7270da840_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:6024
- C:\Users\Admin\AppData\Local\Temp\_Module Docs.lnk.exe
  "_Module Docs.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:6124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.exe.tmp

Filesize
187KB

MD5
0750b98c7b640b56b0dd58768e819500

SHA1
b8f057e355f644d3f0e1bf11c03a74046b434930

SHA256
20dc52461763045b6acb51245a22c2c50e60be641d8cf406cb2966c77e08ce18

SHA512
b0900a2276a8e4a33f1030a22878a5d970c4d8276c8969e870c5a4d469c8932ed0eef5c50af100429d1f0ebfa0b49a9cae8277bfaa78d439e6a4cb1eca78067e

Download Submit
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
96KB

MD5
26a7d4b56a73533d31f0f13e909ac07a

SHA1
dd45814232402c488ea8ab7a21b5f1fae790a797

SHA256
b62951f6ef94138cb764352cc8662d4ea9a0cbce2d60573c79e86ab23921f4df

SHA512
94884b97660aaed9c4757aa9dcc189ad966abbf26f71a9509159cdff57427b2f7529bd005888651d5cdfc4352a69fa672655e173760d637743d4aa17e6e4cadc

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
208KB

MD5
1b7fb21af10ccfe71f82b167387a82d6

SHA1
c3f8657a651528b69662f24440d65011b2ef1111

SHA256
e956b98338281cf895d07080fc0f3d4b1e2dcf9671f37f51ff0ddc2e857aafd7

SHA512
047b093d95413f49a7a965fe09571e61db1bb9b4c701b6381acc266b8296fdb6c22a522b098f563569db7c860aa5f61988e8281cd59a24f71f2b18e505ab1f0f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
195KB

MD5
14dd9c20f12bd90dcded3800ccfa5a05

SHA1
d4a00f300c220d7da9e843ee019dc3942a3b371e

SHA256
fe0d1b69b5c907890388c0a4236cddc46334d4d21367d57f1248b05375f726d0

SHA512
4927374a6313e162fcdb2caa2449d7daaf155e8da9c7657ec2ecb172a6a34a32bdaeb320aeff55f08e408ca731c87f24ac7f4cb07c1510d8a80bb2f992a07860

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
261317841d3292ac46f6b86e478b01fd

SHA1
d7983dfd362b1d140f347261cc7fc179cf3afaa3

SHA256
4703753d33ea5f5520f5abc9ba64ad988bccc5c6f4d244493c8af480aa506e8b

SHA512
854aa700174f3e41c98c52bb7744f20a87d6a22b0af684627585671e143c725b0eac3ac4c8f34c39740fbf832d11516dbcbd0c4e96e1081cbdaaea97a5211a67

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
284KB

MD5
cf50c119b16a9729a321ea0a5d910f0d

SHA1
a8b47e9b353191327bcc697717de1dfca6282540

SHA256
4310fc5388ff286a0af4db3fe1b3d4416297ff24974dff14a5049f455326c90e

SHA512
aa9854f6205acbf32cc33148a0139d434557ce417b80ea9e18c00a297a2ec3d96723a602c4702d58f8c4ba3c41361d14339eb3f2fcc5cf619c152baf5aab92db

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
2f958d35a70561bd96e15a115cc9b949

SHA1
6bfab5ebf1c9e3f26a7c3eddccc9e2a9993195e4

SHA256
b6220fb0f8a016507f4d265f01c8981c89fd51710de5fb81ea9f3053d046a2aa

SHA512
b4e18e3bed03b303589312928b1e44d4a593fa2882eff81ffd6a0c02c760eaef5996c3bfccf88389784cd065ab605147107cd8c08b345b728e55f48a377788a1

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
100KB

MD5
2287ddbc9bf7b280843a63b4ba50c323

SHA1
14a8fc81423158840bae7b47275d98d04373ec9d

SHA256
4d660c0dc3ea3bf3c34ed35d44f5402eeeb9e05a2d76e8e36a64e56863820c9c

SHA512
e4bdebf9ef2929926a0f56775105f5bb5a360fcf11c687de48eae008ef4c9a280f17ecc1c224d4b8baec072ceb83c2f759c27354072d716740d110a98cb95acb

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
98KB

MD5
366c073b7d6fabc488e8da061d57f1bd

SHA1
35de6f490240633bf475867fadc1d50c1930f4d1

SHA256
5f0bf8ad3322b90aae98085805e67a8f8f715384dff90b524355cda5096579e8

SHA512
401fb6d71ab8b541fb7fe69fbbaeefd745c34f2809662090abcd94ad0e747402ff03ee4890cb5621a0697d06faf84af1275b368dc342cdd0b29460a7645b1589

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
103KB

MD5
b870299fff6675e0b0a0e464e400b8b8

SHA1
01a9044dbdad7e5778b730538abcd14bb8cf9396

SHA256
da2fd313b40ce494a6ac151a24399333d5a16f7bff0250704fd1065af33451e3

SHA512
5e072aa4b9e467b0bca9c541d2c58fdbd176c5d0ba3483fc0d434ced901829397dd5d9e43cd15bbcb05fa38a8e7875848772d482bcd576b992b624b91f9e3b9b

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
105KB

MD5
55be0d371a0a66d72176b011dee040a4

SHA1
d7f85e69c3e260b292b59b60def12890291bcf8f

SHA256
d26e2517fc5d69a4d1874d05ffee8c31ce266efc1bb685da6f8cd883a4d77290

SHA512
a6870f5ef38f26e628048024eb113756c0c59ab803a406d209b930a0d00f3618482e2511eabc295f89b6fbfa6254ca699c295a00679d18a4047f176ecbac6b8e

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
96KB

MD5
e9682653de310823f8b1bd3c4597b630

SHA1
b03e14e33a0d81446a438af8b29d02318cc46446

SHA256
771c26ae45870e1f6d7106f5e47d94effea02b16b94e54349ccc4b11f15de1ba

SHA512
33de6d4f6aff9d2ea30e060c562e9565ec0315bfb0255e9dd6a7ac81d36b81c8c70c5cb4c7616e144e97e6047f0ca152aa3ab20be5e212db2596aa1c8e02a04c

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
96KB

MD5
676a771d53332f05e68c2e2a72a48729

SHA1
8a4d64d1501e5554fcdeda7f9893bf59cf92d39c

SHA256
8485b25893a2d9bece651f23fc12fb5f3f629946faddd903908c0d7c789238b5

SHA512
2b87d8683582ed1028736582b57438fb9aaff991b53a9f295c9f480c7019b5b26db195e4577d22bed99174ddf0ae0c6cdac8087078b0903c0999e04d0dbfca4c

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
104KB

MD5
6606999f76fbf0a27075ce224d4f72f0

SHA1
f34a3104309d2969fe5b4c9b15039b09419f80dc

SHA256
a42e8ac0fa81238ac81a889c563d7ab656fe17a6118c0cf168ca0f103b2a0ceb

SHA512
3890548526804b595a0e9c6c4f073040213748dec35d3a5b7e8777f152b512556eee53c47a70e77ee874aafe23eeca614c0fbce1737789399a27580e8de02bbb

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
100KB

MD5
c802c854d1fca501020dc36659ae7864

SHA1
61082267fa4cf065c731a261febced0379bdf453

SHA256
db1afe6fc6f4c1f67647ac52e5d79760a58633e7f7b606aa7cecd6975ed42dc7

SHA512
f5727e6c41e7c9551833347aa1a2cf52aa05d049927dc9f34519beb0b75fc65011fabc3759e0aa3f61877e46f143501891c46d396e7722dac92e7342913539ad

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
107KB

MD5
77243a256574884a46c157c9e7ffa3c3

SHA1
199d09b67d43b73d78bc5d3c40bc86ae2a4f4f88

SHA256
cc0a454b99218add9596f27cd031648f7b7a6f6ce5b73f190307878f0381da80

SHA512
6479a7d8eb823f107961f4c1519953cfa98d6c2304fdfb745ce0784ed3939c57b97c7adf179f2c872e43cb8177ce0df3bd21db92205ba51651c906220277aac0

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
103KB

MD5
e6532e4b625b91a144e70d6653774556

SHA1
ade94b023e88d21dd0fa2c8eac1483472340b103

SHA256
8df65abfab0cec43584d794b5b6875ebe4f88c90054e8b45614d2763fa93c919

SHA512
c2533c0e6b94c5961b8289ef7d611aced0a4507c9071d8f81e2fa8dfdfdc56dcb258b079bd0869c66515b7c2cbd1a0fe266742939ced6330557099e00dc19de9

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
100KB

MD5
87ea9bc522e11647f6738fc66df8cb3b

SHA1
26eacb02639c75992a8ec91367028d9c14d373fb

SHA256
b6fbc90bd6082077d2f6be3c403420aeec1e6e5b995d92502db535b5503edb41

SHA512
25e3da2f8be2dda1bb101eff39e73c60783f935f5c6d2adb2cf3ed576e2129f2a6039acc8ca2f6fc9bd62aa4a2ec062cfed3eb71e5200193f3e82e9ce011db26

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
103KB

MD5
76a8cb03908e0e6688bd0fb724b5008b

SHA1
053436b586cbd374e94b5925ba84d5c470c0775a

SHA256
a1f61ae891eece6cd4f1eb4c56300813e5146e0c241f1cba74ed303b6b7386d0

SHA512
acb29d641ed717ac7f9f8cea884092c9ff953188f86f9f6d096bbe036fc889347dcb97c5b4ca5d9da3b8248128748ac536a546de7da3bb96aebd4dc22d727eac

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
104KB

MD5
858f79ca061c6ba3df07fc59cecf98eb

SHA1
b1f85315ea4d87efeefeafe22d5ba8574b2d7737

SHA256
f6ff1f84eb288ba347f87e83c2106b5edc3c889bca576ed05739f5cadab65b0d

SHA512
108ed3b151e9524f40d64f751e4d837b2ffe585bdd6de29b11c4120c6e6a171f3788c2ea75b655d128063a25086fa7b98d37a310afc2b275fbfd09b9e1f2d99f

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
103KB

MD5
ea4ce04b5ddb8bf4bc182d14a9b542e8

SHA1
a344c204b453965d9663ea7d9c5504c223144bec

SHA256
5705919409170736568ffc593fdde72f4d6581151b49d21eca47ed08fa652a8c

SHA512
a3661ea932de0872587faa1c23524d8e5ff4168380919d4e0331f1322160e8485cc31b981bc1a06e638abc29b33e242121956d31fec3923c0b54c94c687bc177

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
98KB

MD5
b8b77d394b93a38862cb1b7915060776

SHA1
56d5df0556b3f577f80e0cd4fcf48242c329e480

SHA256
7e19b0d4f546dd0bd0605b4e5756934554dc815c93faaf9e689d7abebeab6ac4

SHA512
fab1a1fbc21100ab887689191c3922057af95df6fbcc977461e95febe4abf02f41e8a0b7ca7e2bb55f5505ac5e2009470d497826c59b58a9ce9b6152aca36e31

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
97KB

MD5
a26ad444c3b2a7b27b79517e8cf3b536

SHA1
dd8963b3e18ec63a1f6ce10f7d18e402637d51c8

SHA256
0ec114358480e8830bc88b59ee99360e62a3457cae821820188eabff383fd7a3

SHA512
565353f02e47b71a3dfb6036dd1a7dd7e8f48ae0d7dc1bf6ea43e604611739817ebd9bc332645847ee929f8d3d7b53d3cff22dee7c194e2ef6f1d6111cc9c563

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
105KB

MD5
391427c0af1100c6b9476e5f2a5205a0

SHA1
8f67ba814a3d9c612ba5372ca0bb6988b972ccf6

SHA256
c19d152676462824b9eb1c9d0d136e4d451e10e73469576b2a6ad28ef0c4a623

SHA512
d330031f9d1bda6e32aa2ddde0482d79ef8a06f2482ef106927c91c28e39ce0681fbbec63386749a0feed6788794ec28e299baf9cd22f18ce78f1ee01eb0a7ed

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
108KB

MD5
0780e4b765aa3506feeb280eb50c00a8

SHA1
cb0e14b12dacd8eab75bcfb6a391bd2eb5601049

SHA256
f2dc9e76d85ffc11c7164ab45af32823d8584ceeb7204ad429918c7d9331dc1b

SHA512
1963887d2589cf7b086ac3b82efa8cd6133ad53244097e8931dc0f7d06069b6cb334c1f04d89230ad0e6d74881af3b365dbff59548c430a83c160f370556e239

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
113KB

MD5
a2e16e5d3d9e18993018c07bd6580bf7

SHA1
f2ee506036ddcb9fe539a3e8186773f0c17783eb

SHA256
9deb54859dcb71a1b0b6acbae6ffe8358f6bc50bb4085a032d4f721851d31e77

SHA512
8dadaa8b552fdf808a57c9418c5b4a03db99419c75fbc28e4be8977e5cd05f330c407d933148ca315b64f3d1eb198657b4b56bc8a3b0f0f4223bf12100fce5c3

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
100KB

MD5
ccf6dd6a147355b74652c6bec425dcce

SHA1
9586f80eaf9fbde4bc00207d6f2d505bcbb94a88

SHA256
9da45300486d21670104eda1fc385803f387f0688d0416d74d67c9d54904861e

SHA512
c3ff592ecc713c59eba78b50ecdf5759006fee880b8fbd4fe60f76d33459df46658a8ee679dae81c08463678c1fd791d0e605230c08a9b95bf66348ea32e2fda

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
100KB

MD5
179128dc008bcb0faff0b8ae505b7ac9

SHA1
05a443765d0331d604df02b1f4f47dce73a05d1d

SHA256
b117816702cd65dd0b0f0059e415cb7bb7abff7f66736bd7fab86f4d865d4653

SHA512
0a783e42f8902ffe5a6d189c42f7bba87dcb07091bc472f9586cae7a0174dc15bf3347203c18bf0736cd111d8302df53e02f5b11e8be34e4ac82e4495f37996b

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
99KB

MD5
65e7c8899801382b18ab8b354692ce84

SHA1
bf75d0fbeb35bdfcfdc2012a8a7021143155f742

SHA256
32cf4131afb2bd429def9947ac8ee2b242aa33d425a71c576dee102219a1c1f5

SHA512
62fe24ca1f4e03accb8c358d54a98a3ba73f1e28143a9c544df889a741217c0100220e260aa57b49759a7abd901756ca4344958d9efeae9c762920d12869b02b

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
105KB

MD5
cd7c819481711a7bf0ca2ef19eb1964e

SHA1
e9b0b3ebd3e4a38abcf5c3f56886fa0ee41011fe

SHA256
94120aa51538034e5e627efbb5a64529f91105045f92886e8df1524e6cb03b88

SHA512
a1b1b8c622ba675c2f2f6d43137a5b0a63f575342684b48185fe95114c7f3426d3b3f1a5312b0f60f46c5a3f2edc0b9caeae9c70877d0f8fe9b7a5463613888d

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
108KB

MD5
47e8bcc295eddeaac7999b501b666602

SHA1
30daa8ece2fe345a3674581cbb9e842d4afa5cc5

SHA256
5f281127b0b10de72ead684e81f8f0dda6065c92a464348272d7405006f464b1

SHA512
307636ce764179820f42ad039674d3f85f1a43b88f3705935f8a8fe69079c117d086dec1492a751fb72da801d9c770c10947be0f3f4494d88815307061eb2713

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
113KB

MD5
7fcf92e5f4cc00e5bd33c42688cdf52a

SHA1
11aa1fb8483f911dbe4ed3551710d9b18a983efc

SHA256
e6016dc91ca42943293dae8b7cc35a80530781a57aff270ecfe70da9951a5407

SHA512
44d299e133f7dd0d489d600546a337d23d43f668e63ac09af8071e5659c892d94d87a83aa02a623935a6795e89b7f10406b39fef2ffb1a40a2d6b9a9c14c674a

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
104KB

MD5
392481dddd9c6f554e152e9836264d72

SHA1
6fdaeedbac1be740d5241af14339f5c8b814998d

SHA256
a3f5b14177a3e8e948534b5f11093b55bb5f86fee271cd154e08483673600647

SHA512
26823a503190de4d5ada7e35583453afb56cc3516464a8a9222719e995be3873971c61b698e7ff74537797a23bffef243ab1ded2a7c53ed70005644f10d1d22c

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
104KB

MD5
e2e68adb14e2be81cf15e97881c5b592

SHA1
d40d30d49b6f3c60e05128adc3413b99ee4d5d1e

SHA256
a8fc6274f9e7daacd5b1454dad7b155656bf35581a4f5d2236cf77b49187f748

SHA512
fd7c756d518e2c3b2598e354b427aff9faa39cd6b0cf8b1052d75c31cc8a5bbf4540a1c19ed2f9e4482ce896c875ef0573c9efc7acae93b347d067e6ac3b2534

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
106KB

MD5
94fcf985a57e721f9f5aaba9180f4699

SHA1
cdfc0d4e6ca367fcdd52ffde278b0161fc9661cc

SHA256
ee59f12893fb3d5247b29caa08e405d6daa70be15935205be455a764d610bd40

SHA512
3386ffb49726f990c2cb18c536868837b64a6c65578ff00fa3074356b654a0ee49f274a9fa5db8518f71141e7edc66728f047933962f75d644e8c3df49a6e115

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
101KB

MD5
b12037ba996cd1a2a5931e81a6f80749

SHA1
82c9d205fb315b861bb0e7c0f1cf0d4af5739b3c

SHA256
266b57c5ef519aa6e8a872d250ece2f35734d9ea3b4f5e8feb3e4bbe7fc5b8f4

SHA512
90c957001f7cd29268c82345dd2c8e56cbf10f1a6144d6b5fd15c7e16de5c95586f6d2e041283c813f0c4eb40ab083444a610faec3c610d948d79bc5a2ae3147

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
108KB

MD5
440280aedf6d0d26c325eabf190c23a4

SHA1
5a14a155a312e9a72c7348d18108a8b625863fb0

SHA256
e3c5aee1832520747bbd35b8f271a84decf7e8d82008819fee105afa64d2e51f

SHA512
4c44a26fada04a30fb64b7084ac6895912c96c24eee0f969c70c9c93a6db8d0af07f9f6ca7092d9458a4dae7e8bef43f1b336f264088c1a6d3af582653f30463

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
103KB

MD5
8d52992bdf78dfa8820545f3fb88c8e9

SHA1
519c8754d9749c3aae602b34b729a6b097824879

SHA256
b01d1042f79dff4398935c483669f285493921400537af9f5c45e5b70f62102c

SHA512
d2ee4d554d9d1ff2a5bf7aa3e239afc9796cb4f50f8f019566a14bffb1ebd5338bda6fea918555e52725b3be4055ed74dff33bb6a4e980cd45ae347c47bf22fc

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
105KB

MD5
517a86cec3a0f8272a4552bea979fa0c

SHA1
7de95c868e89faa5e5684149b11bf3a6fd06c240

SHA256
f9bd08222147c42841850f43158b09ff0683e08993a1ed6497c4899a89e18490

SHA512
f040e8653560d94b680150478f8b62f61ea6af50db0db0c800f85fe336e747128b7616429da7b437237e80aa24cd6d49875085ae94fb69fcabdf38376922f056

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
104KB

MD5
54e9a4132b33f9191e903df3f4b70be9

SHA1
b5834f7bc6e07338f28520622d6de5a370480bbe

SHA256
db60c7574b476cbd0a44c2cd153ccf26bccf07da54bd9e75c9630f958097f8cb

SHA512
64212b2c7dfa49383a36fe82fbb4b76c72147a24c66e7f8d7edd18f771be85f85e974660c581ad11f0d733d2ca1a78edd00d7f1eb54f007c7da93b1644f6cf34

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
104KB

MD5
8dd94fd9f8c502b396fa400cf06ff7ae

SHA1
2faa80f4acbaf58f8df6822301a3e7415362a515

SHA256
f392dc953d883a0c2a3cc514dfa217bf8ac1b3110483a3db7dd5990ec3d03c26

SHA512
8a1cf3f97b5bc65689265a51058ffa465762d8afb46fc35e93dc2b4e08a0369ed930801e8ae01a2da40bf34de4ce6ed958804d4ee9ebc1a70f561c31c4b68e11

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
106KB

MD5
95e1fbf044e4fb06624ac6e16ffa50ab

SHA1
e229a40789e9a07463ffe7b8a715a5a80bf29b42

SHA256
124098b03e4d71e798f4ce3932b861552aaace41fd6212fe67f80534a07bf4f0

SHA512
245655e1a27247336dca1d59402a3cff248f1abdbaccebf5a2e2f98c196d61e596ba63713e27f4821896c2a78f8303df58c7908da1459484871cad5eaac45001

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
96KB

MD5
0f7a577c326ab9f992d32b269cf9f6a1

SHA1
38c7cbbbe4a791d661099736058eda20254200e5

SHA256
fb317e189b69d9b677413fc96e5e5e96a414e4a4c70cb95128d2c4aac700c208

SHA512
4ca44821299fdc20924968d6dbb0508eaf601ed5149af5f51ef9a6b7daf2109ac0db805f9ff214b0eb7b03eecc7a7aaded4698b210a67d7ac2d9d2ec7551519e

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
104KB

MD5
a4d7ebcb354ba33d6a5189249ab78c60

SHA1
ea5983ea837952240435350aea44b74cc81a4704

SHA256
5dcc4cb2a4c1bdb31f14aa9d082f44a0c0e1d250d108ed8c4fb4a987e8de9dcd

SHA512
ee3088ddb64d99ef3f5617cc565d154ff757a8bb880b5345d21023717dfd4d8a8718aead398694b41b7bac615bafa4005728a721a94c2308762aaced373c5f69

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
100KB

MD5
dbcd3e741140fb94f341bd34434708fd

SHA1
c7af95ca6198e8764e5688b51f4e719cf3a633c5

SHA256
abb6d3b32f0511198d7f2c50166751594744af74696c81048c1f0f323f007ff7

SHA512
da69616d170aa694aa4be5e5318c052b48092fcd7917720fb7efe995e1e213dd8c2a1975808d53b3c5c4ab67d50c3f4c2227bb5cbd5d32e8e64cb0e56ffc1db9

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
101KB

MD5
cef25d5e9763aff1c30f4143e0efa122

SHA1
ec9db38f74d8c9e9e5db98023d5f80aca1cb88a5

SHA256
329ed99ec4863f782f6f66b3dece6f40bea3930d2a1a6722cd5fb36206f28bda

SHA512
fa30032b224ba75d7716bb3797a9a21e55efffa7a1c8f7d30ca93d695d26ae3c3c25aef26593d1485ba0c72cf43412c7cc4d1f1e3e174f800eb71f0039f6bfae

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
110KB

MD5
384df964a55a3ea7cb9017f620718b15

SHA1
9de0682864d6bc0420ad2f6127a6ba4bd893b7be

SHA256
a35ccd233ccdfe2878db06b153b2e60cc80d7c8761634921c4e45979aaaa579e

SHA512
54f8123d4bb60df9ab71440bf74d43fb254c58baf6af49b8544eb06cf73fdcec942fac3231fbd1aaf21e5c9cbf4d98a70edee495b3d04490c5d8abd13fe7b2cc

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
105KB

MD5
a8f1692ea7996cc1a20c1aad0f674cdf

SHA1
8e63bc80f699d3cc5657ec000fe6299bef5d77d6

SHA256
bdb265d4be32d2dfcd49c15b52190b8b92b188ca3e943dd85d7d48a186f2e49a

SHA512
a5e056794422f5ea0294bde080b3af7244703108099f3c5b3b797893df636b0a98a06265ce156fe563278189bcbaffeb35e119d7d240f31f2094abef98d5288d

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
99KB

MD5
acba3183003bf322810268121cf55c72

SHA1
7bc3699024bbe095011439e0a3dc8b8db1f3bfdb

SHA256
efb271ede870dab707143c76289b7d778427dc44cb14b8fe47d70c8cffb08fe9

SHA512
685d293257bcbc1840baba1ec6e76ceb15af7f69ba148d7902be67b514b0314801b84b4222679bb60075500619420c807a8023fc237edf8686d8a1941dc2530a

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
105KB

MD5
1d891fb5f3a279345fc84df2ca43941f

SHA1
7311c3ddcec606f81419b119e9a08a81e8df2d19

SHA256
0d52a34706b90d9a2be8ef0bfce702fce8232d4be5f2261192738e3e22e049b0

SHA512
a5988523bd107e2770047b913e3d6dde3db86e2170d40a5613a6639b1e0fa6002b19a4521b92bfc4d1266fceaa79910f5d0462c78fae901c3e759d2de16c1292

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
105KB

MD5
34e82ab6108bb9d62ef9da44a59be13e

SHA1
d5b9e056a7b8f7caf2c99bebf552a0efcc809bf3

SHA256
f072e21d0794d04c28b45ec5ab3643408f52646988e5e798655f28213ff30196

SHA512
bcc8c9742686f48c9565ce8c8b5e47008cd10fdd692c78ff1bcc4dc5d55c99a0f1cd2f0f16e190c167ab962a0335c8ca24256df29476024021e923f02e8e529e

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
98KB

MD5
2c1f387f10bb9e332a8a538a9362e9d4

SHA1
72d1325c5cff604db3ae70d1b7c964f016ec896f

SHA256
1b7bacaeaa739205c51f5418d58a8cad9c0a99ec2b01b2ad3f2fef69c8aea8ec

SHA512
7294099330b5d7a86ccdb92ebeadc69319b856365df54552d7166bcb532a56ba6ba1bcae3302ab482f25772d3a96801bc2ede842dfdf20b3a215d1f9152b984d

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
111KB

MD5
4c89f95802f4feef1395ca1972e76fd4

SHA1
2e2deabba405f3bdd40fb65246908f352e9d398f

SHA256
3cf2a1a946f77f0bc1f826a672a97ed418d04130754b3ffbee0f61eb8e25b77b

SHA512
f8da154e74244ea9c776b56c6d0896383a576360e22348fabcc0cd4e375588863420aee2e0c30d1048c8c7b967617b35b17df696f52635aa6c07373f62eab94f

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
109KB

MD5
edc6f8f27545906dc79159492bab8e74

SHA1
4555ce12bad79cba93d1e2e078d96237fa3f7854

SHA256
986eb260d361324f326dc37330cedc2e4c037b3439044ba42d7e8b1fa49615cb

SHA512
c27b7537875dcffcab4666369afeb9d2c0b46045d357bc1bda98e3a9c25bb5660da94421a5a99e3def3c67240a7a52c01878c7591f24f1c53e58522260f6fed4

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
96KB

MD5
8becf70de0f5e434c9b849443b915b05

SHA1
57ea76e226ad7494a2e44b9a891c36905735ffe3

SHA256
ed9b2aebf0a2fefb618539ed9dbf680f13ec5dff917f92724eeb8821e5d2914c

SHA512
05f81ffa4a9e31ec87882ee83b94044451b7275f8a4a6f938d6d6d412e2dbc71863baab1a2ecf4c60e272b93a72a40e571ba014e268625f9e8982f89ee78bcd4

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp

Filesize
103KB

MD5
59183fbbab820e4cf276b06804e9a8c0

SHA1
ddc7a505cceebc92214850d24866c88467f0035c

SHA256
035eb9f58b317e3a3eb1d5c4d5fe67b0d748f0c90138921ab32f5da7e33f3abe

SHA512
5f1dfc2474ac0f3c7204fccec895f5bba5d3983780a76e8c68f190b7850d2edc5997f31ad651551fb5ded6c195e1335929449fecc47394b22b53c51139f5fee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Module Docs.lnk.exe

Filesize
96KB

MD5
6ff3c5853818f0ad63834a0b4142449c

SHA1
964cf01aa9a68d5150467e15f95c5a7cc5e578d0

SHA256
181cd0ab6d24ef0e37bc8e3d1fbaf6ce988ced6e930151274801802428a56957

SHA512
022b06c3dcc2d77a12cc757f650f7a576076cbf309be656321e068e992ba75fe36237b5872a200c70dcd9b65f8390d9a2f9335e17b8d3006e126c536063612fc

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
90KB

MD5
f052d15f1b566107764a2774908b6af1

SHA1
9e1028843bff7fdffbef8a8a41d0f96811c6316d

SHA256
f85dab0872df5adbdf677222092b0856a1838d56cae16021d069f293b4b34b61

SHA512
40ec41f35a125c28196e16365bd2b8b480edcd6d19c0132f248b3b32f04f22fa49efe1c7bc5acb9106215e1630475f4e3ba562d77b2d707b6dd1bc1562c798bd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads