39eb998ee4b2bdab88b158d2f8371754b880b3dcde6c190f8fd87ae2b5e433a0

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39eb998ee4b2bdab88b158d2f8371754b880b3dcde6c190f8fd87ae2b5e433a0_NeikiAnalytics.exe
Size

144KB
MD5

f92880c7842b6981c71e072d681d77f0
SHA1

53ddd84a89399984daa462f1ee3ba0d8e164ba1a
SHA256

39eb998ee4b2bdab88b158d2f8371754b880b3dcde6c190f8fd87ae2b5e433a0
SHA512

44217094638848440d7e3be29c517697ad329ba1ca836607eac17bee2d64a49728fa33e68435ef7daede37829dd627d99f1f9f716cbc2c979c07d9e6184b8112
SSDEEP

1536:W7ZhA7pApvOsOKjC0YSilpFpfkJOMETC+cI2Iv7ZhA7pApvOsOKjC0YSilpFpfkC:6e7WpXYvnh3te7WpXYvnh3v

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5240) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2524	Zombie.exe
1096	_08 - Homegroup.lnk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	39eb998ee4b2bdab88b158d2f8371754b880b3dcde6c190f8fd87ae2b5e433a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	39eb998ee4b2bdab88b158d2f8371754b880b3dcde6c190f8fd87ae2b5e433a0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Core.dll.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-oob.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fa.pak.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ml.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GADUGIB.TTF.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSJH.TTC.tmp	_08 - Homegroup.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\javafx.properties.tmp	_08 - Homegroup.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2524	532	39eb998ee4b2bdab88b158d2f8371754b880b3dcde6c190f8fd87ae2b5e433a0_NeikiAnalytics.exe	83
PID 532 wrote to memory of 2524	532	39eb998ee4b2bdab88b158d2f8371754b880b3dcde6c190f8fd87ae2b5e433a0_NeikiAnalytics.exe	83
PID 532 wrote to memory of 2524	532	39eb998ee4b2bdab88b158d2f8371754b880b3dcde6c190f8fd87ae2b5e433a0_NeikiAnalytics.exe	83
PID 532 wrote to memory of 1096	532	39eb998ee4b2bdab88b158d2f8371754b880b3dcde6c190f8fd87ae2b5e433a0_NeikiAnalytics.exe	84
PID 532 wrote to memory of 1096	532	39eb998ee4b2bdab88b158d2f8371754b880b3dcde6c190f8fd87ae2b5e433a0_NeikiAnalytics.exe	84
PID 532 wrote to memory of 1096	532	39eb998ee4b2bdab88b158d2f8371754b880b3dcde6c190f8fd87ae2b5e433a0_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\39eb998ee4b2bdab88b158d2f8371754b880b3dcde6c190f8fd87ae2b5e433a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\39eb998ee4b2bdab88b158d2f8371754b880b3dcde6c190f8fd87ae2b5e433a0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\_08 - Homegroup.lnk.exe
  "_08 - Homegroup.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-200405930-3877336739-3533750831-1000\desktop.ini.tmp

Filesize
72KB

MD5
791456c034b69e3a6d0858342fd0b31d

SHA1
1b7e28cbf14ebd2fdad49a8090a93962fd13414c

SHA256
1e3e8164958757158927af548c7948f877fd04bb113bef94325898fed0d83790

SHA512
fe909466440bdd34a5191792f90cff01dcdde4a15c0bc741cd46284561a1ab79ddaf49b16a9939eb5e33a981e0e5d87e813d813c69c976996030402fb1dbd10d

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
184KB

MD5
ecde706f1cce12aa58d9928f7b26043f

SHA1
888592ceff45fc24cff32b62e1c8b41417b11c30

SHA256
5d3bc850208b9bee78ca6f55d131b4e336f1655bf575f83456aabf2e30072dd0

SHA512
7a8767ca516f9adf83e01ca56abcdd34a33d73619e007e1e7c7407672ccbb99c9306e94e22b2fd17c33f5527abf2e95ecea38d44c1a3e3614635e2339b4bb9f3

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
2b401f86f2b356a9cc5ead6bf570359e

SHA1
492701cd7d83889346b604291253d011bdeca140

SHA256
c744b6e0ba54d90887fb6030d4105e1a4083ba70272a48d7b5e53dbbad98512c

SHA512
4b6b56f1a145e8db63d8ac9d7a2f2702d03f3999e8cf2f17fdaaac85bc2f5f0cbb5216d9a6825b7f4b4a0637c23ebf8c6fdff1bf515004d9f8ea043f2909f37e

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
616KB

MD5
fea49e74a4958b526feec753971c7a36

SHA1
489d8bbb157ab16300eb4e49234df16a04d57e5e

SHA256
f4368b1e43244be17ee13f6a74b707435c0baf78856781a49d1d77fb210dfa4b

SHA512
2c0296b1037f7989050a3556c9db3b896b1c65bcb86a34ab510709ae3b4aad24ad758154e5603a12303e7712631ed7005f713c0e13e4144c26f2a30c883b8f9d

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
261KB

MD5
12fff0219c18a0a38c7057623c13c01c

SHA1
43f7c8b447fa4860b5e2c09803a12356bba74575

SHA256
653323b3e1f0cb0b52ebf3ea86c28b43c2b51207b56f23955936e3226ee4e44a

SHA512
3fa71d16c49837698b5dd54c032a10960c6cd0a3d4454c5635de292f2c289ddabddb0daefae5657459a57c32853a5c4c29d47c01b29cef144bcaeb699548685e

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1003KB

MD5
730d8d38744ef30704c28e7bb6a760d3

SHA1
c27e60020903cc627d12d4f1408f4caa9be8d611

SHA256
e09d0d2f3fea3fb23121f649099618e8183284fe471ea464a76215744016e027

SHA512
a5020b16900b5ac57dc16247d3f9207adf904c87d8e1032f3b820e36d3572f34d4ba2331e7bcb3f32b1bde9c291ba8c3b06ceab07a489e6004dd5ec509e3ad52

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
756KB

MD5
826c4de52281f65edafaea4fe3966ffd

SHA1
c08d28e0050c02485666af8d2bde4b38ade6d7ad

SHA256
438df585996b09445e5185cd847394216319d70b959be2468717560af8e01fb8

SHA512
fc8c34cc8e7da18b28019dbbdec86bfeb2b79f061ac239d39169a6a5b4067419f54c5b5775f9aad8ad64c584a0d4914f3f88bed3c7a8cbec6084410610a259e1

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
129KB

MD5
ffd20c46aad582122058bd4ff6e1d39f

SHA1
92c7a0e3124354ee5a475b7b507708815de4bb4f

SHA256
1f95d214a4c8b62c7c1e22799ad3ac511283b475160196bdc2f1530a6e65c41d

SHA512
2f3054a5b38180a9109824b41a4943a81e3b2060aade4b9fcf19d7b42e35cf6ec926091c2c4044d136e9313cc0371f00dbc48d072a36572f191fb5b95acb53d6

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
82KB

MD5
627f4f69008f32749b4c3e5121e8d400

SHA1
21f4fd5075fd199eca914cc56a65c920d7e4f82d

SHA256
345f6a8638283f391d5f80f1a99531791899c78d88b57017290570ca299bfbda

SHA512
a072861c29095eb11c06ecac958a0e4afcf385f573413982eeb55408defa156455efec99222a59ca2f666640d6551486438cc8a98b0f3e6757c2fd588c077220

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
80KB

MD5
14b616f43d6b2fefc387abc307155cab

SHA1
805d4e1d87369956a707248d6ba8e7f41392df68

SHA256
9f46dacfbf305c1c85669cc2012a4185c8bc3aaaa513cb9bf7565d1c2e540eb7

SHA512
82e091dde8da4b25a03f52cc4d1df488ced10fd9103ccbc9b36bd1d35f2b67afcaad5592a286e4ec379daec40366ec959942db52a222db833e0816b760ac8043

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
85KB

MD5
864f4ef7ce605a688f85762643bf60b1

SHA1
31f1b015ef5f033aad2e39f0588322287a3a3be0

SHA256
9831993142ce165096a5973f54143572dbc5f58b71f812f559d2c7e803001428

SHA512
55ac4cc66466dc89afe2b1dd7e1111cc24e157ac6235fc101d0ab8159e738cd3d19c6f37c28d6fb7b23a234d91b63a95f0a8592627e8907e730238d7d47ae02a

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
77KB

MD5
e5118ac5286c050f27d06da745e4bffa

SHA1
72718145fd0ded2acedcb215286178804521fae4

SHA256
a4d5ab2991d6243616039ae532c9d5d5cc4586296370f1873825b8fa095c297c

SHA512
da5be58e70aa25ff3aea348877d062b5ff0ff104b183e506d34fd37fa515f62f676c7d57035634ae84dab1265baed516cc98baaa91cb5f33461d1ead45cc3005

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
81KB

MD5
d758b96501105816c7a45ec1da2efd57

SHA1
ae16334d0d2eb905707794bdff44bf9cf9861e58

SHA256
24651a8c8b835f9bf87e524d919ba3de090ab63075d42e1115d3fa259240c240

SHA512
ecb8f8f73dd8d1d6a1019819a7fa4ed3ad48160ef43c5df21a56c0ccd6137cac4da1c10b8e73c6743580c5b5ba827e9fa56ab6644f105196b9d3e9dfecf3d797

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
83KB

MD5
6f45b3ccca1e6f1b0c5feb89bc552620

SHA1
923ed07701f25a2c946e65739dd1c939e523c903

SHA256
3cc766438d7b5fb5d0ff65bf3c84cb6472eda90bbaafe9554f490ed763c22186

SHA512
b4f5b0e799c8ad2a89f26a94693bdc33f35969bcae49b063f8c4be15e4fb31fb7061203d79f36d52435a6dfd18b71c9ca9fc317b2f285b70c6fb201b887fd2fd

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
84KB

MD5
08c362a3a7d8161cd3f57725cf375f44

SHA1
9ec2702dbad6b3d8d13df69fe0b33f401e713f61

SHA256
4094779847bcdb2f135e6fc138c29d8fac3054ea60132f9a9dd9ae2e7ed57d47

SHA512
bf4041e26c1e7629d93e60619ea6d593ebad478ebb11c536c13f5e3b10cd3a6ad873d809e2181f52ccd6c1ae42ddef79a66a4bc44224bc59e02c8554107f17b5

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
87KB

MD5
f3ee9313e3621fc9c2df8f70a3d7c1ea

SHA1
650f69b3a1ddd860e9634f43111a24f16e8c4786

SHA256
bd62e0f23efc7c0a29befd3bb26a939c286ca788e333c985482af52709a8c306

SHA512
77c4e3584fe552d75a2473a58cb7c12788c2c1fb8aa553f18e8e0feb4f9605f3db86239a009cc042fd1417d41cfde8abbc48a70f09f0750cbd9efb9e5365732c

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
72KB

MD5
b659878534e2450e1d9a6729955ea1fd

SHA1
e754cbddad623ec0c6a722bba30fed957484661e

SHA256
367fd2624cadecda6568abe8e3eb6a7db7bf415df85973b99f29449f44bf3ac3

SHA512
09d36d37e77b9a12c73bc7d38d1da84f683a5d5e9a9286329ab7e2b87100e45c28aba258e881d681d5507770ebf15f32a2b2197d35f84bf4938d8abb6a45a949

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
82KB

MD5
da7f51ada3286373325e1547ed6cb933

SHA1
6eaac846d33a6950f9d8763b927b69a6fab234dc

SHA256
21eb561cb257252180f08f24a67e07b5d6d917212aee2a373ddee07d057acb86

SHA512
d9b0d5d2c5533f60174a93716442fe84e69feab0fc18ea7ae7939b5cb74906439d6b8501e11d05c6fa0e0de047a9befb7527e3b6e7a3bca063ad6d412b19d2ec

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
80KB

MD5
15c1559215f8f599b14dcfde04652d81

SHA1
fc86da62c1a90cf8786cd0b773640c06f016b4e4

SHA256
5d6ec2f9414f6286021fe9ea8b08f1e00b9285be1d60e7abc82c4bc0ab123952

SHA512
774d21f524f086819d6e2af7dd1349f45e2529f6cb6f866c5915d060eae4b5e395eb82458334a6be5580664a8c2be667235b8ce4e2cd33c70daa00f718e6721e

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
77KB

MD5
f3b4554db7853dec9fa3c4411dce722a

SHA1
357bd38fdaf5f1d69033a1ccada2cb0fe9568221

SHA256
a6eb0dfdd111751a27c8cfa7f914f0847651278fcfc14ac4981dc09508890c9c

SHA512
35defd5c63fe9a30341883447528e81d7aaff59cada15ce2c60178a08ea42fbcdbc6086fc80e3d8382eb94b4c7354aceb80608a7160ff1c64bbebf41479f9085

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
80KB

MD5
97b80f66e3f4c344b61b0cba265fa7fd

SHA1
49dcd37be4d0647c9725a08412632b38c99f1df2

SHA256
7cd735590b80e18735e7de03762abc46a8819af44689d8f63bb7b84f48e86ad6

SHA512
72914af7aa17515302a29ec29c99df5f15c0e163232d7ecc2b628d8fd69a116679685a8a860c768dc6fa23ec80fed987c5e38150ffadc3eb1e781947337ae348

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
82KB

MD5
d9d0ebe6ed8e47f6435d03bfaf14c439

SHA1
eabc25a03428fc2c43645aa7152a003ace032723

SHA256
74f07f56957716b734c2bbf2ec11dd10938791adae45b5e8cdaedb44919932bc

SHA512
bcd67338444a11dcdbcab063585fd50a5966b35e0da52651f6fb76e9bf5212646411ef91da64647382a1eab935cf9e20125f16d499b559ac38188241d93de29d

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
89KB

MD5
65eca46348193bc159becafd9572e4c9

SHA1
34b40a332c6f5ef3789e973fa34fc53e19b3509e

SHA256
d5ccf3d2836ac5e38f207148ff70db2cb09eead0b05bad466b86ae76029f8e32

SHA512
e19f3d493e44518d89aae1bd74a38bb31c6e7481e85353f2e151dc8eeb269ee2baa9527709145a103707f84b524384d120469ee41f69a8abd43bb44229a87da8

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
80KB

MD5
9bd4ac3bcdceaefca7c297f4bcbf940f

SHA1
999faa370747ad20407b31e39972c021bc7f32fe

SHA256
de3b210256a03be61ddfd6cea6a0e4249b26c1c2e8061ff2bebcf1d6e26bcee5

SHA512
47f64eeff497a903b5b2c2cc92a25fb8e4b912081eb3d7de5fd003531a7d011bd7e4961e79edf81f745decb6330442d5f81d30ae03e1217c113ea299b103fea2

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
77KB

MD5
8ed36024a01d572861f075c2efd39d6f

SHA1
f6701293d44fd441e4b5278c0ef9a4ba2961cfe1

SHA256
3555f228a17832ba73d00c7d6dd71463701c9bd136151f2bbea95834b692f313

SHA512
2b6de631d8528b2ca04d4ee35fae2ae1f5fbddc11ed4b0de9ca25a59693218055797b7b9ca0bd2403a0b0d164e8bc18717997250cec4ce9df6c356f106beeb2b

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
81KB

MD5
44e1b3fc2d0c9ecb493ea284d8c22832

SHA1
033fb47fc051ebc7550d93554f5fb208e2204b7d

SHA256
e024c8a2683da9e257168f2fe6a21230459c23b2ac1d9d16d6353ed80643c077

SHA512
e9661416ff8a402a8684347da4e8b27839532633b5c821440d9510285a91e9cff70625ea6cb9db5ed77656833069cf2e51bee0cbfd94e438f93a0541cdbcb07d

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
78KB

MD5
255a3f0af682700a0dff9872e339d9d2

SHA1
534f3f628feea3f9e976a45ac7e4c120ae7c40af

SHA256
218a42be8a4dc4c3a44914f2136a47ac24633169d48328b733d01734d5a8183c

SHA512
7d0118abdaf3ee17b62862416e57321c5a43d937c99f584efaf2a55b2736d9c6cf3fd184f98e04c6e5fa92b687acd5c4f7bcfc89e0afafa6963af3e5e77303c5

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
80KB

MD5
984e6c98ad2a5399c902d5a14673576b

SHA1
f6526e3d1002642e3e260235888be8ce5c428ebb

SHA256
3936921ef79df8dc1133d01253aefeafdc7cf2b2f11e5ef5e1719f84d2425680

SHA512
f830853285e0a9b98856417c42b4e18a7bd02c081aea45ba55625e4eb69a02191877e6939058c82369d93a5929cc8bc6d9d915d5b010d36c3579b290c6a79bed

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
79KB

MD5
c1697c388a358e03602ccc5707aec5fd

SHA1
9c5b9f8383339c76567dcd6abdb328b1d4e501a1

SHA256
b69c0ed2e5554d0444a5090f8c6644dc6d114ee4d7fc98d9a1ec64b67600610a

SHA512
0b1228b39517165ef8016386eb9563d77178795fcc2504330ea45597c567a7401fc0bbedaf7ac24873a670d57e8c88b1cab409a921dd5ddb6327f57723c022da

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
86KB

MD5
d1565269e589fad889e9b355e719e2b8

SHA1
de0d40c3be4243cb085050b77cc61f879b2a9558

SHA256
2f76a72d99ed0a160768a4ab2bd5c2c4cd9e7e514acfb0e37fb99cc5b755255f

SHA512
d18206fd81f8607909f0696546fd66ad060d0a6110771bd8b32e0f33de5f3135c604d7a94efe942abac0b9ecd9a709d5912c26b02646562038c06c700436915d

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
80KB

MD5
538197397ff044a105e5c212b2a7cfd9

SHA1
667cd76be586819123a7ed9c6d6e9256879bb326

SHA256
438ed479840d203d50876d15239d097b12337f9540211517a76a074f7d1b895d

SHA512
17207575ec028c080568997294bbff849e7cf1c42d93d77cc0252379ed270dcdc5a136b94d79847834f663d9df8e29249f98dab8386b20b0cd888db377ccf134

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
79KB

MD5
c0545dee8eb8f931eb219972760cd378

SHA1
c291bf7945d085df985060a91c0f5bafde8396b1

SHA256
308fcc70954a0c59380bf16fd155d7f68421177513ef534add440d89a440fade

SHA512
fc000589319d05d81741f437e95c5d1930e7ad72d8e5fc4b5cb416a8d366b1c562a355c37f2da0f436ad221196f453bfe72769d785489d5846df948c13e2c642

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
80KB

MD5
c3a64fb8928ee3ebd31bc4c46fbf1f62

SHA1
f6aabd0628181018470d5c7d9f18686c730e8197

SHA256
e9677a0458ef6fb926d96ecd245d73e7f6bf0a03c9336868c4495dc114806dc3

SHA512
0223405cff2f5c407a94216339169c10698ef382f8258c1784d8aef442df6616349dfde7c39c773d2670b334a9a2010e0add7383918943e35e99b2ee9576e015

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
72KB

MD5
cd72662895122219af30a36a37e361b8

SHA1
8eeb3f9779381b40dc24eb06d5bea53d5cc039f8

SHA256
e109741cfd4c2d3390f5be393690a16c70707addf9c64f2c7ba70418371a6c06

SHA512
8dec17f82685d0212286f04deabd44aebc77027be5914e011c5d3081a12bc18478c574ea57e98abc85d993c843be58ecb3938a1c3bf2794a58957a78d20c18e0

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
90KB

MD5
488bc0c640af45df6b61c357b7fc30e3

SHA1
1fc3a8e46770725d6d6ff8537e5e589679da6a72

SHA256
63b761698ad66c51a0a3e3cdf7fdeef652f3263cfe05ec6ff60d169a1f55fe8d

SHA512
d3318b318fd0d2a332476c761076a530f845705d8b93dbb913f893dbf6a90653a4ac7d6d3de62cb89166477f99080f2a778726be2e5b1b8076d60a89dc233c80

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
83KB

MD5
032fbae7c3d08d1624c1a61d03987cc7

SHA1
e4db20e23837909c90ab46cf4ab921e4343a768b

SHA256
5d829b28592dcfd6acc2a6e27f255a9f84f6bac9468673acefbb6de5572ca676

SHA512
ddcb622ade20d7b3ee2d7f45cf9b2ad698c86057b215ea8e70d0126a67319a038a0cf912e2e9b3ae559e3ad1fdb273b4e4d1d26a4523f5ab248430bb40c6425b

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
90KB

MD5
8bd6ed04e7d7a4057fd9f40e0e94f10e

SHA1
eb8b85590d2ae06a49027c08cccd74976366554b

SHA256
b1f6cf01d369ba92a8d27e002eead294a22a5135a7c952547d17253757519390

SHA512
968d977c2be782bd7e58137943b0163629fc8ae578e5f4db2a4f2af2f4c95d4b52aa78c2fd778c181289191406c5795c11a40086e522c83e6137afdb31bbafb7

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
82KB

MD5
bdb146f562215ec1320098e00c2bbf34

SHA1
c231b3a2ad5dd7a9712342c9fc075625cf33bd0d

SHA256
2c9221996d9a9c4057028d06ff5c3964bad4185db8872b765f9c568d09f70ee9

SHA512
53b1df314349bedd891efcaeb4241cc2a8c400dc1d29272a7040c2e8efc8674eea66ba87a0d7748d9b62273d36821bc5a05122fcd965160fc19d233276ffa092

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
85KB

MD5
3bee878c253b6d157379f819e7724b0f

SHA1
8f36a464179785a03736c556643bb0e6d94d82a5

SHA256
2f3dfe477df7cac2d305d170fb19b7bce084311b095019f5939b06f8d2041e66

SHA512
d848cc1fcd742ba8c4821e727fbdb83f02b486f74fda6adf00e34ec1ce1a6635f49ad60d830e3fcc0bfd65e960186acf242e06cf54fb857727f9a07d2ac44356

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
80KB

MD5
e67f3ae83a89001154429c8ceacc9245

SHA1
4d8339850df74f29b65674a62bc5f147b4d512dc

SHA256
6f39f3bd6c573e806f42d6f33028063ba695bc104608b1d4d2315d1cb87131b4

SHA512
99b9af676f1f1ee077d3d6d0d89956d4a21f8be31573acc97cea29db2c110c7c4d5c962b84ee3b236f6eeb2b3f1f7292909cedfdbfeb0413ccc693b682954e23

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
81KB

MD5
a729e4ed747bb0dffec9ff5b22969227

SHA1
540c5bfb290c783bb0c315dde1fd32427d3a4896

SHA256
41ec1b76bdd12957230fb4dc4b9e5da242b2d804b050ad1560d667ea63ad8374

SHA512
43d84324f70e41a5192b549e68c9f189a4e7485918276942b59f00c63a35b612f6b879ddafae385aa358ff337b0ee03739229f099a85fc85ee371382c05a77fc

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
80KB

MD5
b518925316f3b06784321cc4ca4fddcd

SHA1
85a71ede6567213a50621ebf19b376110f540d4b

SHA256
c59150009cd72f63e4b25b3056c39ac6cf688cce0a004d51c30d08e835feeaff

SHA512
d7f956377eff82e9d622b54af4367acf1532466148b1458544b06d3c64245c444e5fb91008f35e0f6a7fb8888cd2db15da3364fe65ed2a59a297ab89b098e891

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
84KB

MD5
4e7b250c4c97f3e70576047d995a5211

SHA1
642d1e97d0c728440121311918e9f052072af097

SHA256
20cd82bdab479af0fbf2168714b452ef095ef7d32fd352bed8510f3b18962c88

SHA512
72386659a68c4023dc3b6135adbd598db6986a705bdad018e58603cfafefcf5c9abcb58db44f7db134dc653cba5bc9fc5625b36a834fbd007d9a5a01d903438b

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
80KB

MD5
910c1292f633301bdb29f6e48cc49896

SHA1
c56a079ac85654e2be5ab9c33e506f1dc1898e4c

SHA256
62b4780a035e201b869a2098a3cf164a1821844ff7a73bd77201f6d3da17cca8

SHA512
73c447de6c6394607acd73ad81f059f82baaf9e6625907708ad64003c1874c349aec92a4c2f7659f1949e17f66462c8e9a6903cede40ef268ae6d969f3b131fc

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
81KB

MD5
17d79c1b682b6f76a33896bfd655f2aa

SHA1
7de474655736c34747eca8c088e9d325e3e54906

SHA256
4020ee0e9dfce21354c50548253b336aa641040853c4d6c917d4dac7c86b0c05

SHA512
3fc38bd2644e02b6e2cf96d9cb7dd4ae4bcf9f8a9545d7d6423021f5d04c7b81ef25afad8e257315b5144bfd403e997aa93ca470d71963d9ccc7063e655e0c74

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
83KB

MD5
d658d402c8c0da7a89c5eb291c9dde3e

SHA1
49dddbfa0f5103661b499d11b63fa3797fde4298

SHA256
7083d18b99b3857e51bf729e9bbf71f018735b22ac81811b24d3053496e46966

SHA512
4e29d71e6cb3acdb4639e6015d141a898d1d76854e96fbb75985f09888e8bf5687713ac6e0dc46ceb996a372a0e37316f1d789b866baec27356f23d6162ff707

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
82KB

MD5
accc12a87db733c6d85af727d9a90cbc

SHA1
83798547a5efc4cf1333c3efa445936cb2ca4fcf

SHA256
83bb623dde3f9a2d5f38071a55872e995933346f2e0559c310856d2a242e8dfd

SHA512
a2f40aad5f6af97c02259d6152e11b394a5ac3d799f24f842fe4629320a459edcbe7ffb2b968a6cd2844b3176863bfb9b8e12bfb5201a93b4420d3409432935f

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
84KB

MD5
fb739cf7ab03368d76de02c83dcd1296

SHA1
0db38dc11248397705517df836a0bf0e00d05637

SHA256
18891f65a91855b2cf068f85357bb75720dab13b5335002e56fb019fb1e4018f

SHA512
82f9b156999af90597b45e7a22088af89381ed25773e1a3b02873e411dc793f6d1b72ecc15c7d806d32c8ce5634d70cadbe8cd7a88e0553c3bc59c489a2833e3

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
78KB

MD5
80e05f7ccc43743cb9a318b80ef1c6af

SHA1
e4f3fcff3d2ef1a7b0a20e49b65d5650bc73be70

SHA256
0e5f3dd6f0a556ce78de828242178e7fd40b1f452534ebd5b061aea109a04e48

SHA512
79a86072e49f806bdf209290b803447eabddd18fc8cb4035bf7b686c28c7838dd37db4d019e9201776d768de13f2e45820aef92460ef6572a4c9e6b90fab6925

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
84KB

MD5
d45748f53ea2c9f41a7da6d82119f660

SHA1
2f142e52b6b89b7c180c5489a557fa17a466b32a

SHA256
4da801574d25278ec72efae70ff2fcd5a7af0e79d8cdac2a4479b28e8da118c5

SHA512
3d628a43c5730e3afcfff586d3e702733898dfd1b0a443d6a55cc2e6369dfe6c23f17c926d135ecfb1175112eeff3a6e2592cabf02c9d35660c38bd2e564519d

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
81KB

MD5
47b875c672d2e2ef782f38f30f4e6bba

SHA1
1297f7f961f8c3ad0e2b6fd47903e84cd8604646

SHA256
4c08a7438a4d030ae894c4ff43739b9cbb5b4613f04faa4804f01cdf33991d86

SHA512
8dca624c2e862c92ad573de876f0e67736854b802395d975925fed96aa4d3cb7dc3fd242cdfd394ea50a936087fd62f825c96e1414246411ddc6efe197b16c3f

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
77KB

MD5
3de47b57a0d9169b47a6ab0a1c15a023

SHA1
57ec7ac43507917376e532f023d3148d904ad73f

SHA256
436f582b1f6028909f4f3a4fc58e7243390a4731f0d9e79ddf7ad75aa2f588cc

SHA512
0f384b7056e204f5c2203179177b987cd2ee8501ac94281fc4777b43797c646514325d591d494014ad6f8ac74396a569c564f55115072e3a5959dc4e20ae35ea

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
80KB

MD5
bfd156e3faee0f0835c073cc45a8e4a4

SHA1
321474bbbf4999bef69896a91dc35e9074a01d83

SHA256
b412a85918a56bf420f13811edf91f1a8cd4560f861b119aef12901c67ec498f

SHA512
1d6789eb5147bef6dfa4c8c866ec79ba65c22649a77232325e3a46771e4fdd14fadf447d6b7b9093815d6b318ab16073c107384d1c30ca97a1d5f9b435670829

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
80KB

MD5
64cd8e0b0362d14fe978d9040f9b12f7

SHA1
70386c0db0e97ed43fcb1b2c7e557e6da85e7b9e

SHA256
cda9637109310bea9aff332721197166387cd811afb0d5355dd1c82bcea0dfb5

SHA512
d090067878e396935fe843fb3dcd4f10bdb46119745f1786a42394b0ff3a3c2e4cf3d407ba049d9511834f477199ee61ecc56ec6d0159cd61e1d5ef2c52492bd

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
72KB

MD5
f73649ec7e1649d762babd2bf793112f

SHA1
fd4e0dc863d1dc240a237565f099f6cc3a7d7f3a

SHA256
b089bc88be7e2e06e8bd67d1fcc94bde3013dc0a999a6f950fd9f2a2b0e5bc61

SHA512
e1b4758ed8e59d37444431948aa0428257c4b59bf8f6ea956154030a4932c80ca0a9f57333738a3358554675afc476cf98c46e6eaf996b255bfcd054fe814ddc

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationTypes.resources.dll.tmp

Filesize
90KB

MD5
352aec1f8d6e640816ea840f3316c2f5

SHA1
cf5bdd1c3acdb52dffae4d6448f5edef8a08bcc1

SHA256
df4e9153d9c531c10ae41c8adc9c1a6f7acc3484b7941d3a64a4126317356458

SHA512
7a2c4326c25e4fa0236a9d8356a83182c13abf1caf44b6661643c6a3729969618cf718c6fb5a15055637d730f9417ef62ee2306f232af0ff3ef2510b259e068b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_08 - Homegroup.lnk.exe

Filesize
72KB

MD5
29cc6fef129aa08881a4fcb13a728369

SHA1
943188f03f7efa5ae296f46178240131f919b830

SHA256
e5b7f585f6131df7defbcf8497416bcf596a6dfc8b159376bfff1d3b7c0bb30d

SHA512
aac4e9128ea3cbea8882401c5bbf5c81ede5879dd431c2a35b3cd507de92a5ff41c83474dd268988e5b19483631021571fe1f788783decdf684ea1d4618149ee

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
71KB

MD5
5def15cc34ee2fd2c79a1423c6cb3a44

SHA1
803e7f5e9fbdcebb615f716adeeb2659ea07cf09

SHA256
f1755cbd41ab7a77fd278375b3595ca4975192752d24f3bb857ccab6324deb9b

SHA512
e18d7c765133b90aef7dec683112500d943f5f873db3b93871bcdacedcf2ac32a342b6a4fad9ecdd166e71fdbb2e47d68977032930c2c24a7b685094bb0e2f7d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads