ba0a3085dc7b21d3013026efca1a6fa739e1e33eaa75504051c272cddef49043

Analysis

max time kernel
149s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21bbabf0be3cf6ea0a792eaf8d416f00_NEIKI.exe
Size

199KB
MD5

21bbabf0be3cf6ea0a792eaf8d416f00
SHA1

1bafe382147fa1d48252caaf606a1466b4b969ff
SHA256

ba0a3085dc7b21d3013026efca1a6fa739e1e33eaa75504051c272cddef49043
SHA512

808099a6f6e6fdf4ddc07bd89cee376a383e24ca294f5aa6ee82289e238db0b5b6a575ee8485470e621a55468ae5e819dd6248e3d02633ed9233c679cde3a0cb
SSDEEP

3072:6rWpcOPxPke+e3fFpsJOfFpsJbgEXrWpcOPxPke+e3fFpsJOfFpsJbgEZ:tFPxPke+eIKFPxPke+eIZ

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4884) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
60	Zombie.exe
720	_Google Chrome.lnk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	21bbabf0be3cf6ea0a792eaf8d416f00_NEIKI.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	21bbabf0be3cf6ea0a792eaf8d416f00_NEIKI.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\Logo.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp	_Google Chrome.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\ImportConfirm.dib.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-pl.xrm-ms.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.dll.tmp	_Google Chrome.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll.tmp	_Google Chrome.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClientSideProviders.resources.dll.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp	_Google Chrome.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMML2MML.XSL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr3jp.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	_Google Chrome.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp	_Google Chrome.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	_Google Chrome.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteFilter.dll.tmp	Zombie.exe
File created	C:\Program Files\DenyInstall.gif.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 60	4496	21bbabf0be3cf6ea0a792eaf8d416f00_NEIKI.exe	84
PID 4496 wrote to memory of 60	4496	21bbabf0be3cf6ea0a792eaf8d416f00_NEIKI.exe	84
PID 4496 wrote to memory of 60	4496	21bbabf0be3cf6ea0a792eaf8d416f00_NEIKI.exe	84
PID 4496 wrote to memory of 720	4496	21bbabf0be3cf6ea0a792eaf8d416f00_NEIKI.exe	85
PID 4496 wrote to memory of 720	4496	21bbabf0be3cf6ea0a792eaf8d416f00_NEIKI.exe	85
PID 4496 wrote to memory of 720	4496	21bbabf0be3cf6ea0a792eaf8d416f00_NEIKI.exe	85

C:\Users\Admin\AppData\Local\Temp\21bbabf0be3cf6ea0a792eaf8d416f00_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\21bbabf0be3cf6ea0a792eaf8d416f00_NEIKI.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:60
- C:\Users\Admin\AppData\Local\Temp\_Google Chrome.lnk.exe
  "_Google Chrome.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-17203666-93769886-2545153620-1000\desktop.ini.exe.tmp

Filesize
199KB

MD5
8d309cbc5913f8ba3078893677a3e095

SHA1
1ac25cc2d873281dada3254426d6c683b277ae8a

SHA256
9c524aa26900522ca11c7939ea6884e540e130ad747926bc89973c7506690b1f

SHA512
28b0ef953294a44a1bd4d85c0e15d0e31945602837c0110518ca3036380bc70bacfaf5f95caf67b804dc36f03597383742a34e6a46d295535ebf99070e38fdcb

Download Submit
C:\$Recycle.Bin\S-1-5-21-17203666-93769886-2545153620-1000\desktop.ini.tmp

Filesize
102KB

MD5
28b8800b39458335a6a78c45b096d95f

SHA1
0bacb41c9413484033be8ea6ffc69ca8cd39134b

SHA256
1a1fcae62cffa49b03f31273e6ad43824f70f714d2d43ae514fb77483d5566ea

SHA512
c97163dcad532acbdd8399aaf97cffec0e880d6ae2286a889d62077577204bd2a98cbfcaee9b4e9d815a44f6a2d8b3ef2f11a8748d3b8885bf0292bf0dabf06e

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
214KB

MD5
2636bd37ab82d18f3e2b4094f76c3f18

SHA1
55099c3fe5fce1a9fff4e2b6842509bc7d59bb6f

SHA256
017f7fd7667b122571e6b7baff2ccf5de8c7c2b4cabb44cca84c2e70fa7e9bd6

SHA512
5553fbe324a45f4b49fdd42c9bc3742938332016250d3c5d6c6dae8f420e5e0b779cd23de738a803c7014faba9fad3b9f19df348a7ca7d3f99bab2f87cd3803f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
201KB

MD5
7fe550a14dc6061adf497e2a13df93e8

SHA1
431c68a8542791a9202e06a7d52d47fa422197d3

SHA256
6ec3a58a9676f653f4e841b169eaff41fb87cf379ea0ce218364350b086883ce

SHA512
25dbd0cea2e6231490586991270f7a5740b78e5d340fc9f3c09a5ee1699e7d13d178f7cf375d2ff6c3670dfe395264bfdf134959fc35eb3c33484335456e318c

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
13c5db8693baf544003ce684d25a685d

SHA1
b0679a8d463cefe0ec21673ad2638f13044c9eb8

SHA256
4fe6c13270482e348ef31418ce7d0f96783620514bd23cf35fe4d1f2d50eda03

SHA512
9f29a9c5d810861f7b9a7024352aaa7808af41ded58e7fbf38303aa46adf97b5f5b78cdd0bc7c564977b42b06d33f4c859454bbca13521ecbddc7fa8d95b0665

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
640KB

MD5
4c322e383b1cd694bbc3d261e8f3c499

SHA1
a8a1797dae5b9960662ec2be4e2cdc66b0c358b6

SHA256
da84fa2bdff222733f4a816b42504a98cf32c4bbc5e7acfa6ffce94e76ab5230

SHA512
b6a20999a1f98d80ddb499e90d91ce0d109adbd1e45fd566017d682324fe2a1bef70600e576430bb17c333b5c65f0acec2bc663cb1dcb83c966d9477a625b0bd

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
290KB

MD5
bcd401935b9ba61ccc26e13bc97c3781

SHA1
ede3b0f4c87aba163f028371bda1987f186d376e

SHA256
003d3075551b2a6437a4126326f86d73aea2d1903af4d5a95bcfc98161dd82e8

SHA512
35b1baaab2e2558dede5adb67374c59eb84d2c4c8098ea76fd7b3854b83e474224b1552ee51004ac700ce3db275305b4010c9d63c2274629869991997d5a429e

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
780KB

MD5
c99ecf52792cd5422563dea29e42416c

SHA1
452f1c93c891605df25b3204c1c92fa3076bc0d3

SHA256
6b5de007e7856f1fa419a9873c36212e4a5d5ed45eb0ec82c18a517a3e80388c

SHA512
1ccdb43e2b3c2a42559a372b25ae4b436ffdcde248211a2769dab31eab4bd0c33772c93fa3a2e35c8973ad8d76187380bd1739e38886be766bd6a964cd440153

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
111KB

MD5
e7af945c6ef30ebcdef2d6effb180e7c

SHA1
ea9920e4b56c6bcc471bf67d51fab13fa819fd49

SHA256
85f642efe39d4614f8758f09789cbc6786ffecaebd9b449399fdae710c8c6f1a

SHA512
2dfb1d5b7b9be46326037e5516ed997999c1f756dbedd7f66817f369fedd99802d7bbbb83699da7cd126790f1c9b008c16d3fb17d003e5cfae967c448d76cfca

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
104KB

MD5
a7db814eb9ca5b228c465cea9f465212

SHA1
b577364a48596a08435ad73472088c0590af49e4

SHA256
34861db56c73c1af935597ff7cd8dc73ac875726d4387d528c7ae568d8a0395a

SHA512
4cb471ab88106a7f0601b0fbcf70baee4e1ae590a3a0c6f5e257c026d58c136de49efd077f7171ec3b263397dc12b230a760edcea72a5b98baf669c4fa59d74a

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
102KB

MD5
db31e8ea43c19b2509fc187ab3d7af2f

SHA1
166a091a72789af6710234539c08bdf3fb0d9286

SHA256
eebe37c9fb85c390f7551e8ef67b4f776b46cfb5ddf5944b3d3d51c88116d5f0

SHA512
14aa23c52b42f9a13456febd0e892455ed98943245de772c3d1287bd02459a27fe14f180c24c7b1cf83f4997fc5beee90948d58d1f2ec125f8fb71106367791b

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
107KB

MD5
7088c217fd1d8d654ccf229efd65f799

SHA1
fb691b84ac103923fed0a60b7240f08438a61460

SHA256
da091c978a5e369db7ed7c06de5630031ec12d523547955183537fba95c69af3

SHA512
4953a6c84638a2bb2cb84f2010690e5c54804cd68ed2e922a101d99372f09858fcf195f5be4b8a7845667f26874e8075b939e024d6c30233d3fc7108447f8a45

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
114KB

MD5
5a3d18a04bb70e06b02763bd2b0bb2a0

SHA1
0f09649903260d507c7d48de28be35399170d477

SHA256
0f16ae66f0d28717c7d4759db2a4c34ff6e937c9b5bb64f3d84190b6314bfb32

SHA512
75b54e4a40f8bb70c32816457b63a3e25cf3d3aedaf2790eeb82ab3d1e809c3be8ab26bbfa7c35e1c93aea48b2c6382503d5519cd0d15c726ca89a1a37d4ab6e

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
116KB

MD5
0c2ee60d631c1c77d6cb276f0b90dec8

SHA1
a6fd3ced14345394446f14120f5d00c83f3ea164

SHA256
946964776d2dfad4272b5c777a1f2f8340c14dffbfbb7cdbd939f500e05cb542

SHA512
747a96c00a817a12a157516a666ab95a7808582938dd6396053d1a95381d694757f23025ef9aa484ce70786922395e522a2473b23bd4c538647f3c8d86525446

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
107KB

MD5
2a53205e7dd4ebb9283e0636b2a1241f

SHA1
e16364e2a80a61ed8f99d22ef1bc36e1a2355ba9

SHA256
ed85a16172258927f20d5a7741e37bcf19243bc283b2f51e71bacdf6692bf335

SHA512
b53520752dd38ac8a9f00adb9908882b19bdbdc0a4ccb8f28239a71d3609c2a584ff3d02d4f62ce1fd4906baec66ee20c888b71378b9ca3424be11cdcc2929cf

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
110KB

MD5
3468c011947f8aab09f9e0a98604ce33

SHA1
88be9618771520a3c7d8fdce1c322168d0366eed

SHA256
fe7c069b1e64199b2924a879961f02f1ce411d6df71d41ea44c8dc0d8e03c888

SHA512
f9138bded4b42d89ea11fbb5cce809558b81d02aae2113578036da94e8a2118c110faab19f0a72020af2467a318af0ff2f93ddfc7db9611bcb9a881da19a6b54

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
111KB

MD5
3d619f2bc3cba8051c85ff9f1a12aeeb

SHA1
d3dd24e8774fd44b39a6f833b5a5ec2ae0496a4a

SHA256
0be7c03d24069e557f09c8d2be8d36581ec8723c72cb2538e05b913b8693c279

SHA512
4973b934057f0305e4e132e4395fc92639f92e03f062af0fe277d470c8c008e8e8c61e4a5ced42cb99d1cd88543125f963c6808486a7d01c8683c1fa0de4fb88

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
118KB

MD5
ba7bdb0cc005bb42a9b3becfda2ecd2a

SHA1
9cb685c3a2d755c02df38b4145b10c4abb555a19

SHA256
2b9a1d1310c437b5bb24cf1078510d788a49eab3e7cb2d0bab6e61985460f857

SHA512
0fc6be1d14454caca4be0941051c89350cadc59dc58b9925750dca395afee422d7ae2b1bcd16cb5f68a715f4dd24466639df7510fb7b2f99961ac57bc89447ed

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
107KB

MD5
13dfb9e0f340541ad146f179f89285b3

SHA1
b3a31a2dd1c0a51fceb2083ec5e870fda483bb64

SHA256
55088e32543d68054c974e4942105ac794f89aeedab5d705e21eb20d024e8092

SHA512
9c18b6886eb95b4f118e2f9196345f9892d2c5c45aedd8f5a7193215eae3143228a5c7e48495fb65a0dea0ecacf4f92359d417de01247a2860299338923ce7ff

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
102KB

MD5
17817274b5e2ebee453886e1ffe2a4e9

SHA1
80614cbab90d97154509c1493ca06d89a8400bb1

SHA256
5450175d15d8eb0dabdb46f1bf354e6b2e9fcd809b6f876264df5ae8f6154e98

SHA512
fe61dbad893caa1d9fdf648bc9906e79101be6fafd9ccdee3ac3e12170c4960c2720fdb8fe408b4177d6814d013eccd6a54d6b4eacafb6311417c74467580040

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
110KB

MD5
48630fc1e42ebb5cebea9d1ec43b1a4a

SHA1
ca95d38fbf1a06c3dbc38d396a84f2ea83c99a8b

SHA256
e871e3beb89a7ab565c407ff5055bb0a4b6fea8c00a7587ffff2dc5a03a6a3f0

SHA512
eb211af67c72bc853fcf3dd0821107974700c83f12f3cff4fd05f1da3baab52386be3d9c2ca64595ae2a2e09c81bc5ca449cda588e5112dd1363b69db8957c4f

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
109KB

MD5
b3b40b0264c9f68acf405cba3a3d6dff

SHA1
91f83b8863cc9b971733a784c27c49a16359d3e7

SHA256
6cc9987a7af0b65e6ba1a6f1db51307c1b299196312691c0b627ef3d2121c8c4

SHA512
ca6062eebd86ff3c52364ce8956f461cdd92d112a21ca79e366c3d802ac3ce05e0ae0f51aa59f6104505160f198455a369272646288b4244376847d76887920a

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
110KB

MD5
19bfec922c6b74b795767774d0827e41

SHA1
ba969dbfade2411f466660f4953b35f5240feb11

SHA256
65073bff7a7d6a12693e5b421042c42b6ad0478c90feb24927d149cf87b71ca0

SHA512
8d330ae710d6695cbc9745a44ed16af3ba954a6dac23c256b94c322cad4dba474314277b9f9a12d90f6e9f10b5b5f3f9e709d45bbfb73ab06c896242f3b57ef2

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
111KB

MD5
62902b377f7c976e7085357fe9199805

SHA1
f45d21e8659ad2d0b728484cd41d46108a25e859

SHA256
43fa88ad57d5568d881788621d023b9ab5b64de16c831a070bca9a1f9e0ba19f

SHA512
6a908c0317fcf8f6d804645dea8737ca5982c8b7cd61c96cbf98171aeeea05b2f440118262257830ff2a93d5b9f5ae1db8855277e61b35eb823669bcaa288e7d

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
109KB

MD5
55920f0831490ac76214e888de7456b2

SHA1
5945995fe27ceb0a78ca3a50ee8f8998691f89c7

SHA256
60e5d10710c1b03e9b354ffe28c6ce266242b4344fec59032e7a7c800e236e4b

SHA512
b8b804be4bb79fc1a5809ada3700697189a01f9047e45db5b2421521a8f99d5717d56a524558ae6c2e2d6c7b2ad527a67ce93c613ff2bba0f78066b2e1cf6423

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
108KB

MD5
eaeca8b49a08626ee8c4de9a531312d1

SHA1
5b86d3bff24250b714b94f12065bb91f49311500

SHA256
06165265d8dc2fe610d4fe034c445161ca2f21930f82d43d66a168734479df04

SHA512
b7bf2b0660e03e6c01be224c72c1a65198224b9dee3ff85ec98b84ee7cf666a365573d4c5c89d471ffb892a7b9e1eea65f3ab2a8990f1b12d708b30017df625d

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
110KB

MD5
8b35bc09ba9d430e6269d6002a8e135f

SHA1
1b79a68582fa39fa23464535f31d9a726a70cde6

SHA256
ef68cc2101694c90ba466e54e1bd267470fd165544001886d83d20809f37a5de

SHA512
04996bd78c7fa204ef93fd3819a73fb629f2010945b6a0d73e1c777ac5e011e3c2ed2ecaebead8481ae72fd4a46989bb191e931e9b9f95ee293749755aa48e63

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
111KB

MD5
78422192bf254caaeae06be1b69add83

SHA1
c59ccf2da9c3e459260f6e4801838daa8f367197

SHA256
1a588953cbcb409fb4e24c35302c623e2f497d81912f3c6ed8390845f4ea09d6

SHA512
0c2037bcd6ddd8910dc79e215cdc6973e3460d68a25a4cdbd550d249c3e84bc7fa413bab4abb611d651a988aa5ad4daf4fc11e5cff9a9d7820b910abffcbe74e

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
119KB

MD5
2be21c92ede1c980e35d868c612ef17b

SHA1
6d044b8d8c118d6d86213b63e68666690f29d579

SHA256
65845399afc0a9b45bae08d7e9713a1e14dc02bf7fc82c2c7791c2cf61e1240c

SHA512
4b8176bd476d30ad892b1e6b8f4e139949e57f40a2324d33fb48c271923594f36bbb51592748882059ce5e386b4c8eb0c6f582bd71c035643a27192f48d708aa

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
115KB

MD5
2646048929479af916843a00dacd1209

SHA1
b0c8b01a160f71e8e559911b5b68806e9d32d808

SHA256
3055707ef20a5a6ee7ab31e1667a72b5b5787e9e0ba7f2cc73a822a1ac52dc13

SHA512
f0bf93c2899b0f6fd99d93b213b5094bb58b79415be7fcc6c31712a2681ed1e17571b7b57b94a2673539d5359792fdfaf59f89aa32ad8066db63aa52000c2f61

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
114KB

MD5
f2b5eb7fda337bd8c04267e2c2d07152

SHA1
4c927fc0afac386cd5011ed85f30699f58325475

SHA256
eef3dd8ff4de5fbf5dcb4fecc00724f0faca62cccd303a52158ffee8e77b3c5c

SHA512
9b40314d21d884de5f60eb819695b2f26ca62fac42996fd9a6e289808bf183ee1e0739c7ef7c13dbcd7127e93b4f64440ad6dc83838007be42c83c29a1636d2d

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
119KB

MD5
c253ca24efc80939ab6fab0f71df3ab6

SHA1
f3cd9f61c8eb971bfed5bfcf59b307de53928a41

SHA256
d050737fa0370999154b5c08d8a9d2783d455c4fed85bf9f7ae013a190dd60c7

SHA512
191fdaf6b040bafdc921cc0ebf07aa8d4c387b78307f82c6f27a00262e6200e6dd339a417d636a59470b96d13fd647e32e809fe994f2c25914e8f559091a5366

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
112KB

MD5
cf6f401215f037b825b81358d521cad9

SHA1
73e2521e4495a1a3806602ba23505f3a1b7c447c

SHA256
468e89d5426c1f9fee9389fe13807a1398887fb0ce886f34a130b7892fe2a934

SHA512
0a23d790f8ba3293233c94708377dce6ec96e5ac889fac90cadd02da61572c4824e78378aefc759e9903a8e95fd538df529fe823786fd0adac140bb17f9d1277

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
114KB

MD5
e4571a86cf21268f89be878f490e201d

SHA1
e3e5c8f60cfaa52be6157029a0a66e5bc235f8ff

SHA256
0d3ac51f63701f79497ad0d3aafed26609a9a4583a6903656ead0ed18ba73606

SHA512
0c315fd434ee1a9378991d7a2fa510d2b02bd0f9c277f7eefd5dc644c0a75fccfa2f24e59a4c1abef9edd9a2d772c0f14dedcb94265b886b693a7f0dce8fffc2

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
107KB

MD5
ab7815c9ccefd04713348bbe7986c525

SHA1
d849a7ef6e4b1eb889d893a1f1288ad6f92efa3c

SHA256
dc73e1fa34294fefce5f18b5efae347fc3cc47932315d6d0f5e241f5cd85269c

SHA512
e64687f32d06418cfe0fe6e491543434b06cb1810ed729cadad8a1fa640d5660f934f61c84666b3238c87fe9a327c845c6f105fa06d64e4a4d1ebfc8ad540702

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
109KB

MD5
c8078cee9954f3520ec21ea7b37f1258

SHA1
657c5a7e2cea5ef44bc2d981cbb198d71199d9e5

SHA256
f6cf706e0d2cd9478d72668cbc91cffc674a32f165b36a5554435dcdbf803801

SHA512
d5e5b7e7a53056dbe6a06ad8aab2713f403ffdef8ebffbe3c8e204aa26d54889b7dea382b9e756fa579872ef4e0447d12c39efc976a04be99e105f371ada43e1

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
107KB

MD5
067dc4b9df29346316fe3254cbadcc2e

SHA1
81d664972e28ac72ca76e541600ab14f42f7cdee

SHA256
14f6bfb1bf1832bce281320aa00e8b25b7b3be391c19700a1360a23d9bf418e8

SHA512
b9cfd803991894892ae41216688695e86211a51bf4fc2ea147fda256f4ea947839b47253decd29faf82eaf2f9c444c80c628147dfe8301be36206f9489a1624d

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
110KB

MD5
0a8a7c658745b6ea741b8cd70913d413

SHA1
143666f09b12368c692ccaba9492c5b864cfebd0

SHA256
34a0129b90d1fc9a8664ca1a43fc69c0b6594c84172e5f1715af7d5fc8fa7828

SHA512
e524d0f1148043cadb5c772c7aa11bf16dd0bd4561a3481e3f2ca573c5ff4d02d2aaf84cd14cb8c435c451547a51b956c58ad36ad3acb8eef7f4449441515d8a

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
110KB

MD5
b5c3dc7ecaf1b93fe5632d309ff25a12

SHA1
af4f980bd51065215b5d824e978a04978b0e460c

SHA256
80154496e493c4fd73f1dc7e875ecedea52892d1cc1668e5caf6f2f6e9702b76

SHA512
65d36c0af5c9d18e2edc8700ccf11394787469a3dc273dd54837d68c8068c726c62f9e866ffb5b302a467342d4cec6dd1336d072bc6e4459920cf616de4971f9

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
123KB

MD5
8f83388e8c20f517e0f4f14e16c7d57e

SHA1
1aec9cfc56422d21c87d1b73d3cb3fbf16e723c1

SHA256
cf50af95a747d91f648fcc2016a848149fa15ecc26e8cc84d9e8addebc3857be

SHA512
5233185c2470e5b13af91e74dfef1bfd49dd053339c7db4dcee7ec90f5b21a8739574eddcbc8595804158ec2d36f1fb6be7c06f74c4ac297f18e40942a8e5395

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
112KB

MD5
4c91618e8b67ac97557e4500d5988895

SHA1
3a7c690f981fbbab0939733ba25ed56124bdf70d

SHA256
32a6b28866e86bff59b259f9318ea0713326c387a50067a7730dd5f4c4d90f73

SHA512
762d83cd8e85d71aac3ac03b6e4f5b4c173a007e4136e2097d054b6cf58ae654fca43c78f9fb307277ef3aa42df353fdc8fc0e2bcae705b62c5cdd871f0d09d4

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
107KB

MD5
1ea27eadbe67f5b1415e419f5d11a91e

SHA1
2c38860d035bd405bd3d8054f637ff37af9fde1c

SHA256
ba9ba0c9e84717ae305f120e2890b7c150523e4747b6bc82135a971d40ec1482

SHA512
4dc820571d4088e04d0e1c94985053620788131dfb723080d0e2790a07e13e47f920b8b0c9ba0d87296ef9302b8284cfd043fac568e6c5eb905a48959cb800c7

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
108KB

MD5
524da4664253da6aee36704db55dfff7

SHA1
94d79a4a8f327fb56d9af9ea2845ce9035af8db4

SHA256
1b3c75182d73c7dc3cdfde02d03054736b65ddcd8d5676d5a52c0e5978cfe2e3

SHA512
7cddd8db37022f722192d44b5ecf4302d3d50834c76d5cfed2f933f1beaab14a70692cdb0646a693ddfe2967fa34adc684a403df4a4cbfd46af37522ce9b8573

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
115KB

MD5
da8c429d111e6e4004f04b6d337d4e71

SHA1
2eb36c2bcbe266cda7b2d0257e19a48d5c61dd09

SHA256
eefc01be4f365983bc05ddbe744da84930260aa802b66353c24742d9702e04b1

SHA512
20ffd595de99f1314bed2d1574e176a90e02cc0cf73129ce8eb1658d8bf7e438aeea0ac6a7d8d315e97c7c7e8c76240db9fa546db013b3d573f11d192ad75042

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
116KB

MD5
1932adc28108ed0c5538fba1a093a3c8

SHA1
009ffd1a6890410b6b1ac12d49d3c72f095be63f

SHA256
7d8197c01de03059267bfdaf3b4dc17f82bb0721e1e1e8b2e38e664cc7bda948

SHA512
440f33fbab45aef4d4d8612b602ba13068a24bd819aac907067b3c9e4b7d06274e5a2e5c974229ca4e9af22864883e2c628af70822876c104994178ede2cc3a7

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
106KB

MD5
ab2f452443a4c22836b5733dbe1f2b5e

SHA1
b9cee2fe1f53460e8fde5547c2d0ee886654fe73

SHA256
305dc0e14e182f1884fceefed7140f625b761e88fe36c280e5bc27d432cc598c

SHA512
65a5fc746b3f85be629b148b9648b84b76f88a7013a95e29d00b906d927a15234ebc34803c2526691f839d95c73cc65adfe093c209daf8e3a3453e6e4d5621af

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
105KB

MD5
ab47ed179b734ae1786b21fd3fb91200

SHA1
d515bedac4cde9c7bdda73a00599856ff99bb474

SHA256
eae4a356aadeb2629dad2fce17c5f9005a77f63c87ac275a99c5e5ccd413c7a0

SHA512
a17b1ae611dc5e740d2e124d431001a3b17957deb02bb0e80933648def5227e920b0e2497509d1ae2a142a0d4c782f8f33a85906f4202346b5c7c036ede65d3c

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
106KB

MD5
4529df292fd35d98c2dc1837350efa3d

SHA1
f52533e60ab42300e83c054ab8e11fab45af92ef

SHA256
6a814d5f0dc24bb7054bcee70a2316e25588263d4e9d49675642546dfaf913d9

SHA512
a193f4bfc0e0350ad83dc396907c00678fa6c22e5ffa86c6ddd4999a3617f8898e322029a41e9c757cd1d280a5789fc71a4bdb913b11f3d8255608ae4c3c2991

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
106KB

MD5
400eb5eb34bf031ddf4c81920a34a651

SHA1
649e41b266807f9f631cd3dfc0cf25f71f8f1a86

SHA256
92c36bdad70344d22a8f7714a91636c92e1064637cd21c8c21c7c01bf2a18ba9

SHA512
c2f980ec56656b514a029726c96ab67e81756f9f320d8998542bfd84b2963fc74e7dec37af2db373208484b9e6f725a82cf7506f6fd83c1786f90d6b31f13b02

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
109KB

MD5
6fe267b6d11a816ace98dd786f9f2eb5

SHA1
b828592d892357a447282f131a747716f2746afa

SHA256
f2d932746dc942b85fb734d78eea75677be7fa523fd2db7566665a37e353ec77

SHA512
b0265c3bd024e169cf019785f208421c9654cb5715b8d6b41ea037b0576e996f50e1d2b89b88df113ca8221a17155ddc49da03eae57f73acf9f41150f8c42ae2

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
117KB

MD5
0068f192362cc711b43c59df4c0a5f07

SHA1
c7ceaa3989705f852ed090b18e3ad0e9dfa3e373

SHA256
96bc84ebb3150b328853698db8b3d99f7e69aec57715f6a8ae01bc00c4c3eb35

SHA512
777c11024c4f413125cc85ac80ca7efca1db5f69392b61788332c5ce22e860cd4eeb6141c20dbfe9b883b47b5801a25245887ce5d1d1ec090babf704710d1341

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
115KB

MD5
251d697178c1b5f0af46e013df2d560a

SHA1
b2b372fa01d0e34a90770298c45dafa9c878a93b

SHA256
8bb08d1787527964e494fa216e2733f092af9198023e20250322467a93644a70

SHA512
4dfa8a0e0425663a5b027373a6470e37ef23086f236343190f16a47832b527f4a03594b850aafb60d0be12126f294f2c65989bcb4c287c9e0979f2d8175640e6

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
115KB

MD5
41a75611eeb513c3708d2eebd95ed88d

SHA1
9a2fbb771a7b60014ac927b1826b7284a9abdfc4

SHA256
4104c8060c46b685657535fd7ae9a1e37d6d06b677f678475c1b49e851d7c2dc

SHA512
fd62ac737c2e0359c5386601f09584215b288edc893705ea38e22021cd072a459a1238d5b0678e9d45cdad17cbcdafe62ceec3a6e635329eb25c98d0c8e0c934

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
111KB

MD5
818186ec22081dd21190a4092619e587

SHA1
f569274619f5b3a2dedaaf20fb14fdf857eb3370

SHA256
9c3b00504ae4448aa9250451d5c2fd635e7c33789f06f8695bc6dc7ed093db9a

SHA512
ac2e3fbdc020da5fd63c6cc50f3bb1658d53ecf4a16fb31d8783151cbc86a1b005efe83b21a6f781246a0683913fbcdbf06d90b62c8cc804cf9cdf3bc42b26b5

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
105KB

MD5
85c6cac94c943eca9b47e125ac463bc8

SHA1
4894dc272e8f11cd0fe631f36f238cb93d237dd2

SHA256
12d7c4cd67e41c44cdc1f1a5bf2d1166290f21fca32851ce970e6704109695ff

SHA512
de592d3d7f756a8bf05b51a98c47bb5d99de1b5430e0b106991d91988b9840bac08e2b7c1b96765cda43ba269ac8ee5da34572fb55574da826d1e5100b3c25f6

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
102KB

MD5
88b84680f6f7aa9413ffccfc24089b3a

SHA1
6bc5f8e9e0c8d2f307c4db3ccd0932855c87ce50

SHA256
01a1492ec6ef476999f4a625b2837a7c4e89d98d2da31230ae7728d60a074005

SHA512
3711c11b4e3fb1e3b0ca192d9b453c0d4a025b39e0eb167b2e2bc57f86802bf23cff61bb0dffb3c149d294fe210398ac4418d72c7d38a9b14a54b895789a201c

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

Filesize
108KB

MD5
428e7dfadc36fc4078b22531cbf3a632

SHA1
1f8f1804574e95be23a183660e95f8beb5a7500d

SHA256
63f04104d1f168285859f4671a49db38d5d4bbed63ae794e99a1549bc7cbbaad

SHA512
b65e6666c160b3d64ddaf6a30a0442954f95b51604e627e3131fb1c3e5ae6b6a8ef8fbe92c0e0b020e6ab63a780bd29e3b7c1bb4415a3f408218fdfd846a3382

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-utility-l1-1-0.dll.tmp

Filesize
117KB

MD5
d2e723a78f592c81a880ada51e1f2c7c

SHA1
c28dbdbf0084fe88b90f138dcf0cb81046865718

SHA256
3d69ba5bc1038799990656ef2bf6ad1d6c99c5d880ef5df772c27cbfe8f3b527

SHA512
a5e702df9ab40dcc67013ac2cf857682ffa04e99f670d3d53c219ab0aaa5733139f42466307e2367542af75c541d97dad3c8e5aba075b658d7a4b09789f77c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Google Chrome.lnk.exe

Filesize
102KB

MD5
3b0e54600f61e2c55de7f8f5cb1483d2

SHA1
12d81443b6c7f9308676e2d15b3919babd494006

SHA256
4a200da35f244e53b5533c96a29aa8ca548dd9c45b9c15a51374d523f68e73ca

SHA512
6d290aea9fc6aae2eed99ac9f8a549d5ff4a1e36ae9ab8b9662126a30f85ec708605c89f147243715bc7c4fe545c6a91d25d6bb1be4e38b419efb83aec64b4d8

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
96KB

MD5
57590d1cc527b355fd66a60e93f6b1ab

SHA1
f9ff10b051edcfd85a4ab0e77530b0f38fecd6c6

SHA256
9a73d3afb397ed0a5a87ac9a4944c6224bcfbcad738cd197b91369375e9b6666

SHA512
b2ed2e697cd1fd91ee4c8c39544ff1092348c5a8144c6750fe78681f1f363d9e8ae0e7dd93b4ed79fa336fbca1a73b3346fa479acef5dab8b0ffd00e442e97d9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads