7c8261ccb976c2d741f24e1891ed3f767fc91a54d72a4fa261946ef056a747e3

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00be27cb2cbcf925306971cdba59bc30_NEIKI.exe
Size

149KB
MD5

00be27cb2cbcf925306971cdba59bc30
SHA1

5ebcf99b330b701f2961187b3fefe6b835b38ac4
SHA256

7c8261ccb976c2d741f24e1891ed3f767fc91a54d72a4fa261946ef056a747e3
SHA512

2f3edb0da6f3533f9911fb9ed1a88270359de18b11824e6fcf34dc592b292ab536d883319d7d357e05cbfebd6bc5596c5d2a511665fa3c62effb9749c80e7178
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZEe7WpMaxeb0CYJ97lEYNR73e+eKZ2:RqKvb0CYJ973e+eKZPqKvb0CYJ973e+U

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5123) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3220	Zombie.exe
2824	_checksum.license.txt.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	00be27cb2cbcf925306971cdba59bc30_NEIKI.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	00be27cb2cbcf925306971cdba59bc30_NEIKI.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.LEX.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.resources.dll.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties.tmp	_checksum.license.txt.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.ReportDesign.Forms.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb.tmp	_checksum.license.txt.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\hi.pak.tmp	_checksum.license.txt.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp	_checksum.license.txt.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHEV.DLL.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms.tmp	_checksum.license.txt.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PowerPointInterProviderRanker.bin.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp	_checksum.license.txt.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.tree.dat.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\DRUMROLL.WAV.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp	_checksum.license.txt.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp	_checksum.license.txt.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp	_checksum.license.txt.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	_checksum.license.txt.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClient.resources.dll.tmp	_checksum.license.txt.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 3220	4584	00be27cb2cbcf925306971cdba59bc30_NEIKI.exe	83
PID 4584 wrote to memory of 3220	4584	00be27cb2cbcf925306971cdba59bc30_NEIKI.exe	83
PID 4584 wrote to memory of 3220	4584	00be27cb2cbcf925306971cdba59bc30_NEIKI.exe	83
PID 4584 wrote to memory of 2824	4584	00be27cb2cbcf925306971cdba59bc30_NEIKI.exe	84
PID 4584 wrote to memory of 2824	4584	00be27cb2cbcf925306971cdba59bc30_NEIKI.exe	84
PID 4584 wrote to memory of 2824	4584	00be27cb2cbcf925306971cdba59bc30_NEIKI.exe	84

C:\Users\Admin\AppData\Local\Temp\00be27cb2cbcf925306971cdba59bc30_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\00be27cb2cbcf925306971cdba59bc30_NEIKI.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3220
- C:\Users\Admin\AppData\Local\Temp\_checksum.license.txt.exe
  "_checksum.license.txt.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.exe.tmp

Filesize
149KB

MD5
ac0d63bcaf7b96d82ab152c098528d13

SHA1
5cb08e5bd87aaec81e55dd5494847d0b32afea23

SHA256
b40a686ff63fb2d817a0ec609cb7ff664d4455e367996664db91a026c27ed626

SHA512
eebf263e93010fe4e3f9eb0be736ed49c6d688a09845fd6413e23a4c259f9a2b3e219d77cf8dbbe6b83f29e4408d75c3add81239fb7b89586c07dd6d675a5ac9

Download Submit
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
74KB

MD5
a3dbcb64b54153492ae914b40c220cbc

SHA1
1352f24ed11aa9f71b4f97d7ab2261559c3778e2

SHA256
78d8f41d21be0c2f8bfab5313341bd4b2605f4b35bfa9692eb015bb9c79ee276

SHA512
a27b88eccfb290d36d7e774f5b6ffd266deac92f7c20340082d95726aaee26c6d82f3cebf89ff968b177f4624146ad33347d0ff2fd5e1dc0e53a7cf9fe00f133

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
187KB

MD5
80e7a016e7303d42a6f67b4c280ab2c9

SHA1
43f319debe01375c4a2d91ab87a8ae1cde490dbe

SHA256
b5764bb37e07e1f596af494f611dd60eaeb0d8c06347f4e7e2777474e41edf12

SHA512
3d8d33ea2ccaad763919acfadb81ffbb5930d47c587e0b270439c437c8fc60a278e8daf4306f08d2c0732ca09f8157222b53e9bc43fb8328d40c9aae542d400c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
173KB

MD5
8da682f5c3042f235cf0ea1d2bf00b3c

SHA1
5fd51e8de972d2f233c4879453cfce2c3ad56c71

SHA256
558a1b0543a3c62b5312bd692bc7dd31ef84370829772c06464373dd2647f125

SHA512
dce2a933aafe2b80b7213bd4987b38b91d60996949a5aac6c7830240b8979ec0d8460f739ab2e7f07d8a792dfb5a9cfad5c017aad2f8d4ce848e720b2f19c97b

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.exe

Filesize
139KB

MD5
07111c1481075e26a3f7535e069d40d9

SHA1
819209d058ab83fbc250dcdf42015fc33bb78217

SHA256
c19bfdcc823b7b982c65e4e3940726c978984609311fee99b6408e24eb70a2b9

SHA512
82a2f29bcd40e973197e9d4f7a28698e781422e462efcc7c3af98311e002b9f9da54becd23991860d229ccf5331973427c571b4342e3aafa9c2e5e9b5e3dd419

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
618KB

MD5
52660f7c78d83a0f27d4f32723fa55c5

SHA1
3ecf2593d736e3ca046c44f5450afd09bd9017ef

SHA256
6f6fb2bd947135ec9f1a54019cb371b7cf30ad5584e2d34347d13e1f154b5b4a

SHA512
94d91519b259feea2866c93bb515355f59ecf985964da90f7116fc1aa779d6ff6f0fcdc97f3c9077b44124a0386362c14807ebec0338b487cef234dc80110b9c

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
263KB

MD5
e418cdd4fce72ee6184886e7d9f9e59b

SHA1
5356abdc0ea5932b9f7631290c5a4fcefd7fb2c4

SHA256
09560b4e2d07fe5a21c8f7a1bc0a54b58e81334225937d96d888dda44bf1cd00

SHA512
827aa6c16c416eb26d07e2d91b478f7fec438cb8a0ef6583bf91dce45d73bcdccda6dbc06fdf4699ae3f18e231facd7e8fd1858ef1270f759bb04726fdb9e0ec

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1005KB

MD5
58d2b2ca2e84fc728974f161c39550cc

SHA1
8190b5a3e4e9aeb2a21da31c47699ec764973190

SHA256
2db514fc5987a09cc205651e402dd7846ddf9ee262d8a5b1afc357224729e23b

SHA512
1bdeca3716c7d01d9be8f54240aaa4393c2bd1b5fb72159d597752f6e4e3424a58b098f03c72c1c46c4241e7bd9b3f5cf93cfbe4bdb089daabb50f948adbedd6

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
758KB

MD5
d58185ad9c02f3feb14330c6c7b3fd58

SHA1
27407d0a13f7cd496c95f048c0be4ca1b38d3f78

SHA256
cf0ae43f262fd5a2c765403b19af0c3d76ac0da11ff33144a12caf4bc2aab630

SHA512
bef7101c4713c373fb7ac13847c09baf5b356a973519b6107327631b9fb107e47bc10964aeb410af2977c6ced3c5e55d9588d0342838d132c2ffa0e786227009

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
84KB

MD5
810f44a79eee16d8e2963d6bb7d8cb87

SHA1
f12cb500012ee9cc2a056e844273c6dc039fed7c

SHA256
e6d8e15383153a08898bed253420a4b3f26a4c173594a965b10c399bb4e34579

SHA512
c3343f8187614a69208ad1a5f90e57c24a2081699902f1bf11312929980c7027073be8ea06b45cb07dca2daaef8cadffc1475ed0d6c7ba5f22c064b24523999b

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
82KB

MD5
ea46ca965c15d7180bdafdf98690ac27

SHA1
c239b524408d9c45192a2e7512316bf1919748f6

SHA256
5290ade976d7a329a033ee738ce81cb65ffe5b9a7d40e861396d8931be772f5e

SHA512
b966bcfb34896562915aa6b96906aa04c51f8b215808c36d39ce006eb283ce79b9f9ef2a07181caf3f349e1a568da17b9b7da03ba11707e8f0503a509e2fee9f

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
84KB

MD5
5aba38a8c42a8267caa76c9f189d924d

SHA1
345d9350153bbfa5baa9b61eb081ec2c4c7fe977

SHA256
51af5245c2a470a742ee44207cbd1ee54c54d16596bbacd2727e7c8af3a52074

SHA512
5ce40c50e1928d026eb03313935da78da30d322ee01a2c35a5f7acbe0c3683f3b734b3d9994fa81334d37190bf6499fab9e36def6addbc9c21dc039b2f3ba70a

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
85KB

MD5
76dd0070ea26b41771b9498fc3ad66a2

SHA1
428c5d66019d1c4eaf832b0b8bceb7aa82fb0ae4

SHA256
3376c0e351e532e44f2d6c1f0fa3aade1a19b5516791b5815c458eff05956bde

SHA512
8b342cce8339bf8a4cae74139abeceea7ae2503dee78e7751d11d13bd5af0271ec05a4166d69aa162b208e6be00dda41a0bb0c93da13ec256a19099e1b01999d

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
89KB

MD5
ee555f12f552747daaf3befe033dd74c

SHA1
d9bd402cb364fff369202b6105e369991bcadb52

SHA256
a3a3db6b50ab5c69985eb302c11a041b5d56a4cb68309f61f671bff896e6f5db

SHA512
db26cd8500a5ab721e0612ee772f5ba02b7cd08cbe35f60bfb62715030a50f7339c78693b5e7eaecdf1cbb8669638bfed64251c3f34a26d2fb69c96c16143925

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
83KB

MD5
0546f7d2dd96ebc0c2197c720789e8ec

SHA1
675a2df6f6207894505781dc2524112836043394

SHA256
0b336dc94a9538abaff7360ad409979b5fa2239fc458e0dd0b4cee463dd33080

SHA512
72728741615cbda37632389d48cb351838487fc19e977b61fd0d39e0e0b0a37158bd9681c5b8f1f50b186d299bc81a7cddd4ccba081fe967b3290604075a8dda

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
85KB

MD5
6fb9c7027f7c3cda28fb410ecc2617d3

SHA1
7ad153142ab70e0d7a4c1a3e8b98da2b969a4fd7

SHA256
223c12dafc7679dc0ed5a3912c4cf0edeaa629e04af617884628627273a06d20

SHA512
5a6c10e11d8ac4151b284e883b2c7b8b559c027d2f699bf3040ad61960aa82e5911f07ea75ac2b32dda1716d0530915cbd38f264ab821dddf02658281687feca

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
83KB

MD5
65e56235b0d8607f59e85fbfbd7533be

SHA1
b3e2c3d0e57c0a8d8d2c49efd424c93a8c1059f2

SHA256
3bd08bd0ad40e4afd2b9a38f7bb3a68e25badb877e99bcc7f691d7fb9a8a8dda

SHA512
e20ba82ed2df6c06455f5942d049d748eb171376199023da8a94eb394cc30a413cd6aecfd85ae86eb6796315e19680cda56643f40c83dcc605da744281dfe2ef

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
82KB

MD5
67d0456f6d67e083d749b1645aaf311b

SHA1
adf88e8ef00ee420dba0293330937529a43f8ab1

SHA256
2ec1650dcf477c785e670686869080fb37d217abda82b8debc44255516444554

SHA512
f7904e090c02fcb7f9e529d0aba11640c4d54ff4076b397f2234fdc98ab6833914ed060762a36b097453d32c6174cd5e2e01d60947ce09bfeba55f3c4194b7cc

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
79KB

MD5
1c87dffdc7c2bcd7d4d4bb0660015846

SHA1
e976248e19b430d3b7325431f3cea53a643a9410

SHA256
dd3cdc2fe2cd53dc98eeab9dba864856f7ad5fb46cc281d7d63ce67d9ce80e56

SHA512
f4ea851c88fd046be3d5e6aa7950b5601753048e348b949e166f1c0d568b32b74e2bb7b709bbe82666f457c84d5e5adf846ea789feb85fa0608dc42368fe76de

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
84KB

MD5
80e8b1f3922c85ed31ea44b2c210ec5e

SHA1
30017dddcce5ce248493d6273d340986fef3d571

SHA256
6033efabb6b83325483fea9ee9a8eca1f7586ed01cc0d8c6e160263b303b0de6

SHA512
8775eb8a2bd7f055abb705f5e3cccad328eb1853ffc450d26e6a2dde4997cffcbec56966aa905216bd2fd8f7228869a4fff8bddda191efc42dde9d97244bfeee

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
81KB

MD5
358f3d95d7ae72175769e7ade69c0fd3

SHA1
f2f49165faf16f3c31766dc9a94ef8673b08fe12

SHA256
0c02c24325acec8cb5e314261154f07f35b761b045ad5510f2a5f88f1a7ae3db

SHA512
457c4d1a2035989e4de23690ba84df257a5853d525f351ccf479cad55e4ad494ae12b9e7b4424b5b354bf36df7cbb7d8b5be2a3f22adb32fc8fdf0ce9b147f3c

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
83KB

MD5
6bfb1af09ed5003e6669ed77a5d0541c

SHA1
d29a1e8386ae8878341e279ed13fa835dbee0038

SHA256
36618cd94b7012b318db97e9964dd5a148d489f7a2dc65d5505339f55857e056

SHA512
6e839576fe38615a56438c0573e563be83d1d73d7bab35a1e598ddd443f8207a6ef4bca852d25923b1f811e1fb5ee8029bbeb8534b2089b885ec256c77c3266e

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
83KB

MD5
042f555ff506c3db5fcc6f8101a1a8c9

SHA1
2115b99a14946a3152e28535101e5c907c733314

SHA256
de3c649f3c585ee67152a39cb208ae18c75587e3c6a430baa0d6988d5d31ef1d

SHA512
ab404b6c45966ac2ceb1ae0b5505f9afda4a5f978aae21a108891ed49db71618ca8c206b1110de6144aa7b92ad32ad6724a83c3047ad49665fada703ca915ebf

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
82KB

MD5
243655261fd7e90e4a91ea3d4c88384f

SHA1
b3a6d4fd67755506e174e367a2ae43723af0a916

SHA256
ec99f846298c38621c58f41882339d3234244cb409c4f8ee132a5a04df5d015e

SHA512
75bed9f7c0cdda956b03eccc0f90ec6d6445b0ec44ff6c886eaac84f2785c9a6a2314bf0163c513a6bd3aa92b00891361a0a6ba102e5783f7cf6c1130eeebf22

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
81KB

MD5
9374d1e731695705771c6703ced1a15e

SHA1
03dff72b33dedc06959b7a408bd85c830ac6c9c9

SHA256
96b3073e837fbad3f8b8155c697caf7b8952b16cee59a8c94b6856abc530a881

SHA512
62fdee07150ed8fd038d55642599891b0dc8f0f976327e5ec35cbdc41d22dc54c1548e1fc89891993c604452f5e6c27960addec515c139984e074bc31907e14b

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
92KB

MD5
bff1a8067f7d38d64baece26310f97b8

SHA1
bca39f22dcbebc40e61884d873087988844a2e60

SHA256
e431a11a8a56fde8a53ba013812bb247af4a4ddfe193ef8bbc359ad9bf97b425

SHA512
24def16917b444d46c63bc410826b50f33ae41d9255d3a2b17a5b55c0171bef49cb98a37f2eb0200bb556cce188bb4bbcd89b8860df78ba09baf4f563fb1fc64

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
85KB

MD5
645e7930976994fdb074b15870f9b015

SHA1
b50851dd2c3524cb8f0bf6e1be0c16c3f79cf4ad

SHA256
6995801d84a888a5d65f06601e15e858842aac89d62e7c9b702596eb62a05499

SHA512
46b4f320bde6ec10763be54f5a8068ff16131085c81b60b13455fbf479cea6884c93e83c926caa640d9caebd6f4659bfe1d28ec29235c59c8d5c1079d93ddc41

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
92KB

MD5
de66e092bc38b8a8b43e8dadf490aba5

SHA1
60c13e19adb549053b52676e2d9c06f055db79dd

SHA256
7bbc2faff399ac780eff9eaeac6fc3faf148d3c335d0cd21a2801f89410c88f5

SHA512
68bbb2b3b5d9986dbdf32d60ec2bc4a3a8767f5be7c5354444b8c9e35904598344d87abf973bf8cd7210ee607fc82ea1d8a7ea06501d80facc887e3c9be5311f

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
83KB

MD5
ffc696db56a0297eb8facfffeeb1f4c5

SHA1
c590b8457d7928ed3a889333c5268ae23d0137a1

SHA256
981d861a79f0b3ead01514ffe718d4f39684b65f8195b8bc08b71cf77a4e197d

SHA512
305452cbe2a1cd1e8be341979d9b71c08880f98e5a6d50245a98a427b0a1bd3acad68c086a219c526af2456c1bcf16a10d548536453714c6390f406399bbc6a4

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
84KB

MD5
f29487d1240faa9a2419bd533b6d57b2

SHA1
e84878b2bbc19bde2500ded64cbef0d7f8dda441

SHA256
aa1257c5161dbb8c42258799c884708e2b80738c1a36734de08f8a76e9733606

SHA512
a279c9a993da5a97d0002d24a8ba96872183cc68deef118dc6699c70edcee1fde3cbf7c0651d0d7c53eedcdcbb74ba6504cc330b26452c212b382b9b29d9e0d7

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
83KB

MD5
4ee0e2474d139d9a9874a9e86511ae62

SHA1
bddd4a126bb9fa3a431674a114ea1a6c985ebac1

SHA256
8b4af036bc97f4fdd50db8e0ba28139becf838fe667f4830ffd362bbd23065f0

SHA512
f1b8a15029755db54381731c553c9efd58d06ddca7ad2bef6541fdfe203213d37935b721d9ec33dcc8603ce5f43a607108cbf9712564495def188c0a90a2a065

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
74KB

MD5
85f773bc0cd51c05a6ad482ba0d49300

SHA1
da081bd62a1e690fc5db60699e3ac33486069a94

SHA256
d2d22dfd88136143e930efd639f993231c38b5a432e307f2c80f2edb3e6d1163

SHA512
44c17b56e1d0134061dad60090b1f5a54a046db74890e772f6c93933f1970f1fc4f3d89951bfa197c4a406e4e88f25de46d824116370e7d190750e8d03b5e47d

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
92KB

MD5
dddff198ccd11ef68fd425a1c55c0c62

SHA1
6263443d8e262f8116f375a2db06a12ddc90ea25

SHA256
c25b595b14e52a2e2ebacb78100e11c8a82ab6420f0e502f1e8636fcbfb1ee7c

SHA512
f1a340e0be6c35eb013c79a6f3d00bb6e17a2d867540b9874245bdd405b32d404aa8a0797797e3661e2957c2ba316df7c766d42b7a131e715a8c65bda3e12a1e

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
82KB

MD5
67b139818e85ae8312603ddd192ff0fa

SHA1
89ecfdfaa68f67ae849589ab34bfbc30a46e0127

SHA256
fef820bdb9b979727e88c674f2c455adc1a6eea3d3fe4cc67ec1c4e7c8e2b75a

SHA512
8cda0726a3d017ca7fa58cb52a0af7be0e2cce225c623af0436c0c6ed4a4e05abb1768a03f80539507ae50622f3314140b0a41a347b9b6e9ae2f05e98fcc51f3

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
83KB

MD5
b82f0d5dcf3ed1baccc5d07df01a0b91

SHA1
4da8129d2935035a22f326403bd7c8f8bd54ca5a

SHA256
cafcd2a1de570cc2437cce472cb7a37143eb3b0a1782346de10f8b971839ecf9

SHA512
71701ecf2116fbc27eee0baeaf1cb03bc0abd86df9809cf156d3275a96616b5e1d81a7dbe5278109721d8c9de586db8309f538d3e733989e8db1743c0b04b56c

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
84KB

MD5
862fe2c3022e00d9169d733975a408f2

SHA1
22b8fb9967425842076dd31a407f19293985fd06

SHA256
dfe1dfd11227e7f25f7453cbc581eb3a64abc5a0e93fca741936d7f5eaa47958

SHA512
528be89539b36688e7a19cd2e30c728e64d115701568c9cefa861a85c29598bb0a88d5a14a7ba6de9296e1275d9bf2f45d66d9bf710b90f226afd329089f6dcd

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
86KB

MD5
5cb0904ea140c58b5ddc5e9ebfb8be32

SHA1
e703dc5a69ef04789be2d88b2979dd703ee59d8c

SHA256
8a262f12b69cba210d4e8ae881f8e1850330865c2ababe9e632e306d622a8aa7

SHA512
bfa5c2869b4436bb6f0310a850bf4434a61213d61109d7cd241328702916015d072ef4951cd6db48f338d51d7a5ea8e0fcfa8ca266435063707f8d90fbe5fd0d

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
80KB

MD5
54dbd5ae338ebd2f75e5ea49ac668603

SHA1
7ac4f7e7353b17cec8a4e86f95d31de4ab5b1e28

SHA256
94346113d77600985014426daa2f65acbfcb61c6c02422c5e4df848ec000890e

SHA512
9972ec5377ffcaed21d1001e5354f64c8b91caca3349245e05f69bbc425dcaf1e1273f194a15118cab705d09fcfd13531f6bb8e48eccd23812ee18f01fbbb8e9

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
86KB

MD5
6f4dfdc1df428fc4c14e859876555cb2

SHA1
880f489a3337c6d679afc6b483d2b90d86c6a81b

SHA256
e21266ce77203876d15a090216b73439949781e621c3b148dc0580ef724e71bc

SHA512
57b3ea25c620322ad80d96be30029d63a4a63fe06e7745fd76fd7b876f297e19c43008f2250eecc2d76cc97874915ebb1f3a40ace348b14208a35b8d68b46d86

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
82KB

MD5
e38cdbeb76badef19da351a07037da43

SHA1
0f7f587e809a5ae491bed9ae977aa042531c7d22

SHA256
c0048288323bea686bba5bd8d14391a701c56cf0c94007efcca6fccca53121f4

SHA512
b8f0319cd0837d0652a3eac617215afbf14e13ad42e6e31b15de8d3da0c7fa59340997687bb4999b53079657d351ba60344528b9092c585d2c7391b112b7381f

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
83KB

MD5
38e3b61a4aed664ccd02bbee7420fa9e

SHA1
f97ec84abd0d37dcce5aa6bb7e8c56fd29ec8c64

SHA256
c57612b2d6f3ea815e08e08b9948d4f2603984f463da1ae1d1586e9b179588a9

SHA512
7dd4555cd183762b9a6c1ed2ad7d0d67cceb952fe5442076c811b59df815120d6588ee892fd331976414db109db2d302632a6a1fcea212c3d29abb38287e05ca

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
79KB

MD5
45a421a08e768cdd3f199507b14c7c42

SHA1
70ac6742147a60b1efbc52a24e53b27381f6655d

SHA256
0ece2007b9f15efc30cfe9d7fc6df8daa5c73b49593859ed731ae62dff9f6ffa

SHA512
266fc0fd8538a74a8f13737f8f0814a05c0677fb38ae7c3d20a2f0264ba592143ab7028ac95ff6f742be8b8f0a2478365bae72b7b512b0421180569c57cc9c4a

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
94KB

MD5
48ada51b2a3b9cc52160255eaa2a21c3

SHA1
62151c0538165d7868b4d87b2554c06b42dc4f06

SHA256
6befe941dc012d34e060e8985b84225eae3a244baf37d5921ad1d4c5c48041f3

SHA512
1bccfefed07957f3b20ea9eea72b2c39ecfb7c997815025ab8b1bf1fe5be8b18b04b27646a7855b1bb53e31305cc5408871b1918e897020a00c0171b7cae2802

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
95KB

MD5
2cb0cdaff0092219fb02879797c7909d

SHA1
74962d5888d250a967af2c8b7aa8e996e79c2c6c

SHA256
4634f72724ba99ede369c628099647d85dc2137b400d318a9903906e28699622

SHA512
8af1f21a92aec9689b4cff7f6e0f9e290d8eea780fc56f1c92eb016a6eecaf49c1bbff8341c7663b689263de82165e6bda094838f0046a20a123540f0844b1ea

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
85KB

MD5
775859ba6f99ac660128baa4d42795bd

SHA1
592b9b1afe240c956212ebe2b18d9b45ac242efb

SHA256
52746df950dec5f0d6f60782bce569d8eca1d82615edec448c0ef966ca00a210

SHA512
349509368e2ae56acb0de7717fbcc33b12a4ce662bfe5a6b35f28854a21035149591b1cee323053e055e94b3e15629e9f5508a0af431a2cb7f02b89aceeb7438

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
80KB

MD5
6c41285a7bb5cc86b9ea1829e9dde920

SHA1
708c3753549c7144f8fa7cd3e67c9e8d2bb60922

SHA256
d2345c0869bd6bce0cfbdb64181b9e350bd0fcaf04d3374fc745eadee4d779c8

SHA512
da8277228994680ad7a8950545cbcfc7b524b3470c644dda980c5e81802aa7ebad8b0d5c804f3a7d684972c8adba04b1f7ec01e63f88f0d73b90c622fae69a9e

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
87KB

MD5
6c943179d0859714d7c2bd1e2b06b6d6

SHA1
6d71c8942a3ca433c8fc1f23940850682c34215b

SHA256
098816a7dce1f86a1d41109d31fac4b992a4bece90a79259d617d257776eea36

SHA512
8b0f977d7c6a81cf9585fb0828a2570dd9442df037e0851b3d136686a684e0fa1b9bff0fe3048192247ac2b57ee08a8237d993edaa8b92d4ead613dfdc639b6c

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
84KB

MD5
d553fd89d81b1130a98aaefc4157d359

SHA1
cf641ff3f88a0879786f970b69be75b574076b08

SHA256
4b3f45b2c2a8f0c98304d749e8d714b83739e031e1aa3f30216c523559b560f2

SHA512
f0778ed851da9010b89c6f56b911a66c634b55c05b28dd66b8696d1bc31d49449a4136dd08f2b9878ebe183f2dac70a73f6ed5240e6235f9ba71344820d7bbd0

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
80KB

MD5
b824e7c7f287bb2d3541a2ba6cf79919

SHA1
45791b10dbccd5f573f9ff3838241dbac19530c4

SHA256
804430d134b010bb310e9f534b317b784d6985586167aee65bcb68b082d4d6ea

SHA512
bfc2991b5e40852ca724c4b5544db68892c90ba1acdbf68676e8b5671c1b75e1bb1eef9b2af005f3e2a4acfb3e4325f66169da56839ccb330d27e95fbebc7dbf

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
88KB

MD5
f95aafaa190d58c238e5c4ff351e32de

SHA1
e152200cf6e3598714c2049092963e14d1775732

SHA256
bb19e70fa0b554f89fe4e7ad7ad6b156e4fb4bbc505df9a56b08ceb3b4210223

SHA512
80ce55faf8ded975155d21c5ce7f885d15cb34f8b8119be71149ad946f347f54ec79f1aa8107050ec24b872425bba688b45e62dea4c98950a678c2fabdc6706b

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
74KB

MD5
d5a1734da6bac9892b062b62cd70bc4a

SHA1
e2c2a20d49bda2b4102c5fcb18d88765f9aac682

SHA256
638570d6497d283b8bab3d4191edc42a255adc7022d113bb1a947862c54cbff0

SHA512
50e5b47de7eee464040216eb751d5f8ba0fc2ca2d079f09b59c6e660a1c80cfcbfc3dcf56dddc0c723bf0735069cf1e059b7911953981aef6b616e4adbbaf566

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
84KB

MD5
2874e03efdf24b945656fbe696643bd5

SHA1
b0bb87a37c9e1b0a811ff75c07a440ec276bf17a

SHA256
78e7f39c1be7cd0af5514ca8d524188584c76b06b96a03d2a2d11edf7d84bcb7

SHA512
caa59924258d870a05e2ca8dde3e8621bd23c4ab89b8ed21f08894df03300f6603acc3ae4240c0a02373379d8f7788e7de5a1e25a19148ceb3509f9b6a36f34c

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
82KB

MD5
577122b68564d913ff6a1eed698b53ef

SHA1
99991e5694a3c10898144ed8b1a53ac24625d740

SHA256
ce9f175c81caabafd9d365fe8b0858285c4eebc7114f42b4d378ce4af0b073c8

SHA512
b46df64020bf921a97bdda180328cae5a970078ad37efd4bc4b809b423ebadc4c800cd6c8d82abf0d62f32206141b7e7260b669620098f891152eea980a7e6e6

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp

Filesize
84KB

MD5
57030d8b3607e40e23f318360686602c

SHA1
07458196ad326ff2927d2c2a8fcb3363b6d25eaf

SHA256
00f2c29ab664b5da914683cdf146ab664d2e68ecbe03e2c4905fb3e2eaf49a59

SHA512
d9d1bd70a1edfd67acdc81a88719ea971e62993aaee37e48df198be6ed9ac1f26bec92cdc29f72b5c60a1aaedf21eb90e394088800edacd426f9a2a3e9afad30

Download Submit
C:\Users\Admin\AppData\Local\Temp\_checksum.license.txt.exe

Filesize
74KB

MD5
b2e7a936306957a086ba6a70c66f810e

SHA1
3c7f23d9f2f7ac3ba26b7019665b781229d40a3e

SHA256
b333865a17b4a30ab18eccc9101226a7c3281fd5e95a298575d145f047d5b9d3

SHA512
022dee064e71ba38d61c62bc3445a1571f68d3abce88e444802a624f6eaebf5e97b8cddfafc62878e3a19fd11203a2567a3aba929d625a776cc6f43a7160f18e

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
74KB

MD5
7f82eb688642c8ddad0770ed2028a6c4

SHA1
350d2771e667d3a618b4da99715283427da95227

SHA256
82b234290886e635bfda2c5bd1170ef9bd4be9de5ea43cdb7cb443f1f0e300c1

SHA512
13a998edb40a15009e1e480a062ea6ebf2e2c6532dab4b86f3d75890f4f1765d2b563a3e07ae5c9bd6aaca652b2f6cf192ed40a3d6b8799a4b9736a5dab9dffa

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads