41bf5aeac945356e7271c4580158f24c6b2760d2f389232cf7901cca56407bb6

Analysis

max time kernel
152s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b38c3107faaa7ad759d4f588df1aad0_NeikiAnalytics.exe
Size

152KB
MD5

7b38c3107faaa7ad759d4f588df1aad0
SHA1

e3ab549e3863b18e4d9b6cc4884cbe5aa221e889
SHA256

41bf5aeac945356e7271c4580158f24c6b2760d2f389232cf7901cca56407bb6
SHA512

790d6ad7f8348daec6cf6c8abc39a885374c5f8e0616bf2e8a202bb557671c4adee9d88a3fddb7029a0cc6b194a7dafb4eeac538dce257332e5d56c457eee5a4
SSDEEP

3072:6e7WpnhkElEa0NQn0NQfe7WpnhkElEa0NQn0NQG:RqthKqthC

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (477) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2064	Zombie.exe
4656	_.files.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	7b38c3107faaa7ad759d4f588df1aad0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	7b38c3107faaa7ad759d4f588df1aad0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Process.dll.tmp	_.files.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.Native.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	_.files.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	_.files.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	_.files.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt.tmp	_.files.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	_.files.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.DriveInfo.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	_.files.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	_.files.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	_.files.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-localization-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	_.files.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	_.files.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	_.files.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebSockets.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	_.files.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-datetime-l1-1-0.dll.tmp	_.files.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-util-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	_.files.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	_.files.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt.tmp	_.files.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	_.files.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2064	5076	7b38c3107faaa7ad759d4f588df1aad0_NeikiAnalytics.exe	90
PID 5076 wrote to memory of 2064	5076	7b38c3107faaa7ad759d4f588df1aad0_NeikiAnalytics.exe	90
PID 5076 wrote to memory of 2064	5076	7b38c3107faaa7ad759d4f588df1aad0_NeikiAnalytics.exe	90
PID 5076 wrote to memory of 4656	5076	7b38c3107faaa7ad759d4f588df1aad0_NeikiAnalytics.exe	91
PID 5076 wrote to memory of 4656	5076	7b38c3107faaa7ad759d4f588df1aad0_NeikiAnalytics.exe	91
PID 5076 wrote to memory of 4656	5076	7b38c3107faaa7ad759d4f588df1aad0_NeikiAnalytics.exe	91

C:\Users\Admin\AppData\Local\Temp\7b38c3107faaa7ad759d4f588df1aad0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7b38c3107faaa7ad759d4f588df1aad0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2064
- C:\Users\Admin\AppData\Local\Temp\_.files.exe
  "_.files.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:3104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
77KB

MD5
c081906ae63eff3d943a40956b0b288e

SHA1
01e4d05f5688760b8da7ef8ff7a1ccd7939065ac

SHA256
557c225e2fa55343b7977cd48c6c6f4b7132231e17227b380ea8413510d6d8df

SHA512
3b1c5b601c53b045014363c82cc6e14d5718d536a761a3d73509204bddfa06ff1e3cf46b46902bbc742f7310ffa5ec0d19985ee078cda776b51edb93ff56dfa0

Download Submit
C:\DumpStack.log.tmp.tmp

Filesize
84KB

MD5
9d3b4766332877cad43715b66557376e

SHA1
67dcbcb09fa8a04360dfa0435ec772010a7fd873

SHA256
e9ee4cc7258b22aa03071020b93ed04de6e10db283472c7e32c4f977a61285af

SHA512
7ba870a635a22c02df0079e46f1a649471441247df45b5d3c8db0fa3e4d0b1c20b013a06e05be69cb5da6c18e12081e641480d41595a711594b6b4d171785847

Download Submit
C:\DumpStack.log.tmp.tmp

Filesize
84KB

MD5
8bad41e36dfc21fc47b8462175ada84f

SHA1
359f3e9e76276de7b0e7ade64e99c38389bce53e

SHA256
45fa4bf4d536f0eff53bd91b8b376edc0546390cdc0f87b3e218baa0e889600b

SHA512
6e86550fad44487bfca9e560646c28856a69814792bd350391138c86558380101349ff8e00146b9c4b82bf8dcc1900eba1ceb2f6de7324c4c2aa2b90ad85f62b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
72KB

MD5
02869ab6e88f86cd05ab34b70052d57c

SHA1
ddfe1f6649e66a710747e55291a02e586183f56b

SHA256
14ef1b20586c2054682b8333a895b931b31f22e571804275d81df5104a6bcba9

SHA512
b8ee3a8b07582798b855436786d2171a29b9085460894dfd81bcb5b01e39730f62a1721da2acdc7e41c7af17c85e8ce70249960c3c59e40b37ca1e978eb20390

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
141KB

MD5
69043b3726e6e7cc1b0c5262bbc1d3ff

SHA1
74aee7e06ecbc24150ad4df5ec73c6a7fd2bfe14

SHA256
0a47f8e1136935e241e4681176352111d6db135636fc1c9134af99ddfe81d377

SHA512
45209b26b064ddacac342daf42f3baa4b5c78edd43cafa0717f1a2e74cf08fbde64f810184556a153d1df98bda0a3328ab485a25375924e7ea0a18ee5fe2c168

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
620KB

MD5
ce55d05424422ca873b0140c3b233ee1

SHA1
a59f837f88e25e44a3acb1017d4c3c60c714b3cb

SHA256
b5e4d1fcf75d37294c68dbe2fcb3fff4330a5b1e6cd8a937b05cb1e1e623c450

SHA512
f17828143274603dcb2dc2e25552b63c6459911f0fd23358e05e356db78d186f25fe957dd13d86c3f99f2210973dee5309385e5b4df6245eed12887780a71e6e

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
76KB

MD5
53fc8878d2bf33d561fe8aeae0a1bf09

SHA1
11fb1fbb050ae3c0bd909ab5c761305627b1185c

SHA256
2264246586ecc541cf7287408a5f82726b8dc353cf31ce7360c2e63f4e418622

SHA512
73f4deb5ccd3450962aa7377fad216f7034c0f060732650599198e98b65d201fb75d338d7e57669130a9c7ab7e9d691ad52b8fac4bfe2ffa35f4faad01d9d1e8

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1007KB

MD5
6559f93c0757316eb22af0d0f41055f3

SHA1
549093befb16894c6d1ceb776130fc42094d9e29

SHA256
42cde2adfa4ea362036e374009e9b3e9e017265fdb464ee81aece807955ca969

SHA512
090e94d032f3eca5f4daa1b8016504fe150ac6294f7437929b6cf4c98ebe7937769450441e28b920f86a54f60e1d2787d9510c11bd079622977db9cf494a40b5

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
84KB

MD5
7e26db4c16a3beee02566dc2c9568408

SHA1
e2716d300ee6d72a01b24d6e6dbe96f68fc400cc

SHA256
58e7d1a0fdb8853df845e8c2f79d4647e2c25064623070abf79d718400e4efb4

SHA512
49b34a5fe88567679bfbb8aa1b448b54e03c585e85c1e69a05e9ed059d453d3aac499d73d7187a04fd43adc889d0fd34ee93a6c3640796de9ec674a4d5715087

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
760KB

MD5
4bd65282518703247dddf8c8e6df23a3

SHA1
dd637a256160b79a531b7188e848669bcf3ce2b0

SHA256
a3c6522d9cdc80d0e7a56494495c4036355dbd51df4388c45d94ff719cbb4191

SHA512
55b892252233de6419e573bc70564fdfa63008c97070488db533abc4626b4099627514867f189e93d59caf579460aed0f607f7238d09411cebeeca89ccfd8b9b

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
133KB

MD5
3dc63a1518ca04a0e88776ff81b37632

SHA1
951d49d050935241a83187e2102a888279986dbd

SHA256
e171deb648b2771f6bbcefc1c9a1fb5b0b1e534fc12ce6ebbf65af31c3d750af

SHA512
23bdce696840161e692ed077f4ac3bc3839880299afde075e24d47508566b231b131a95d854f1b49b48033448fdec9d9df7f44a43060cbf2bd72fc5cf0d75d4b

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
86KB

MD5
3f8feb4211b27188cce3b180d41ae9c2

SHA1
530fbb9eb4bccfce1f000ed1e3a1e0811bd59c5a

SHA256
13ee771f0e7bd92b9ef81f3b662cb38200593f98ebfbb1415d2f236f92d153a9

SHA512
f9799581c6a90d8f6d41d78b6fb83fb9f4bd87e8d61fed0773751af037f4a2e7f470221e268c4ed93f6ebd5432694be502a99cee4a6952b5944253e77d97c908

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
84KB

MD5
d2b08e80a38b93b3116fa016e25ce6cf

SHA1
14a90aa893cb392ef66c45c692c32169d28ce20b

SHA256
556b7822d86fd23d09260cf5552e9a490f21b620d77b363cb486492fa873157d

SHA512
be8937226ee85e390841c7cb04b85bbf17b4fc234ed16b34eeb0fd16429a8c22e966ac57c8676d8897f3765bae8840e2d0b13385a9de2687ef5bb6b44b78a42b

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
82KB

MD5
89a8874884eeef361bab4a8b8d0c9a5c

SHA1
fc2b80d1ce63579eb68c02b48d1f681eaa6119ce

SHA256
ef8e9c943de55f19cbd33f585b83ad0880a9acbc34a6d5e32f1271a0b7ff05f1

SHA512
437425a2e4f606eb8e96769ba85c82e5ceb764825cd34093d0327c5bb6dacf315288a7076364b50df65e69619aeb36b57e99f1d9cf5a258aecc5b933569acfe0

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
88KB

MD5
5fc999356734baebe9190c6a6238636a

SHA1
fc791c71c88ffc10ede9f8c0ae4007d04b7d3e7d

SHA256
302ac4bf4a4ab8e1f81833d82309477385db38f096b0aee126f47f846636b4b4

SHA512
c53fe9b601cee1a3893e43457a1daabf09a19451d23d12fa97f02f6f9efc7bf312b131be9613a1bf0c7c2c58f813393b2c98c906d115a73bcc4a4ab25f00b568

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
89KB

MD5
5a4b8a46964c1256ea1e293e6b4d2d1c

SHA1
759ad28875aee500f15e5ecce418d001560bf2a3

SHA256
81a62d7dd4734cd1d4a6c0558a051d04795ca2ffe5e4be659510ab8c27f9cd29

SHA512
ac076b05cc673354738e26e21c02630bb45b9ff4383b637c44686907335a65d4c420df90fe7a7f11d01625d24d801cd46bb25161802648a4ce3f1287e04ca0a8

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
82KB

MD5
f8e3f6245762b444b42249da473c2d33

SHA1
76b91c2c15c92e097f77c9c7465bd611a89b4047

SHA256
785719bc433da506a83cd81a6c770e170c819c43746f1b732024c0f0c37c575d

SHA512
715b6c9067a7c15ed4133f1ec0d8d7bad55e7527bcdd7ff2cea992e3b3494b8e56838fdd81f38e69687898affe475c4993f1a98847d99028082374c9b4f263b7

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
85KB

MD5
be2210a840b299d0b82152d8baeaa538

SHA1
74c375bc016ef3fd851eca58eb06fd2fd1bef236

SHA256
3a8a053b820e062421ee11832470da114282eb14c90c4aece5b2fce92591a786

SHA512
2be9ad41076a5505d3dba6184e80d501e6ff02db11b4f9dc51613e7ea5ee1a6a184e17540514e1bc2a3da7326074abebbccf9c76c8c65f49a2a3dab5340fe7e1

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
81KB

MD5
dd0684d5df6c64c9ba9d2d5072c19f82

SHA1
4ff42d9abe871dac78644f6bc5dec706e62ca322

SHA256
4a1331f7012791ee31f25517e5961b4f9b87801b9c9bc2ea5b13e661d801afdc

SHA512
0eaab432028a3989ba08eb7bfca7cf45f2f4ad7c0d5d4919a82099f47258cc34b31f951877b88815abd2d6327efd3a517dd46aeefc71a4f812b7108d96770b9c

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
85KB

MD5
d07b64e83ea136977288ca22cced29b8

SHA1
e8660329fc011e40c193b46b6565d5d816406cee

SHA256
3a6369d1f9d125a5c83ba707797d1165a529ab839b20cbbd35878d8f93f7cd71

SHA512
14f96567b79b8b86056333d02e530bca52d117783008f84d8cdab892b7634ad60274374e849686105bae827d0f9daed5285d1b98169e2e2350d461e54c8b37e6

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
86KB

MD5
5ade1811a7f31c42e249bbadbe5aca0c

SHA1
2f8c825de782f3d38d1ff36d14fafc5abcceb5f3

SHA256
e5988aa34cf99565be94241d37672495ba44536d93835447bad21ed63703a04b

SHA512
d80a7f2cfa4bb6ec44483dbcbe27e43776b47b7ff2c8c4cd301b3849ee3cf09281be5e48a4370519d78885b93fd9d19cfae906588371135aa31e554e188bf88e

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
93KB

MD5
5117cac6906f3e673a5e585da2c4dfc1

SHA1
ff55080147d994f129644941aeba94e200124e53

SHA256
1a932cac0dd6a5c5096ac5fadaaf738c980fc06e242bc3138355cc96464f46f1

SHA512
b1f11206b25c22609540295d956b982adadebc40aad522b43d4b3bb89aec7cc2b9150f33c10c033f308e66684637913c969f1085ff3c333ff7e6c96a667aa129

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
76KB

MD5
cb6b5ede214e212434fa5584d2170c14

SHA1
b8e474a771c4de2842c544afd02a3bb9fc596478

SHA256
57622c52246f84cffb65c992d18bb858911d6d6824803b65a075daccf7166bb2

SHA512
d388ebb196d54e209b286e69412c54639e3d5e9b67cc0526b7816b36bfc6d9da3ea4ab7aaa46ca1987bb97ed5ef094940e52731a834f7a12d889a5ca12cdeb1a

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
72KB

MD5
bb831e89a6754c71462446a9626569d7

SHA1
6fcb40d534e56586ca68097e55dedab84219cc7f

SHA256
eda33f861331ff29f1773cbf11f64fa935c37dd0dc5268cacf57135a7104e8c3

SHA512
e5fcea1adcb76d1add8e9dc0766bf0223a6ba8e9aabd789de0fa8301dc065d6ba4f5e84f648ef4602e9130a6cd68205e35c55ea6fd27027964c145bdabc72ce5

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
84KB

MD5
1b7b0249946ae1e0ea3bb07d1416d7df

SHA1
d2db96098258ff5ddf5af66b0b1960378f5fa2af

SHA256
018f4ff4b299c88f72c9a8ec4bef63262cdff8a325f37a12367eb9fdcf8f7340

SHA512
13a586b4d5d71e0ce1049b449f6784b1524455725210e2eeee7aafac99df0d1710d1c3287614ff10b869bbf9ad7d565763fedeba16287f39cafedd2329845a62

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
88KB

MD5
3fb90ab8855ac0bc9fd6f4e1070840db

SHA1
438b6aa4775f605fdf58b7ed9ebac09df4de0128

SHA256
f3988d46e0cdb5f559aa9b78ad69e72a07c516d2046bc67f222d9794f3efe521

SHA512
710626c35fd0dbcbd82a30cf93ce10f932fbf3efed6f210700e06a1c7b9598665e3dba26450d940b45ee911725e5df8770e515b0ad4b374566447091ef5f67d0

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
85KB

MD5
75242d48370bc50b0c1add3bf18c6114

SHA1
027b1eeff4658efb42b1d61c5845a93147a20f79

SHA256
3de1d31794de8629aaecefd95b4a17c76118a7e01d0508ed58cd1076e3650287

SHA512
11e16c5f0d0a2b01caf5c3b453a3e8a04fe19106cdcb582baeb6ba59a74a5829079049bc036231ac5b7f0463981e17139503f54f2f1ffa058ac55242e0ab9cbc

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
84KB

MD5
2e01af4a714db31906c6c0b712977103

SHA1
4fa28a7a3d422858e7c9f106c08445239d3b182b

SHA256
669d4466c095fe476617f383ac20092abc14e57a74b011203239b3f6e96c5a00

SHA512
f602d1504c73d110c3bc4b9b874e6efd29be50a4d070fe022b8cb730e74036909e49c1c54f47b9a6d9a0d15e5c0543796d9ee9123cc62c0030c2a584f5cf5fa8

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
83KB

MD5
10fa68ef8115a54519f3884de1a691c6

SHA1
f3bb0985ca6b526004113b5bcabb9dd116f3cbb0

SHA256
93fb9c542bfe1825e82f7022a02e83fefa1afd876c43355eb68d85ef6a8008c4

SHA512
78ed2a82572cda6c61dc7310c73ce6610cd871699760c538ef09bcd4d7136ca3e8890457fa6daa16610881c932b9c5e824531d81950f8cdd7d6f32fc369e3ce1

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
75KB

MD5
7fb88f255f1fca6e3766ce1eeed5bbf1

SHA1
0ee110b3309fb9b8710347514152aac58ebb6ca7

SHA256
8ce1624f74d1dd3afb0101f81639e45b45251258bff011eb3338522690b8adce

SHA512
e11b083357cd9c7e8570b9586f4dbcedb911d3b79d041ddae6e076192204aa15846f4547d7837d08a4c38ecb41d8fe85abff3475fe4d72192df10ed646c358fd

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
86KB

MD5
2b9369f16e1ef96a7e29ecdb78b965d4

SHA1
70b625215b03b198782b6bf50449b66c16c66f63

SHA256
da431cf84337437ebdc8c14a13b73d39d6ce8eb8da540b63172e3f9df7a26d95

SHA512
02b074d30081f9f99bcc4774c45afe057f943064d969c3b039a0dff3e63683fad29e863a2d77e742a767cfdee423a1200cac1ecfbaa4f7386abb4475d8d1a535

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
86KB

MD5
42cb26ad2336173f6630c123630c6256

SHA1
750012041f6899b7f855442550bf14bd90af0a40

SHA256
27fec431be8b1902bb2a701078dacd8d45e919ee4f6a20219fefcf7202cd177a

SHA512
0a1f241f95e31bdbaf44fb99db10abf1e6f23023b984e230dcd6e8ebb5d7f6abc29714ffd7e4715f1ce7811b69818182f74c5032e97443d2145735969d6aa43e

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
92KB

MD5
2db1800b041facd49b6f89cda80f7c2f

SHA1
ff90bcd80a85dbf02bcf65d762cf82e935e2f06f

SHA256
676bc57e9b26a13429ceffb9aa8cfa9cc0cece70afc37d6c227497522396b33a

SHA512
f1ffe3e0a5667c1ce4f446bec343d4ac2a337a7a6b688e0b2f37c149113752dbd4ba06f4ee7967b3ec98657e8565ec6cf3e79cbdc84888a3989e61fac522bf79

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
90KB

MD5
82d7154e15971969a86ff622bd9ee17d

SHA1
f81a8b951517f9d30e66dda9cc8929960d959911

SHA256
09fd45e44d21a8262c5023da589df706b40c16bf15a88ee20dcced64025f4d31

SHA512
48ef0725205faa5b20b03a84958125acc239aa4721cbee43e16b8a47c88902b16bab8f00d4b5891abe050ef0fcc45fbebc31b6b31448c8f5b0671ca769187efe

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
85KB

MD5
f0efbd2022eb24f7c3dcb18ec2b1877f

SHA1
2309d28775da25545779418c8d8088a8281c02a6

SHA256
e5ecc043b777d85bf65fb8d67dd60d79c1d516c95a63d3d1767ecfcb28b27a58

SHA512
f8f6e8b4da13dfaf0909ad376d54072868adb32bddb4aece264b0d461c81fc70bcd7de6aa63b1a179f130e6b316fab3b017c3f9816cdce000b9a06e75f68e388

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
86KB

MD5
cfb2d3592a5346eb8726f9477bef028d

SHA1
49892264506b31a12ceef7ad9b17e1a517225e2c

SHA256
8dc3881d0846aebb3cd1a0531d665b206ac2d3bababe4da0c71a0c26d2c652ca

SHA512
f3d016cbb13ba365efe5ba46c87dcde83250d6bf3448ca37b97ad1a49c5f43e6a2187c1f2306933bdd04bd4c8e4f45146119c515a1306e10f22f9451ad375e4e

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
85KB

MD5
daa909f10a605fc58baced682529d4a7

SHA1
1537368c29e8159cf5217ef0c1922c600b20c207

SHA256
6c65377650ca44b451e56d231256c330a1ca2a9b2732a8a6d8d8b97c49d7599b

SHA512
7e693326ba318186a7075e5ef671b6baba4bcf5ca21ff1e8efb7cfb5d30ff26ef3988cc95ac0ff4ba6fa00b463d53f17de2fd7883cbe1d2a8f31afe122533cc3

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
86KB

MD5
e0a03a14cc3e7f1df6be5d27eed3ec3e

SHA1
88f66ca2224aacb037aecadbe7ab56d99c918e24

SHA256
86760b6522bc21126b9f996bd60e79ae036a68a41cb79de1d1d01903aae5712d

SHA512
8137fe461a9804cd1efc8291991cc8a6dc8db38ca2ddbee0e4684b66043d0b39d3169c06701332851e6246da1ae5f94ddc7ffe0e12f4aa38bec233ff3960e6ef

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
94KB

MD5
277e436323057a32320b53d8c09c30cb

SHA1
83801398cca6d82d3448cd8d0a2182479aa4ab6a

SHA256
55c3de7b432c6308697d6c6fc6bd3a7c05ea01b6c01f255aead87b49793298ec

SHA512
c392ccc741a33bc42abe5b60fb7e136939ce472f8052a8aa399cbe689f360f474a40eae012cb12d0fa22b65f51872ba0c3dc22209d54ac194214072e82bf363c

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
85KB

MD5
61055c92ced96ae08c5fedc433191926

SHA1
9895d9f90efcbfb7b5a35837b364a417b1b1639a

SHA256
2ecdc24ca0751c547d4576a6e9713d522e5c3183443a9cd942d16b88e706f4bc

SHA512
811c39e90bc77d1ca7a00002fc5e0a50ab584b7790872f82eca146dae347249c183e29d70aeda8f41de10e3febcd43e1d0833ca4c51e042278e8f40a8ea3811e

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
86KB

MD5
19b4c7d638438a843a4804aaf3b6f787

SHA1
3b99a3fcf035db3063dbbb3f9f761b4726820d9d

SHA256
ec0b56d376933c34bf52928c82753d6eaa0f919aceffe2529f0ffa812b183b21

SHA512
ba59c7b350d8b83a62941d31f5a5f9e17a80b91e237d229f59c960d4b47fb35a60ffcea62a708f40931eaf5bd9d0130f17b1d3479cff0bc880596e0744a24a1e

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
88KB

MD5
82122d0bf45a5deb878a258359ff14d4

SHA1
ddf101f10c8e5f10c52055e90263ac63ad560d94

SHA256
b99857c04c17153e852c970616c487e63e3d714eb23b48eddf702246789f4114

SHA512
e59cee71c27c3cb35f1d4e879097bb7b29fda2bfe7528230a1fbfdd3ca68e4338b3c68e37f578747aabc2c069d0cc8954efb8333b9638dc1d2f32cb1462152c9

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
82KB

MD5
609a73c82dcb3c624134ac4c3e25ca4f

SHA1
e6821c373df3c963ec1ff7c709b270741a1009f6

SHA256
8af2c578a9d91fbf168412cea7018ab5962653c73b9b9a8f896b858338981959

SHA512
4f29f9edd2cfb0ebda6feada361ebbf3d3de99a06facc77bd80177bb44a672348e95addfc8f6510d6049ee3560da6d34933aeb1d0bdc76048cbc724c2a2cce2b

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
89KB

MD5
74113e30582b488f33cda13d8866f1a9

SHA1
11f8542a1d3ddc76bbc77cf32ba69a73dca9a330

SHA256
11b4cfe0c70f322dfbf0f5f98a80caeb933b86338916d5001a65bb68155742d5

SHA512
d24eaca667e40bf388584da37d19b580fc35b2ccf4ff765b98e5f3cc54b2648b040834c8f372cec7cba6e2d97b15b7f941cf3dcddbc509075ec90561878739a2

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
84KB

MD5
731a4be9acf14bd6d595111e85119f58

SHA1
4b8b9dd2d47e6cc677e365934be07e1fc03ace8a

SHA256
61252a8bea2984fb0cf680fbc3396484475a33b2392167181f15fd5cd6e1cdf6

SHA512
862c405a5b69da98012709d5b6f9cc54497c4f043a42d4a5f36a75114fa600f7eac374cff9bdf73f15f342962d583cb50be5bb61e8d306f675e46d70bdbd8ec5

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
86KB

MD5
6768dfcc1cb1228e3e53c4a9108fc0f1

SHA1
99e43504c072bd6514dbe582124c94dacb46b862

SHA256
87961809ef296ac5b9ef57b21142a8f86ec2050fbcde58e9495b8309cb01c28c

SHA512
165e76b559c69343511d6fe1ba7d2781d9f624302e9843d62bdbbb3c32f5f834b4b0163c2fe47c00ecabc6a7b8c6cdde05321c70f24fc6ef4fea89261d31d41d

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
85KB

MD5
558804c0f5ef02b9e421940aaffad861

SHA1
efc421d5a31c7c94ae1b948a61842045c23de4ba

SHA256
c2a9f530558af46d5508eb69a0bd8da48ed39b04249db632635b6f00b3af0e02

SHA512
dd6b01f040a7e0b3edf72319cd012f7ecb438cb109464a16fee46532104e1548da4abc765ad3ecd5ef6e24c2d81b1348f148cad89f31fea26d454cd69d04fe0a

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
75KB

MD5
1ad16ddd85d600f9592deccabe0eb0ed

SHA1
145e520d27ebeee6eeda3c35610afe5a8d09c994

SHA256
6052c8fb2e3103b8e48f3e0875cf3cc1a8caf825ceb298b2f3864691169dec5b

SHA512
44662de1f991bfa5b8d2c3e4f1c7ec7400084e757206acfe15dcf14a334320b4bc0b79192f369fa8dfc1d961e46d540e4ac395336373fa84268b9a67cd5a6ad9

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
96KB

MD5
be6e49cb098f4b3eff49d1a0d91e5b9b

SHA1
4633c880ee960f29b7eb60437ba85982ac8c8755

SHA256
2a9aebf017c1fbb9a268dd6f6961c017c78fb20b516b83ab59dc21be23b6df84

SHA512
9a43dd3a32dffa31d2a040bfd4fbbe1be7ea48a64eed04804d90074e935f20bbd0c26e903ac534e68186f965cbb95e23e107582bc1aa21a3fff842fb16588ff0

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
86KB

MD5
0df65bbbcd4c5012a057edbbe948325a

SHA1
3462fab8c0407fcb40e130bef4668aad21d29e46

SHA256
6d55776c03e8656a599a46662b25b357bd40536476aa27149e2a60b6cc5b1ab0

SHA512
33dce9dd3ffa2987ec51287a4f17f8bacf785488ecaa707acd191b1fa06d143d7eb3b2b997495fd57c0e4ea762f26fbb3c02b821b7e39f9f0408febfae9d759e

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
82KB

MD5
48c0d92db1e4ae26df54bca15ac41c9b

SHA1
e25dd1f7fcf336611d5919f15be1a89e63795a96

SHA256
929d5d2d7d9b023e6ab2bab000105db51b9a2cef35c99629bc3252c7e9e97566

SHA512
4733202b4e9ac3e21e8d0e24a88e2076e845dbd37e02b5bd461cca898c231bf5ba8e28234cca57c95042b3986eaf5f739f5be553c12945d4ee7b001652d6a74b

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
89KB

MD5
80f1ce33aa0a48c32a04e65e54715962

SHA1
ecf85ef1fd3b2e43b76a1ccb8b4cb2c46787c25e

SHA256
4d5b0d42f67e5a61e8bc9aaa01eb838308df640e657e1018173f6fcad2e3f4dd

SHA512
4f4fa775ca6dbab10f33c57341347ebd35fff598528d7d51997f0ea12f893a4231ae9e24a443997a6444b904f4f80654aa061cf7f7a869c41c5894f935981e71

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
77KB

MD5
2d539a65f027bbc5899df40bbc8cf131

SHA1
436328bff25941d97613ddfc59788113ecf39fe3

SHA256
c40ec82fc1ab778abb049981e5af6064074871dd17659452ea5b527f16d1e210

SHA512
8f6f83dfb440c625f2816b8127ddf68ed4fa7577493ad45387d1d90ca60920f4d627adbbe33961d37d596107850224eac65fbc47c206895a483ae3d40867e872

Download Submit
C:\Users\Admin\AppData\Local\Temp\_.files.exe

Filesize
76KB

MD5
f81f371cf63b6d210ae4b1b1aec7048f

SHA1
78b5ecfe2e85d6d4b588831db3edc18698f3dc10

SHA256
eee5729267a0bba672e47a030c1735f2eaa959aac293b57cee30be5855f4bebc

SHA512
1bda17fd8321e55af65d1578d16ab0f923d15a2306e5ac82664ebc6d5543b211d1203b388c48213c9b02a0d36f19cebe4e71ae748c95051745dee235de3a1451

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
75KB

MD5
0d4ceea11d57dcd6ec4d10086ab2bb6a

SHA1
844e86dc7ed0872f30229753dee7018249b6068d

SHA256
9fe2cf16ec00920144c866aa4c13c6749c5f2de51165a54c24118c1cdc4ddb5e

SHA512
6be6f8cff787d8ea358c75c9526f76bc29c3bca573d377a34b75ef5cf136ce632c3858ca1a554e79be80dba663a86c8e31fe508d83f4aafeba18418598008b56

Download Submit
C:\odt\config.xml.tmp

Filesize
78KB

MD5
25009e90692c06e789bc74f8147ce1be

SHA1
db7b328687184b3f9516ceaaf2422b00c50e1c5d

SHA256
5f8af58b3cf06e1f782560a5f9c958308b696bd150b2e61a3779bbaa24c4a6cf

SHA512
367e94438d3b769bd08f28ad6ea97f17c3a8db833055d2e4acdfd0bc4a9f640c37957ee16445b36d9ffa24fb2183fdfbf076126a470d8151f371e2c377b67ba8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads