b2c730b9f3b654319b4147979c9cb2533e2af79e6913aa4ecb96aa52aa54f345

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bba841afd4683a12e066ef87b6f98700_NeikiAnalytics.exe
Size

190KB
MD5

bba841afd4683a12e066ef87b6f98700
SHA1

3ddb38632604f12c98452bb878f99e645329d43a
SHA256

b2c730b9f3b654319b4147979c9cb2533e2af79e6913aa4ecb96aa52aa54f345
SHA512

e588244c21f14458ee75f54612eff30fe2801a6b6627ba3cf5113820c3e8d397c8177de3e6ce253d4feef89f7336fd6b3a35d768daf7a4be71cc2c233b570b43
SSDEEP

3072:6e7WpnhkElEa0NQn0NQie+ese7WpnhkElEa0NQn0NQie+eP:RqthOe+e3qthOe+eP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4901) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4804	_.files.exe
380	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	bba841afd4683a12e066ef87b6f98700_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	bba841afd4683a12e066ef87b6f98700_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp	_.files.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\libeay32.dll.tmp	_.files.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png.tmp	_.files.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-CN.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Design.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	_.files.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrjit.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs.tmp	_.files.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp	_.files.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	_.files.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	_.files.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp	_.files.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp	_.files.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 888 wrote to memory of 4804	888	bba841afd4683a12e066ef87b6f98700_NeikiAnalytics.exe	83
PID 888 wrote to memory of 4804	888	bba841afd4683a12e066ef87b6f98700_NeikiAnalytics.exe	83
PID 888 wrote to memory of 4804	888	bba841afd4683a12e066ef87b6f98700_NeikiAnalytics.exe	83
PID 888 wrote to memory of 380	888	bba841afd4683a12e066ef87b6f98700_NeikiAnalytics.exe	84
PID 888 wrote to memory of 380	888	bba841afd4683a12e066ef87b6f98700_NeikiAnalytics.exe	84
PID 888 wrote to memory of 380	888	bba841afd4683a12e066ef87b6f98700_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\bba841afd4683a12e066ef87b6f98700_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bba841afd4683a12e066ef87b6f98700_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:888
- C:\Users\Admin\AppData\Local\Temp\_.files.exe
  "_.files.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4804
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.exe.tmp

Filesize
190KB

MD5
77ec93af9a79cc5bec4baeb8e16e203d

SHA1
27fa84e4fe7925676eb17fbb03af32974e3fedfc

SHA256
b3f32eb2fe0b2754a0b720cab362e202716437d4827c29900c58195cf0892ba5

SHA512
7dfbe94c33a336f70a6a897a5c7402c1c3914a9087fd30133c4cd1828a15f0f40645a09c80d39c081f34c6941a188d118fa0a09c21246db378cd29b6e76c212d

Download Submit
C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

Filesize
95KB

MD5
69a488130d841fc35f7eae4518a4f127

SHA1
b79d5bc1b469f920d8b422a6c8609dd045449ece

SHA256
c4605afcbd24a6caa96d1f3ceb3ae17ef3c80301c354155c22c1f6a93dfa8a71

SHA512
bd77055a4af513f226eeedfb9edfe64e3da603103fe6cc392d261dcc9b0c5618e12ec460cdc8e62d19235e1463dc90b1169e3c8d893ecc5109870c88c5b784fa

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
207KB

MD5
d29182cebe6045b680aaf30e362f6b3a

SHA1
06d0922a8319e0fe04b49eeb04a49b8b54f454b5

SHA256
30d27bcaefb1be8dfc32dbe6495719e58c4f08fb525afab0368cff707c44569d

SHA512
4cf0e3732eb75879b445027323e55f78111ddf5c09517d875e1ed843753002e83d04734ac77f43adf827567991608f4319339546738ece57de048f23b68062b8

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
159KB

MD5
a2153dcbe89cb27c7432ef6154269ee8

SHA1
766fe60299a29944a5cd913526ab2edd36b2b927

SHA256
ece474f709d9f5a73e6c5b71b802784a210e3a1c770bb92ee27953ee829284b8

SHA512
d60c6f640285edfe68033e5106827516a0b161d3bb9f44f19cc30f24d6f95e3f7a4563114f9a771acade7c6a283000ec94ea987a97e60421d07cafd04f734254

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
6e448ff6d0eeed44352eb63b818aade5

SHA1
d2c2dbe25274d6070c3c649fb3341b6deedfe18c

SHA256
151b5e4624723dcc2b11b71f670434ecb25b9248f7657ff4d82e590a868525da

SHA512
67c0c32eef192279b8e5443ebf283a6e5eff666a494fe1f0fc2c46041a4a59d5f22e4ba39f6fbdecbeb29d285eb6e273ec68e2a30d47e87a2a486d717055e63c

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
639KB

MD5
b67b5a37d3646ae760228e07baeba952

SHA1
5450772791ad3ed01377439ad9182692afe8d213

SHA256
f1e63226d68bea069aca9f8319825d5831e21a448173ce667e2b76ed42d49214

SHA512
a9c5d12ad0fd323040cab910d339042ed2cc80ea02dad24f028a0ab3a213cabc6650d70ca44c24445eff1a53b0c3e72fcdb36d87063d40a34beb09bc84c85453

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
305KB

MD5
cec8905b47da8b021733aa7092216083

SHA1
6adb653e3c2ef719166ac4914a9b7501076af20b

SHA256
0b807de355bfa243c864bbd879f15ec30f0c8c486f3cdd2734ffafc9fb99789e

SHA512
ba761ef7246960fa0cf402de5609c5d5335e532738c3dc9d910f8a26f8954b2013a56780bd5447fd49bbd4c867e76e9b7fa8d91ec4563ee20388faf672144c62

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
b0a4932ac1043949dd3a10bc6ed358b9

SHA1
585c66e85f7a607ffbbe0387697dc3adcfbf4d6b

SHA256
c24cce344f58b406e77e869da1cc6e0d3f31d3ebd5889050b42776a8f14807d8

SHA512
b86d4c5cdfb8e313558027e6002a462061f9702fa355573af39c2435455a8935f6bfdfdf47583b93d96352bd67098d1253bbffbd2615341d793e4cf4deff0cd8

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
779KB

MD5
6f2c21cf1ad3f96d6d7e6847f1af2403

SHA1
9c041397bc9085921eb17c2a43ea2b23417765d8

SHA256
ec6dffae78ebe6a8dd506cec4a8f9aeb39cef3fc542f223488ee17f4079468a2

SHA512
c918c9ff8f9d55c14c077a7e6937916c9b80060d7b5e562583ae6efc46489ac6fc4436e69ac4f64fdaa3e6295f0a93a7da0ab5271fd61040005f529b13a133ee

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
105KB

MD5
4a28c34da46777021b2165f71b1c9fec

SHA1
58c19ccc57082eb36618f26b7d768754a97f0081

SHA256
5b40985e51b32b07be801c27c9b97cab415c3308c71363c4111a154f07b405b0

SHA512
087c3e5a00958e4309db57e2c874643590b2b0a213ae0eeb3a6e704f7df85d3f75163ee376656efd9f606a98dbcb3cc77aeb5886aceb2f5283fbf2245658e37b

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
103KB

MD5
67c3e9b8712bb957780fd9387713866e

SHA1
d9da0342768a7a8d5706c1665cd3d41f5127440b

SHA256
2b26b9a403469283b10e229cdfaf618da50cccacb891374dbfa82ac73ba36201

SHA512
943f62fb298f6e0110bda4697b37f463b0f0c35c87817bc260fabd66a1866a0b1ee8616901d7e906ff010f68c9f2ca34770487f47c232b43bf72b0d702113934

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
104KB

MD5
e3b41b9ccd68682f46edc34afd5de403

SHA1
fc25f4f749b5fdd4ccb1a5f644777e81f41e4e62

SHA256
c377c93e13e549164760697bd795d2b2a057bba3a9bf60e37f666abf2b7ca9db

SHA512
f8f21c8d35657d674db6b79419ea157d5caf0f6318685041b08aa593f0490b51218f997e5295c8f8db24d578523a29230a86983b2b9cd03a37624a22e808893a

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
99KB

MD5
9d6eac4ac5188526530045b06884dad1

SHA1
a5c4ed521b5a7bc27e45da1ff9ee11c9d97cbda1

SHA256
8ef6f44b69c0d2a59729817c71951fd1a654a8227de974be21e40662d5967088

SHA512
bf95480818fd3895d98f3b7c545710775bda77e3c1ac6ea98cc89977ebefeb69387d278af17c99589adc054fd5bab39118780d77a5eb59efbe3fbb978b005c81

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
103KB

MD5
73fd2068635e414c64549fa36fce0e23

SHA1
a604577894b6236a5e6897cb690c208bc42bcda5

SHA256
29f04015c9a2abc1dfdb74807b6fda29b85237492bfe5f00b90033e8fa3f874b

SHA512
14924bf8e805137e32018e7db56e75c1cf856412037595e7a3be2fad1238e51e972206a78013f07cbebf6a42a2c77b76b8926146e4182a1bc421314fc330bcd8

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
104KB

MD5
4f73dafbfe05565f6f0fca12a032a797

SHA1
6c68052da186ebab82ca9eef05478056a4f38b69

SHA256
4857f6ba8e8194017d57fa505d964a4c8f80168450843ce09333bad5fc149544

SHA512
52adc5f9ad9b9a53698b0275540d9ead60a3a21a09907f9cc76059d27bc848b946da6aa34d6b687889c302b49dfd9fb983f12a1f24a2bf2661485c5968e80c76

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
102KB

MD5
39a2bfd44081509481e56e2fa3faa789

SHA1
bb451611c2d9d5a82eb29a5f3692de8a55f8a549

SHA256
ce1f04ad96a123c6ff77df0d5170b0631ae7d2b295c8b51ee7bbadd78d4e59dd

SHA512
d6301c67f335fe867ae618f7a1b34dfe5d4c9b5847b880ad78947295c97e5bcc6432cb85b23e4ba1e38da20509ed6e7c828c80134567e8fd5732d7528d53415b

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
108KB

MD5
a4b1ebc348cc3c059020db88dfff698b

SHA1
30750c4d6fd584f6a2945a3f43b9908a60c3e611

SHA256
d96c65d59a7a743f8cd643670af2d27ef1b754b1dead945d8f77b378034a1263

SHA512
6675336f753b786900ca1b5875a7f3a5b82c00d4ff878dd469b801f003f970e2d513c56b5c68978a925682ea4fae870fa2ffe38c578336c69469e243bcb2a79e

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
105KB

MD5
c7d33abd2cd67fe4d9c5dd347d88912a

SHA1
b65fe693f64a13ebc09bc0f7cb2195969e6a7374

SHA256
9283e68dff8e98a8443c2d45b4beeb21d4cf6d7fe26b36bb4b409bf08ee70c17

SHA512
690635f48e4d9dbfc5db1feaa379c6883822a4902c7a554de5c3bac61ad62485c75520029fa8adfa6bc4b94434d30a47ade57ea90dc0ed54c5eda307a3f8e5ec

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
113KB

MD5
7bd32c4f217d6d2bfafec8c0d79d2ae7

SHA1
9024a37a92e823e9e59b7f70d340fe8c2885fd6d

SHA256
0c33b314728018502c6271d1d2f9369b86f394d161d871e47ab1e8c18eea4c29

SHA512
6e73e068d7f7e0c999d50995e7e308e127905a2508b2d7d84f216e3335b917d6fb8d16b0b9c480d490bd99755190aa33146932afc29f58cd8de4fed5f9dd3161

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
113KB

MD5
7cf54e85d2957b17d334b6ff0b283ead

SHA1
7e430cddeec4e6ebc9b23ee2d528234171e1728e

SHA256
360f1c5c33d0cff8b827cecdc263a858156de767deaada38363c537c31be6d07

SHA512
84881e3aabe6f4a877d4f71180332abc58e7685a970f3b44fc71d3c72666b6081c6ea530399e8e690aa1708ef673a49c984c756634539f84a511f9cb4e31e4cd

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
105KB

MD5
bd2ae3091386ce0293bafc2e7c47a8f8

SHA1
4247be484a873ae8b66f02143f9c4e9372831540

SHA256
007a27ac2c225b4603f9d6fa4bbeb9b5249c370ee3dda860977e231c44cd0168

SHA512
51274dba8a6a5a274824d4217aaab3f380d6900e922ef94a1b4e8cb7e676533b0803c51b2bc8cff6f7df402c0fb88129c1686b11f91293c03f39ad4987864ccb

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
104KB

MD5
eed6fc00858c8b61e393340525a84f17

SHA1
7325ad8d8158e0e5c0246dfb6dae634bac0db0c7

SHA256
110aac19a8f65bdc92e6712a9d23e301ad2479fba621a7c711326b2df53102ce

SHA512
d746d3e56d2ff49009218be2729b7b58592961985eef79414976e942c96fd17a6b9ca6d09a0e84bbbe34d48e11a6de6ce190a7207c3bf06b68867e266a3d11ad

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
104KB

MD5
ca88277910abd711d49dbe34aed4d8b6

SHA1
b99c008c2f98cf1aaf69bba0f438134a32aede1b

SHA256
234500c180d2008e12dd607fec696dea2eab4fe65caf677d3fcdea300d8d44d7

SHA512
ba9ed3183a0d4f9a1c3326544b7a596f9c5088f4c4cee082e953c481d95369adf37f216270cf3d2933572ffcb43cf96ac998484c07b36fda2041c75cbae9fc83

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
103KB

MD5
904c3aa3ea2f4e1b23ceec22dab5bc23

SHA1
d7cb5ed6d0908244a937b90f53d7b23fbd6f9d29

SHA256
8cb1043716a6b2807a2cbdc9fb4e7727b1f8c63284ad64db56cd45ca366e2971

SHA512
9648c62abcc6c9d178aaa1e8f859dc9eb9246dba4efb9c2be3f0d6de8612b8f686db1b1636fb3c5a71a6372b8f02de4bfbeb1e9015bb505cc4b7d46a89508ec0

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
105KB

MD5
80515b7f15c415e8440b86946711cb5a

SHA1
c3e451244298f0a6a3766451a4c2d94a055c6f1e

SHA256
610dd846ffb3e06874ba247d28bec4837afcd4ef48222ae621b9771bfa7eb530

SHA512
763dedaf0c092377d20651ca0ffbf48a0f6662155f53311d8572469fc9831c22a11a5bf74b9d38974b9a6bbbb212881a730628c0a7fb0f018566834355f9f3d6

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
106KB

MD5
bc98ebad22b7d392a9045082859ba81a

SHA1
291c4db309b98ede127a6932d69ec6011aae9e6d

SHA256
9ba0556a91bd79d90e8846b6c66b6d236dcb6deff36572e65ca0a1484dda9c86

SHA512
42d9d3ad407cea5f0891da584fc5c9db6e4d509d7ee22c567377462e379b18f3d084ae766c6d05aae4129372278d8c30a7e0c3f398e809a284a0833ce1fef1fe

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
112KB

MD5
99397d2bba963de68a5a11c4de8a71b7

SHA1
458e08f7a1cde5d54ca5be01a70d6f6fd84f9f90

SHA256
d172fe87a7dcf0bd5055019df1c2540d9cde3020cc5e9d99820ecf3008e916f6

SHA512
f0c9fedcdde73ed2f782e5872de77eb90e5e6c51e8a855a674b04266352943c5a154a50b98437ccde9f33f21dc0dcdfbc2d2bd57318c3377f11d82761da2dfbc

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
102KB

MD5
52523dd90b6f0f2fe81d27f903557e3a

SHA1
e8d4402ec03a79847ae837cff2a591531bf36219

SHA256
066dc76155969d3112efe09dcc4735db16667dff15f0fedccab5529c965e66ef

SHA512
4a58aba636099bd07de8ee5fd2eae661e83496ac67759d5c5e0e3bd69c8b29e41e2d5d3889a9d915d26463545e8cda0e4bc7633b32837eb6c0aced5d86869330

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
105KB

MD5
b2138617fbc22933e44f6b2384335312

SHA1
27655354480c09a6c5f2d022e26ab13f8ddc64cb

SHA256
1a7014e434cff9d984c847002d9fc97834e593f13fa5db000f72119fdc440098

SHA512
9e7e0f3225c56f90064ffcd9c7c6005491ed0598e8a925b82db90d24a0b8c277291ae9d35479fcc5f8ee94251334c0cc051b6e856276c7ae4db6be2a5d1e691d

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
95KB

MD5
cf402e2c85b4e5205f4b3d0c15302566

SHA1
634a8f4a6954a358eae986d4c0deb814a03d5517

SHA256
a2b413444d66c68f19d7b3de93fb3aab36dd48bbcc92684c84a9e363c98be5e4

SHA512
68f43497e9217e7702cad3df9aad8b2a28aaa0355812270605c576970bc1967fa97f2bb104baa8887882c8ff74f68d1c8a660e86b040c9f0adf488b936c2eb2c

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
107KB

MD5
a6e9da64b66fe3d646987421191dde0e

SHA1
de0b705e2e78f75121ecad3295228d51c6ed9114

SHA256
79a872c379a4a963b03099e8ebc8cb69d8df210c9d0cd9710b1e072e7eb28b86

SHA512
a6c8d5065a2af0fcc76fa6c11061a730805922d3228f14b252c53cec195687b06c3b0f02159541c861025ae7f4d8933742fd9f5ff65009d912819338d0dbc91d

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
101KB

MD5
9c665c31c05afc4aadd389d3c7197fc0

SHA1
59d0ede89327d451347116ac68cc93416a5aee9f

SHA256
c481079055b4073b5a2d1eefa87c7d1d5461e53fd8be81b669876f494ef5cc76

SHA512
fc234d740de72c52d9005ba70f28d65a04601198dbe65603ff11b2e48612506eea3cc7c501c593dcbb276cbc2d3cb0789e2925fbfed96a347a27cce03e870d66

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
103KB

MD5
fa77cb958f8e86683b4eea81cd0f11f4

SHA1
4566c08ad5be7b438530f80e442e252dcaf55d6d

SHA256
e9f3f176dc59c267120b2ac68444c1a37f6be4715c526556cb37cbddb4441e7b

SHA512
f8b2d9a59e55ccad1f01b316290033c67a0a2a7e3f4d93bf732c88c5fb17b054f9d950bbf4c82d351898114856b13e7ed4035023b5fcbae663685c8411f58ecb

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
105KB

MD5
d37b34abe51bb28add336d9e1b8e14ce

SHA1
fde7a1153125f7810db98de277d451452e802022

SHA256
2b9ce74c80d031eab04f4a4b3344bb84a67703c47ed9aa31c9923d8df03da348

SHA512
f060b8cf14016dd6da2d1c87ba0ea25d648463d2e3e799be21e2335084e32980d271eec97a0759f9cb43be1fccbde4cc7f1d385207382244c51e11c5dee61db5

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
101KB

MD5
160fa6d504085e1d40875b2499bfbcf1

SHA1
64b68bfde36dfc7555f950201a0f7c561468e9d5

SHA256
8857f0b4e6ae3dc24e22570fd736ca4ab95af514762a5c66659e1330aeff2977

SHA512
98e632179aec66f88e9c9bb302c2af9fab1d371302a857522fb741cc62f468246ac214f284cbb05a77273eb345c9bd1720c1705252033fbfd72e4cb943020377

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
76KB

MD5
23a3e44e9372f6659a84a0e739ad78db

SHA1
3de375e287ccbf567acce37cb1b12d3596e81342

SHA256
31f2285f072610e4e3c5e2035b749f9847bb64f738a0546dc10ae3780b0fd03e

SHA512
e6626390cf13bbfb694a2b9d6da58dcb5d3d896452b3ea08932e93e200f55300ebe3f1517fd802aff32c3473941efd96887b561129bc3aec9be0feeb86bab21a

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
103KB

MD5
e7198e831ca91afab87bb42869a04b7f

SHA1
d9e2374155e595d5acfeb45dc2c2b088649e1c33

SHA256
55b9fc647755c76f9e58ce96ee1772c34d5a9fac2643630341b7e51d707ba6c0

SHA512
c01608fba187fb1fa39b702eb80588efd112c1435c6828dbe8d66b362768b27c9de37164391f00899362b110e6651977302401ef487b8933bffcdb17b2e5060b

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
114KB

MD5
f5c26e44f3e4010629ce52b837b5dba7

SHA1
becab76ec31cbf7c2b7235abc104c416d517b608

SHA256
0707d19ea415be3b6df91db883c622b9d38619c3614cee2e9e803e9f7fa0b27e

SHA512
6ff794257f13d8e3f5629290de3c815b39ee30dddc5b02c5939bf840cae2334eb31674eae86ec8200cff7389dfe732f704f305641ec22fea9d55ffe0cf8b6b94

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
115KB

MD5
db6dc44bde41de881d06b948a05c097f

SHA1
c6f46062646ba631a6c1cee3476591add7e6c175

SHA256
08a2c2962ba903e9dd9e0c2a5135867042edf8162cf98d684bbc0c13ecec456f

SHA512
96896de1b8f5503361b22a88ce80a5184c9578f5d1e27ef80b22dc0e355bd14dbcbacd4c1389347364ca66e454c3ca0b28f329a49970d04f7e68a7d8ce4ecf79

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
105KB

MD5
29453cd980f7251e0951915e69c52bdd

SHA1
089aa4b2ba61be6bf30a1325421e08f49aeea58f

SHA256
8ad5bef25af869b1e0e42fcf739ccc5f015817bf74622e6a6805062284fe57ce

SHA512
0e76b5bfa3511c3f80f5ff54ffef3fdd7fe8916c45fcdbd1effa73afb7bb9cdf7f48f077031f450e4cfdd9bc4b5787db79bfc4e954ab4eed6bab5fea6d7d7e41

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
95KB

MD5
c9ef87aa34a249ecfccc020ff2da997a

SHA1
a9055cae7a40c005c9de428507fc9a84d95bae2d

SHA256
8c474cf0e2a4b932a1ccabae6b8cf46d4551ed9a3bccde61cac8edef9154159f

SHA512
0ab1f9bbb07810c1cc0f7c7da3e0b389fefa7f75ffd5f2bf78c5fbf58ea62efcc997a6aeedfc66344e834c0000354cf6f915a9949a132c247346b60c48d23368

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
100KB

MD5
4bc0ca10d8a4cd772f9dae937556c9e1

SHA1
c214cdf0046dbeeaa622adae3de87de0d53cfadb

SHA256
edcc94f3dc6e670ca82ee77fc0325f022c5dad28dbdb94f209b419a493965056

SHA512
a58782dc85af7d8dd1f383a02f642503df614754a92f850e374d5ad8a234c4d572f76dc9e9a920e2df9d879652a4f2ad3fc846d1f6c02a83ece9d29a282edc9c

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
100KB

MD5
d6b4d132c41a509e46052917b68893fd

SHA1
a4581db6f5eb0a74c3fd0b0e6a32decf82c6fd8a

SHA256
223b91ca20775d629f3c116c699a7d4e20c7f1a1e8928eb8dd8b4de3b6b1df3f

SHA512
fac3e439401bcb3297c709ffb071ce764d44c3205fe70384dd579f2667d09df8f65a7e23653e158e569bf75bdc75f01d58db2f6c72ef3d106208b0e135bcf3b5

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
109KB

MD5
d20c0f6f4364eec160ff668770beb375

SHA1
f10835d2d6cc82358cb9632bd54250df60067c44

SHA256
8fa68232cfbe2814d67ef813a2b6cb5006c30115f394bb0290ef5d2e8a1d7753

SHA512
0e8fa4d8e0a02770a194fbca81c0f53146f3ab11fbc6a53cde60cc7f14fb8f3f02275ec81610426a56b51c4c603628d8738dd6a80fcabbaf756d9fb8b65208e6

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
105KB

MD5
c49401617ee042e1dbba3b285ddb5613

SHA1
bf3d11dd042fc3878f7c56b5394606108c8a8709

SHA256
961974e56a3c1492a58b452c7191e5eb95cb603977bcf2e77e5412778b62b755

SHA512
db73d041c2d64020c3fd01be81caadccde3ebc4d2e63a0c71a42325e59cdd67b5e1dccb94c150c5e1f30e0ca1266529c3778e7a5838be964053f3156b8d8a4f1

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
104KB

MD5
c4b8472b25ef286da84eb4a1b4e3f395

SHA1
d4832b9c838ce0c76b20f0487d5188f9252e1108

SHA256
1eb21ee7cb902b27e21fe4e7bd75b8a3c2ea347b4a0bbd3aa11dbc8417f96054

SHA512
0cbe0c76984b0bdf41d1bb2968d9c8f04e669e96744dd3908eb43c20ab0c496d060dfc77962c2f5539d839514e126f5eb38259b218b402194e2e3899442dc1be

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
105KB

MD5
f637e8dfd603bfba78f1d7a6c12808e0

SHA1
c239c943a2059479909deec68b87f3e71cef283b

SHA256
753fafefef57b38ff81229595a4ff739dd02d3502bacdc4ab09b5b529a445a37

SHA512
1c8c7e2fbb385ba60ec22d751fb4adf142777b3e63fc2799f7ea7b90efd40e082e1275b4735488f4042b0d1ff7cbab19312412dff8c83a614ac44274bf1dd0c1

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
105KB

MD5
c69fd7f62f689102d37a68344df2c2dd

SHA1
3cc3efc691286a5bbd3ecffdea32c2cce5d60bba

SHA256
2aea5c860a8b71024733a51f021742ef178da31e6d126e24091e021a68f9a10d

SHA512
51b358fb29f054cb9748e590c9dee2d075c280767e2d1eac76991f23adfac964029fb325e4ec7e6b4f852cfc622c29a313418877efee85896e004c1eede0677c

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
114KB

MD5
f732ac61250aec65bc775ded974c40e3

SHA1
3ce56353711c3ebd03d60688cd9f601d68ba8f6a

SHA256
a58cb1b792b4354c50e69a449f34d27ee66578341f1346f9c65993c45d41f5fc

SHA512
575dd1d87d43fb617dc213df00d9b8caf00aac40fd7f8964a697d6d37b99ac01d5b844d16cb63103b64d70145c3277b92fd48bc0be26073198956b6cc44d38c1

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
114KB

MD5
629785d84217c713068eb546171703e7

SHA1
88e6bad360e254eee3d2dc36437577598657d0a8

SHA256
e91fa971231493992804a30f2740bf5eb6ca7deed7d56b43702f903eab63c168

SHA512
c866b6e97240ad84f87f08ae6ea7852f633c068fbcd447b59576f8392e908584a124d0043e8ae39a62b4f4fc763029d496258e418d5aebe8d4412c89fd703e22

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
104KB

MD5
f603bac5b6ceb71cbadd8322bb00aed5

SHA1
0b65e69396af8423b2b1db05da337794ebb477cd

SHA256
39ec06721508ae3dfe57544d401bb9a006d199ad0d5d7066aa8c9c6c9a6c2568

SHA512
e4ab91f6019e4c86294685f41f2bf512db10b4477d413b24b48e72b668c7f2f2e37056d470c51d2b5f9bc2f7780551d773f9574f72a58293d24d454be3c04959

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
101KB

MD5
1d0ef48c48f8351a09003e2025783854

SHA1
33c3f8f2c1fe85a93290e1cfd933e71ba3682a43

SHA256
b15711e4733976b3a3043d08a849f6d504df26625b8cee44f89d251443d83df8

SHA512
7c40a9233d5797be0c5a27ef48b1a9c3a211b6f5d084ca8d83b6e72e6b37a5ff02fe6261d6e1f27fb8f641277b0af65dc740634f1d72b973fdd05c86e68a3275

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

Filesize
107KB

MD5
2c259d7fb100356bc5504ffc1191159c

SHA1
ee8da1be83a5bae899a2d477f54e361a6aa5345f

SHA256
bdcbf5ac84515d5ec7d252923bd3cd7d057bd3321303ae07d1f1a9732bdcc6cd

SHA512
f340cbf8ec006af830351b7e556cdb4cb6121c69a836bdce3ec6880b93a871a53fc56bf4074e54fad460e86750181b3c2e63db2383eeb9517bfab84defea9de3

Download Submit
C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

Filesize
102KB

MD5
57cdc3526a3c773e6fa2df72b1bcbad1

SHA1
b48851366a3d09f3acb664e9f32fecc3067cdfcf

SHA256
6a937a3de971ac0a21bcda846c758fb25faf943f081911d4eb264692770e3bd0

SHA512
41bc9758c369fe4629fde8f8289cfd1ee774280a31392da61101a52f386be1cb22da52b2079e799ea790c5d90046ae2f93ba9d697f0244c335cf7cc57cfd78c1

Download Submit
C:\Program Files\7-Zip\Lang\sv.txt.tmp

Filesize
104KB

MD5
7ab5b8d71ca6510c37ef4d60e4c725f0

SHA1
f73a84b01639908190da1aad658ba161a9559d7c

SHA256
8570b7fbcfadc9244b61ca4a984d59fd724e6ae67c7d76a2f9e2f9c94f02628f

SHA512
f247bd5f98a366b1ec808982dd34b54d0e76ee4adcbb1d1fc4e402dae3e43ec95fba2df733d4048b6328c02706ed5f7836c7c73d6b855573b237174761b251fd

Download Submit
C:\Program Files\7-Zip\Lang\sw.txt.tmp

Filesize
94KB

MD5
2e2f489e1dba407aa2ccabeacec3507d

SHA1
ea2821edb8b7103ba9c83de963af60dafc28fddc

SHA256
5f95217e26c8c62733c51154ba12da4b455c90008300cd668a7307840cb322e8

SHA512
c9f5e89bee3f00df247f30a604cdba7a0e19ab4a3efd728cd0282cd99fe6b011d6e39d835f65d1fe533384d118d2212c053a895c362eccdaabb5cf2c6cdf481d

Download Submit
C:\Program Files\7-Zip\Lang\ta.txt.tmp

Filesize
107KB

MD5
2dacdf1dbd633b839714c2cb83c6073f

SHA1
e13e53a614c28e9894fc4fdeaf607e0ec94de8c9

SHA256
47fa57f7187e91b1c6033a5945ccdba1a84a2631760979bb35bc1670d536b60a

SHA512
ab013ea1591dd2e0c5e49d42061fb0f34f66f704549de310baa0465c2544f5eed2b854f7f71dd913b5a69fb12603bb682caf8366c1f38270cffa059064bc17d2

Download Submit
C:\Program Files\7-Zip\Lang\tg.txt.tmp

Filesize
110KB

MD5
ba26ca326473d7a48f16c79ca6bb3b13

SHA1
0599b2860842151f5e69e6d5880cbafcb29d081c

SHA256
76ef9ab258c917ba4f61c5fe6ea2a4b4232982ce224e000500bdbae1bbf4862c

SHA512
1483b16f238060d4d35bea0ad0d8218cc339beab18079a8a8ba6df8b277cdd7500fcb51c30bbb51e175075583cc6384ab561604ac12947e68ec676309c0dc8b9

Download Submit
C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp

Filesize
101KB

MD5
f380dcdf290209e1574faaac3567509a

SHA1
00079a0a860b4e2717d11957a742df6b02bc674f

SHA256
6303dd027a2e67ade58bbd046729b5249ff16a3c9f1e8f94ad84ec73838fd682

SHA512
5de935fa8eb54a2e621fa498d45c3334626f0637377fbe79fc6d3b1f2fb3b893ddf1a23759e5889ad0a7edac6af22e6f0a7edce007d0c0bc735656af09495845

Download Submit
C:\Users\Admin\AppData\Local\Temp\_.files.exe

Filesize
95KB

MD5
5749cf43dab8c0961ef6c7ef2f1d546a

SHA1
93c95ff37e07b6734b3d0cc6a994e5b5f715bf48

SHA256
a0168193896109cac5cf7ef2c146212db42b775a5cd5db456c3f2ab413766b21

SHA512
2432105131cb51e0fcb712ccf0592e2216fa9f667f11aa88d485e9795ec5d61bedfc938a3e6d64063f2f5217e0c3d82d450045ba43727f2718e8d7f68f13e7dc

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
94KB

MD5
72010ca67783dd5a810534b26f28d81d

SHA1
295d424ede644c139facbf2dfb4cab9500491281

SHA256
f65db6f4de77355de8bdef89b2f7d5de66d8893609deb89cc406efc41dafe54c

SHA512
60c8b353636c8f35b6931fcb627fd1301a48963583e5e6f9b7b9d793000b4b56d61c69b2d2f9d4c6d8a365b7372407452f271101464ebaae453a4facacd4c85d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads