bb50dbef45889e19a82c74f70ba86ac395f4c8b2b27cd5c76628b607823e5847

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2aebcfe41734c0219927c626a6bfdc0_NeikiAnalytics.exe
Size

151KB
MD5

d2aebcfe41734c0219927c626a6bfdc0
SHA1

9adaa9d702628c65399a4da3a14eba37b134913d
SHA256

bb50dbef45889e19a82c74f70ba86ac395f4c8b2b27cd5c76628b607823e5847
SHA512

a335164d65c592daef5bb4dc0b30012a91edda0c795b05b514454f5d053b7a9970d73a21f8eb1cc62c7361be9a6b31dc7a73e2d4ab9e7bb35daf494b262dd879
SSDEEP

3072:6e7WpnhkElEa0NQn0NQre7WpnhkElEa0NQn0NQY:RqtheqthE

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1126) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3716	Zombie.exe
1304	_desktop.ini.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	d2aebcfe41734c0219927c626a6bfdc0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Zombie.exe	d2aebcfe41734c0219927c626a6bfdc0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.Xml.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\UIAutomationProvider.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Contracts.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Security.Permissions.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\ReachFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\PresentationFramework.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.Parallel.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.Serialization.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\WindowsFormsIntegration.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebClient.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationClient.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\PresentationFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Windows.Controls.Ribbon.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.DiaSymReader.Native.amd64.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Forms.Design.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Extensions.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Principal.Windows.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\D3DCompiler_47_cor3.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.Extensions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.Queryable.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Xaml.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\ReachFramework.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\PresentationFramework.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XPath.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationClient.resources.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Aero2.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationFramework.resources.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.UnmanagedMemoryStream.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Quic.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\ReachFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-heap-l1-1-0.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.Brotli.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.dll.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\PresentationCore.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	_desktop.ini.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ValueTuple.dll.tmp	_desktop.ini.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.FileSystem.dll.tmp	_desktop.ini.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 3716	956	d2aebcfe41734c0219927c626a6bfdc0_NeikiAnalytics.exe	91
PID 956 wrote to memory of 3716	956	d2aebcfe41734c0219927c626a6bfdc0_NeikiAnalytics.exe	91
PID 956 wrote to memory of 3716	956	d2aebcfe41734c0219927c626a6bfdc0_NeikiAnalytics.exe	91
PID 956 wrote to memory of 1304	956	d2aebcfe41734c0219927c626a6bfdc0_NeikiAnalytics.exe	92
PID 956 wrote to memory of 1304	956	d2aebcfe41734c0219927c626a6bfdc0_NeikiAnalytics.exe	92
PID 956 wrote to memory of 1304	956	d2aebcfe41734c0219927c626a6bfdc0_NeikiAnalytics.exe	92

C:\Users\Admin\AppData\Local\Temp\d2aebcfe41734c0219927c626a6bfdc0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d2aebcfe41734c0219927c626a6bfdc0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3716
- C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe
  "_desktop.ini.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:3624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
76KB

MD5
dacb9cbbfd12d74c5d572c87612083a8

SHA1
6adbc8f7fed8003f1b0d71e3cb144236093678f4

SHA256
fa4288333bf420c3fa00205d7752476b6646ddec75f9035db6bad60a626337e2

SHA512
64037d7b87807c17eb54f8fc6e35ce011471d8a044081a1387e27c19a4cd61fd443252985603fdaff4d8c0065a48f96f28485bd8dc3b06803e1db448298db800

Download Submit
C:\DumpStack.log.tmp.tmp

Filesize
83KB

MD5
a0ab4608caf6678a7a6b4f6609f668bc

SHA1
06cf0739d007c9ddf71aabc87f9d7d32f426ffd6

SHA256
183d5c42a46efe1c76bbc285188d8e1567b8f9ff0807d7108e255232e6e81be9

SHA512
02d83690126c65642d3c321b2beaad788bad439049bd5dc9731b4a7bc9af2c09ac739a1211d66a476b0c6be5e07d10e4a2b49a1a778befc0e1d8572c6670edf7

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
188KB

MD5
cfb6aa20bf819f8de92e729dba994280

SHA1
1dc17e8249dc82133a002e12f0fb2be3f05b97bc

SHA256
8897dba6c6f16e3aec443d209a258c7657b1809d195a25ef4623fbfb40aba21f

SHA512
3aaf99d1e83932d93ed758469709948c35e2b5feecca013797e3af8c8790ad6774294423bb5445c65bc56b5f6806c6a7338b3bcbec4ea4641681c11207c90857

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
174KB

MD5
908f26170726806688d16fa2ae95a9a1

SHA1
fb872366688e3c63717d93f0906a5ef2d107ab11

SHA256
ae15ecccb2c5a1b607e4ee5b8c17bd034ec3f3bab0699dded3a7558425f48d54

SHA512
f9ce1bb32c1bf995da6925fb46d2ce36ac5b32dca0ee1a3031a2c869c782db0a8e3b92e45088d5c98d4b80ce1ba023b1f2a7a513939e07f7aef104a6ef38c24d

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
e47cb5c28f56d706bd01a395dc225acc

SHA1
e089c677713fdd0dfdc1a16e7cf811f6d55cd231

SHA256
69f55a779ba2b70f89e31ed4fd032acca057390716080ac6c25fc1660a0b062e

SHA512
99c6063d5ef5e59ec10fb5b9602647573a0fab471036fca6b7ca260e376b476b1c5c839e59243a8a81d9143ce9287c41216f71aac937d0ec9750558e4d6abf2a

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
520KB

MD5
729f35a38882f2b67f79a08085b6dbd9

SHA1
20c627105372c1600ac3ac75bb8a7d8d3be386b9

SHA256
43116de0927a388d41b1dca45fc780154ed19e0f2c7ab2c7c5a57822f3eeb4aa

SHA512
048887d69fa8aedb88a17ea8b44a2b1e9448ee8e4737827cc2433f1a2aee0be9f1aab2527a0475bee3f3b717068e1f24d7455913c1dec74de024e3f67a2e4b05

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
619KB

MD5
81f37412e7b7c8d78f95f60a0ddcede0

SHA1
9b4801cef1b3e5730399b71ca51110f71d0a9ea8

SHA256
3d20addf364b0eb2618a2fb8a64a0ff525fd09863984b6ae470cb0b000908869

SHA512
2aa1df66fe0c51b08f7657bdd1c20d6bdc63efc6628d82511d04b5421d1d993e4c21792f53ed10ddba3fbf781e75e1894d6d85a0dac01a9c3d7fb82eed885c5a

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
284KB

MD5
cc6d27967898e5efbfd2f0f756a6e985

SHA1
5f462b2372a06f351cdf78698857640086ddd52d

SHA256
c6fa00ca95b88a1eb3971f9c7de0a3f27900a34b72df629d3b1a20acdacb2ed7

SHA512
2d9109e0cf46de00cc3600a0408f5417ec52a68d3d5e35100af6de16c422bc74d14390c6db47d04728b72bc9a611ffb69dd747b0c0063a7a0e0cf7995eb6afc7

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
285KB

MD5
eb189c3e59ed895ba55c73d206744cf4

SHA1
e9ff5b1c17340a2961876bbde3be267c7e92bf34

SHA256
a81c5ab49080d3b81b6427fa62e98ad8370a95d6b110506aeb0faddcddf32f7a

SHA512
33fb4542b78d2c9db7db0766df8953f28acfbe4573cb992ae082f9783563137e9e31522e8d2a2446a7b2979cb1abc2f4cc14972b09dd852119379ec09ad44cc7

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
264KB

MD5
d53f6a778b9c6ad304237b16b8d2ca58

SHA1
ce52be19178f28ebc2153abb151e919361fee89b

SHA256
72592983f23deb24fa72fa0af87c8908e565b8445d89443c60a1668aceb12a2e

SHA512
beb83e050c728be7dd42bff183e82ff2dcbee9a724d3456100f9131bdd5e8c04ad6e4210d1a226206bfdb646fede4cf95e9fe5262edb9d4659541380a6bec37a

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1006KB

MD5
705ec860613ddb80b043ce4aef399978

SHA1
fe9a26aa3b367e4349b024b67ef925cb7146fef2

SHA256
8a9a06e868185bb53e8f313ea063d0ed9a0fa8b5334144f08fae4bed89b43b31

SHA512
820243efdefcccc773fb175fa4e25c4025fe1d7dc67f807e368f60d60f51ddd90589842c24154fdc970bc54321a6c8d8434a3e07766431abf6eaf4b8775e5665

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
759KB

MD5
7525c97cfaaa5c402648debf5de807fb

SHA1
c34f7999193d2b037b62350125d417dea8423a2e

SHA256
5e537794f30fd78e0113e912173544f9f6dfdae55795d877ad5b017e4d5c9ba9

SHA512
c807ce5d91175d4ba2068a895b9cf5382240cb98d8adccdfa9848b457b5b2f3783824171ae47bffbe461eaf80cf3e2ec8a0fd488910699acf40d9e68b0be521a

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
83KB

MD5
d61388d9eaae71d83e772566cb56dea5

SHA1
7b9dfbd729860ada91e9243b546f70e885c59af4

SHA256
2c9a7746386001e94ba4c0599a95c389623d12702408c90309812b2a42c22eb5

SHA512
62356e36c569752ed26dbe1f6f9917140956aebcb4b58f1e56d9714649f279316aa11f354fdbb919c6495826cbda4eb0cc2d80b4b23bb7d71c34035f3de43a17

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
88KB

MD5
c1156713cb1843ecf7cb81bc87bd47c6

SHA1
c60af1abcc8987863a8674883f5d338305f5c25e

SHA256
aac83c7e118d2e7188be726f7abb2a97c5686bc57000dc825274c80b24a26b02

SHA512
34ea2f2ad8598065e69d7279d2830cc7c2fee410be60a5d703c5bc4f774f1df9462db9bad2fedda3ccf6b77a76674597ab76037205406d47f20c4c3dc92ebaa4

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
81KB

MD5
cf20bf4075c627527e8314db2e548ccf

SHA1
02eb83dc2106e7fad0c40e938a81e32a8f17c752

SHA256
96d3c9fa9e7a114372d297a184f531f2714d97cbac4588554fcf95606ac83a57

SHA512
dd1f65f2ec986729e7ba3375e5bd9091daa08498dc906bcda40cc4368d93fa05f8f69788fbe03462bcd03bf0eaaf68de84765ae8c33571ca060f7f4a6ccaa354

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
84KB

MD5
e2b8e10011ae6429b59a5aa1bd6fd6e2

SHA1
725475921dfac307d4e672122fe1018d396c7ec6

SHA256
ee598ac8c94cceb100d4a35147d0b79581bc07271b4e8dc6a3ec6764df48e526

SHA512
20cf157f19dcf78c937b1034aed344f9aedaf84b8eefac1ef1c13f355b8cc1ef8aa14ef2c6afffcef615e031dbe70355791fbd4ee899a9a69ded51875b1e43dc

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
86KB

MD5
ef16f2479a1904600e624fc523529ce9

SHA1
eae37966af93d0c6f4e80d9e41cfadf8a1078752

SHA256
3937ef8417eec8768ce3910fe309a71ee51b239c5b3534028aa3bf0b6fdcaa50

SHA512
3d0f8ea22c5a5a76ce1a01d9efec6b8fd0302ff238f398da21fb85d573ec9eccbf2c931e7e3f7bcbbe0fe6f120a6af6f0d53c87e6e1af3260a6989d6e1265fae

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
88KB

MD5
aacde92b2ccde2fbadb98decbd2e122e

SHA1
f2d8f635c1a931aa15c230e226ad8074bf0dd66b

SHA256
e2b9d2e16af7f6b6a75db32d6ed7c500c8febed75f730d0c5ea57db17335591b

SHA512
5e8c9b8581333656f0d1299a86abd5cd4d2fa928c99ea6aac2198f972cdb080302851e88ad88103c253b87d7dd36e4baa12b92f3cd6957e285ccd82e88753f7e

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
90KB

MD5
5930e9c85718b0bcfcd882c149d3fb49

SHA1
761afdb55a4e4a6ff0df364522934a1c69b72f41

SHA256
f73abcdaa3cf90618a81e27f5bf11dff4aeeed635a583d9197fc43bccf5de69a

SHA512
99cfda99132a852b587aa6d2bb51cffe58f9a54cf9690c209b3e14c7cf46886dd9a52fcb0f4233abb8077af9f03f547a2a0a407c46cc166b962bde61967a2773

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
81KB

MD5
c6b4c258743de17f3f10b5dbfddb49df

SHA1
ba820f89d92a9df23fe6edfb1dc7d6ca8e556d57

SHA256
acff45cca6b65c2df98271375c86cd76463999b3196340cac0f4662b15eb4387

SHA512
5165f7a3597def8463a88fd3b993da2add8a19501ef758bf9931f02f445791be1a3cc890d8e18097fcad0307df6edffe8a909bcbf842e27450b8d3193321caab

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
84KB

MD5
951c706c099888520a45bbb1c56986d7

SHA1
be8afce128ea872cbb3210fcfddab79518de781f

SHA256
8602c6a269b82070ee2863d18b6fd11dcfcd3cc25d4cb4f1dca6c79cac9ff6b9

SHA512
34093395d900e1659e428fe771d5536d07b3295cee3ab1dfcbeb4d6401edaaacb965e096bb73c1ebc937a065efa2dd0f4aee709d92911e23d8ba99dbe46ae84d

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
86KB

MD5
964d3ac489d947393947e6c24b7723c2

SHA1
cb5f6c6818ae707db6d87307a5675db2c7d7ae78

SHA256
456b6aa9e5cce7c8d149e990bea230c6d8cfeea324ca1800c299116d46a1fcea

SHA512
ac294c71ea748b4f622de14d7760ab7bd8b846812bf4cf4e510e0462eb66fbccdb1a227745687aabf947f5b9e0718a71af5fb8ca87601591f6b6b233ae11bad5

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
84KB

MD5
9b8feffaa94e2002a33ddd1e85f599df

SHA1
92508ea98292f9cebf673b38b284d1b599f39923

SHA256
d390f89ca85733013fa00069b1bb7ce39cc70b2716acb2f91c397792c6c26bc0

SHA512
61deaaf642032a13071b181cb35430d7c5408234f7e0ea5cf03a9792e3b0754446b143bcadaff47caf5c3aea5b234bc409d7c45144bbabaa13208595513e1303

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
84KB

MD5
92bc8a4042d9960dac4bf5b3f49b860b

SHA1
c883f835ad96bb0b4148351354714b613535ca6c

SHA256
fe6a74d18a88ae639582916fc1cc021d2b68b163812a158bdd1a4a2d983dcb3a

SHA512
6a71b69e9757fa3240cfb45979dd57878692f0f13533e3dd1271c8705556a3db5dc8c8221008151cc5d6259ddf805e718bea5a87e34b3b124297d6fc69ab0240

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
85KB

MD5
8fa002a2e931a9029f1ce033eaa018e5

SHA1
aeb1c378e6177592e8da410d860f96c1f5e6e8c4

SHA256
cce7e5c4163841ae1fb1821332cb1a97025cce07e1e0b8349602688e8e66db74

SHA512
fc423362c4cd9e70c36369575512461dfac69463b3c2a0d9aa950abf6f87dcbf1233fade2b6f7fb819cdeb0c55bbd196a8a760ce57154cb3d6171f0b3134e4b5

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
88KB

MD5
cda92f7431401d70ea75c9e699e539d5

SHA1
e2fcaf43dc586c0ba65c3da8528f6f3a9f4bf1f6

SHA256
250ab3d91af93f9c5028facae08467ba5e35d80e95ded087b96078a09c393040

SHA512
d84db4eaac73521e939d31de4539af465f26b13493fdf86918b9c5497944b4eac3172dfd893567dcd05bebc1efa7594949888902cc2d5d6c3018a1bfce628aa0

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
83KB

MD5
3952bfd2a99313594729990446502321

SHA1
e6aa3564ef9eef13fea0c96c7cf5e0970ca62809

SHA256
5d33d264e40e99be02322d3d5206159bc136a1d626f32b3d8315bc6ccb801763

SHA512
ff35b31a98c819ba7c05fbd77d7fda17c3b1c7d6621db81c7b412169dddbf2cb93be4aa898849e9f1113549aa9b22d0748c677df54721d7b8b7a37ad3f578ce4

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
80KB

MD5
961de708ca03cba82adf73c3e495254e

SHA1
092baa749561dbfb489201f56c1aefa3dd93eef2

SHA256
252277fc51290b6b9c4693418eaf0cb6bb9bc2c46206cafb0da9c9e6c602af83

SHA512
f3105c08557c12deba14d00678fbed92bf7263f954b3d34ff8df37c31d0c5db7dc3527d0003ba2a77545b4e46fc9d62d8d14513e93aba84e0cadff5d140af702

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
85KB

MD5
9e59d05a4ad6517f93f8abb3a1941324

SHA1
bbc8eb5a5ad5fe762ecee2e73e9e695d325e15fc

SHA256
9d9ef9476ecbaf2791f948a5232c2739e734e2e5df96f179151589c7149d2372

SHA512
8a4e2e5aead03f0d85a6cc4762d2814dd5c4c9b11f4500b1d96174c2df8760523e8ee111073a4161aadd5b82d3afa9c2fa90dc139d04e0f78d443f777fe3535f

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
84KB

MD5
4530928bd572132c1d2565d69babe9f3

SHA1
8dcc093d1ac06f196d3e7945ab69e253c4e55787

SHA256
dfa1ac06d86c80e21f9ea1503ac96158b6b05c4fe634eeeb9ef6c211ff9430f2

SHA512
3a5b2adb084f7dc6a394588fea6c4af46e2bfa819f24fc0560229272d33b6a2f33c464b6ad7fa473b434d5126612c23a4e78b984aa54742380a85b3211bb69bf

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
83KB

MD5
90aa19277f1ffae3aaaad0c1d125b622

SHA1
e4d75eae8ff1f7d3b98fb523913d8fabb0b0c11a

SHA256
737b0ed2be0eddaec3adf45f63cdf178f13f80c6b22bc782a604e8a7cc0474dc

SHA512
e3779b6747aedd0071a736a7dad15e5052b32e5cfe5a9dd491cd7bfe12455a1358075353c10623d093248a11469b0c139f77bc231e6efdf53bea0e17283ac76a

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
89KB

MD5
f018adf2673435ff20c842aa1c70dfab

SHA1
8fc8966135d48967e8576ce8524c613773a14a45

SHA256
edf4529306337f8d746d5be069ede2f24fa85af34ccb5be102cc7adfa6bfe94b

SHA512
1addd10abc37af849a22aee52a0d316cfb2dce228c93e7fb19a99147b8b43ae4eeb232952d41c4c30e934405efbc15c9e9d82cf638acd96d788a8ea801506e3f

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
84KB

MD5
f82575355f827b9beba76b6621a6abf6

SHA1
9f0c1a29b5818ff6930afbbc36ea7b693bad1469

SHA256
d90ee7085717bde5d01df76c167a164497336b1fe1bb3bdd7040ff7664fc4578

SHA512
84cbd25c17039d79321b1906b9bfb35d3e7f2ab9b6d2d2cd8bce2719cea6dd0b5b546a7d56e7345b393174de890b80ced25a5ec9446c2b447d935c4c34c87a76

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
85KB

MD5
01c7b5ef0f4531c71a59d114cc843185

SHA1
f78053efaf8652109b14b7991de5140310261973

SHA256
a0c0b822259770dcd82f413cb78247047f9badb94b89fa2f32194aaba1b2582b

SHA512
4b6fc57cb545a8d6d97b23893e97f9c80cf2d8b52c0b4c258d080d79b18710aec02984ee579eb2895583afedbef6858880210475922ec5fcef6835c76ecc1cf6

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
83KB

MD5
d043de8828d006e80558c9b85442062f

SHA1
235665e27df801728ed5fc34a43528cb36f038fd

SHA256
7993fbb24f834e1059c46ecc791db4507b7c647b6c79aba8dfb1416afefd7096

SHA512
81c12bc511f2498c321d3f6ab7f952bfd937bdd56d112c0584773193bb0b84890eb97435ffd771d77b1fcc743d9a5992276cb01028801463d8f654fde2f1711d

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
83KB

MD5
597f0007ab3af1ab7fe5d60bd971281b

SHA1
a2037c6ccd7143c2d10924d1d84ba1c26f2774b5

SHA256
2d5a7ca51cb085083c772e682b47b387ff280244fc2227e022abe4911a1c5c80

SHA512
814082adb176922c17c59e8182181ec8618f29f32608d54288aa0e0c257a7883c495ae5654f5efc6d09ddb002289460aae188283f481a29a358b8e74b2aa8d49

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
83KB

MD5
882cefbcc3fb8b24e1e29ec01bc69fee

SHA1
04d0b039515b89c2c292d86adb927b0410ed854c

SHA256
4430f835d9813b7d6dff5be0dd40594367da3ab2ea8fbd625acc416e68902fdc

SHA512
651fba3127e0bf7bc7190b4bb952aab35c308f15cc4462ca8fe6a3448ef776229d831c21498a3b03e7e4704671688e7a7923f5a6017183c5239f78b4b7f476dc

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
85KB

MD5
08fd24b962d3f0a177afdfd5ac47c03a

SHA1
8968e74e0638162cb58c9da3daa08f5e4556edcf

SHA256
336e461e4c4deb5a40f775974dfffe430824af4c7fe797189581c7bf34eba146

SHA512
924d89ab05aac46af243990ed361d989e07e342f82f6dbbd88fe125bcd451469e9f4c06dc284325dc99fcd238f5e3848462f3977dcdeaceb930be1b9fc84a317

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
93KB

MD5
7037be8d01b73ead8bba2ee06b18cba7

SHA1
59b088678c88b03d6430f587c85206ec6b010825

SHA256
4056d56cf8377629951b113d0bd3ddef85eb12aec52aa6a9391c79913186fe29

SHA512
5f18a49ebd39b2986a7e42ca3b5e6fd571bb64395afa6942ddb2322f373672befa844ce7cb798f43e30312354044dc7ca11c45a6f53f065d9829e7a11486bc03

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
84KB

MD5
4b4e43994f00c3c072492642dd13ec9d

SHA1
643a4096b3fe87e12281d7290b8f1ae506106831

SHA256
fd38919a40e36f7dbe9302a2de24a533ff773bfa2f7836b37109e3b95b2dd657

SHA512
a110f327edb446f542de77e6d855e0e4b4dc8ba3bb7c90dfdfec93641569e55681cb588a37ad7119583ac44c76f777d1e2264a36553199e15c425daea1f1a93b

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
85KB

MD5
4401ce1f0e74c26106490de01ab9a538

SHA1
f1ec9f4721b7451b4bd921a6d94b323789966c56

SHA256
a744c3f89a767a2972447cf2a333de3b407c89de58324914cfc1bc45882797c2

SHA512
1cf6c519a25c710099db0146efe21b6df2d673a9f3d967ecfe23833266b548041b2e5df1801ff38b59c3cd2b7b9d51bf4378cf7f191a382eccff8a168e506730

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
84KB

MD5
7056e93d22a35fb1b78572410006b63f

SHA1
22aa9335b2165a31ec9326ecbe7e81e2c00c07b5

SHA256
4d4b54512be85f085c719f57611659f0af8681f3763d494076a6bf3b31ea7149

SHA512
cb3118c924d005c8bab6a2b8d1dba0c8ffde14228e7b49182e5b2b5df8aaa95bd443eef2cda5d52270fcb4a1c0c90d131e0ddf3458cc24f68c263442f9ff7c2c

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
85KB

MD5
c0477c0d2d7393aff49cc6ef68592f6a

SHA1
ac9029240182c39f8022af6bd4324ed0096a6b1b

SHA256
1fda6354f3f79ca6def5fc98e3737592efc3357ee09c3901505d0c485fcdfacd

SHA512
3d409406a6c752c39ccd699f5d88b8fae6cc9cd2bde19f3c680bc59c787c693da56ebc4826fc698f12cfa242707a906a672b60a5f6c707cf5f0ed20d46cf81ed

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
84KB

MD5
9de4d88bd56353ca847919c1d2fbaf64

SHA1
f76db862b89454baa47a2230fca079d745d89390

SHA256
6183450053aebb7cdc69600423d212e8e615f05bee657da408a4d2a352ec4092

SHA512
f0e27494f7a0fcd48ad4b5ba8e32e92f77d2f50aafb6905e3c5ab371f46a1c787792a30e2b08bdab37b6f831fd0ee023edd06aff4fe8b8fac6fcb53edc63c960

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
84KB

MD5
afeab6e3164eac2152beab204b2405db

SHA1
a6f5fe4e136000f4b4b795130b19d7571d1f2ac5

SHA256
425670778ac1383a72ea07b11aa74f7920d3ab2fc40be5363401ee7de0cbe270

SHA512
778e987f3dc6d525cb99bdb68c859e6bbff1dcec3287c440078f4aaa4793a2370c7ac41aad21a6ecd73a5d7bb5deae15a304c6b9c9aa6e26beeed837a0488694

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
93KB

MD5
65f9b8ecf47174491ad02f9b6d2c0688

SHA1
9c2f5246fc08aaf34739621ea8797acff4dcdb36

SHA256
dbdd4db0b6d2f00016e12f3fd53fa598d377b0be3b11e4bd4bb38b141ba77b22

SHA512
60b21c44a63a41360ae9ee32e7861997516a7b2dac820811f87bc79771f42df9c2f02a8778873f19b6c993dbaac2f995d7d44cdbaf69c4c5b6506689df262575

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
83KB

MD5
a93607b30623667b7fedad194d800dbc

SHA1
ef0c86cc4c03487389efbbd327db693a3db8593b

SHA256
831acb765f80f6f36b761182bf319c1b5d811db187244ce4c141487a50d0a8f0

SHA512
898f6b92825df5603ed92e82c71f029cd966e7d296143e306715b70bdd4ceb0e7b16be2efdbb06274f41aac0a6fe762af6b61f9b2a87f32ffe98ebd6eb005047

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
86KB

MD5
9c125fb68c9c2b6a42c21db1b178b8af

SHA1
f24947a7a324e86746547277b6429376cf21a0b6

SHA256
dc79ee8937850c653f6835cd1a570ae943159ba4b2c2a0d1c517bae2f0e40640

SHA512
063064e32bf15b21748c10edbe51a184108b9eedfde0ee8ac1cbdbbbeb55308aa96f3c2674d36b7b924570be6c89b68bf14d2018cc0f60d21c492f32e1cfeaab

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
87KB

MD5
b1f2831ceabe5912a4e38c9544cd23c3

SHA1
a498d669b1e50c3916f50aca67854649f0d93c25

SHA256
08e09eab0e398f7ebe3faad41747c5d28ecb5ab3fe91ece1deb452f369b89a32

SHA512
dcfa70b7af3d18c40c22ac3f8946515a16360121c165dcae1b2c54845f428fc2ee0eccb9c2b6b682687db001be328f15d562535d97d0b8ba00bd54b5327bce76

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
81KB

MD5
bcb9029009b4aa35bf6ee4430968545e

SHA1
1da6b4cdd1e4993d793a93c50a62bb3a4296228f

SHA256
932545ce1fccf68ec05ef93ca04f64420990d6ebc896033af6d66511f5a27bbf

SHA512
e85d572ff1973a0093e765d44c4af9cd02aa9838952a2ddd42427398fcaa16c26b9afd2dbb0e6db2b10f8e8b542712317ce6160f34347a93a95da35a7ca5995a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_desktop.ini.exe

Filesize
75KB

MD5
c13f9a6c1e0fa33bc792d1c35d4d8b3d

SHA1
d37a483359ae422f331bfcf5beae8f6b332eb4f1

SHA256
bd161efa33ce96b7a57858260b775d5bc594c5ae023b4f7d7da3c97a907ee1f5

SHA512
eddcd6de35c81f0e76e3c236fb47f869758560ebdf75189ef35c61c7b84edef9648a8aa7aa0e053c5bbeecee1f71decfa1026a1039b386930c3884303b80d3e1

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
75KB

MD5
0d4ceea11d57dcd6ec4d10086ab2bb6a

SHA1
844e86dc7ed0872f30229753dee7018249b6068d

SHA256
9fe2cf16ec00920144c866aa4c13c6749c5f2de51165a54c24118c1cdc4ddb5e

SHA512
6be6f8cff787d8ea358c75c9526f76bc29c3bca573d377a34b75ef5cf136ce632c3858ca1a554e79be80dba663a86c8e31fe508d83f4aafeba18418598008b56

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
75KB

MD5
9005a52c67a20b874b223c3a550cbf54

SHA1
d1d3e8708b8151f6597939c8251f6b89925f6cc3

SHA256
a53ca4cb8b1f8e32da8efa7be643fea41bcafc6e314457c6e20e64fabef4216c

SHA512
a6cc8672a1c7cfeff323cc91adebe533ad5038ede481158e4dabb35a58401188fa37219d585239b0dd95ef25b546b4a9733b5bdb0e9e15ed6d2bc4b66b58ab62

Download Submit
C:\odt\office2016setup.exe.tmp

Filesize
72KB

MD5
bb831e89a6754c71462446a9626569d7

SHA1
6fcb40d534e56586ca68097e55dedab84219cc7f

SHA256
eda33f861331ff29f1773cbf11f64fa935c37dd0dc5268cacf57135a7104e8c3

SHA512
e5fcea1adcb76d1add8e9dc0766bf0223a6ba8e9aabd789de0fa8301dc065d6ba4f5e84f648ef4602e9130a6cd68205e35c55ea6fd27027964c145bdabc72ce5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads