85b0a79907361fa8863e3803703987b9dfe8a6fed4e6ecf715d3002fdb5408df

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

20bb62206ecbc9eba55df9623c1fe8c0_NeikiAnalytics.exe
Size

165KB
MD5

20bb62206ecbc9eba55df9623c1fe8c0
SHA1

ac28f27dd28232131ef996fd760c5c910797fe80
SHA256

85b0a79907361fa8863e3803703987b9dfe8a6fed4e6ecf715d3002fdb5408df
SHA512

a8737a87d586b33a1e3ac28aecb67cd7e467731990ab2f6c60280d0510cb65703d38e6076067d6fa4b0edd026f67af604addb8749903ac6bb6097e6778229e11
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZ7udu0e7WpMaxeb0CYJ97lEYNR73e+eKZ7udr:RqKvb0CYJ973e+eKZ7udu/qKvb0CYJ9k

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5058) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
5060	Zombie.exe
4764	_python.nupkg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	20bb62206ecbc9eba55df9623c1fe8c0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Zombie.exe	20bb62206ecbc9eba55df9623c1fe8c0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	_python.nupkg.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuuc58_64.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Dynamic.Runtime.dll.tmp	_python.nupkg.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp	_python.nupkg.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\msipc.dll.mui.tmp	_python.nupkg.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationProvider.resources.dll.tmp	_python.nupkg.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	_python.nupkg.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\CLVWINTL.DLL.tmp	_python.nupkg.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp	_python.nupkg.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	_python.nupkg.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp	_python.nupkg.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_python.nupkg.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sv.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp	_python.nupkg.exe
File created	C:\Program Files\Microsoft Office\Office16\SLERROR.XML.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMK.TTF.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	_python.nupkg.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp	_python.nupkg.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	_python.nupkg.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.dll.tmp	_python.nupkg.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 5060	1540	20bb62206ecbc9eba55df9623c1fe8c0_NeikiAnalytics.exe	81
PID 1540 wrote to memory of 5060	1540	20bb62206ecbc9eba55df9623c1fe8c0_NeikiAnalytics.exe	81
PID 1540 wrote to memory of 5060	1540	20bb62206ecbc9eba55df9623c1fe8c0_NeikiAnalytics.exe	81
PID 1540 wrote to memory of 4764	1540	20bb62206ecbc9eba55df9623c1fe8c0_NeikiAnalytics.exe	82
PID 1540 wrote to memory of 4764	1540	20bb62206ecbc9eba55df9623c1fe8c0_NeikiAnalytics.exe	82
PID 1540 wrote to memory of 4764	1540	20bb62206ecbc9eba55df9623c1fe8c0_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\20bb62206ecbc9eba55df9623c1fe8c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\20bb62206ecbc9eba55df9623c1fe8c0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:5060
- C:\Users\Admin\AppData\Local\Temp\_python.nupkg.exe
  "_python.nupkg.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
78KB

MD5
75cb45b1c74cd6325eacdffd24803a17

SHA1
04d3c222fab2707a9ba5a31160e9188ad30e9c97

SHA256
1f3c4c136c5419359553b7cb97d5380e8201c2d9ce4f95ebb01661c0ef511542

SHA512
3a1c6837014fe814f3304ce03a55d1a9e60ba52431ef737ed995853c159afe0a63445b060f725b95d79c50da4e3f62ce4adcc5cebb72de7b56c5364fe95784ec

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
199KB

MD5
d99315ee85614c5422028471e2e9968c

SHA1
db8b14e2a5f9c8df00f6c3f78778800da49b805c

SHA256
56a0029e91026e20d0edf668e628e940092a6b4a6fe8098cb42de26fc29d3cab

SHA512
832de8208e64d1e19d9f232ef2c17deb76ef3a31aa88f3aef2f38d0b4ba9730868cbd622a9fca9573ecafa986f6e535ff562cd7bb9507b0945c4a27a5e882352

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
186KB

MD5
63159f2cd4f62e0ac7a9db496b2a33ee

SHA1
fb5b4eb49b498f58ea8c2ea2a4bf4200a5f3b880

SHA256
3b88e2cf079babd8bd5c232a49725ae2d21776d358640a9c3b81d3ef767186f7

SHA512
9e07266262b130ee59dd7c991f775cae01da0051e8e298e9a0f4f42829b78896f17539aa8cfdb82a249809d0492f1e3912d9aa8a164801983622af4623b2a43c

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
152KB

MD5
3141e06b8151939157f9e984763b8395

SHA1
493680fdc9326d59afd12ccb26e358cf00dc27bc

SHA256
5f7156693c943dd27d4eb34a9f8b401b1f946bd047e6b89cebcc505262ea5adc

SHA512
a1e7de4b930238f55dc52ccf43626a31f2259770c2dcbb0489b930a184f9c246e12911f1658037f98fbfafb684b306b0aa9c2c8030f2cc0c1f61514d9a3e3ab7

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.1MB

MD5
fe2be1a24e3766f933a8947dd9494fcc

SHA1
3065448f5a81b0007b30fee394642706179e6365

SHA256
a57b1ffc775a2023df03912d0398351490743668947a765530729d18e37b5a12

SHA512
6815fefb6372b96632c69186147be8ec6047baccf4e0d591aa8d687c0ce09447fa9efb9aba60b16106f314f042c3ea9d12bfe1279cc8881b92e691b64a53b238

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
631KB

MD5
37f9eb426ea560a0cf37a4989692e340

SHA1
2a6785d815c53979514bf805ae552f57c4455938

SHA256
bd5dec42c2e316eb3b0049f890afbcf2f890a29e008d9e34e4cae76a3de60fcc

SHA512
29fd1989f039cbbda07d212cdcf7a83d2f735922e3befd9b4e3837bcc152c366616fb33868598f4da9245affd0739c059ec6f70258d11aa974ee6df9e6e0b888

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
296KB

MD5
98b334cfaaaaf487509e457e3122cd2f

SHA1
f1b068deb9e757a8c97b966d23b2a63b8765cc2e

SHA256
859072896feca900e963fe5fb2447004ed6230f83c0e2d00216774c2c94ed538

SHA512
cc902784e881fa0a9022d3db0bc4905eae737a4e3153ec181c0d980e77db07e6f9236d698e5cafd0fa3c9a7acf21f637db7a1c32170715e51334a4a2c956580a

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1017KB

MD5
1239e54c421636615c501807e84d76d8

SHA1
190c80e0ec25602685965d5d9861cc0e78812077

SHA256
8855e7bb6aa7960453676ba7eb955f515e710c7862ad09fda6cb7c4f925167ff

SHA512
09c1ebeefc7fa04315cad271fecf476bb1bc696a6f2ab32cb8324ef914dd139342885e9ca33fbe886f9b14181d1cf44453d82663fddb9dcfc0c428365bdfb923

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
135KB

MD5
382881e3eb5f241ec35fd3f292c3755f

SHA1
e822e4121bc966e60b1aed742816c148d8162819

SHA256
9026bbd76182d23d9ca33ca68f964a09710fffa9d790567f8474851b1280e71e

SHA512
f64d4e247d1ead8807ec2b0f715fcb876e957afad322f538db5dfe8dc905a2331afa4952ec95af84e6d8bed414d1c5209c69885b3c6695c02f57c9d7d0298b49

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
96KB

MD5
21290d9a84d2191f8dcbcc66580d1e85

SHA1
a82659bb9108816ae5b1b1bd804c98af3abe5013

SHA256
e2d2c3fd82a571d074cb20eabd7954f8bd44cbd89e828896f8de32a034c296e6

SHA512
d57bfd32c51f0eb06bfa557ff9fc2be94c3b75cd73f73745555eeb0c0b16f14375d43b1d357a49b3b72fb2fb255fbdaba3cc5d2d15ca907313c695e5d0e01edc

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
94KB

MD5
06ca60965264f6d7525425b2966997c9

SHA1
d23f1a2484238c5cf0e7cf7a3c600f5e6cd59e89

SHA256
b86a3f733a99376a4dd3df7f2ae60e4b11d244962cc37dad888f32d747ecd1d7

SHA512
fe7b5ed43cdeef8c542d82e5a14cf14f4f9249d159bc77d0e1d6e825a10483915c708887225cd52fe0fca391b967062d32c337d1465ef8e406b2513451b9f92e

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
99KB

MD5
53f6a77755628b61d5fe96ceb547d3ed

SHA1
635da7676f04946dfbda6366a878a7d849408c66

SHA256
72221f6f5e9c8655919488b7e388166f8d45778d31c2107342bc480ad8babdfa

SHA512
afaaf6521ced0418477c2bfd1d0b685320688cfa855b4f4d65b5488178c16ce1cc10112b8fc9d76129aa90f6cd89c75ccb50103c4ab9854669de6a926bd7938a

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
92KB

MD5
873fb6de362152a1145d011a1e48d772

SHA1
63043aa2bee9a677a3b5b5090916e0de6b06ad4a

SHA256
46d64baaebd8a90f502bef4e09bc01235b962b7bb9fffcf8972c0479aa87d1f5

SHA512
af4442a1f8b64eed091caa9d90b94ba8673b948ea17b60233e856aea1d6b025c3701a311d12cb62ba1d861ba3a1751cd210b6da9c65a5b702796880c7d84e823

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
96KB

MD5
1223467da08886a0b4a751d0528da282

SHA1
e18f09d1d1564dac943c3605fa6c28b92f2c77e5

SHA256
bd865e993ba907189319b6cb554e0aebe3e20c72afe13549be8eb92bde67a33f

SHA512
4409a0b6e016e09215fec2c7473eb27874685cf10dcf36c0ae1e06edc298d0057f2321ee5aefece0f2b4c8ff533ed23953947b8d3c3c1cbb4125a5e670fccb46

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
98KB

MD5
7bd4c9b41e3668c8ce4dff8dca5801a1

SHA1
45e8513f47e305c926d6de99d4da5993ad7c0271

SHA256
db57813f7ab89c9537ad8f8d44d631e4e9824bde23c8967827d29ef8f12a0b3e

SHA512
1f5a72871c2596e2af07a0852e75a30cdf9f7f83d97b36ff24d19722fe590cea07a5a23742e7241e8d56f7ac26e8442790945e212de5a0bbbacb58cf0af177bd

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
98KB

MD5
85f9738421e81ae4a6a7ea5face8b1fc

SHA1
31ce74f3675b8b63ed987c1cabc81dcf208b7595

SHA256
b66c7e8d750f9e0583aec1548eaf5557612d2d8459664f4cffed9df4ac17a65f

SHA512
235ecc62ac72b148d2d83280630694e94b88e0e1d8f8e4531229b5ad1abe0134e91fd5fc69f8195449ceac09b0f975adedabb3d058e09afdcef9b8698af34584

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
93KB

MD5
0a3690ff765d6ebfbe4caf8cac5ceda4

SHA1
49331c51726d3f7a190ba121d9812069abd8bc10

SHA256
b4e32627d2a384a0d7b366c44dd6116fb240d6e4446a7df9354a5841f77bc3e5

SHA512
de8d0490dc3d8029d8e390fc17ba8083a1c63885c95fb01b4a65d7a83f038cef82088130e93ea4b62adad199d8d591b4d5fec5b8604a246468ba5e1c954acb20

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
92KB

MD5
c75c5ea9273641fd7616bf8024b210e0

SHA1
ee6ebef9eb24ffffe43eba8c912b93a4d7b35d5d

SHA256
2c76bfa28502975a0e587d651ae60205d4008d93c9563670a4ad28a30bad28f3

SHA512
e7f32e03cc7a874ce2c9eb76761e75bddbb01882adada544f97da78fb8dce66f9e4e034ba7aba29fc6e2584ef290620ba8d28e71846c63d72670c0116b6f9302

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
87KB

MD5
94b4cb3e7287552ebf81bdf77e3ec9f6

SHA1
26c538f2b71605089422e6a9790349c1fbf19fb2

SHA256
7c0e9fe944a0fd0f72fea2cc4543fe98f5d98575b1b8bc0ae4231232663f9e13

SHA512
89cc1ced33b3aef0958c527316ff4dd38fbd6bc49a9829a4a6cee61b4de20d476916db10051e4e22482a060d25bd5cfacf6f07a6979b77a99875a619dd2b3346

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
97KB

MD5
ddc7713478190d5c2914c2bb88819b46

SHA1
958c2182724efc9a24e0be5bf5baa8ff0c69a9ac

SHA256
1ab57a7191465a3f878498698a6126f02270012816ef8fc1cdd7ca448681b10e

SHA512
29253cc3f8a32d8300020132a67a829a6d2be017b3b7226dd6a6b371bf601b1882dc7310704e8e2009beb5490e9d7e51bcf51838a953732a0de271bb91cc75f6

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
87KB

MD5
5b23c3b817f37b5bfc54c243c84dface

SHA1
694e9b625ce189c0e5d5c6298d4345a0696ad5d4

SHA256
a05f4df39fe174a5dfc094b29f18e4bad88c12b0b91fd24a4f2ee9d3515d91ba

SHA512
db6bcb73a676da779eb692790f293e0d97d0b7e3ef6f5012bdbd6a0b91c0d4138b54a7982463b43465c198eb8830fdfe401149aca5b4b46cf4762dfebce8fd4b

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
87KB

MD5
600338e0feaf037401111ef28952a492

SHA1
5724a4df34f14b8ccd6e6eaad460c70c13b182d1

SHA256
063fe818796d0e7c8a8d7ae48eeb639483114642f396ebf83cc01ac601cfcb0f

SHA512
b3de12db57bcde040208c387ca28f8be8734c76c8c1855bc829ead5a91b227c9d5dd24320552c8e62b7a336a45f569038df1d75b675dfac49c86cc59fcf74bb3

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
86KB

MD5
c30038ea982ccd9ff7462d6b88c8e627

SHA1
6b12ce56b1c3df7140859aad1b1d891c7c68ac86

SHA256
eb37611d4dd973ace775001125a5ac1945efb65767b8933d790bd2d4b00823f8

SHA512
fb43c989de25159e5b8b3ecb4619faefd46297cc95e706fb2e31b373614ba7074455318c4489f9898eece49cac1717503c6fe2c1dce387ff130f789f376e3915

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
87KB

MD5
627f16062eb745a74c8c7847861df3fb

SHA1
b6670071a6879352ccfbbf52116b0150311fb768

SHA256
8d158a4ddee71cadbebb574e5cf3cdd0a5dd61b66e9c6b01567341004ee67dc4

SHA512
379fc5500d72ac17408ef03536db83013869f94135bc0a298efcfcdc2582e52299fd546ff998db0db197e70ee09432e896731bce3b3ed4d0760703dabe73444c

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
100KB

MD5
3b82fc801d5bc553a7d67c3c510063c1

SHA1
1efb86569796dded44a5566df1e2d5937c288a95

SHA256
781b20160a84e4ee9e3ba723c039a1be1e092a2f14b4ec398faa9cc3445a73f6

SHA512
015f763fa077f2b0339b5c3c5acce219731d287549c4d798bf5d4499873076b9d81027ef3afc8d61dd19279e152d06480d9b87aac74d5f6179906653abb5b8d9

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
95KB

MD5
18fd8b291e9d56317e82ac02a028519c

SHA1
5817a012cecdce528a8078db13b3ee1a0cc95f5c

SHA256
f450722be1b59fb68e0cb79dd8349c9115b15932d9972e38f54c7bd95c6a87e9

SHA512
df573eb5d50e473ed502dbfe1cb5f6666ae0f3f8aa667df63208e864f96d1b6f2f8764f0e3e470341081d6e3968ed94e15599c4e2b3f93dfaa7f09bee064aedb

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
96KB

MD5
2acbd092172b36fff709c852f6ada9c6

SHA1
82547a0a3e6ec399b0be0bb8ee411f3692150ff4

SHA256
407033088d951e796e05c79681da6f44f51834c3956da09d14ba29d3ab8c0a07

SHA512
e6071230a3313ef0c408696539d2927e73a1e01bcf8abe41c05c43299f46538a0ba9f3169c85bcb568e28b8e5d365749d72c62b8c6a17fe36bbd5f7fb47675ed

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
94KB

MD5
4cec147e1281b18c5de526ed8bea932f

SHA1
1cd2fc0bad986b85d0b813010b16b6c3a3280de7

SHA256
0f0ac01ea8e1fd9f79a916ca8f5049f1a3c857992f76dc6abc8de1c3f474e38e

SHA512
914ca7d3a12318503a906377af3118ecba4ec987e24e891d0564a3de4de729246b83f871ac0a2312723938258025d80f816bd555af4c4efab29d1a1a70b76750

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
93KB

MD5
312aa184e4bb37757ac29b5b1fde5db1

SHA1
baf5e2cc8bf276e362031df5ec503581ceaf2252

SHA256
939139ba12f1a49585bc560c6896a1ac130b8fd3d8377787d20b867d0edc0080

SHA512
4ea6abb933b29cc467503e3b2803ffda5f8032ef90c71fe30e8d8e31291015425b871e489495bcb82420886ecf7dc2bfee2bd00ee0697abddfdc67ffbe3a4ed4

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
95KB

MD5
7557ce90fa5fecabe4a0ddc839a04dfc

SHA1
732f5f1ee498ec22101d9f635108bef43381ea9e

SHA256
34771f786dd21d92cd56228647acebde519ea3c92a7eafa09f5ff6eadd74cebc

SHA512
56a02d8dd06acd839f6d98842caabed6410b4002a276a5fdfdb36a88ed7807a57f9a68e9317b5bc10440ecd88ff6c8c981226f259e8e6262ae160ec26334a081

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
96KB

MD5
cd04cc05ca1dbbc839a4fad9709fcfa4

SHA1
88127eb9f0dca5d937d096c83edc7f19e9b6b208

SHA256
b080a89a22fdfcb73bcad9dd9280c54fce5d4078e3930eb6608e14ea1321009f

SHA512
4acc2bc16cb1ae942041208eba58d89075b4a016a475a81928f4c82bec0f1e3dba1a655fe6a62fd18f38179b73b9d6902e7be838d0be3c26b2c097f4ba030414

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
104KB

MD5
11bf8adb1ea7cd500fd2f0270c715f62

SHA1
b8680a65b24f15835090f038826832710c350481

SHA256
e6483b8fadeec4256be9f0f67a9d54bd4305e1586460181a375111319358a8b3

SHA512
b00147d700692f7934b921f56a41d8d5737d683de5d5468361978b6c040c0d0f93d82590ee37efe01947fb894104df8962ccca1cf6e0692d362e1e10f428aee9

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
89KB

MD5
da70cd0859aad2e60d0e125cbbc2a924

SHA1
7bc25d7d28b6e9b73abc94d94795a4a6de3bb88d

SHA256
ae3ebf608c363d92784b280879a920dc93734b8af414822e0aedc04a4df1ba9e

SHA512
db6ffef0a795577979dadf72e278b01b47f18b1368bd363138a7a5080f61b611240633f850c65969001493378526a9c807a0317766c95b9ceed2f510ad6839d1

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
87KB

MD5
5bce31222a4589d31224dc318a421213

SHA1
f4dce7d81c30e375c89db0b3f2dcfab2b49198ce

SHA256
acd8fd4be8d508a693d9d2dfcc7bb254b3e9c9b8eca259b7da8365379921a512

SHA512
5891bf9aac06f2508ed4a2b53941140274bcf58dc01663d53f6363dcd7ffbab57fb865731b6563f1ab9bded7979ba3c0f03fa45000c4324aa5cf9d44ae81b43b

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
92KB

MD5
daa37fd0fcac763754935e5e601672c6

SHA1
c2ed4f012eeb8fc7f106920d118eb9ba676fb32a

SHA256
257d204d7ec1571b788909fb55686dcc463158e7110acb81d4d31ee37089c39b

SHA512
cf20aa5378b19b8f28d1f32e3cd367bb8afa60c578f1e7029990c45bc7de44fbb3c775b81e3a46332dafa98a932a0a862cd68ef78e14d30fcbb3dc0c6a4c1d0c

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
88KB

MD5
2184059b26c10208ab6eaf80edb490a9

SHA1
a2393f76e5d961bf7455b3e5c14ac6d8d839a3d4

SHA256
e014b24278d5cb41cdcb58042d4a820f1223b25dd18f05cee436913bd20ae6c2

SHA512
67499b2c7edea5cd9787017a70d5190b1a7fa09c88ffed219c6b3aedb8952eb701432e9fcc2f171016df3bbe0e6ab60f7e4f26115ded68fd0500409b774672e8

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
95KB

MD5
2019affd4dbe29a74ac1b0f2134a7f7b

SHA1
8b4a46f88f7a9c876d148e7a48c610a89125087e

SHA256
357dc9bd75063122a3330273a39c7a618371c5f44e79b3a3673449234d10c7af

SHA512
d9fe542bda20e4a9936f868ccdb7c3028f016e7da44714520805f2b67f707c3e471e288047f88e1ec170efac6d51e8e0b951705328d7338a4dc4b859d2fd9a66

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
12KB

MD5
5b7a3cd76ce32e54144493c75053f6cc

SHA1
40c5b2047c0e6fef1c71792862cefa38d86064b2

SHA256
c6e9ccbf0cd27a0778f3bc9ee234c54b167cdcd49c0660492f773c20a891bee3

SHA512
f28871bb6125c6d6a46fa0f0779cdf7b6d57295ee6ca7093af7c0849d8d42ee75974c3dfe826f731dd290303124cdd46d6f8b7b98ef2bca5355ff441bed91416

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
90KB

MD5
59bd1e842102904bd1db348e5d4c0263

SHA1
07418ffc85b091dae8a549d1086d4c7c26bce89e

SHA256
be373c31963eda3d493709171346196e9e90e2538bb4e4c39fecc7bcc61c969c

SHA512
3d360d73779c366aaf5ed9e4ef848b263882df2f3109b842105e74ba6f460498b41bd71d076aa57026fd9be61fd6e1e7ccecad5d1dd57cda55db5972d55d1381

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
94KB

MD5
584b144463191653978239a02d0cd8aa

SHA1
65e0ebccf4b9b1ca7b8d3f4dd703ec8d05e3e994

SHA256
9c0f3555fa28fd713c707c2fb297f97ecc83e85e0cb13b1596b135bd534128d7

SHA512
ca67180f5d0208d9e4dc70905077e897218f87ee0a27b33c511ed3d5658e4fb9eff5769996260254fa53eae0badd1ab7d9cf4119fdd2d40d109511388ccd1016

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
95KB

MD5
5992778910c78b77680ad6af6e6e4bdc

SHA1
8a365c30e6fda2111eb95c8caa3d9200dd09aca1

SHA256
36794f3ce5d8c268182b2c06f72de7cbb6bf7e01dd98fa6352c8183fec748da7

SHA512
e6ed7ca6c8c5e3f7da04e07298a84bb6f296788a1e419c1be3bf16d59aa657a47d8a047194d87fba55286b98b12d7bd304b5ba49a870106dbbc3114dac1b0c64

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
97KB

MD5
c310ae7ca188c444d86d117ccb7ab717

SHA1
d04c047db430d4c61236e119d87368ba60907ef3

SHA256
57ee48883f2faefdd64530dd6153517c92fbef0ab10443031a2d392209ca65dd

SHA512
b3d61f973c34ae1788dbca7c3675b8c3f5b51d52249fcf2303cc9d0df9616d757f2e9827930e909cdb0ff2d8e970676d351992ef7ff9ab1829e884c7ff860d66

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
80KB

MD5
35a73d8608fdd596658f942a72fb043c

SHA1
cfd09340920f348c657868f966a96aad64ff50e4

SHA256
2439c4753fd8175515bb8ce8665efb2307a78ed0374cc5d56b3b568edb3ce9cc

SHA512
9867a87604a5a7cfb368d3b9d190842db29ba984cee6b52dc3900631fff3975d7c9a2bd159782d4f33139d9c550634f0caf711ede236e8618ef3e3e474f6d572

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
87KB

MD5
144e0625a8271a122f747f503d089c78

SHA1
2f9b89fdbbe500ef94c57dc17d98c7bcb8cc87d7

SHA256
730af7e1beaa802a2012cf2310a19ee979b0863fcbef2605b62090a30be536ea

SHA512
748ad4e6ef5986b3d67ffa7a89d1955c5531efbe908f1edadeda249040ceee7c300f9866003537363d4ed61c1775d0de45d348c3bedb64bfd8227281323fb536

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
90KB

MD5
9ae8c6f9750db0d33302ad92886b364a

SHA1
d4af4895c8591e9a59a7f5c3c36c7bcee539e496

SHA256
fc5cf17ef79ef485e590f56edddbf4103984efe9ca06d26435d1c52d35dd753a

SHA512
84e2525a35493128083d9fca3357be828b067cbbb1bc450cd25d71bf4c2abe4388857498f5a0365edcdcf00e9c455084fa1714ad6a61626dfffdc3183a43f861

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
87KB

MD5
4cabc788f195dc144adac7075d9abc20

SHA1
c973d24a404e28692b7a6d841e6cf077638d2855

SHA256
8dabcb84f51401968ce93af524c27d8b9d90ecb5199791f1d990a40e0467169a

SHA512
ee463b18f1d7d09f903b450c7cf9f96ffa6fe05586f62a2a5f6a36f3ca1b88a6aaa921604d90ff8243d8ee0d446dbb7717dda5d17d81ef2e39e3ee6bf0d1e079

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
92KB

MD5
e6710245ac43ff9c2889ee5b5925dcb0

SHA1
577dfea65230821636eb746bb2e8b3752db66b7a

SHA256
4e34ee57cec7fe34b3403cea327bf0d828b7e23811169d75c8a5e09be5d9d7fb

SHA512
edbacf86faa8ee5f246519e9e9b5602bde462e3573e4127cc33c15978d6e58c855e95aa00c64ea6baa16dc9bef67b352e41a8dc40fdc13ec6c6693d56bfa84c6

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
92KB

MD5
f2c8cb8a8318435e4d54f98f1332196c

SHA1
d3ed94a52c08ea48769df858b71b5bbe13bedbb5

SHA256
3382a18afa8cc2432061f98c1fec445984affd5638d2c37a22e48d612509131c

SHA512
33e001dd16a3d377b72f55779d7398974101c1d45360f34522d086c5011597f3e7ceb4ec0165632c73d11f68975be25e0f8ad948ccd489471a9c0a87f384bf63

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
36KB

MD5
217c765b63c27175db881366ddd39ae7

SHA1
4b3a5a288132b5fdc54f243e33c23005ce1bbe81

SHA256
56a98b344109a695cfa6f224c2165792033d2d441bc35bd95ab11f7244369836

SHA512
0d86dde9326f0152f68aebb39dcf7c01cb67e80fb20d0be68017cf6e50b9676b777262ff7dcd9ec3720c52ec01ab326b223746ec1aae773cf47b6f40c6b7ba06

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
95KB

MD5
5f8662650b3a2650fef2e693360e1934

SHA1
7ada62dfeca5e151aae68afba8400f5ba8406b6e

SHA256
d7cc7e13be1b3af6f15e27f69da73fdc928c4068b972794125f7eb8f383cea53

SHA512
a1e6be88484c45c688f499a3be668a7777908575493ddaea7289487488476e940b36ab1a9bbfc3e8929d8c8d15689e8de368049a4d1a163550110d1e0e00fca9

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
87KB

MD5
9a8e0141f2648fe4507e4c269f3c5a2a

SHA1
ea53db1e5d5c3523309f837f04b93e9ad4d86f46

SHA256
d64df17c8fc74bc7f1dde43a9c002c9e14d6537a14891139787243e0e7a670a5

SHA512
e2c4cb77de0093d325d7d0fe688f1ddcfc995d236e27385c2b4ba76d8a9a1067097c3c625cb1e89e73e19ef46768bb43ef68e3fa433fefe369295630d12f7549

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
99KB

MD5
e88f10bf041c95f6d4c8545cf0efeb89

SHA1
f86bec03974146f9ce2b3323901b2b60999a6b9e

SHA256
33d37322ed0717d1618a7b909600b8fca1c42aeef57789c22e019e34e4a2a40f

SHA512
be4808c1c690f4f20fb8d063b287289e9f82098363fba52b6e67d5c5fa8b7364181fd6941adeb1c0dae7a99ec6d7a357653ca9ad1b8986055d0e742e14a0ebc8

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
92KB

MD5
6f3033c0f3d364a9ea810a57e95ad58b

SHA1
0881f045844bcd30d3029a49cc77e45cae1b7fe6

SHA256
49f82fec75459131fc8a3519c693b00618aa9f553a9a3ae9024cb78bd5507f32

SHA512
f33f5fb44ab23cbcae148740795b3bec2fdb3e5024109acf23be24a708c2bb36f924b7048649a9b164900d946644a40359315a74850f8f1f38b0afded94a19c6

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
92KB

MD5
b182c482206aa139a7d7c0edd75ceb9e

SHA1
a5ec0bc99efbdc188f0fa49012580019ab84c268

SHA256
2917c494f03768ca327c9ffc6df036b52b754540da5981012f5c74842f83d5ad

SHA512
c0f006fe464ff421ab01b0fa8c0c8e4984528e15ebf9687d0e7d9358d1b48df2e4109160d3812322ab796c4f9de049c8d3f126497ec4fb0d14ecfc168fa6c83f

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
96KB

MD5
97977d9c380436b7299862e14818054c

SHA1
8fc25e78c6391762d707dd703426dc8d73ee8abc

SHA256
f6805311fb4ab30ebb8c95959a71b8e687552b0c8c35f57c94b2f631118a8586

SHA512
f197c4759390e3ee17115f44ebf675fac8ebb87c95e3f794e7cfdd2728d7343ad4730220bedaef491d9127b5231c5be0a0ccd7f455925780beaf95405dd184dd

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
87KB

MD5
12741b0a5872b5a1d801fa65177b9029

SHA1
ebe63896c9f3d2723dc7108ebd136aae6d1e80da

SHA256
786f9eaf7eb43965402536a09102fb42ba6c49a0ee3ffbf57bbe9bf9f98db159

SHA512
5880fb5ec8df55a446b4b87470edc24df44c447f14cb28da592fff44928cfe12233ce1fe2a9a5fd43ecd46c0dcf3fd99419eb41690ac9d98cfd94035d14e1f6c

Download Submit
C:\Program Files\Java\jre-1.8\lib\logging.properties.tmp

Filesize
87KB

MD5
624861fe040826c71b82d959ec706c13

SHA1
9921765571edf7eb5299ce21a494c6b98ad0c41d

SHA256
0edd7652086bd2f928b91a0f7bf53cf0cb2096648b76ed672d8b244bb6f1c7b5

SHA512
119e27fe6f13f09fc68a313d687677a7ea1d5f4ca4552e5554eecbab3439916735eb1c2af11b0d472a05a11f6224c4121dd5512132ceceb685118210afb00b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_python.nupkg.exe

Filesize
87KB

MD5
3f65c18fee2a92019411b65c61efc20e

SHA1
9f034b8f92b7088471dad2c93d07eeaafb3a3b79

SHA256
5ed24de8429c6971b2b2000bae970c7c6816f64a640a452e133dfe8325acdc87

SHA512
1d59b48ebdf5fa1b3bec31c495921a36a671388133a98dad3cb1ebcf0b3372988079eb9087d7d7806f9d809324821e305c0f45a8604d94b5006fb506d6161e2e

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
78KB

MD5
323f7b3893d906b61feee5f4ad5d0347

SHA1
000d7f74bf658f576531ecb4bc0bbb9f968380ba

SHA256
dc98c5a07cca4964befcaef54acea9aa08f4ab57778b85c92cbb08ffc6772c22

SHA512
09ee7744e2f0efb54bbe973f6b939804aae9bc338ab63a68d88376196322d063731c271e1e76c546b4ce4096b495a2f8537fb178ff108dac90834881ada055b4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads