d9b253ee25b74d132850ef073e34648929f3c2199bf3667df295312969a53d11

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

891a2ceb8d30d3471b09c0f7129a9c90_NeikiAnalytics.exe
Size

134KB
MD5

891a2ceb8d30d3471b09c0f7129a9c90
SHA1

8be0c4fed0796240dd88d3eff87222744b58c87f
SHA256

d9b253ee25b74d132850ef073e34648929f3c2199bf3667df295312969a53d11
SHA512

2774c02ea6cee722b8d589473d798ec573f7800f20f382093632c00c008d41a09752b12e80363d7097445b106b291435e7fe1f4d77ba529f73c1dbd8ebb804c0
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBP:PqFF2Ie+ef1qFF2Ie+efK

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5214) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
232	Zombie.exe
4440	_06 - Pictures.lnk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	891a2ceb8d30d3471b09c0f7129a9c90_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	891a2ceb8d30d3471b09c0f7129a9c90_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ul-oob.xrm-ms.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BSSYM7.TTF.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-140.png.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\fontmanager.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-140.png.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Interfaces.dll.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	_06 - Pictures.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\invalid32x32.gif.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp	_06 - Pictures.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnOL.dll.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	_06 - Pictures.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 232	5100	891a2ceb8d30d3471b09c0f7129a9c90_NeikiAnalytics.exe	83
PID 5100 wrote to memory of 232	5100	891a2ceb8d30d3471b09c0f7129a9c90_NeikiAnalytics.exe	83
PID 5100 wrote to memory of 232	5100	891a2ceb8d30d3471b09c0f7129a9c90_NeikiAnalytics.exe	83
PID 5100 wrote to memory of 4440	5100	891a2ceb8d30d3471b09c0f7129a9c90_NeikiAnalytics.exe	84
PID 5100 wrote to memory of 4440	5100	891a2ceb8d30d3471b09c0f7129a9c90_NeikiAnalytics.exe	84
PID 5100 wrote to memory of 4440	5100	891a2ceb8d30d3471b09c0f7129a9c90_NeikiAnalytics.exe	84

C:\Users\Admin\AppData\Local\Temp\891a2ceb8d30d3471b09c0f7129a9c90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\891a2ceb8d30d3471b09c0f7129a9c90_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:232
- C:\Users\Admin\AppData\Local\Temp\_06 - Pictures.lnk.exe
  "_06 - Pictures.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.exe.tmp

Filesize
134KB

MD5
10d56b814e9f2381c2af97b5c603ca9c

SHA1
55bae5913dd243993bfaf1eb69e20b74b456d524

SHA256
67d36bc08e3f3f5117b25c9e9fae4091ae0eb22daea6f986ad1327f60319178c

SHA512
20c5ef4e99d46c8b70c4fb8133a4bfb79d5b96cff3544e636df4ae1150dbc394b97b299191d016a9e0beee2da27b4e41cd8bb4cf766b2e3e8f54552bda558f95

Download Submit
C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp

Filesize
67KB

MD5
0446a4f982bbf40b8e9815b9be6d80d2

SHA1
672b5662874223684f2a0efdc97f3f8e74c848fe

SHA256
980f96609832ffe1c271a33a78ae15aa8f8c40f0ed93971c5f27a87c116ab6a2

SHA512
66d3fa677e28caf91fd78e42f1f351ba1c363388a46ccd3147da2a2db3e1ca922af6619f1098c869ee6e27d05b28b75faae63bc6ed15d575b8ff92d8618c4dad

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
179KB

MD5
2701f78425839816faefe15861a69142

SHA1
4f9404c39c154e821f49940137a5c129cb8cf8e0

SHA256
df301786050cbd6f6535133d87e9ac8db1d9d1540af2eb13d5bcc32f0e571c86

SHA512
fd0a0632ff52d87f5bca10d18be5fc73f6a4a9ee80f6628e5f4774066b373abd1064bdd8b7e6e2cf1f0cc30bf7576d577dc1aeaab23fdc19a6c555af21839210

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
166KB

MD5
8be3bba0605d7a6fb8fbfbf66f620821

SHA1
2b7aa3de8012b6b2b1dea867f145e66174e26328

SHA256
eb15438cdb07739b99d9aa404b4d3f8b2348059315733df5fb3b2840845c2091

SHA512
96d1c96ea4d8485cf46b32b5a2d2e6683959014f1dfdeb11d7acfa53845eb97ebcb0926ecea2b102e7622cc68d72df2e541b95f253e0bc898b25e4a9d8b7a663

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
39f09643417b9ac45639dfd2bbbdfcec

SHA1
a9e4bc0414a6b1b8ee9d88c01482821990bf92b1

SHA256
e0d53ee10e9047efabdf5cd8f975f512479f54c3ffa89d4fc53888867973c705

SHA512
674f10dc7b6359c0e862d52f58c1f48434926e6c1234dd7b9f773981ef43b6a0d8a04bea7761c6fedfa9cbf3b4c8edaaaf1966e432faa143c436e9f638beccc1

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
611KB

MD5
ed49473f0da645c0ca41b37042473cfc

SHA1
bacb015e73332717629869aae0ab353306654f20

SHA256
88b6d417ec5147fb2a2a5d6fbad4adf49d52df38195caa336580792877a4ecde

SHA512
942dff288e101b11b95d87390d36769e494fe26b1337afae49e6751659dca7530ec410d5420f44bfe90935ffe3ae0d3c1541b061458065fa875f8f1e2b7c9ed6

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
277KB

MD5
b38cdd4a9d3f738756f41b00dca7cee4

SHA1
81e3e7c7da611fc0cb175fd475751df1ed32592a

SHA256
f1feae952184931bab6136c2981e3da84cd947f69e1e8821436c7a4ea40314c6

SHA512
b84933ea3acf32ed0f687e3770f0201480cc682d3d715a88c3eab44cf5e85fa7ce751e5b9c5e00117dbed34d6a7db0be14f82ff2acb1aa1df9fccb3d92201735

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
998KB

MD5
ed14bb0d60123e4ab711ea36bcf67c62

SHA1
59c5c8eb595f87bc5e09bd0fc19730dabaa870f1

SHA256
45a46a57e23e004fc5749b07eb95b211cc8a290a91ddfe969d47518785aaf17b

SHA512
3385764dc0c9a89c18b1c21c49a691402e4d295ba27a650fce36d55a4d1e5dd2529cef3e7bfa86ca458b1a0fa87e8e1efd6bcfdcb99571a69293bda0667a26a1

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
751KB

MD5
1e91cc91ab8258a7a189262c26256f35

SHA1
58b43c62e00f27c2b39d200aca85e68933298785

SHA256
3890cdddb47e4dee9df52aa6bdfddd7ec29fe19b16065d829eb2cc53f8b7dac2

SHA512
b16f6ee413b940643c957e86fa8eb5bbeb3a5bdbedf83a6c341229fcb4a1a12df831766582dc2802937b4b27ca5b71e3b5b4e6cd3225f78fb29e24720f83c3fb

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
77KB

MD5
718cceda54838eb43a1837475a119779

SHA1
285399fda8d2a10fe1614f6f3567410ea400ca31

SHA256
0e1aef2e9de753782ff3d2e2c5b739cd4ef239554c83f832746f412e993a59f4

SHA512
32913994cbae48432dd2883b558af409412432090c84b8507e2d1a6bf5733ef32183cb17f3f7b5a08a39af7d289bfb45bb8733d18d34f324b10565006522cd9a

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
77KB

MD5
571ee9d7051e98a1c7319111ad0a4032

SHA1
70d3731b29c3f6a209275a1d24cb29ea4c19c876

SHA256
80a75a994f48a9e041a1da21186b4e95cbad2e423279c05df8ac6e7d6154904b

SHA512
37f1fc1c9facf8bd1748f371386f68e94ea51b474573b11f5adc23c5d0ca7148fae29250299fdc2e7cde624f8c45810ac8232666f4d35a1978d673a662e9d9dd

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
78KB

MD5
53f8c4070f2acedde4fcf18ee54c3c64

SHA1
2a43cea82e34ea4428c62431e3409165077e9084

SHA256
844b7ed7679624377f75eb9b92d67081494bcf58d4866b23af001e055be5b293

SHA512
72d8b140129773f59528aad5a7e6700ef20707789f33f896dc08b31afa9b0645f0a695e2dc336f14e630aa547078660a3032e394bc291a229f7b0fbf4d45ec35

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
79KB

MD5
6d1f2e934ba02c9a3572e6300ac3a4bd

SHA1
dbe944e67763461e6c2371399fc2d98e99dbade0

SHA256
7991e5c72663567d43d8b389d6769a18b0910f7fb232aa965ff85d2d1c1376f4

SHA512
397ab569d415c17d2e20055d686a71662bb10d7cd9c1c0629ba58a3c656464fd516d481313077efe1f961db8a38a7c6c479078a4db369bf4d59638858d19754d

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
80KB

MD5
d529069fa10d2537d9ab570b2a5aa6b9

SHA1
8367c7220523ca88318b7ed149287d60fb7d1b62

SHA256
6ab7e91bfe3fb2c6d77452a005154e0a78ab153276915dbb6d566ebd88fc2492

SHA512
fd0e9e55ac9094f1879040d3e690ec77dfe8770b83c0594dd3297bf3c2fa5433c614bfe3a5237aa234cca901bd6d7b79b92450746e7c9bbfab1373259e14ec73

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
78KB

MD5
b71796195c191c4fc24fb7a2d2951b1f

SHA1
3eb3f754087ddd216127c29cdf40c5962610647a

SHA256
f4a4abb735ee668e9c2b3299dcd906037c2ded555edca4f963fa62e86e4941d8

SHA512
4e0906a78195bf550682eccddc44d6b2ae4752453d8486de58bf22b975d8d3c2f84d53c1cfe09e1ce6bedb6761ac0850c161707fee0140a849beb8dd47342416

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
72KB

MD5
0e00210b98572220f1dd240a59e29cbe

SHA1
7a7f6131b675d33697b0f9e8d810ab6f43d54036

SHA256
c0ab085d1025db3f254f90ddd603b69b55aacbc9235bef0c4dcc50fc902f2a6a

SHA512
1eff4e75c4990507c6bb1ed0f51ffdf734cee7acaf6f66bf8c3aed7ff4720a8e6101b066bf107462eda75739511ae5dfd0b6242db314bb95507257c2989f0220

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
76KB

MD5
42ea34956f3cade5d1729d6bc6db40d7

SHA1
cfb605fa629bc751ef38db9fd39b5f279d686e6d

SHA256
f207c0b9a7651004aacb9664fa9afb742ef0f4220c356d0fbbb8c4ab8aa5cddb

SHA512
16b20611fbe885ca3ded036624215e9da4e287504cb501e4a683770aee233e755e0b1fcd9b7a153bd8d7c289bfbd8f37d7f3319cc86325be2b771f3deec11a5e

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
81KB

MD5
6b71f9c40f151eb560c25ddf714d4ea9

SHA1
db8e7680dc2a6f2c6db3c8985461e7098e237196

SHA256
36e6f1eed17f10423559db91ea3d7139cad6225a201d2155c785505701961091

SHA512
831da01467e805d70689e47c4c6379dd3cf4ba21d7e921edef43cbb90992e5f107cff9703dd322f7b289f3b56597c4eb54f7208f78d37575beb14c9ce8378160

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
75KB

MD5
7771439a050d11e11fee17691e958753

SHA1
19c4f226111b90042a634a360d378dba6ed130a9

SHA256
d5e4c1cb2811c38272aa891be097717b4875710de865de521edeaf4ebebfa0c8

SHA512
779924720c5c567601f1ee6f2180d99a7e3acd8de63e1d9d397bc07bbf3a99777c009e3a28c17499591b97d3659eb17aa677a4d27439f63b32bd87af43fe7401

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
74KB

MD5
71e2c009847f285080ea110b5ac5a007

SHA1
45bb4842d9efa5c6c5449d44fcc5d55831143e92

SHA256
290cdad16a16d4e572a1d6ff9a712182b8c220fedf9d17dc23fbfa300186cfc2

SHA512
61ac11b66cb9a718d776a3c81a657ea6245816723d00307a64908b480ea8b4a671b3d6494d2aec9fa1b74f61124db80d276334d445b3fccb9caba9f2f4664323

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
77KB

MD5
0fc2d12305f42ebe233c72a482f6b100

SHA1
1e250c23d6f8fb0690ab29d4e4cc64b01e5a68a6

SHA256
54b20e1273c71a7c99e8eded9f17e6056b61f996611e774be09b77678c265f71

SHA512
2b246efba1d31ce3dbdcfaf8337c7a4d26f6eaffc915d27817eca6bdc4db8709f7bb6f994d7cd3ceb24851d3647c2a056ed9bc638b1c7dca74e593ad0bf48e5b

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
78KB

MD5
3fe547c4b3737c45be54317496882126

SHA1
f5630a175f9960c6051297b52d93f16c70b35945

SHA256
04e0e75194b8885f16a6258047313e5de4ce081196341502a4b8180deae233f4

SHA512
1064046826f3552ee4601d19ac275ad3cdaa947e39af88c8c631f0316cae05700cf05ae77f2da4602ed4d5225bf3321f1e8f401521d16531f1ffc055939d7d36

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
77KB

MD5
29af57ac554761930a1b121f999d356c

SHA1
dee8cb49e978999a9d3b57e83c1394b00f82c632

SHA256
fd83ad4714618aa19d7ba05f9ec81489d74a1c1a150636e183c022fc2fa991f7

SHA512
f58ffaad25677accfbfb6df318b6a0e2040142e11496eeb202d362a1c5435eb944a72ad4f7c87c87ace77943656240f7310d7d37f9aeece73e430f6bcc598bd1

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
81KB

MD5
d41e7ae3825c527e9597191e185958b7

SHA1
925b9acaa84b846a6046d81a039ff603d1c87161

SHA256
c3f9f5ee7fd19b3f95ad6bac8559fa35bab2b623b643e392d355b845139790a2

SHA512
3cce772fc256caa33e741f956c6fbe262c870bd58be0d8d7dc185c053713ac263fbf2795a6789fa3ec342e8a19a3d0911e154ce3febfb7a435d470573ef42e24

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
76KB

MD5
20210105e4e1ae76dbf7121e5e730dd8

SHA1
00f81c160a4caa00deca141e59683a0499e7f2ba

SHA256
bddb4111720d8fc8a12984448648b521412e45fa572dea7c9d6994a656312af5

SHA512
8081c70f58496b4a9c09b3b417d135894f360519fa1bf2ae36a432cd890f8e53bdeeaad34d3536920d329873e8168fc8d980eddc538a937e5572dbdc944c4719

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
77KB

MD5
a1870fe9d96f14d17f40533cffd9bbed

SHA1
d661d7fda14efa28cbfdb0c1a862ed03357e22fb

SHA256
26c4a3ada39e2d3bf35390eb4aa9fdded67e90db9d1bd66e6402871fa0353c7b

SHA512
eed5dfe22915cb7d9579a2103dfc8aabe493fb1f2bdf76090a75704c537c6baed327a0d1aa23acd9607755ad3c666771e7c4f06aee1e895d0ee604ecbd48c120

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
75KB

MD5
318f66db611e9365f86a4af2b1783588

SHA1
2792355337da5b74113d50a052f635f6ad1ea60e

SHA256
b6983d559a71aa983a4a6dbcfe6c5dcb8ab0819d8131871af9fbfd77a44ff24c

SHA512
7138bd25196c9798d46d6ea77b1b064064bc1ef0e58092a5be9fcaef56237c9d39e432c2f9a70dcbf85b5b448babba896ee16b5a9ef293af46088b7f7369fa7d

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
76KB

MD5
ae198f510ae691642e17063f980676fd

SHA1
f9248b50f5e9a4e40c1cf2fd3bc3a23764cf61c7

SHA256
729df1f555ceafad88b8c29a18cc9b51a7a128e9e8b1427fee99607588c7e04b

SHA512
1aa42fa0bdc9b79f2242dcf6ead96ba442a506c8c0ba0ef7d44a4c01151daae68c3564849d4a4ab0f0a1665c1c058749caec497c5064c10a9c6d7987b64c0d00

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
79KB

MD5
93e9e45a9ac80ae5e251cefe3e7b14bc

SHA1
e98707a8e994a18d582dfe67b8bd66c262401b76

SHA256
d92d3b991d76ef89491bc755a1cfdcfa79e79d6c10c7788abb10dccc6222831b

SHA512
a1f1fe677750bc4bef774e62d9dee438c4992b9c21ca7d743874c0790cb3066e5e13841c6bf12656437cb755fbac46e25b0f599ee01517b08afe9b7bbfa8a0b1

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
85KB

MD5
dc45e1b9354da1df63199b7dce2e0095

SHA1
a00a1074b8faccef8c0cc7a5321b0ad84c6f520f

SHA256
d0b49cb1339d66a06445047dca654cc54d4121c005648d1058be2753dfdd9d47

SHA512
ca694a46a43e0587a29d101caa1935d05d7788f23651e236549049bbaf81fe7a20496218e20103744ef511e47b78f7ab79f5070569bb65045d4a6bec1e3df97d

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
76KB

MD5
916dccc5497704699f2373118b0cbc85

SHA1
2990ea1ce5ee693ceb11e3e83732dcf72bf9e571

SHA256
878163eebfb6d418b44345dd1e9f3d933a64f9fd4957d470eba2a060992a141f

SHA512
51181d212d14a6c734042299c20ca54620ef7408f872cbcaae7205748a4150e1c61a072dfb4b4d8514af1757966de9228a9207f6b65980be8f949cb41862ded4

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
78KB

MD5
ee69fb52d0250829c0c32a6a8a319052

SHA1
4dee2db9a48a833c4b1b695ea1ebbf83d4e36826

SHA256
d021801fedd9a3f7dd24d8395c578d75fe226f484e49463b0c79e3ec19a46c47

SHA512
8477331a369eec6a435c2cf5eca7a5d2dc19a750f4dbedad4381740adc9f09c483ca307e36a395708741f346c276059859160494c5ff220728a85b49fc34a966

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
79KB

MD5
a5869f1c1568c5fc5ac167680bca4b8f

SHA1
807542307c22437faa083e4a0ec9b1063bfaf7af

SHA256
c3e4cf89ac931962a26321e65c13e87d68d42bce2762f58a7cfc5b24f77c28ee

SHA512
26aca7eb8e3d25ccf78912f108b0bd90518db7d38a4fd41538c8e19e5df9d26f7192cfca919d315b70647f33a04e65083bb25632ce80c9830e3f80e7d6726ef2

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
73KB

MD5
6e5e04f4846f80aa832149fc0944a02e

SHA1
8e8eec69f70f69ef061f92f8fdf471360a9bf80a

SHA256
7eda0cb3dc971341306e82a4ccf16433bfe0fdb325b8a0fd197c6a53d1611a45

SHA512
72f99d48a54e4e9a3a5c0896c43bce2c13fa77ace51aef40edfef853c1a78b907898376063a018e298d502238a7c0bda0edea0c9dc59bf4058a1ab748f60b1b8

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
79KB

MD5
6d11defa29f2d3f738ac6c089f58141a

SHA1
292778bc4baec47335c21c55edf5573c4dc3de28

SHA256
4b506dc2416615e896473f809bb9f8483feef2dbe619fb9dbbe915d9866f9f39

SHA512
70e5687cd3b2323a5bf4ac06dfa9b3f53f38c0f148b020e62af1ff1e3aaaeb9b03aa007312face5bf05cb0537264c867e3514c6e8fc8cdef100d5bd8c9dcc955

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
77KB

MD5
57f6221f8f345fa0e919a677b1200422

SHA1
50b5a0f7783f2d6a5a315607ff57575f9061af21

SHA256
39bac3973c10074c98fcf1c5539f43e42507db8b72fb7a3a5dd6b1c5fed3df4d

SHA512
052d063e97c0db52cb16ce88ed79b86fc61fca159b2ddcda77f83ab430ed09c9a94f2ff025a067725adb72c49de9b244147729d4ce389309115e32220c170b1e

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
76KB

MD5
e76315d3559dc8ab4e868235a0c3a975

SHA1
eb0470332c81ca9e81e1060809f0f8dcf7b56713

SHA256
9b39d8b8dfa42f05531771504f4dcab43a7e649058e703b111a46587a0ba0938

SHA512
7c3d038f6726172c5c2d8added57118cc540848437d84f019c0909f97448895d4119831312575c2c98f846a2c22010ffcd686ffd1b0d203e32d4d753837f6eb8

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
76KB

MD5
64ab3ce53f2ad57ffd33106a1f4e925a

SHA1
519b5ffcafe90ddc008397b0e6ef1a278c592832

SHA256
12f9410c8c31edde7bb5fe5a2fd4c6a65a2191245a8c62c66de2bbb92046f7c9

SHA512
88f3f23994caa72ab35f409b9548331a86b578a1c12cd9904ea42f7658cda0473d0cd7313af9286dccbd1d9ecab5c789e448d4e9c529277e8423bc817cd26ace

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
88KB

MD5
05ce52a3a02518d3462d879c89bf3be0

SHA1
cad8ea248c115d5ff61e7c0a46a0827e34e3271b

SHA256
9a16cbd0deb8ad535e971898bdb086f0e488f04817b4f38290cbc2a586e6a910

SHA512
99ede2acbef4264d88bc5b938b8f7a45a3be74a7807e142d803b989376bc6e77436946f4f7b27b1d528da66840baa977472e6ee29f83598cd0135d661b819dad

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
78KB

MD5
9361754a36b31eae58b9ae440fe61892

SHA1
4dd69a017ee9e717975a813d6ef645c3c52e329d

SHA256
282bbfca64d4ecf43200735a5369cad94157daf9412d24a21ffde04b9124ef4d

SHA512
c3ddac40ac21f0b251a8f01cfc8858a45877365f9a2252df4793a48f3e3473c84661938e78513fc556bd556135360c99aaacc3ad77e8811ee386abcbd4de2ffd

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
72KB

MD5
2b36ac46b83c11d635614fb64a8a0824

SHA1
ea456cbf4f1071c44b565a9ff50ecea85f17f527

SHA256
b991074466fd416a8deca7978668aa9bae5d744c4b499f89f6e5482f05b28bb0

SHA512
2e58fc3b718261d0a15c33dfd8bab10524f54137bc2afb4411ba7de803216fd479779e8c50cf70478836a67d5c76c15fb8d716ae06efcb7af297a64ec0fc5773

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
73KB

MD5
6cdd29a8a7652ee0c743872159139fde

SHA1
4ec6d2cb001fcacab58ebdabcad602b7f6e2045f

SHA256
0521217897a76bd6f2aaf0d50c7fa2fb11fe11652f76af991c2e980cd43f3aae

SHA512
e5f2d9a302f3d52f0f32cbcc2d61b5d0dcf853a62e12c9a0f0196fce86e49431e6f6a90562134cdb320b2496505cb2cfd4843815713e84c9f85695b7834b8f34

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
80KB

MD5
5f2ad4c266d5f45a4efa22b2c1518e7f

SHA1
08da1b7d2850872717aab0811237a1227cbe14f2

SHA256
f7e28f79504833b1294b4e407a0e79931cb5ef7fb73ff48becb944a279a5f22a

SHA512
342b43b61096c2d682aca88abce4aeee54b8724f5b0f57d0a057c5491372ea57fb4a72adb32dec41c559f324a02b4bf0998688c0ec76adba0ccf3328dcf94c2b

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
73KB

MD5
e4abbd2a8b3e6890c5eca6bcd2aa55e0

SHA1
a420fcc0ebed04670ed4f50b176ca9fc784c2c7e

SHA256
dc7a6485b72033d40440446dca27410578693586515571e58acd89430a7d656c

SHA512
674a56761d9ac60faab8e73589b08c21614d6fb34d017987e0508a0035dae20894d4aa3089207ec13f364731788c21a8f05b97df9f67a3beab4c7fad79e76c65

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
82KB

MD5
67dcad673a8115fc31bcf8167abf88b3

SHA1
7d5ce36c5b4b660fe166fecf57e5aed06bdacfb0

SHA256
851021483ec706b2b9cd860f9c8232f90097e9296cd5d72c173fb413377a0a23

SHA512
968964275d612642b38ae8c0df1651c5d2265f6551ae29f861a91ed7fbeb817f0912e364504f75eb22d45765274bf4f5490d619b152d5a6f35420f3220524271

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
77KB

MD5
0cb3b8fd431b7fcd862cd949f4d3bd51

SHA1
3f844080ece12ea97ddcace9c37b7e38c93b0ffe

SHA256
5c81131a23cefbe29cb099540da8b8a90273ae44b4dd4642cd241e6ae3ed51cc

SHA512
c3c16d35e40c8b0b34ebc01ea57461d596f2827ad5ac41f83e4024dada8b08bb77a4f083c47f6ea343959ffcfc78d58fa25a2fbc4e2af634867f9ca251c5b15c

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
76KB

MD5
88b1e241ad1eda91defb817e1785d19c

SHA1
e5f8ffc422f5bd7c824c477dcca7612b88740b17

SHA256
c6446dfd947ebb0bf2ab87fcb64921f8c5f99a6110b7d6e9a90de6506d98047e

SHA512
49b68070d9dfa30f90110a96491d3243105a4b45eef1acca3afdf0ed06cf5bfa6c83d02a343d4ca04469f3141cb20f10f8898277bedb4fe168e9b46966087efc

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
77KB

MD5
5cf69604c3be9a8d4f7d34646a1425ba

SHA1
a1c070044eab8ce5cfb26f127528214554b29dd0

SHA256
9afa70c1d4a9763190a0149848202128fe4beb743c713bc6bb41c07a1037dec1

SHA512
0269ad9c66ca7e5807b5a57f3392fcece2c8d3be1148befe40bbe4262730a3d0e08ac0fa3a08b183c0be0ff5f5d047b0a38ad286ab6666ad3a846229881d6174

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
75KB

MD5
105699b3d9da7cc30f975fea430b40e8

SHA1
d65fadb7469b86902f1daa1486194e3f33b95da8

SHA256
12d7e432609ad26be302a013f95b4d7af606fb0aa1b972ac96e34f08d18fd923

SHA512
e3142ddea5ac62d678cc33c5e9859bc06e5f1d832614cb88f5850618d9c58efc45ea28953224a8807dbb457c22e9dcd270682949423c9602a3b7961dd3766774

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
86KB

MD5
ce41fc5a1b029a2bc210f342bd42b4a4

SHA1
db70cc4b3d72aefb0581c7ff04d146a88384e01a

SHA256
46d93950e0bfe533aef763e0824a5d2898afe8dd2bddbdb14203d15573b8111a

SHA512
1a886a4c8aecf9321bb4f2ebbf11d657555b2453d54bf55ea894bcc7b4bf8d9fe8fda7be6541c550750797b62f8ce076d5f8767a6152c09b0fd0e94182056668

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
86KB

MD5
8fe2baff2635e2f719a31b5044f15378

SHA1
921ef2f8fd9919dbedb4c879c8ad3a0af5bc738e

SHA256
8e22619944b614010358c7ef30a500a09f0983f51fd851e70d161cc4c732f586

SHA512
6cc1a4098e4eeebcfd6d82af8ac5a0c7298e297ef187738664e703a28fd0e2969cea9d5c9681654f421a4e6e9a39927f4a5711385bda3b17e176ae109d1df67c

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
76KB

MD5
92e6e108509475545a6b9d643171808b

SHA1
1f00267c3ed611f39782e48bc5de235d3bbad66d

SHA256
a802ed29c162c3a516e0a6412cc9a41f9d1baaaebdd3896b957648c8661f8783

SHA512
c628062f1b536741fc0daf11c0e0a65818e45fcf7ccf320a1a26d90845ff6a408e313fd2d41ecfd740c5e2a347a93912e8fc20a1f5ae92af0ace049f1e36998b

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
72KB

MD5
5e9f9e9e5a9dbc67d8bbb2be12028739

SHA1
86460e023b543ee8aac5d75b85fddae537208b06

SHA256
025187f65f92ad6232bdbf3f7308bf5700377268022ff430db399e87fbe3f0b9

SHA512
0abc975c4b9e6103fece81b8e3164c5dc1ba083da7e5f0482ff530a9a2e53507d15fbef8bcc6412efbc7ebd690d7d49a324d5d48bcc839f27ab5d53b60c9cb45

Download Submit
C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp

Filesize
78KB

MD5
0b63b3cf0b534f04a699a11aa01cd96c

SHA1
7a4651c04bdb93bae998b687018591386c19a718

SHA256
141bf8360105b3d9044ed8f0f95e1473cce27967bf49e986b024b366ebf174f9

SHA512
0ff0e20f6d1c6bbadca2305efefa850e8b5c285a7e3248bf505a13a48c9a2ef5b1ca0a9efbca5ff7bc0130f0a18c9f31db32ae6412de5cd5ef192ab9850d555f

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp

Filesize
75KB

MD5
787b5f7331a133173313fbdd0ff3f427

SHA1
2a2f78d3a0a23952d015f8d9d90d8c223517f0ce

SHA256
adc62b16734c191a4a3bb08b3fe18ad87cf1808face403e8f938c1869a683001

SHA512
5d820934d1cfd3f7f62e2dd21c414aee16eb02cce33dca74c2c905addc63608cdb7cde162917d3c80f2f55461d0ed93e81cfc560f648b29e4f6a2b504ae59d3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_06 - Pictures.lnk.exe

Filesize
67KB

MD5
d0a7df08a2ea0a1f8e1d722553f603c3

SHA1
94b0ed35509d5d173dcfd7348974d8573b35b136

SHA256
01da847b94f9c53c5d43dc1c163318a9a280f56ca396455a47f0d2dd91e37c49

SHA512
cf1d9b075afc85ec01b9d1fa9fd54f1eb845d31f4c2e7d22ba42aa3e12d47ba58c1916ad9dfd34742cd7aa97eac5af087907dea10c1c769fe9e00dcc280c6dea

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
66KB

MD5
765eaf47ea43a3d3cbd5b56323ef2e8a

SHA1
c40ae56ba7ff8a2c89ed1ebe7440a568138ce9fb

SHA256
ca1fa011e5033f167d72a4cb098a82c3667fc49733e10d0c0ed221f5087de020

SHA512
043cb5082e4d1cf40006065a4d67f8ecf5dbb7468fecc76926ab23d9183d10add914721a4f19a34fb2792da3af89a0b994a512308e87ed0d19e9def27672e4af

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads