ddc8d5d22b35da45431847e3a84aad0a361565ef059dfd00789b787afc3fe88d

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

865121cc4ac9155b2a882288b363b0c0_NeikiAnalytics.exe
Size

128KB
MD5

865121cc4ac9155b2a882288b363b0c0
SHA1

12b440535086301c3c96d4b8f858b985b9d10ebe
SHA256

ddc8d5d22b35da45431847e3a84aad0a361565ef059dfd00789b787afc3fe88d
SHA512

9f64961ae6aba064814463c5c67a332ff902993d7e542741173ebd65933c15ad78059fb772094dbf4809d9162e41df7d24604d2c876a7f62685ba862120138fb
SSDEEP

1536:W7ZDpApYbWjIlE77ufL6YRYvBl7ZDpApYbWjIlE77ufL6YRYvBbK/:6DWpwE7oL6uODWpwE7oL6uv

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5144) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4008	_user-32.png.exe
4192	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	865121cc4ac9155b2a882288b363b0c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	865121cc4ac9155b2a882288b363b0c0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp	_user-32.png.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemData.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp	_user-32.png.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	_user-32.png.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp	_user-32.png.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp	_user-32.png.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE.tmp	_user-32.png.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	_user-32.png.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp	_user-32.png.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp	_user-32.png.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.tmp	_user-32.png.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp	_user-32.png.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Extensions\external_extensions.json.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	_user-32.png.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-pl.xrm-ms.tmp	_user-32.png.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt.tmp	_user-32.png.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8ES.LEX.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	_user-32.png.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.tmp	_user-32.png.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp	_user-32.png.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp	_user-32.png.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	_user-32.png.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp	_user-32.png.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms.tmp	_user-32.png.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp	_user-32.png.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	_user-32.png.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp	_user-32.png.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TextWriterTraceListener.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp	_user-32.png.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PG_INDEX.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\dcf.x-none.msi.16.x-none.boot.tree.dat.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	_user-32.png.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.boot.tree.dat.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4008	4368	865121cc4ac9155b2a882288b363b0c0_NeikiAnalytics.exe	80
PID 4368 wrote to memory of 4008	4368	865121cc4ac9155b2a882288b363b0c0_NeikiAnalytics.exe	80
PID 4368 wrote to memory of 4008	4368	865121cc4ac9155b2a882288b363b0c0_NeikiAnalytics.exe	80
PID 4368 wrote to memory of 4192	4368	865121cc4ac9155b2a882288b363b0c0_NeikiAnalytics.exe	81
PID 4368 wrote to memory of 4192	4368	865121cc4ac9155b2a882288b363b0c0_NeikiAnalytics.exe	81
PID 4368 wrote to memory of 4192	4368	865121cc4ac9155b2a882288b363b0c0_NeikiAnalytics.exe	81

C:\Users\Admin\AppData\Local\Temp\865121cc4ac9155b2a882288b363b0c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\865121cc4ac9155b2a882288b363b0c0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\_user-32.png.exe
  "_user-32.png.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4008
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
64KB

MD5
204f5ee874fd75fe4583c54ca156fe21

SHA1
db67d02f2bd3226df5ede7a69e1d6818daced3ce

SHA256
e3220474c7a47e9153cad0a7121c5af2984277e355b3e12c489d352f5102cd14

SHA512
e1cef7c9ed6fb91c68e4a76eebaea167bda9e3202005e5c01bd9c6d787e2924f070fbec9872296db020a8daec94acdeacfa81c2df7a99b5e09454267f523bfdc

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
176KB

MD5
7aeded695daecdf2a529122fca68496e

SHA1
3807dd19499ef02fa7f53feb9ccb1b8baeafa822

SHA256
d5248f42158d0f6d544b4e2788e909fe3dca5f6c5ba8d0757571976aa267d955

SHA512
22a434836d2d3afba30b06174d0b4b1551f3e30dabf1e98910cdbde3ff352652f0686608378a6846bd3c1132108f192ef93ecbf824a6504f6ff91adf7a40f9e5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
163KB

MD5
5b6336ad670a91b3b3cab850ca82c028

SHA1
8f85f8046677d3e64543059ffaf85cb9279320bd

SHA256
9aaa61a43d1c9094387e743f80e426d3e979702e0bba576d085282756cd2bc54

SHA512
4330150e8a70367835391cc40b89932a34c90572ba095ab8998665f57a0ca8de8d093768432eef25c14a9399b5b469bb6fde10c0f32adfc27c8257100947d672

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
129KB

MD5
0671a6df613b6734f45110c3956eee74

SHA1
4d66d139d45b74b823a234f8041affcc0db5f26c

SHA256
5d3666b882694f1a7b8421f881efc882b8f13e8643cb909dec451812d8006a0b

SHA512
1c083e31029f8f92d225f951149a495b9a01da2c88d765c4c88412ba7e19bdd1664736e3171693842ad353fe638fcf9c34ef0b8e04a5e7d94a54d98d9c254ae8

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
e209f8bbc1409f6ab2d1f73d0336cd35

SHA1
9255f32b900d9c86f9df53dec97766cc168d1fdf

SHA256
e474e56a90d27af4cc9d6fca60b63f33b929bbafe789915a9d3b64cd0f139cb1

SHA512
7288e4d8be286630f0fa962e982a18e039e4108ccfcdf8783357afcec4e4e15398b885f27dee28371b38fea0acdb829e45f82a892927f075e4ac9e4c7ac72fae

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
608KB

MD5
469e809242d171850e5f6677d7dda522

SHA1
812342fbe822d7d2035b95fcd7226292d8fff5dc

SHA256
5ad2a6fd59f9da2ba0d2fc2531154666999dcf6db300ae68f2a0559580a38321

SHA512
9d6679028690558d255e48b9470b4f60fb8c25535cd4df999e41281e44cfbada9cc1e2c3d71ac9d32d51e6b12f1b4ba17d942c41786c98c81277cd78f78df776

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
608KB

MD5
d6500f5b144c03b7e25b00f1bdb74e46

SHA1
371e39ccab2c22e74b25dc5a714f44da2da0c6c4

SHA256
e5928d075f047efdb4c9de735417602df8f938d08f92b9d7c0253a9433f2c4b5

SHA512
74069d6966ae879f2036a3176b3528c0ccd8304dce0d49e47a7a6a484479d8b421406afea3fc81a68fb3e024d03e1b054d8c54b82ed513e7a0f53a7cb19a454c

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
274KB

MD5
eb637e20e89220605c6df00287051bd3

SHA1
79819734597a040e8b76797945857bc66cfa54b7

SHA256
e8142fb46fbe205263ec793b94b22e1ea3ec9730251d3ea47e0748d62053e99c

SHA512
50516e3505bc2ff91135b33b77d2925c3e7f1994645c62a7ed4cc3200f950eaf900a00be719e83278752da207d4f91f3b9191c1e90c6a464af085a92d0790317

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
253KB

MD5
47cc2c95a8298ad103768fe9fcfc137d

SHA1
d94a11fad9196c1b0963908965a822860a4673f1

SHA256
d8ee18bd430f063b9ef328367e2f786a4458d494302994e145b377608ff6991c

SHA512
1f8f1a1dabd4deba18aa14dd2b598cfae374ad511ddcbe65071c91ede0bd1cee1f5dd788ec04c90054c85e49bb719df9ac32361c72f43b3b61c4c94de0192ecd

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
995KB

MD5
834fdd7ec8eb2f1551fd202cfcf516fd

SHA1
116f4fa74656dcd6fb78a0df2bbcb745d955c6cf

SHA256
f6354754ce0c1636d2c854b0fc158425ce2351ccea1ede741e5cddb94d7552c5

SHA512
c59ea74cdbd0210c9e73aa5cbaa0da2f7e630b764fcbc1030ec277a409bc37510720bb89068e1227ccc074e4b1c50f70c3258b80778a4aa83e240cf3ab79337e

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
748KB

MD5
2c7f3d2ff0e4fd41d092c7eba9f06ab5

SHA1
ec188506c48e9bf6ed9020df9ea78eab95d868b2

SHA256
ce43a1284424dfe8cdfa14d9d0b48cff4ab19a441320a05ec6403dc494c3fd47

SHA512
f7a90853b8370ae074976ad3e01a8f895076436a64ed7d79c26592a5da65b588e049305f0e39743fbb3fd41f03bd4c892dd065de1fe2c391a44fb24a2324bae9

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
72KB

MD5
09f5c0022ba2e3c16e16b814c90a0b7e

SHA1
9b92843f677c73c6ce07408dd584a6cc18573036

SHA256
17c63d2be1277a9f23fe83e3579246b3529695d81bd39e9428cd591da02a6153

SHA512
612ff8dd36d9591052006ae1c3b6a6111f9e992f94e05ba9b6e8ad6b20afee7436ce0283ebf4af6897c92cbc1806cb1964a69f18bbcb7eeb9156217734eb8de1

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
77KB

MD5
503760e22dd55c71e167ac952a375b35

SHA1
dccafda914320ade26457d5f8b59e37e3ba751c7

SHA256
03bdbaa19ac459f0a7f8a75a7ba5e125eaf895555056c08b3d2f2cf067eb225c

SHA512
e45416476f2899aab11d759489c170f928bd270f0682118a46862b57dee62e41b306d9d093f15daaa31c4a9af63cdb84ba3addbef3e10294381cf064538bf808

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
70KB

MD5
2459496c669e0bb4a5db853ef95ab888

SHA1
6a3ad998d9b7b6e70115f0278eed5a2832a3a14a

SHA256
f7124f3881caa6c9ccc29143324f5620d5b48673d83750d0f1e2dcea50d3d1e8

SHA512
f36135d574974c54b864758d5af38ce1f7bc0d463ac14abfa3b95e0fd7e760c8bf0a1b4bff6cf517f3bfabd93434ca7893ccc4364dabe105cf7d5790f54a3707

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
74KB

MD5
44c586ef3c6684c7a6f7f22e3eb60d44

SHA1
2ae377a1873921a00fe87f1a664af5c79a520c5f

SHA256
da469b55c8458709e81e81b7007a9eac4916d7ff5b950657e831ad7ec2149b81

SHA512
1f229a50411b85892816049a3c68a5ad6a0892569e177b0b420052b7494d5ee551ed5c906da278e5d692ed33806dbd897878c2b64a724ee174ec8a347cff621f

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
75KB

MD5
df105b5c50bd98a5e657c182bd33a72b

SHA1
6d99f04f8c7f4143fae57f5a3e48b0a0880ac636

SHA256
fa711b4cb57e5219bc047cb93368594ec8ad3a566222ecf606c2e7a1e593cc28

SHA512
c336b1490f01ac2afdafbe721d175741249733d3cde66d811d1efd383b658066bf4ae61803edc1a4918922fd5974b0f07964b35b817339c5126389a45e5e3cfd

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
76KB

MD5
7fd0f8d1a5edf82b8c50d25d6e8f674e

SHA1
623de75de462346622a3ee6fd308e6fd0aec8d57

SHA256
4b7d7900ab62fa3c32e670a461f0fa6caef8eae47e5bc14eb41cfe7b0d4aba7e

SHA512
299e3bca002f62f2a40b7677e16b487eac62b2a097eac370287b81314d05491f2d3ad951669744dce8b84b2e8a621ecdd7164200c6f4907f42c9cc4122614c91

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
77KB

MD5
e86d5f2a3d0e85574b104fca019092ef

SHA1
d8c0f8414d7b4d66d2998325e2b126126cc5b4b5

SHA256
e9effd95a0356f1393dbdca8f8603069db21f3a3dfb8cec0c78cfa8b78236f74

SHA512
e3bc5923ee96484798d67572577f7f72aa85a6b9678b118a70a4137d4881c638e907883973a82647d3f2be09f48b0db498947ac3883530eb044f02257e7c5881

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
79KB

MD5
c1edbd23d467ab76f1a63cc7190b3d31

SHA1
53d32c2383873c8fc487d86a14234c50b609de85

SHA256
002c194097e855fe7db73e462c6ecf5958175d6319792afb957f87fd2fef16bb

SHA512
e1fb2ec5fa7e4f980ed5365c0b02d6e9bfb6b8386393585a636dcbfd22850f38a89c722679707b5fb3c4334cb4cfa2e147760ff2e7cf60e09b4c62a4e4080976

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
68KB

MD5
94cbe2b4958ea379d732bbda18ed049a

SHA1
f8f223bb52d592843154d767f159ed17c0f5f5fc

SHA256
7b41f275c462f42b691e6763b5672690b32e3aa66954f3625f00efbba25a3dce

SHA512
873bcba6415f7d901b14b0679de18ef43cb3834a75ccfc5d020c68c667a18ca0548711eb84e6f3b932475de88d28f89408dffad25c3b4dd48f9552cfaf58383f

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
74KB

MD5
e912c1aeaec4e3ba9aeeda6a39c1b516

SHA1
d9776177eac651fc2e9c75df41b942fd5fe293ca

SHA256
72e89f60114eca922973a5835172281f743b15053568baba4c9ed1ee307d309a

SHA512
d3ae106ddd3e32ce4e27cf863bf4d3d3cf85d230755646328b976de816cb57716dc676e562615a4c5b8b7b6e04cdd6c43da1c35216d6cce8a0183d48c48ac1da

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
69KB

MD5
56ff269e42cc0de2b63c32a58cc37866

SHA1
21ef2e9a238854c5b76c2666e5f37f2b3a3cba0e

SHA256
0148a144bfad5f61b9cdf51faad9c26d9a74663968a1f4c3d7d05a171cea84e8

SHA512
e6a9fa52115d8dd814a2ec8b82c35169e1623e601e636dd983b3d21e1a418e39c44719cdfe8e40647d477c25ccac3e1264b1344b3b117b02dfd55866f82cd215

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
74KB

MD5
6c2e86ed8b648af5ae40158c7d73265e

SHA1
97b67e504baba47408cdf6b43e3f3fcfb0fbcd8c

SHA256
ee31ffc5d356047c2527820658653ce1710ce001e6d0785aff5a7516ec4e5da5

SHA512
91065846a311a245d46792a6df3440e815dd9870020e1ff644f182f76a288c9e84b03c8cc222beebb50d39caac36206dc6d26cfaedbc83aae1eb2e258d097707

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
80KB

MD5
a04af1610ba81f08e77fcb5ff9f88953

SHA1
eb77f332b721d0d2c65d396e6f1f57e05ae7f909

SHA256
404470e7388f3ea2c570ff6da013f4e4f6d9b1441024a73c814cdc361a978e3f

SHA512
53b627e185e23ec655e273247d7996d8cf70eec3099d49da9f89ba8b610412777e8294e51a547e7799e58372dce3df8d84e300c989c1ff6beed596e230454803

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
71KB

MD5
43bda3e614ea6d38f95648396b7eba77

SHA1
88a0d8b3e6069e4eefc493a72ddab2235a12736d

SHA256
661f83ea252d3debb0c4426f70962ff3167f9be4a86de6b5dad6628a226b9214

SHA512
5ee221a5762a8c94e4ee3f9a1ba64618726bc19c34b32620224de0e2edd89057643a8910be957c8d32ea73e6e5a04eb1e392e33d75792134cc7adc761cc1ffae

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
69KB

MD5
460935cf4991ff05f68112635e460b07

SHA1
4cda9a72ad7f586e1c5b1937a99e5d44001e203c

SHA256
f5f7635451f8cda87a51c0cd67a25d7922e41f91bbe1771d517c4a11bd8f3945

SHA512
ddef22ec186bac395b44fa3b7ed0d15ceaa6fccdd9cf82bc0ab2057ad599d7b92958079870b3a48da492c2f67ccca6fde615b6ea13e6ea7405e9c77121edfd75

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
73KB

MD5
b173eed58f6968d617054583ea2ea884

SHA1
893a22df0aa7a53807044f0b040a217b97781299

SHA256
b77f47de928d4de4499f1798f2581b6513804e982ad0547bc40e07dfba21639f

SHA512
d3420f4204ab2ca64478418cf318f05c2123b0935409a7f56ba378484793cf0238ed9c98a0371b6798fb773d3361b325e107bf60404e6a7b4b909b5afc1711b6

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
71KB

MD5
53ac70b2090b9d17e324d08a65d36477

SHA1
bb53fbeec9ff1c41ef190dcb62609977da893eb6

SHA256
459d9e302a9440205818f6638ee885ce7dd18447a2bfd80a4abdd2ff012200f2

SHA512
ffcbbd3f02ac8e76201543946899aa360a52a89ff300ef724bd09f3b3ae2013be792a7aeb89b03cf922a29a627a8a548c7c362ae4223def380985aa09010a42b

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
77KB

MD5
8b9045060a33919174c6462bdea4a0df

SHA1
391f27f0af2b287c11559bb31cc123fa6fff7dd9

SHA256
4cb6f826f66b968eae1c7a0b31edce3d12c01f70414c723f983c25f5243a4d74

SHA512
bcaeb4102a3c522b380648e490457c7c508da7f8bd38862b3ad297161f15f617e06214de3de2e7791cfe14d76a044a5e9a7a388b4ff129c6650c04ab89d9778a

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
71KB

MD5
ab62fa666e762b2a32afc23b972b08e6

SHA1
d8a98a7830cc40785c1369732eaf9d9ba8fd2298

SHA256
b946ed932d8e78a4f8463e0fcbdae90f6cd19121036837bb72625e5fa3a3d16c

SHA512
be3c97bbb481f2b94ed3af585200d5dd16b6043ed3222756f4a81d090772582948584efbd0d8e422e29d56907282227693ecc585537301dd4377253cc1d6ff4b

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
72KB

MD5
faccf765b9831d123913425f806f2391

SHA1
061065265fbc3c248b438afe19084037b5d915ca

SHA256
9ce1018ed85feb9f9135e6ad6abfe424768b07062aecdcdebcb10872d3495e32

SHA512
fe744702a95511f9453955c0ec0e6ad18fdf0f141c9869d7c06b5c442a6938e03ffe6edcad44fb16b1d93393ed11841f5e774c6147a5aa95488ba027eeb0e779

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
73KB

MD5
b4aed76ca7dffb5d154d2bd70b6efb71

SHA1
fd577a901f975a2e126d50ec14df752d509b5015

SHA256
a725e891ace8069e13958702700d40719b18782cec752f8cda5a53fc0efebdf2

SHA512
b5ae2e28c1d24d6ddbe607b25ac18b1c8d25e01402ae08c6106ff608b667901817d9efc079122108f3bacbf816b5cbf4bd11774769c4e152c03610f449d2bf1f

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
82KB

MD5
1826cb169aebe3fbfcb51157cec8bc9f

SHA1
37d272e5f0d44bb8dee186d43893000ed74afa2f

SHA256
e0510d2a480eefad4bd2a6f054386df16f8ab3cf344c2ff449303fe03d1f1b04

SHA512
c3867a6fd7d78143d50d3f6c8036c5110a5e12605dc371205d449d9e2a8d0dbefc9573f783e8592249813146d12aa258fcd33d5aa8a76ad828da3ed3520d84d8

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
76KB

MD5
4ca906ca183b62fbf9796ada9f54b39f

SHA1
a7302c553cf578dd41c7645d1ad5366585f797fd

SHA256
aaa6a4cd4f10b875144607f88e0b50213a4585957072cdaaba5488e17cbaee45

SHA512
088e2cb0235db822b718f6af81e5fd1d8ef93091dc140c542e9d31f380bedbe34fbaecdbd202cfefe8522d9020e9b1f545a049287c92007f274022823730d78a

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
82KB

MD5
a102ba0a06d6b6e720e14d7225103427

SHA1
9a5af737b7779ef4142f282a6d90e1672a68c14c

SHA256
30a3fc5c9ce34f6ef5ac7f2949ef983d3f86b7b496d05a03ed71065bc9a97ec3

SHA512
3b3bfc13c633f2638d4303c1a3b9e0d306089fba81a0d49fb9c2c27a50bb3e506f474cc70b23d4bfd55151d2e3f46760542a8eec3b6ee40a8346543263b74400

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
74KB

MD5
b9205805bb15f9866e076d3a52301aa7

SHA1
b6609c36919ae6782f1b5df7eeb4570a47947ffe

SHA256
20764d365655cf46f459e26a2a156194327a36d49a7ffe9b94c07bf5641ff484

SHA512
a6a4acd0a3a6fc271fdf9b9769b198246cb7f25581b8804205725b7740d562c88cfc4413a201280803dc1bdd7d291ec1ba02a3d680f84cdfb62b0d2dc1fa0d40

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
60KB

MD5
e8bb86d20ad04a20eb50ad65be144c15

SHA1
e3feeadfb8429d93d9baa7fcba72ac90ef4c5d6e

SHA256
bb6463348928d32cf49e0e99b719c5db24fddff38268dc253793983172836754

SHA512
ee4dd0d25c88a49ce245e047f3d42a590c94c643cf0ae485c7900cb34358315d8c67ee9ca40942df073379a86b18d33dd2844f3cc67415604ffc919842dfd275

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
78KB

MD5
117ced5a6d12613c654d5e3192e87fbd

SHA1
67626a6992d17355f39b444a1963c03af4e09bff

SHA256
2c586c468838a2d589b1b9db21214d737d252960a49f7ac4d356f38b9d1c6f69

SHA512
1814002d9e3c689bebced4dc86b534358f590ff16a67a1b514632e92602ed18595fdc8d07864ee2ec0a5160ac734d4ddf3f7552a2b67193354cd37c333c88932

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
72KB

MD5
06b00b9bb5cdede638e9f79d69ffbbdc

SHA1
1e8723a5691298e61b8610ad42c6fc957ecf1aba

SHA256
7c62e3fc1c504c982da38af991c9c591b2f256bd138d3ab7a46a8a42a8f4fa6c

SHA512
c258ea172b82848911869eba57be53e07567e3257e0043335b47f56b82c9964fa94c395c5ccd966cd509c2d91578af5e6d297b31599614706654e9c004c99d4b

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
73KB

MD5
5d5be8a5eba9b17db4c6e5e7e4673195

SHA1
8c4c87ae4d5af4760a28d68ae9698c63d3522a84

SHA256
5a42f412ba6a8e95e1f65b0d9e34b79d33cbde194124055476e24c81686dc5fb

SHA512
f7b803856c8abe6c6598a71bf356d780859022c0c7e55bf360ed972e9726972c247464bb214b780d2fbaabed8d1eb0e16fe24ca23dd94b3118cb1121a98658e5

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
73KB

MD5
c57e00cf926a87bc6d320b78f0293ca3

SHA1
12a2c462c16b932ebe8cbb5db1e16f4d40d8d57d

SHA256
fa1bc673d039875be52060965c1efa467be07eefc36748af22adb0a3123bb5a7

SHA512
6566d50061e4f7d1d9ce4247f573bf736ddfcd8bf732cf9f70d80debd8a6a06d34f6c1a7dc21fed1e93031aad34621ef34e85dabd0e8e38fc1b8bc82b0ccb2c6

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
64KB

MD5
654262c2af9f4c20351f0b9d1899769c

SHA1
e9438bfe7f59907faeb3290b6399cd81fde08231

SHA256
7187e56ecd986d7cc93c7913b93580a4ebda4feb927009a7386d5b9dfab6414a

SHA512
e327e04bc41f9bb7a979d39a7222dc5a36b8f0958ca3139ea76e442f637e097b038412972ac0641ff57a128961a85535c3fa8a005e875fbc472e5ef27d6c7a64

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
82KB

MD5
016a4efbdf7fe09645cbc3f00a7f377b

SHA1
5cde6c6c505f1f4bb254cf11ba199e2fd51d7cf3

SHA256
4f7457b198ec4d03e7d1a7b45654f5b6592b935b77094388e744560423743c11

SHA512
23ce925e7eb37ce576eb653e548cd5e3c438064e03779dabce4cbab15bfdd9be4838d166f6e87a08392152b04e51cf5977b3852d8f8a0b85628aa046d1f66208

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
72KB

MD5
2aed7546112efed0c9a8de82179f0f24

SHA1
499d887e99d3789199fb2c9bf5452c5b75a4cae3

SHA256
729def4b201476d94907ad75fc3377f0de5940aefc5915f0170b73190f80a36e

SHA512
937b616129c7bcb3e16d09ef0689029cc3672dd3643dc5cb289e1a057ba1f41fdccb3cd465f2a833526ebb5a9c57bd7adab89b103c9966f690e07f5ec59b133d

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
74KB

MD5
09a075ef122236f72353309f9c9620aa

SHA1
772f197a1ea6e507d11612378e2c6da22e4048ba

SHA256
1390f0a1804e5dc20bc6594b9021b185d4aefe0957de4d2f8e3f97455c3addb2

SHA512
faa0e5f56b764facf657d7a323d313d14185c79c0e990289035e4b3b2c295217767c77ef5a46317008b64adf64ff711bee56f112c56688fbc21df2ee8daa73b2

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
76KB

MD5
aacd20f5400e72303a4e3b5437fbe995

SHA1
6a952f7a4ed7d083a6eec00de461195f16e9273b

SHA256
88fa45b68d98fbb7633d03d1d7b300596173eb8df53760f2d6ed46c026be0666

SHA512
32cb14b2eb7942ee5c376489ddbd74d57e68a72730cbac39aa4430d850ca44eb1fd17c0c9183bcecc543243642c0f4de8db7bf1d7484b6182b8ed231ae20742c

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
70KB

MD5
d3607eb794f5ca28674cf889525ddd00

SHA1
df89d70ddfb20db38ad14797d01d7443a3506b5f

SHA256
cebcae05ed4303a8c43db02b6baa9ca62a37f611bfe378f4d10128ba45c66b16

SHA512
4624e8fe63008ae5a2a409044bdb3abbf2b8a08fb01d448dc14fa54f5c1fa726d79c1e33c3a9dda5c79f88a8c19cde24b3913ddd0ba597ecef26d15ebfad856e

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
77KB

MD5
6642bfbf9398c5844151869759bcb434

SHA1
661d4ee0409c09020b8c328686eea55ab03b6f78

SHA256
0c9bd355180d1d845108c7b9c63567815ad3f2875273b5b5bdc8d55fe25a60b9

SHA512
40527a8f26c9a5a2538b120996e1f5aec7549638680baa4d7841aaa9b82a90b4f005f561c48d0ebe15558e63e96ed9ea1fe503c798877b6cd71a58d7505fe618

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
72KB

MD5
64a437803d8926e7110e73616af78c49

SHA1
ee46145edf844d56df186118896fb52b3e106709

SHA256
b2c814e18e637f838c0a23cefa6ce44cd26ec70c4cb56e1e6cb1d3e3b5abf053

SHA512
28c060c14b68a61c0af17d83d227fe683e3021bc1f7168d94dd355fc535627c8006b61e49ca25bd4815903efb39d1af588061d1278c4061b0ffbd45ea42b959e

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
73KB

MD5
c712f9ccb69bb15969b1112b657351fc

SHA1
0a9bb7f3ba926b80d2028831827696f943373f07

SHA256
423a76814ab95a2c2dd439dff16b235dfa59fb64efca95349d0f36e0ef7c3e12

SHA512
4332db2d3e8ae966296184f96b2d4f6dcf2ecd3a66a00fd18ba732503ef653a7cbea0c1d3ff55bf51fbc37e1f9b98aa1de27da5084f4725dbf46107f8451f47b

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
69KB

MD5
0bd846c0bb6e4f67588802c4cf3c9fb0

SHA1
3e3c7ec37c5711d8a0954fa5fefe6be2fd8df5ef

SHA256
c70f72132bee1fe905c5a1822fe85eb1a311e87bd42eb0417f56f7115cad439a

SHA512
41fff16bc0f0eadded8978ac0e48822b5eb76a310e68d9cec56b2d8fdaa3cd8682aec72c209bf08f69d2778b17abb44ab5b8b35ef948f1839cfbcd5fcc1686c2

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
84KB

MD5
e23d80017bae4845575bd240f614238b

SHA1
341b89ec2d03da0706ee1c16edc96c45505aeeb1

SHA256
300cc0f8690acd7ae46f2b4b5a6ff3b44af5b025964eef0d42706c4fa5e850a1

SHA512
07c806e97da25d2ce565db3fc75dc6f95106f25440b5497001834144d820c8fcedc85345d5dbbc5c168ada2dd4c3431239bf11daf9d2132d000a19cbc5db2d12

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
75KB

MD5
a59ea590e494154b185dfb7b88f8caad

SHA1
08041b0c829f317a08aadf601f49a719365f1d03

SHA256
570135ef76029ca62aba8721ea37a9194a8c4c12ee751c14eb9582d531326d10

SHA512
2d4bf6f268f2d2acceda7687320e59c88b9a582c36dec31a609303ad5e41bc00ea8256e32cb3326db607caa765168a20c9bbb4c3caec5467a7a269e99b6ec5ec

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
70KB

MD5
200852c8ed9de52ca9b4cefc511834d8

SHA1
d60a9340f5322bc7b6646b4cb5b66ad5ba79ab2b

SHA256
2427261112a94b11529187d124306a7ce40653df5599b9593cbf7cb8d0986910

SHA512
8dd492f02dd0f6244836f95eb790b2996253e2e2d6448b07ae2e866de58beb623f18a10332484fa2b7f89779959d27d1c10cc736fb3e5fec632b5b7dd5fc5c83

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
70KB

MD5
e1e228b4b46679186c7297a27eb59d03

SHA1
5d0be7b8f641573c242e38c2a1e40e0dc16c0967

SHA256
2a9b3a22618d55395e0a0978a7b479fbf2d23874b85a4e61dac58404c4bf8880

SHA512
33a74a893cb36c0c71b4a0af36efe7504e5bb4f96ca4f0670d3230512838df5c5901f9f5b56808751cbd7782bdd7552207ceddebc813f02f27ea3b55a2defcfa

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
78KB

MD5
b3fbd6d2f5f9d291621ae66e6a0fd33a

SHA1
44ff2f9f59132da8a9b339762a14cac8886596be

SHA256
ac4c114541a1979d7c428b06d096368fd6c7b0e9aa688eb47610ddfabc325647

SHA512
11be738a5e8395d127ff50f103f37cc1e2d914bed080bac201fe51d255d7f7ced619f790f7188b605078877d4766a6825465b0b8d4eeb02638a51500d5cf2ce7

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
65KB

MD5
9a45bb4fa21bc7b61f7326d935085bd1

SHA1
1e4a24477d5a6b00fc36a1be50f0306d46b185cf

SHA256
2cbc3039e42a1629c99e0d2320ae03451447017baa35919e38c71e73234f51bb

SHA512
67354552b151f0ead28f4147849640a900278158d60f09922688a12a9ba40c6b7aae807ee4bd8187c3325061624f48da58c84e9d4126989bc9b66bbe4b2d77e8

Download Submit
C:\Program Files\desktop.ini.tmp

Filesize
65KB

MD5
915d138dca688a8891588eac8bfb41fb

SHA1
35ab492ddf2d2f4df36106f869d74a8cba73eacc

SHA256
685c337109cd2fb1a44d0d7663d731369640189d56d0146035920fae3b2fa071

SHA512
f04e864853d4b287d2d1c07e201cfa52964959c6c30d037154cc498948309ec630a96aebe3485e497c2c43b1c1bb146f981f5d0b0d6abdde7905923acd702846

Download Submit
C:\Users\Admin\AppData\Local\Temp\_user-32.png.exe

Filesize
64KB

MD5
397e03ea24d0b06cda765e963d551531

SHA1
a485fe07e16a8e090674cbd86db662e6f08d0e96

SHA256
bb4b4b11df84ce78b0ef8716d3b6ba775b3c66bafeb023c56ac33d882a70f59c

SHA512
b81a0594ab2b5cf409fdc23b2e2e17d6a8fec72e2c6a6dd9f8d04b7800fa5e6a6ed81ef70d2eb17168f4dc7e51abfcc0f63d42371baf844a7a2543872985578e

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
64KB

MD5
65c65e9519de40c6ba403c2e9f690b76

SHA1
cf900541f0c4928fa5d27d98bdb730ac54d68d26

SHA256
9442c30ad4cb1abb91ed5289e4f48b2e25d6ec77d6fdbfaf20354727d6934414

SHA512
2b1c5161c2db0ef4704f87a1c89a63e79118177968a4f0b4bfc4c09a4bebf5af34b76678e740a4c0044cca0f103b65c702eb4e8ede65a597d921efaac35fa7d0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads