b669a3cc193b86c25fdf2be273530c4d8ed64d0d04b33d02eefff7b62f6784e2

Analysis

max time kernel
150s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

440c92b85876c782d99a6ec563760220_NeikiAnalytics.exe
Size

164KB
MD5

440c92b85876c782d99a6ec563760220
SHA1

91e06335500ed3ced0fae5bed53c5c0180c77f2a
SHA256

b669a3cc193b86c25fdf2be273530c4d8ed64d0d04b33d02eefff7b62f6784e2
SHA512

912da4a0096915d6a57b77490e7f2c08d6e188684e448ce9f36593dba547f616150560d772c0f0e4e12717491886d68749a9b4891a6dfda904b272bd89e651e1
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZje7WpMaxeb0CYJ97lEYNR73e+eKZU:RqKvb0CYJ973e+eKZiqKvb0CYJ973e+W

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4714) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2436	_MicrosoftNotepad.xml.exe
2356	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	440c92b85876c782d99a6ec563760220_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Zombie.exe	440c92b85876c782d99a6ec563760220_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	_MicrosoftNotepad.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll.tmp	_MicrosoftNotepad.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClient.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ca.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	_MicrosoftNotepad.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.CoreLib.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\th.pak.tmp	_MicrosoftNotepad.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp	_MicrosoftNotepad.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp	_MicrosoftNotepad.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp	_MicrosoftNotepad.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.exe.tmp	_MicrosoftNotepad.xml.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	_MicrosoftNotepad.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-80.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentlogon.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp	Zombie.exe
File created	C:\Program Files\CopyLock.xsl.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	_MicrosoftNotepad.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp	_MicrosoftNotepad.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp	_MicrosoftNotepad.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	_MicrosoftNotepad.xml.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	_MicrosoftNotepad.xml.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\mlib_image.dll.tmp	_MicrosoftNotepad.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Loader.dll.tmp	_MicrosoftNotepad.xml.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ja.pak.tmp	_MicrosoftNotepad.xml.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp	_MicrosoftNotepad.xml.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp	_MicrosoftNotepad.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\PowerPivotExcelClientAddIn.rll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.AnalysisServices.AdomdClientUI.dll.tmp	_MicrosoftNotepad.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp	_MicrosoftNotepad.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 2436	116	440c92b85876c782d99a6ec563760220_NeikiAnalytics.exe	90
PID 116 wrote to memory of 2436	116	440c92b85876c782d99a6ec563760220_NeikiAnalytics.exe	90
PID 116 wrote to memory of 2436	116	440c92b85876c782d99a6ec563760220_NeikiAnalytics.exe	90
PID 116 wrote to memory of 2356	116	440c92b85876c782d99a6ec563760220_NeikiAnalytics.exe	91
PID 116 wrote to memory of 2356	116	440c92b85876c782d99a6ec563760220_NeikiAnalytics.exe	91
PID 116 wrote to memory of 2356	116	440c92b85876c782d99a6ec563760220_NeikiAnalytics.exe	91

C:\Users\Admin\AppData\Local\Temp\440c92b85876c782d99a6ec563760220_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\440c92b85876c782d99a6ec563760220_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:116
- C:\Users\Admin\AppData\Local\Temp\_MicrosoftNotepad.xml.exe
  "_MicrosoftNotepad.xml.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2436
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:8
1⤵
PID:2480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
83KB

MD5
1c9dfd28acd6abe1ad384d5f81aaf088

SHA1
d2b63a2e7ac7508ae6046e6e271af45719d45367

SHA256
e84d250aae873452bbd37a27758185c88129b14e33a81dcc42972f8c3acb022b

SHA512
70367f589d63fcf03f69765d786b8b81b531a4530894c549c150585136f3fe5bb0ee0e751a42ddd1d065fc5f5cb2a73a43e318d32dc8ab905c104cdf452f9981

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
195KB

MD5
d0bd57eac52260b14168219ca5316122

SHA1
a9a091d4b5eb9b49d81e6546c60cd2e00dcb111e

SHA256
809c2eff586bc5b1f87a6e34280ebc22ea8829a3262a77d5c11d8fc1ea3e4d97

SHA512
b535a70c8a4fa7dfcfe89c60311965e2baa6c5831ee512cfa14e046e5625318e478901caf0d4202367742116e3ea74c3fa3689ea837221fc4ff92f79743780d4

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
148KB

MD5
94b1a447cc5cea4139a180a92782fe66

SHA1
a680b77c96f2c6ea73c0cf1e53036926761fbd9a

SHA256
15e786aca4836e3e60e550fe390478b398de33da67cb0400c90fe16421d5fc10

SHA512
459f2e8b1131deabead5b9011f202f1d04053dcbdb8b0e5dbc67d15884f0794ea5a7c1f4ddeb52d0dc73f5ecdc74c1ceb6fb1fa1ddf85293732ec2e99776ea3d

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
627KB

MD5
eb7e67cd82560b69fd7fbbb994cdaf41

SHA1
ddfeb0c65e940a1d6e0c4ff9188dac0643c6bd90

SHA256
6053a2f0fc61d831ababb3a350116210c5f36a277f65aee7d3186826a0f7a9f4

SHA512
03e7af30e32a6fe4a8d54c9c6539a6b8011f8801e59f43ece9331b3b15e463b5539ac135e033ebab79c1cceb5f6adcf1300a5f79a178542b40ac75454e929dd8

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
292KB

MD5
f264724ac2d62805b721c577eab36380

SHA1
388b99d6f75e5e2e43c28fdcd0cbdbe728b83187

SHA256
40ffeaa873e018a54a0a1b864247a24f68c48a412b734c6807c469ecae59fbab

SHA512
3906a0ac899c7e26b2127b60ad83908c334e751fdf930497e053280f9f500d6d27f0296e0f4eb7f1de5be1b8e9397c1d16019d8dec60fdb65ef43641d9479574

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
271KB

MD5
8af06789917c2df804aaa543017bc8ca

SHA1
1cae42105240c13678d8c30d9d9a4b320f21a2cb

SHA256
fa64bde3e792d438902a4e59c859db88f6b52da61e339a04ab65a786e495e4bf

SHA512
b4a0f8b3a8e78a55f01225df1909e2e388f566acd2fff5e08ee0ab4537c71367fb081062f1f9d82090b51634b53275697f033f4ba44b0a652f54bf270ba71a20

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1013KB

MD5
af9cf56adf86f9cb24d0150949304115

SHA1
e54373dc0315f121f490d3e93797392475e3de79

SHA256
7b339cc65f82374cc4f74e75f2eded93a8b526b67b66ea94b39ee1d7dbd8aeb1

SHA512
612adc631ffa0639161326b3eb63ea018448da47d77e3c159b8832c282b29710fe13da50ccf6a6a44621bd1e8f3ff67e93fdc58cfa3e8a6321302d33d55bc277

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
767KB

MD5
60e098a05f065b51d9e6adc45616d3f7

SHA1
10c327c32474512e4b2ea85383f00de88542a739

SHA256
5c0e47662b44bfb2cac72d2eef54f7ef078019bdc36de98d582097d73f22bde9

SHA512
c21518c22c70e9f4bd01260c1504bdcb4487d89ea02510fea0fad2d716b329935966312fa18613c1d7f6a9bf614632b96102479aff7ed93b17c83a021a9ce35f

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
93KB

MD5
8c03c87695809cc09d7269e7117e3969

SHA1
8001cbff1c139a763f7f355e747e3f7ea36b7643

SHA256
c041417f9501e395c2b24edf1d363d2ccab549d03c9e5b663d99620864165e2a

SHA512
a6c2be4af9ad2b8121f18c4920d8b92c76eaeba3605a051d996f404e9c4fa433061d33b22777e84fc9cd6093a70f07be655b91364155a4166f2dc7d97d12e71e

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
90KB

MD5
3d2105d0107a3ab85e7963a9d303e400

SHA1
f307d836d9d49ba95252979567589b3ba6ed8f6c

SHA256
04269be35279dfa6bf4ec5fd5967b4aae26441a3c00089794c0261ff790521d9

SHA512
7444f98787e2e39113db356e725a59ef5497949399fbb7c13d6572c49999b8105baa0c6d6e3341fb14ed029b5d75a7e85a64e67c352494f741c8a0fed6dae2f1

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.exe

Filesize
95KB

MD5
e64dcf7472f01634dca862a30e1a7d1b

SHA1
1a4c702a5ff9f1e47c64496930005e8742c877c7

SHA256
277f4586dc71963cbbbc44b092ad7b4c24d079c2f07cba1f950f9169d0554cfe

SHA512
42fd291143e101e0f7c9f6f21404a9cb3a80ea027fe7688ca8aac6a9a281976ecb32fc70980e8c256c99d0edb1e01857fdcefa39ddc31e076092f3f9dafc98d4

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
92KB

MD5
f4d227a35b85366ff1279c89cfcfd790

SHA1
27394e1265bc66bbdea833e8adad24f1885de895

SHA256
ec154ccfe5e1e9d031765b05d7b9a3508cb0d777f84caaa2e7b552f10e354abd

SHA512
fbc37b6b0d77538fea457d74193ee47ac83c586b5b620be3e4dbff2664bddb4280c2a1654b8252a59b855b5a8e34f65e8a74f2e3c7f4f498812583ea255e522d

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
93KB

MD5
b31259b479bb2186bc99fc09f9f4dfd4

SHA1
624144b8a3cd9755e566d3c02fbe40c6fba5c96a

SHA256
390b1722a6bee743c17f3272f313f06f8e373d2521a847df7455d214d00404a0

SHA512
cebb14ea5fc63eff7c95ffe6578052c7dc1dc7e060c0560815aaa2b748099f9eaf5f2dfd289cc024d80d4d1eaa9d1e250c9e699c0fb70f2100dca990cc82d7a9

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
88KB

MD5
b2bdf0692904e8d5c648fa8951dd0279

SHA1
1ad06b435326ebc5d67212742ea8a0d8460e7975

SHA256
91305b78490f55eb09ee3e9eb1d69036c87426266155edc49e952263b5ee2962

SHA512
96fc622017666aaf53439cb54a38c30ca7332bb2da73081bd072622b29cc032e9016a338df4620e6e332ce65c8f274eb5eb09ff9cd75aea2170520eed8737b00

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
91KB

MD5
9cf8a32d7a063825f5ad3726d90e9920

SHA1
e9f8d672a42b493cfd68ad7252935f4b8431288f

SHA256
943e2068caaf02d63eaee9837c3d734ca45b3ef7b88cebcf2f014645677855a0

SHA512
ae8c882b5ba8716c3bf0b7be6b2568888089abb03b6315fcfe38fa5e23fd3fbfa61cc9fdddf4e14dbe59ead16c07362075786b8f380aec0472f2d4fadfa35aeb

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
92KB

MD5
627e6bc86f04bfd1e6e258333a9e38c0

SHA1
7ded52b9062b450adf38f5082b33162baa9784c7

SHA256
9e87036c3a14cb70719bbd606afbd944e69d5c40d0aa505400fcec3ea918c76e

SHA512
51abc2a6c2ca51b44ed3cb65e49d4f72b5e6e79e71d65eb5e4be1100b898727a0634429877edf1962fca57d258a6ab2287cae47c2789436af6ebb7d41666c3f6

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
99KB

MD5
03e600ba9d60b40debe59297261a3983

SHA1
65af0aead51935681a1a9d359335f64c6b8d0e4c

SHA256
def03aa276a52a6a9399825b9eef87d9833419bc98baf41be4ff8c4ffb4d02b5

SHA512
91a8a180a4be293db5801906770e3bee5aa275f95d401d5dc2c711429fa24c699383327044f9553236da217a9a68977a3dd5422d625021141a269256d2f1a97b

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
88KB

MD5
4f85e8763e888a8578c1e7d4adc9a7d5

SHA1
925cdd8759f4ab6f905959a904d5a48a7a2a1186

SHA256
215e5f4ab72a1da84ccf238b7b061f6ff0740d077df1f698e6a087553d894a24

SHA512
70373fb6e647e687e4420fd91f114fb3c36c1b20c5542937ef44fea890a8227eb9e224de98ec41643096173aed12514b83ae84854d89a0c32ab66fc67e64fd0f

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
86KB

MD5
e9420e8e00e49215f03e45713532f9be

SHA1
f67013c21a972df5a1a009bf1339a370ca4d1f78

SHA256
ea4f0d6132c8eace8d0aa6f8d38bcfb9a1b9067df81b0e149b3aaf9f478ede97

SHA512
7a9210609186bf5423bf15a47db31ce909ca228b5d9d4b17ad6e92e53b8704fb81ad3b911c1c5c231c71e900069a0951bbe7afa8e1949cc8337decd95cccdbd6

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
91KB

MD5
c22b55d5b14748e1b8e39dbcab99e74d

SHA1
e9f5d2ff5406dc6800eecdd888549816d559a796

SHA256
c173cc0ebcf03fd3c7e2abecebaec3e73643245b8f558208cd4a0fb40ef30819

SHA512
dba3f4d727911486e4a16b7bdae84fe477585b0680227da5208d573816dcaea9d8f2231801b5706fce16b4dd28aadbb9bd6a15b43bd365e0ea699d70e1348a92

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
88KB

MD5
842dd3490de226435486d8e962e358b1

SHA1
2ef6fbf9fb7b5123f0129d876c5b0de4cff9ec3a

SHA256
bb4c72ebe44687f0b170f680a1aff54072c490b06644c61f9a2ea6cf3a9d52f7

SHA512
45e625b37cedac81358b204ca3362c2a15b3edc3fdfc5bd745af1f8490fa9b34421ee7748197dcef624f72c798d077b8e1b7ff282d89e51c211258b75c366d7c

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
91KB

MD5
1c837da0422c9c4b4a91f69e6f534500

SHA1
6a9eae60f424f8101b5458a5bdfbc4ec7b0e2dd8

SHA256
18527faf3833d424dfc321c092680ce5938b1c1c94ed41efef10abb168e887c5

SHA512
8414c6b297549ad6ff39e5dbcbc3faa2b19c269319469d9fe42e3878a32b5f6bc1389d5e35e31e8e7341f6fd1bf97d748d966c5923349e8900ac71ddaa08d5ed

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
88KB

MD5
1ba3f9e6fc947984a50b00c67102952f

SHA1
24ed68e0eebe382a311b119f405e788e01307c92

SHA256
8afd73e49c15164ec522d93d75cbc6f788dadc3843bee4306c63eb67cdd982db

SHA512
1c6456be33d2f9b01690bf703a6e2295bedfdd9cd70db257020c3b2bff94039aad5287b8174b79f93de96c86c12c8dd98d162cc53e609784e217eb965cbdf56a

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
83KB

MD5
c260bcb823ac9f5b0cbfc0c40ab9c5f0

SHA1
fa08fa25fc3ca85fdbc0f7567e50f7a502699feb

SHA256
0422fb337df96f33cdde5863d932d72f57be72bee7a6b456c1292eb55803c046

SHA512
a7d8b8f274ba6d38ff88f956c1bc5399b3d9d338b21a088c9354437f3cd3d7f7069297c2b47def48d98d79c17a74e0dc3ab3db7a9a8cc5ed61fda376e636bd67

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
92KB

MD5
24fbb0320fa71d2a6296c381a79d3b3b

SHA1
187d6d8811e125674fdf195a0ae7dea0f5729442

SHA256
45fca7ef555193443d80a3c6d98d89b0c5978ce25219e14c820cf3573d281850

SHA512
d2bed1a1e91c57919289596ce129503790c99b23ac0053debbca03657547325b537702f8d5796cf3b3360892523f07f90f35fa0ec96d939808c600d8d4c96cb6

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
90KB

MD5
5b692e682493d4c9ad14ca45cdbb124e

SHA1
97d770227d7fec60e167f6312f474fa474da7026

SHA256
c87ea72e7033178be9c3bb733faf72ea0931b98759e4feb815a561bccbb2add1

SHA512
2856552d52680bd584de0685d8140504b6c95df9e5c3bb5db9d00d8d5fad84db6d25598226e2e5e89b3a609f1ee1352cfc6589b7fab293e54aad25b624773b5c

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
89KB

MD5
ab1c7ca563b816e3238d0f1346a18425

SHA1
53d178a1b14991481b13b8517f9b1890ca39f35b

SHA256
c569e49117d927c27f84af10917760673f63443472219a6cd599b3d2b55e2549

SHA512
c6f3a97cd23c5b31ba1e64d7bc10ac3d501f5ff1ad6df369918934769ff2c18cef118896329c18d1f9814c38845f03e5cda3c131019b559e99e6c63c8dd3a477

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
91KB

MD5
d039eebb8e19d56bfb843f1250a77cd7

SHA1
73a88b061c6d76dc73359082b270b2b9a9509279

SHA256
46a92a53c1aaa736a311db8e57b7c7a47a9cd877a0e2b0b41ef70ee1341f4dc4

SHA512
bf23bc5ecb1945594f21bf0e56920750a93d0629bdd2d4e0fe8297192d26a19af6c7d492454449aa2d76820cc7ad8b5fae42179e085418f45a5c379b6d2b4690

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
92KB

MD5
d5acb464e274b37ebf3cc19e16d34298

SHA1
1166c3c7f933f744335e0abf0fe5db2c58fbe312

SHA256
be9cab73e1ef0cdfa38f79a331c543dfc3b041af335b3a75ee2cc69fad5cb0d9

SHA512
a8b7608e99f83daf577cecb9e188c619e2e878cd7d90381fa580a9efe50372ea79df654b39b6c7c1f7a1190bcab613d2d58fd385db311d1f451ac9f0703ebc15

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
100KB

MD5
933b96515284d132a07142320be79778

SHA1
90e298d0c855257d61912fc279aee4ede24f8295

SHA256
8beb0328f1939994da38c85d353c3492b16bab386e01c5dd4a2c788992eb47b9

SHA512
67588a8981381af94cec86c8c4671efd8673c7307db77714c3a6b143a3998fc9447fd379693488ae4b880d0947f7dabc7fdbff854d224c3c878d3b6967b46823

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
92KB

MD5
a20976da0e44869a12e33d455a7aee45

SHA1
4ff53894a01802f8292a0202aae489e6254546a3

SHA256
5801f2459402e42576bde68c5188147fc0281b94461772119214acd5ffb76ea6

SHA512
67e974b15f31212cf5e0a404e0b01c10bc916fae07dadee90f184a338c7d1054fb0f535fe72b7b6334b3db3e6a80627fc22354b0970fcf549ca33d19cf33f858

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
98KB

MD5
b7cf0db83ef8d3973ce88e9c4e26bf4c

SHA1
1a6f81c7a087ef7c966cf2a6f94d5c2746af39f2

SHA256
ede1763113f835e6065bee64d0a37009a046d73d691ab49c239c68f0ddaf865d

SHA512
8b4530cf6d53f254de472bacd47e9d4baba918834757fc84f88778837295a0d53a6ac09cc96a75745f09a88a989b6b7f40d3cfc627b778a26b99d87f1c19c634

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
89KB

MD5
d3eae6578edddcc2b8d1af8556764da9

SHA1
6bfc86fbeb6005005a0907e1a311d916e419c33b

SHA256
02ead8f6423838b68498b09469240a16d7ac4178346f2af91ef6938234d16bae

SHA512
1b797df0eae1af7d9ea500d505e42c1767346f0efeb7b203793abb5086a526226af1730655143dd7734afe820605995b6d899c7c65002a5f88478a8c5a4102c4

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
93KB

MD5
625111be387aca9437497c9904ac661d

SHA1
7a5108dfcc404dcc2df1e2d0832556065dd475de

SHA256
47283755c77d392bfc4dff52dc7d67a5bda1b67d33156352bdeb34cc9a947fef

SHA512
a7ab327454d9fd1502c49ff43dfcc3e7ae82ee81599ab82becb9e6b3d9118f3e67a052ca7f3d204bec4a765e00183ed7ef9517b30a7b328ca06d9b90b012af36

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
95KB

MD5
dc7ab60c8a1483a47bc4542cd68efdc6

SHA1
bda9e1a24878d21061bb30efbeb05df7b29b3e88

SHA256
94dbfb6b93184a032fc1f6d99474d3e0990d0b407c137cccd015702f3eac2de8

SHA512
d20c20701d204ef2c4f9a330a26dc441c917a77198ea8b3179cb2002b9163a7577043b81f680af6fe4ed1e8083b562e03a380f599562d0e9a4281e09f0688e5f

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
91KB

MD5
c9bb8fc288a260c14df94e89686c5338

SHA1
71bc3298518e7dff5c540cd1c8e6e2e3a5f0f554

SHA256
291f013a71907fccdae831c54deb493a40ee813e6ea1533f6b1ba7f082156c6b

SHA512
6a9ef946b7068d062dc8db5b9fb71980ec8541ff7c2fddf50ad2fd75100b3810f664a5e67c808b66b5a695fd2953dcd11475ae9d57b0646159eba97fdb64c533

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
91KB

MD5
ebd960caaa89f3c3ccd7d7e6ec9afb97

SHA1
a16fbb7d0fd3ec7a0e70e5f669e5dcbed7a314c1

SHA256
730a28ccccb9e9be8ccb166eb5fbfe3efdcdb538aa4806f612aa7406d0c390e9

SHA512
6536c26453a468f2ad82eaf1b9dfbf7c28dbb98fd36a466b2a40a817f7ea6866e347a093759350c3f5257ace98236a62f7fccf09d2a01b9cf4f784222b648c1a

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
92KB

MD5
5f3fe6e559f88c56967c052612ef3658

SHA1
7ba29dd8289222f8ba586fa8af772f4d8100d7f4

SHA256
721567138063e8a075c5b9c50eb802c1f35636ed455ae301e2474efa0685e615

SHA512
1fa758d1935e7430bd865410d997fba1fbd99ee42160ca03776bc6f307bac90860aeefe5b16b16e7172ed2818ecab281bedf1c87ea95ca2aa36a51b5cb23cfbf

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
95KB

MD5
f4ed79e3e5421861f5887ba4ccc5fd46

SHA1
34be7c5a41c7d4029293f4a5b461dc5e1ff5f860

SHA256
dec894588181eb47b5392dc94bc3e7db42e7f90c59cc87fb9c66360a21502483

SHA512
39c8f78084b7a9af897e1995e5ddac199e1877d1e2642fe4c9b67f6c87172ecb9a5564e7bdbfcb228d123fc5af68dfec7a633ca720462e86901605f1071c6d2e

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
91KB

MD5
6596b56b0c3148c5416fd0f5f5646d79

SHA1
157bdb912ab738dd7937cd1aae5fb2707679f4d2

SHA256
9148d9f572361990c7b70ac3c550b13240a35f396875c3d20bf0e7acdb5704af

SHA512
2d061058fc0a9d1a05d08bc2263060632f9181d34b7887d946f3b894fd34e07308dc355d3e795a7547889331c3926350461a857f65387a88aaa072b4ddd71eee

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
93KB

MD5
733dc4863b45f55edca79672da459a9b

SHA1
7780af913c19f6c514d074cb07245bae4e15074e

SHA256
6e6df54f3fe0099b7747de844fff73b7a69e12e2706a4edab6a60b300fcf2862

SHA512
aca6038fda143efc4d6a29a158e4fab16f5be353dfb4699b08e544a8173b0bd70d3df98d6ee229c988588dfc15729a0e265ee184a1d2165f5fff59d053f9490e

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
95KB

MD5
9fea40fb95a2565afd13843ce3275415

SHA1
e9a54ad7d31d797873e17806baa5ca1e19b1017e

SHA256
2008fb031737f1711b67c9df15bd8d274247311f46e335382631442fc5912870

SHA512
5a6e1de87c7d16208afcba326461b5e8c9ddc1a8f7d5698706b8258a472fcd21fa42a66877c399dcc9f331568fdeed30ea7872da8193bc42e5a2ab047821a850

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
88KB

MD5
9dd4f340961ecdc3f25af29c57bc9b28

SHA1
f478ad87a3a1acb82ce3192595a8753f50d5cc20

SHA256
d2ac285eb3917fe4331be2a9dcf07c04b452d7448d5b01f2e0538c2e1651b513

SHA512
2b53dd78316d185a728d571f6d7956fdb3e59166cb45bcce521f9510eb903c9f727e8f53f5da1e281259643cb9eff0f327d9062ae602961203e48c53cfc18c54

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
88KB

MD5
cdf766296c0235b3993ab3861843295b

SHA1
f8237d56d307d96067c5c9921cf49c768d0eed47

SHA256
d9b96821c7f037b5bcd4a9b0ff586f6fe450b6e844dee000933306042aec175e

SHA512
a60f5b3adcb1c559a5e3e92e6cbd5522d2ff2f73dae9f04061c68cbd080e163cd16d4f344dbd0dab6712315641f3253388b7d3fddf4ecd4b64b32bd983edc40d

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
91KB

MD5
afadc9bc14b753934e0205ec1b330cca

SHA1
1e5574fe56b0e8ec70ebd95b5b635bc8549780d8

SHA256
b2f191cca64db94201f7752bcfc11059ba4d44aa0d8dd8504287b94d04faa5de

SHA512
79b0e5cd25dc975510262e3a78c631d9b62a2875774c3edb239d6391b2e43c4789d991859bfe96f899f3e93d1c34f52597ca4c63d07d7b5d57c79526653f540c

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
91KB

MD5
d2097f1e59f5d1a5b38ecd30324e3cd2

SHA1
3ba42abbdbf2b2488bc9e5cb5f2e9a9c41e38067

SHA256
bee615f76f50f60dbb3289fcb4e48b57da17b5876802c1fa7034d670bb3bf371

SHA512
451b12038b09d74e26382dd172fc50eb0e49ee48ae757af2601b38c6d5b0e9c77cf10914689aac6babe326963ee0ccce3bfc142d9267ab14c2186fb47404ee6d

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
104KB

MD5
5f97faa752e44d7c88d926bb3f942306

SHA1
0d956dec7c0c0ea3269cad26fd5d40fc7a86b3e8

SHA256
3f9dab60aba56584707534fbc3625ab465208999cc57ebb0431108b176ed3312

SHA512
3c442abb6ea3c1cbbbb032a634547b1296f4a4a4dd7cf870e46407476e2ec80edc26cb6ac3348279e857f3ce6d3ecbec52114ee3554b01ed5965d752fe6d99f2

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
93KB

MD5
745d177d896d31007cee4783c107047f

SHA1
3dcc994e58e1595530d4d2d0d18a1f871c3e0bad

SHA256
1a8888d1d405d1c1cb5f9e0dea70bdcae581ebab7bcb663242e47d5abd13ca59

SHA512
d3f5b7de0b4cd4f48644fe9f30982b07af575d1450556be7dad5abef67043404252f4a6c5e8d255af3b2955aa0e2ad96856a8ba6839d2266645af9ff1b8517f5

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
86KB

MD5
475b2ace82e486a94c27a7f9915a8268

SHA1
84a763ad38a789aa8d96967efee03b13e930b51d

SHA256
b4a79e333027e278a1b82d8c2b77e663df8b91cdc3530abc97e14fc9a59ed82f

SHA512
c116c6d1bf4a781b5f73bc33a2f80c0c61ef56eb87667d81d2c6f32585ff82926c61b1b2c7537cf99c044ab77eb28b1590ca9c3fdd9fb8082013e1605445d374

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
87KB

MD5
e5923db6383a28f63cbe5862bc5319b6

SHA1
5083b8920e0469dd4f2ca716c72eb2b30a83e6a3

SHA256
042ed0bb34f54037b70d24c54ad7389f947e15801682b3d645e18601a4d85169

SHA512
8313eda0b1bae19ac54b9d6b99c0ef877dcfa6d1527ba92f1d8931e379708c43532b68b0c4c1a1e9cefe4cd5cf6218bcbc24d5a323d7db31e27dcc289c79bb39

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
94KB

MD5
036ff562b814dd9dd2786633c79f9822

SHA1
7b8fa14041e5283dc86c303291dff5916f6ec3aa

SHA256
e838df7cfcab4a630595e59b1100b62dd77d60b65adf7a7cfce3c63613f49744

SHA512
bece8bc2257953bf9159d366cc347f25917dbc81c1ee58221209f98106dc1aa3a1a2b6262fc90129999977b92404298e8c0cd0b8e7928dc5104d69b26d2af333

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
92KB

MD5
a14c33572a63ff4b7236e67ab3926599

SHA1
8d0bf4985029e768352b7e84d07630d3d0796d20

SHA256
fec1c6c9c7490a75006bd049dd9cb5ce1ccf341ae45ec7b38f3d31e7a0721859

SHA512
c6df4fb0bf7c5277d9072124a1c862ea239d3ea70233f0af0f1253a23a3d2f89e2f51b9d0813dcf0b126b02c6a15cc2458e2d6eb01beb38d0971b84cc80cbe4d

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
88KB

MD5
cc7c5a578f2081898917c026c8dccb4b

SHA1
6138eeb7522cf204935c432807069e7809354289

SHA256
64e3c5c691bee3c309d717c3d9e491d6bb79e620d3cdc16a31fc0c97178208fb

SHA512
b23d46031ecc6629c5f0e9463b55b4dbc632dea2b1d05716ccb1e0d64526faa48928a810ecafbfbc2454b61e28d4c5bae02d3fac374662605880d393b7dae9bb

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationTypes.resources.dll.tmp

Filesize
99KB

MD5
1f13a60ce831d5e9f47fa4a03236a711

SHA1
1c61f85a42cdbfc6447cd89d22f823bfd9d0ce84

SHA256
5b3f6d800c0738775c329c0772e915573375446b85d5bc328560a5c4312c9339

SHA512
32e55b076c1bf222a21ad1981bd171b10dda8a82c7603566719e6fa528886e18178cbb7eaf6cd11feef390e3d0f69dd03e5401b507971db2dcff2e2fc4614c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MicrosoftNotepad.xml.exe

Filesize
83KB

MD5
96117ea99a333ff3c7fbf9872ffca8a0

SHA1
0ae8fbe953c0aa3c4688bd1573bd76660b4c3350

SHA256
d1363f378b92582e9ed28a5d11aa5826d736d1b5449c7d8e5a2b697a56d95065

SHA512
93e203472b4c9439e7d6630a36d5a2db9b7a99b4b63c52a1b99e16a7b56e04d4532974ba8b0a522116ea47b79a7f2c5ae41d58dc25a898f857ffcb21da602d26

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
81KB

MD5
bfb28d0caa4be71bd150267ef20bb83a

SHA1
000070cc4da5630b985d63a578826f75c66eeeda

SHA256
af4de42ac7a6ce7122a58b0e837ee99188430b7a7de61f5d7b400140148283f6

SHA512
e6894c74b2531f6ed46e6ed8c0c0230e487f715f117c83e8414befe2bf467a855efd052b60b208d89bd42bb854b5c911bfbc6137432b05647fd17b3f526572ed

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads