d8012371164a88908e17f817eda58de18b78391fe38e9a5f640aace9921a8f12

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cd1ce3cf9667d3cb25c09bfa97952b00_NeikiAnalytics.exe
Size

149KB
MD5

cd1ce3cf9667d3cb25c09bfa97952b00
SHA1

c06c5a1d22878b9724c066047dc3eb4dd637b93a
SHA256

d8012371164a88908e17f817eda58de18b78391fe38e9a5f640aace9921a8f12
SHA512

6b7622fc88f768d319ce72a8725041d0223c0a0c587a3a9ccca7348130aad957ae5144d2b6f2671edf9f5e86534a303e5707af944b19bc4e951aa7416eaf425a
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E65dyGdykNdNBKZJHJf7Z9pApQESOHepOHe8G+6E65H:69WpQE0zK9WpQE0zd

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5055) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3808	_chocolatey.config.backup.exe
3300	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	cd1ce3cf9667d3cb25c09bfa97952b00_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	cd1ce3cf9667d3cb25c09bfa97952b00_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp	_chocolatey.config.backup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	_chocolatey.config.backup.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp	_chocolatey.config.backup.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp	_chocolatey.config.backup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp	_chocolatey.config.backup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp	_chocolatey.config.backup.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp	_chocolatey.config.backup.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	_chocolatey.config.backup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp	_chocolatey.config.backup.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL102.XML.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp	_chocolatey.config.backup.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\it.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp	_chocolatey.config.backup.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	_chocolatey.config.backup.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 3808	2676	cd1ce3cf9667d3cb25c09bfa97952b00_NeikiAnalytics.exe	84
PID 2676 wrote to memory of 3808	2676	cd1ce3cf9667d3cb25c09bfa97952b00_NeikiAnalytics.exe	84
PID 2676 wrote to memory of 3808	2676	cd1ce3cf9667d3cb25c09bfa97952b00_NeikiAnalytics.exe	84
PID 2676 wrote to memory of 3300	2676	cd1ce3cf9667d3cb25c09bfa97952b00_NeikiAnalytics.exe	85
PID 2676 wrote to memory of 3300	2676	cd1ce3cf9667d3cb25c09bfa97952b00_NeikiAnalytics.exe	85
PID 2676 wrote to memory of 3300	2676	cd1ce3cf9667d3cb25c09bfa97952b00_NeikiAnalytics.exe	85

C:\Users\Admin\AppData\Local\Temp\cd1ce3cf9667d3cb25c09bfa97952b00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\cd1ce3cf9667d3cb25c09bfa97952b00_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Local\Temp\_chocolatey.config.backup.exe
  "_chocolatey.config.backup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3808
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.exe.tmp

Filesize
150KB

MD5
6e9c2571be4a5962d47907b357f0b288

SHA1
b9948d4d906152770de8903a82e778e16883c4be

SHA256
7ba641e20022e36fd3000afb5318dd9eee5e6e1d924990feda69006fe63da12c

SHA512
8b13602178c163e7186568005578764392245e54ef13e19fa31317204a575e34a73571b631da4674056ec83f758d2739389f1cc5fec4e07b193acd5d90e837e9

Download Submit
C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
75KB

MD5
566b2fdb74bbaf59baf0a24f09dd8c25

SHA1
cbc5eeaefd45768e50797a2a390c7c7582f99c34

SHA256
3b4d4185c9a862eefb521e6995d035b191d289c6c7efa20cc9134bf6790502df

SHA512
927ca5e51a98218ec0b2dd4b728035d90a407961a579479fc6964f2ccd770e49b0f5af69a87865b8b95fc85b426a8bc6eab7f55fd616effebf8335c139765df3

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
188KB

MD5
9fef7b8003e9bb2e4d59e5abfb8e9b8d

SHA1
70a4debbf7ec08083027b900dfe6e79797caa38a

SHA256
ca60995c39c3bc8574d0d5fc0e50e40950e17aa7c6810781bb742a7414673a27

SHA512
9743d45f014a393b8f7c31283671f5529350103b1572747dd913f7181d936cf6b346afbd98736a5ff74ab21649010e4a6bc529d8dc4d9efcc681b605d277fcd4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
174KB

MD5
acdeb7d2d142061165c24eb69c92091a

SHA1
1395bcf6e746e4c6a75f55f0572494e970dd1df2

SHA256
f2f765edccf33df584677cf499187be8f097ffab24aa9e94fefb6e39214ca5c0

SHA512
3c050d704d10332500a879926c1f503a2e4ff932da783850e773d102a48189da3878e878f217e6288f039a7bd21c439e6b2456241bc1e8994461404634f35470

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
140KB

MD5
e286c2ceb38008907a9dce7f5025dcbf

SHA1
8e4621a9c3a435609a0395c01f30fe66a9fc4b89

SHA256
8abc925f84ababd5e969cdce5d773d86db52b68299bc6f5364c213c290e1c131

SHA512
3914f1a1c4f655f02bc86d20a47851115b14a472148c3b9e1d025203f551984d1ec4f6cf0bc32493f5db4795aebc176f9569d0c670770986681395f5f01f223f

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
136728c4f35cd4a7603b6d67af431369

SHA1
65bc6772fcb901b02fd206142bf853fc62ed0aca

SHA256
52224f67b8beed26d018832cb39a41a2e482224accb81995a9a9efdf3c5c3df6

SHA512
dfe322ee73dddf98446b700a6f730434ecbcd374dd30799f4cccf78d647b43a42099cc47934f8546f44d0f053cb72fa9c0492ab8f0eb43ba347103f8d073926e

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
619KB

MD5
976ceedd0145c2c63c14e273ceb3f155

SHA1
f0de84157a197677cfe5c68eb0b3a488514f02f2

SHA256
8362fce05bcbf813befc45ac48af756dce28b890fcc517b45cdf616f54906ea4

SHA512
44be465220b26009b9957a9d80f337b4cc4766779d785ee83166e9208e4ffc31eb3cfcf4a6af19f825eb29204e0a597b3dc849b28160f2e50eac01773cd0e9ef

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
264KB

MD5
6a2de68f2191d2175ac831076ce9b41d

SHA1
8655c092983dc70622cd03699c74e6e6d039afc8

SHA256
1b2721abf524a7bc524549d436d37f524c438bc2b0c081b7be7f355e2ac208b5

SHA512
3b5f7414a30c3978b1341bc1a0a9063277a380349f17a2535598cde13d9febaddfdb125c5271cb4953a98f7481c781a5f00290402e84700cce3924bb27c9369a

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1006KB

MD5
996ea7b03364ef726922b2d801d3c88d

SHA1
22b713f221715682423eb113faae3f1feaa1444a

SHA256
763c034310d854b1438babaac5c71d16ce3f77a1f8938aa9bdfe641c51dc5f03

SHA512
3c3ca11c24d160bb8a62ec3494b1f946735b10b8b93babc9ef658e2920fc48e08f1bb8677c6156c7ddeb74d1450be2cc5c9dd79179161577975ca0ed870705e2

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1006KB

MD5
4bfaa02a67382a069626398c7eb98b44

SHA1
72cef8a4bdef4303d9d8743cde78639364e04dc5

SHA256
16ccb22e61fb44783a9bb6ec4d12d27338df7d2c7ed42699ef09b6b0bd0f48bf

SHA512
0c39a30e31b96fea94dddf1040e6e9f9e0b44f469d0ffff58e56761f3914d1b74e865d40343d4c43ed62d4cf85fdc4d959462e1e82f09cb4d9939784a5ad121c

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
759KB

MD5
19a8f3b3fe997838258ad6eab079e69f

SHA1
0c7b5934bf8851de4d665155329f487afaf061e6

SHA256
33dfa8f46b41c4e7ac8a50c9512da724696d558452b15c9b2d94169d1f7707d5

SHA512
8653c787841eb1ef2f9e7e2b8ef0d96542166f57b9cac5709509acf234f719069e4d518b7c7fa866f2ada701d32245d03c3844d6ff3cd6e83dcc2f81c613cdb5

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
132KB

MD5
bf8bd8967697a92b3844f031c208ae4c

SHA1
518cebf93551de9beab8f1ae556b48e47a6c40f4

SHA256
5b8dfc0a7ffdd20e622ac05d0ca4c6cc6328e68ee742d293fce012b8fea3688b

SHA512
f010eb52c9a70fb9642737c29fe42169237994ba66781a02dd486635e3c6ae3a90bd8d992e0f9057c7bca625b001319d7b49ee02c6a5a4de63c80a0c53b887be

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
86KB

MD5
330e47e5f8a078f32c5f2f68e400f8e8

SHA1
65f0461b2b1be9b95526ae348f82ff329674feba

SHA256
8014984ddcc4225f264c3c59a324fa5524edf1d01621f6cbe7fe1df93ad84044

SHA512
ba2a9bf6a5b2384bfb42a236bdfec752269bca038b8f74c92a99320284f2a6f8d188dab0a6a14a7c5f30b41ab367bb2d81f7e4800b8d5a6ab065dbf8729536cb

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
74KB

MD5
3b302d4be88790beb38173827c35fd7c

SHA1
d6abba4cfecf35303519a66fde48350645764d50

SHA256
0bd2a7fc26ed4e1de94ec4d642ba2135a456a8130c31cf56ed631ee18c899b9a

SHA512
9f66a3f754c57c26b31cda7f6f25a1e7ba4e5d8fdd9bd283661d8f6ea714682d2c5ade85ead831932c9cf303d87749299ca5cdf762d3b2c9fb4f61e77803464c

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
88KB

MD5
7eeaca20c3831199d0b8df7c056364d8

SHA1
343a1c01e7287164d7ccf77bc50c7eb42fdec4c0

SHA256
36a1786c83cf851f588ca8bf77f297b1d52667e1302f63bdc532dddc89128a8b

SHA512
88fc60e9b565ee3d5b722a2a614d1dd0c9efa6efa431e25aabfa3be370005f5b053c0b7b05bdd60f509f8e2e40426a8999682b0b7c546b1b0a29900cbc24f1a2

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
90KB

MD5
ac7a5e0eeed8b0c027297cd1a7ce67be

SHA1
6330f39a1a4b389760e75d7faa2f6bfb77e0d09e

SHA256
3d35c2ca52eda5fa5370b8bebd8d65e56c202565ceb1c47ae5393ca776702627

SHA512
1b19b4e1ed0d2236af02da98b39d4068b07f56de466d335e42c78ce533588c16a268dd7ca2092cd9ed157853a06db4f852cfcaff38582080139d5191bba34d99

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
84KB

MD5
15fdc9c99fadd76a20347a2e01f0e637

SHA1
d80f90121c3d612a654ba0e5d311a83eb01f170b

SHA256
6c439cbe90c1a9fb07dffb920a152f3e8c39ef951855a12a7d3b1e522ec38376

SHA512
da6ee3d339cf4bdccbb10ba09c6c96667f19a88a3827506430341aa89b819ba03cf7f9dc31c88ca2f43bea6712c9e6fc69ff4323a02d76fa4648487a29ba508d

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
84KB

MD5
951f0ee96817845f85494f846178d5e3

SHA1
e331c1d720b6777998c350346fa1428f3452eb21

SHA256
abc89842cdc80a9b9fbd15cdffa5d0f5d7fe36b2dc8f9beffd5a8389e2590934

SHA512
2b8e015afd06539b97a6917394ee5bd97f9e3f3bb8226bde9671abe2feda77375ddc95bac702c41680c9aeafa58aaa32aa1a64448bb469610f6891ef5d671461

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
72KB

MD5
a32f5c8f7bd9452969d6542d54d058a2

SHA1
9983e395ad01c3078092a11f85a99559184660a8

SHA256
37baf06e5fb17ef990879b641e57ddf6f298d3da05a1310e721e0c0b3020b370

SHA512
6ff8e20a4a5ed0c84cb1692f1f5ffd4e9d79a5171ba3910bacba1fa90a31552dfedd7b345a2805d1e89bb5376cc27b1836684d9fb2dd18574df7434e2f0b33f8

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
83KB

MD5
2f6384efc01054ba0e7225c1904aff76

SHA1
075426bd6b19c1a6bcd4750dc9665cfeda1e49bd

SHA256
75e22501650806262ffbf59e776cd7e8818cf1eae662e0419557a6164240878e

SHA512
d121418d71619f625da29501f6e689ea9016607679f70a68cded1494eeb055f9bad27bac04f3497a2fe0b2f578e2e099c128c5439d4ce2caffcd755c8b36dc07

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
75KB

MD5
a8b6de17c01454f95daeffceb9575822

SHA1
b59dcabb98678172cd6dc65b921f91acabbf4f64

SHA256
18706f1580afb5256885ce14d1e7e9949efeeecd51edcc1f6a8825fde2caa54a

SHA512
85e788d28621791a4c9486fc4d52f553854e7903925f01e37ca4b05d0ce29afc5d04f4eb6d13f9c8fdc16229a6ed12bc7317a0095290b92e57d4fd9b9d4da8ce

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
90KB

MD5
b0a81121d272a8e86090050b36a3faf2

SHA1
1d50701757610bae63c0bd2ad7893c05813bc6e7

SHA256
84e55f5e7066139719a389087135e55ab5a68992fecb7398ec119cf4af00b58a

SHA512
ac1dc00b6bb94f3eefcde3ab33578a8c3fb4f4d5d61e4e16014c84971049112fb142b4ba30d1ece375be1c98b4f912292ed01778e67245aa81b75f2c91738726

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
83KB

MD5
604465d79a6f130eb77c240a7b2f9c31

SHA1
f54ad64a8fd81f674757db6ee5fc4eef3f334898

SHA256
25fa624028acb721eff7288a87690b3daac75e48225f7d074edc9ba6337ef322

SHA512
147e95999d0bf257e7b17565cbcc47a1441b16bb2365a06c41f2caf3d345dadafad28018c2a29c4fda78b20e87a816b0c36a07d40cd44c99ec85957d41217f58

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
85KB

MD5
9ce2fffd4cecf1bfc510a7801ead77d9

SHA1
c74f15418124bb3d89860b2d19022f7c5bbd045d

SHA256
66735a6721fa9c020cb732275fa45d5bb1886fe5ba566795be667e271f527a1e

SHA512
ac54714094bb841bc2bd521329c6b5a607f617c6cf1c77efa0b7a6b62f0417e1351f8e31268d29505241c45ea60f9ea386c720276a0e4adf40d044da181d9bad

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
89KB

MD5
4fabe1ad5e5bfce0a26f46178961ec58

SHA1
5183439edd2b1f3b8c0ceb16d765234816a4a1cd

SHA256
7e449b84f0cc1483bf39fdfc482fe78a04080b3579457f45803b0f579887b435

SHA512
c3d8742bae9d504df4c3113d18a885229583fab65c77b8a9cf8d0685998b5491bf94d7770ef1a7257efacbe30395dcf4c0e395ba63b117e6de0db88f04fd5a6e

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
82KB

MD5
422f5a35e18b5f5d0e7837dc81fed5ec

SHA1
8d9646ba1c041d580ac348a3658d262d3d439a85

SHA256
53ae1ab72a9b948cd308505aa30db078143c4b2efe42e506118c7fe026d2d66f

SHA512
0450350caf9f6d1a38d4f59d6f0e58efc3cb6bd415aced22922229a9e58a2aea713c34cd5de5df15dd613f6485e253f6113d5c8d378a265ca34d7d5d251b9fdd

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
85KB

MD5
1c5ef9de1e4bc772a7189c3bf82ce57d

SHA1
e651c5ec356428bf280843343d26995b852116db

SHA256
1100a9581e5d31b1922246619a13311b0de0d5f0954e3f70d1efff7f74a3c835

SHA512
72908f3fa7a5d562deb3ca4ed058b38b4603a7808b5033301ce4d2f8ef01927df41f91e090d76e44797d6cb122c806113048bebc6b382f91dad22a5212952f11

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
93KB

MD5
304adadb694b7ab35ea726d810b5fbc6

SHA1
93ac0abf5eae4c41390b992b3c4d898f248176e0

SHA256
f15abb2c368a1f5634d03f4b52ff69347f3b910ec50e5d4f123887bbad947b9f

SHA512
06e6758c4de580f5e3c7b898b6576728a06a7a8484641c68d89910943aa70df71d5004fd545d156522365c723e5ac4d7db41e00512d8b78d29923f97db172900

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
75KB

MD5
1ff7dd2f0310988eeb8b06e3e68bdaf4

SHA1
3aedcc298b060009c347de2b7e46132ab106c8f4

SHA256
b7361c18b2f8108a5cab354378bbdd1e892361e6f673ea7b351788296d97e2e1

SHA512
80e569feb785f1eecc8fcc8e2c45fa6187a2a36f5e6d747c7711003574062b049c0db75c2225066634135d8d214be2db11651ddf23d359967ee6d89aa6958788

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
85KB

MD5
fb6e215e020af9f315656b8f37786812

SHA1
49ced0b3e64417e5173a05a92199bc972cc26e49

SHA256
e926f410fffdcaefb89dce32ef071b0e68369bf4f7590292b8d1322368d879a1

SHA512
9384d94f91cd7d50eb1b456c6ff6a5bf3be036b3720a8c8637c7caa0cf27e380d7c32685a7563ba0878a48f79b100145e9c0ace91fdefce65d51598575e833d9

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
89KB

MD5
12072b54ac0b36e2c93177a5e380931a

SHA1
6f57299caf9557ebf8315fc1a4cdd402869ee309

SHA256
ad22f94e78065a58006df95c68e4165d89ea137eb53d82bad4432e47b5aaa324

SHA512
fb11ea6e6e51f3edcd477868348cfc425720e57a21063dfaf2e57972a1fe4961fc6a525cfe002f216de45d3579e9467dd891f6a9954d99819092dc38ead7d390

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
85KB

MD5
ec397f28e434e98b0ffca7733654f306

SHA1
0982c2c2324d21e9a8374e078ba056ba3de82de0

SHA256
3b1346c9b0268af8b0051e719c1333375091001dafdd4e482c296244a84343c4

SHA512
a96dcdb111cfa8cf5de5b8d6c1eecd91bdb3c110322401cbb2723c97972a50e5ca7294cb9b92ce1175211c8bd0bbaf1194d18301119a6a5de024983aa95928d7

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
85KB

MD5
07e0606fbf45238df60909b7951b2579

SHA1
8ac84965d0e8537e92a97697d7ca427783cfc06d

SHA256
815e4fafdcea3b3b69f9d258a1a2aa720633b817437c74a0ba29d301847fc9ad

SHA512
d83f424ec1dabcbcafdd81a9b16b58d962dda65b5698261fc54687b29ba694001f7d0f1a195f4a1f87690e17e49b12de3412b27023d3fc66fe300c0206ac774d

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
87KB

MD5
aeda59cf6d8add963dfbd0d5ea22679f

SHA1
d8fecdf88eff928aedb7575ac4c0dab1d8538b0e

SHA256
843f7385c0da5593535bd28ec6924f06e5439388dda4213af6aa49a0ac1f9118

SHA512
e4bf9c4dc3db3e2234c1425932b3de52fd98d7ea928fd679248db00d35397ffce71cd97cceb58611bbe4070b628af8d39adda0efd4ac87a6ee642f9f430f9681

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
93KB

MD5
822ddad2f189b32e66ff90a29ecb9422

SHA1
deac290885972bed00c56dcbe641c697e68fdc91

SHA256
743f4e1f9438a10424e3feeed8cadd84b2f62d1ff3b1ceade0595f39583c56a4

SHA512
fcaf5f5306db718a3f215319c85430d7483226b37988373797824aff1193aee9817903d7b14af74e7082603db9b2ec42a277743f74614534039f06fd1cd164c4

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
83KB

MD5
5f7dde9528311f9f2ac4332e88d003cf

SHA1
6dcc063208cfcf28acd321492d16854c71b4acc9

SHA256
2583556b9e4c7b32ca2212afda1c5ab690e7e67b00b6f0882257705c1f204d95

SHA512
3043b487731ae24f40111d3878a2ec3ed2e0dace7a55c0f04246e5ad50c8bbf5b7ac7c03a817042433ecde70b2030816e6b69045e1dfd1e47e39634342ae253b

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
86KB

MD5
a02354d5a807b2634370f0ccb7bec1fe

SHA1
275aa9dcca932f646c941e95eb6c9b375fcc1ead

SHA256
dc2a8c5ce3cbce439d4b866614cd9c14e15b0b2d42f7b6cde7e60fcd4190c59e

SHA512
9cdfd04fafd6327a7b1f8939d08275c5cd71eddca6ac08454cb9f27b4c2847cd57395b5625a92f47afa83a23c264d9d1fc164e7515b09dbf0b9241fbcf2fc273

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
87KB

MD5
9781a38c004d824059430b90e29f88c5

SHA1
8316ab1533d30cb4bef1c3b494f086b42b420056

SHA256
fdef5530d566d286dddf6a742d89645c7f18c29adebf85a7e8a236036c1bbfed

SHA512
03a6eee0c1a035d047ae31ead54b83ff1a7ed38733b040d63243073ccbf5e312cc894fbdfe4155235436ddd8a08811f7d052426468ee20330596ca2a2a93e9ee

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
81KB

MD5
e437f00f0b68d4d809f8c3f1b816e6af

SHA1
369348c207121b19167dbe3cdf3a2aa6fc31feed

SHA256
9f05df79c78bf50420639f24789ba965aaa260268a85882364a8ea9ddfa53625

SHA512
6879313700f0911dded5cfa936c88ac7f651d3ee17a9b895379c7c59c0c5216ebdc961d335e97a45f24eb26a457c92aed12df635110b9081b79a67a311977983

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
86KB

MD5
aa567d5a5572aeaf0d2610161a45b9ea

SHA1
4a3370ee2ac41ce8e82087ac79fa8cca93b1f0e1

SHA256
3ee41c242c1fc89b5e49b0d503c1cb3b6483fc37d7a127425ae82d7d2f7eb875

SHA512
09ab35f66876a895fb61235a689edc659e87d790b357df5baf0acdbcf3a17729837667ef4f18abc38c2e4d8299909d3e781dba41042d6040f5cd35f0b3e40e4b

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
83KB

MD5
c9a27efea85a7fbb04ab86dcb5d75e5e

SHA1
9dde5667af7c272f52dd0bb3218a454bec2a83f4

SHA256
7e782b50e9738df48e5c498de31801968d7437920b0aa896530c8c1f266a9d02

SHA512
18219144b986b521e696c4ddf3363c48be9c408caa2b3b21eee845967ea353032dc27d60626fc8ada7798d1c9b41998bb8e83761ada1b80b548148b91d6f5b4b

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
82KB

MD5
f40566f40da76b8c91bbd25e6d2d500e

SHA1
04c90d399a04fe354703ddb14d881eb798ef2497

SHA256
c397a4dba452672abecaa4e1f22c5cab4c44ab2e1cd376d5843a475d0e54f70e

SHA512
5fafa2ad846e62d383530f1acfb218fb82437e648da3d42954838957e97aac63a502b8a4636676772462f37e805381da9676f7c81aafb9a502727e240990ace6

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
83KB

MD5
fc56278dbdb47ef1a17931191e1879e4

SHA1
2ef8a3b18fba042c3f07e122ea9277209965f529

SHA256
82b82228142b4fcddc2a1b693364ca06b6a8ef2c112ac473fb2f782d5f02a5a3

SHA512
30727176db303e5c3fa1e685156739bcb0d221a3f3d47c8cd0470a8aa8b4a0de061893de61812f1d15bdb46a31e9a7eaaa0634ea8937df39136357663359f57d

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
95KB

MD5
0c0ff322df59173870e412a1e8ed8a1a

SHA1
420a3ececcf99efa237f1c4535a671888c66c601

SHA256
93651b6b8dbb6849be5fbc70f52f70a9f87e4d568c93f5e2c1d4a8ed6467058b

SHA512
97b0c10f45df6a3d306abae3699d75f20a74ceaae7333c391731b348d60043ec9f33b77af079edda46d6ee9befc97157e6a689b151f3dd6a8815fa4241bdc2d7

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
80KB

MD5
c480fa938f38581bcdf69e721d2d1109

SHA1
53a5c3b577d2709c68d47bef499b8eba48c1347d

SHA256
6861c562edc23accc470ade7952413c47b07cc50f3c41ccb119b2d849959d966

SHA512
6b2dbda781e91a97967e502731c493c457e7b53a85d1b32ceaa3c0ae2f9570c54112fa3c837b1dc5da3097c2f5e6f887840becc68eec0ae8134918bff93314ab

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
81KB

MD5
93503e0649bd7ef57ec8954093b07128

SHA1
97fc11f9c00522f895e4aacc2126840419a35e1f

SHA256
8cad11b1045877cf63d8cdfb6a869423a3ebc1bd6354457453d7f93adf8523b5

SHA512
1393b91342158e6b747af5f5b0a5ea24b6d7aa05c2fd39d2eaf020ad8ddaa3c34ff7e423352e46c6cf9a399c4bc2d625370fd043127be787f44e82bfb0f03068

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
88KB

MD5
aebb62645eb3e18c3373351da38ce6fb

SHA1
88a2e0a798c469e54cd0f5714187d275f26b41fc

SHA256
b4155434c7f00c8cc90d465c5becd3f66c0a104b44387dfafb7442fc5c0a3667

SHA512
4b76f6bca3fbdd99877a35398eed2b9ffcb2342ab81c9d9b55852f1b505dde1aa30cfbd871435300c10676dc6d4f019854e1a869c33ec03fb15e4989deed6099

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
85KB

MD5
06750f9adaa8e0341fd1400cc316fdf6

SHA1
dc8ffe54df0ae24e67c1f5bc60dba95dc6610f56

SHA256
8958d189b4926617b83b7f36e9e2ed66ccf4f8921db1394a1c5efcf7780be40f

SHA512
f9e376121f985acaf6fd29516623391d746e9ff4cb5e1470c4e04a52d76d40d0c162bbdd29a592b73d8f15f7662b9adcd47415bc3b466659e2a42fb39e45e29a

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
90KB

MD5
d96af947fa8097c74c86cfbc4d94b3f4

SHA1
121ea5629620eb1c09ae998d7007a9f7bbbea876

SHA256
f561b20c85cacb3bc78013132a1417b968486c3424f21dbd10b8b1735c478a5c

SHA512
3e7c25ba42b984ad294dada095bbded09b3f7f4102f36e9307fc11c3c7c2bdb8979ddd7a08465a76e7aefa98ddc56111d02bba7fa493aa723cf822d4c03fcf2d

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
85KB

MD5
3f7e63bea20007e82995cf37a5e55977

SHA1
4754354be860eeb8a7343590ec691edbee4351c7

SHA256
4faf06a6908c3ad4206c7711c896cf360f04255ddf95dbf1759b117ab24188bc

SHA512
98c7d053fa85657ff381dbe0ad69f0e2c0b059543d40c13d9a8f21b3fda9d6d7fff81e8c8c787d1bf2d58eb6b62eb562a870f5fb6e744cabfc36fad1f97c2a54

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
84KB

MD5
092e9c9515427649b8b37189ba7e9d1a

SHA1
ee552a3815298d4b1e0d5c415935e5108a747bf2

SHA256
021045c2cfc6a0be3d9a925266715efc699a338a264817d6338f5e3cff477f49

SHA512
8b7a672dd0272c9211e19c6d74f8bea3137c16623b0cbffe7595211e5738fe897da387d1a846b28c818747adb574acf16c8247198b7c1337145b78d539d9965b

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
85KB

MD5
484edd3dd01b416a9133bf68a0661983

SHA1
8def4f621a19341f4b7c7f654b257bd4677462f7

SHA256
35f896eeee8dbc2171c931118b03975a7ae0d684cd4da00d6764b2dd65663a7e

SHA512
3254838201228326d7ac0c1cfefc21ade5c005856238ee13c2564886af544e6139103ec82c9af1c1bcdc198969d377c77eeb8830f80287c326e709c390be9f1b

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
89KB

MD5
452f7f1d1e7ce0a2897cffb80b147a69

SHA1
982db4cbfa25de53c496926388a05cf1c44141c6

SHA256
f7e3d3965fdd62a37ef36d6e02eea70b912e1c01ace53428cfac0af91071a67b

SHA512
adc30bff7a9bf7d242b809a574caaac8756afc3a99c5a145ceadb76b22f788eef49a4fd8f7bbc99f1cc753dd01ad100582f480e26efe25dcffa075f241e36d73

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
94KB

MD5
1d17f309cc2db85536a0bf17f1bfe190

SHA1
f7daa056be1742495404cd49e2a748eef897a32a

SHA256
2c48d6175aa5f4dd4de47809123f4b70fe85ddc1261a60c4ead212d5f73c1d2b

SHA512
51d476da4f6632000446d08a535856183217e22fd84cc2ecd0b11400c3dc284491e3531cee7e17d19a8107685f0e30f76ab1d3039dd572274c11deb41bd62d18

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp

Filesize
85KB

MD5
53b5dce34354c5f9dbda4fbe5f748f3c

SHA1
573f203febf084c40cd3bd7a757021996c9e286d

SHA256
eeac07618a2e42ccc6170662f96094c5ae1ac395b45c47aab3402ccdb495acf0

SHA512
3ecf839de1bcf6ac582f15a9b6e2e4f15b218e56961e02c1956964b83a8ae752795cabd9e95f2984b0ab51fd188a332b2192b9b516d5de7def27f5d9aa796217

Download Submit
C:\Users\Admin\AppData\Local\Temp\_chocolatey.config.backup.exe

Filesize
75KB

MD5
eb498fb0807f2b12256c85357a11af1e

SHA1
54dbd25f7f8e4c5dfd1ffb24a8f13afc87a10fe2

SHA256
599f9fb1c830eb120767c011403bfa1b1166277b3ff64a5593d329ff81588123

SHA512
e0e17369a75c083b243b867cc9d39dc8958fc8967d2141b2d90ba671e77640c561fb55e30b49f42578ebfe6a070cf5443f8179eb0d2ca6ee6240f3da8879405c

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
74KB

MD5
2e4d48d3fdff8c3bdb5177edb0308d02

SHA1
c2d7ff59722988106d2b62639b12683e4a41821a

SHA256
f2ccba950424e92d85a98e0802cb7d2df9aca0dd9d0d4b590d08ab68c8e6cec7

SHA512
7513654e53f006a1867c8cfaf0373f018f6e62750eaa54cde54978d167592b12cf9ba77d016becbb7bc6aa3c11454e43db2336af81a23ca04db8e39818d7d9c1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads