68d34f7e9b17c5fb2777f67a97bcdf52c42ef538a15b6501979699efe232b64b

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

277d0e9ffd63e7ae9d465974afc9cb20_NeikiAnalytics.exe
Size

82KB
MD5

277d0e9ffd63e7ae9d465974afc9cb20
SHA1

039d1a92a69b289938479255de49783f8c9b5501
SHA256

68d34f7e9b17c5fb2777f67a97bcdf52c42ef538a15b6501979699efe232b64b
SHA512

ad01500e7db61f18c89cf8f1376dda3850a0d1088d59814fd09c1bfc3cc6096a65379391e9e7dd518eb4d907c53515201e5641fc7682af870c21cefe7297e870
SSDEEP

768:W7BlpNLpARFbhblkYlkuvIYF17BlpNLpARFbhblkYlkuvIYFlopor:W7ZNLpApCZuvIYz7ZNLpApCZuvIYngu

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5261) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
932	_SciTE Script Editor.lnk.exe
2560	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	277d0e9ffd63e7ae9d465974afc9cb20_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Zombie.exe	277d0e9ffd63e7ae9d465974afc9cb20_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.boot.tree.dat.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\ODBCMESSAGES.XML.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackReport.dotx.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\nacl_irt_x86_64.nexe.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8ES.LEX.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\net.dll.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre8\lib\deployment.config.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\LEELAWDB.TTF.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\wpfgfx_cor3.dll.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationProvider.resources.dll.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp	_SciTE Script Editor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp	_SciTE Script Editor.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2560	2176	277d0e9ffd63e7ae9d465974afc9cb20_NeikiAnalytics.exe	82
PID 2176 wrote to memory of 932	2176	277d0e9ffd63e7ae9d465974afc9cb20_NeikiAnalytics.exe	83
PID 2176 wrote to memory of 2560	2176	277d0e9ffd63e7ae9d465974afc9cb20_NeikiAnalytics.exe	82
PID 2176 wrote to memory of 932	2176	277d0e9ffd63e7ae9d465974afc9cb20_NeikiAnalytics.exe	83
PID 2176 wrote to memory of 2560	2176	277d0e9ffd63e7ae9d465974afc9cb20_NeikiAnalytics.exe	82
PID 2176 wrote to memory of 932	2176	277d0e9ffd63e7ae9d465974afc9cb20_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\277d0e9ffd63e7ae9d465974afc9cb20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\277d0e9ffd63e7ae9d465974afc9cb20_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2560
- C:\Users\Admin\AppData\Local\Temp\_SciTE Script Editor.lnk.exe
  "_SciTE Script Editor.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

Filesize
42KB

MD5
6d2eb6ce06c86101f1aed4d9dac75317

SHA1
c76c08ef1d0a4ea500882641c3eac8b26dd76d6b

SHA256
f63d8237082447ee8a772f89765b9429da44d8aac0ccc57622b2dfeb9c93df0d

SHA512
c9e71fe14a0c7741333198c45433b3ad06d2c34f5440339da6f9db545f5b7699f3606070d215125aae573a96b89642b2b788a8df12b7d9aae56bd2284e88a28b

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
155KB

MD5
0d056eb135e52c6174b2dc4756b68482

SHA1
2ac67e05434103cb3fc34ceb4eca01566ca0a4b8

SHA256
79c92d8ad4e0b778b8f7cbd1412722611287f8c9e6c046264ac2d8645243b3a2

SHA512
d45c96c222d5cfa5d36587dc3b5bd1493b0023a6668d5d2df48671632cc9234aa239d8ee2df89e2821a83617bc4b49cbed58d8faa26cf0057d9ba87176ce4069

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
107KB

MD5
5af754d957b874950ea5b1f87e4409c2

SHA1
1c525bc0b08fbe0fa5e928df7cf12f51141b76b9

SHA256
7957d397c04523c6defb21b5c97e87615dee75578628257e3d352a06a783df63

SHA512
337d59a90d2777f695af324f00c5cd08cca36add6d1e0263b9a9f0279405addc25a9ab5c794294578ac7b274a2c09a004455a48e0605677202b3e127e8ad3120

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
586KB

MD5
9ed2f3b0703953994746a9bc0917aa1f

SHA1
c1faba117acd92cb8362846b500d8a674143b01f

SHA256
a636f5652c4bfa0aae906501957d920b65765664e25fe62fb6a27dbb8d3ede07

SHA512
286b2bcdba85a3d9b12c7dc6a82916bb35a5182007621e230d3168b00972965bb7543eec26d4c6088db70c4a120403b015d57a2d07d4438dc2c2aa48e0dc6939

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
252KB

MD5
177873ef968d3a6807d654170cce7a95

SHA1
26e00f2239458a775435a45bf6e10120bdeb51cf

SHA256
d3dbba8b9515bbe8055f57857f0d515dd5565efcdbb74788b4b179449872367f

SHA512
fda320eba3d67487287a28a8fbb713baf688e4b798ff0eb5453c02bd929bb35760665128897e61e5b1115ec6de69626ded53156418c27875a931a920398dbad4

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
973KB

MD5
321c7cb1925067bf6a7b966f20880c9a

SHA1
11d57cb2da9bd79ffb80f3817c7c46de0a010123

SHA256
2c9c47f52b3c322d0a9f920f7213511ece6bb5415f582c6d6f0a5c32b897e02d

SHA512
1782079aae4fc6ce47b5cce76861621c0dfbb8cdc924031108efc16e995e11ff43b4856c6ec5b6b679a524dcbdd5a425afd4acacaa221b21a51dbce69737c680

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
726KB

MD5
c9f2c95f1c8a4d75df163409804b36f4

SHA1
59c90e90fba93798511e9e4251bd65befc7e3ec7

SHA256
56c13864f145670850f10d27cf1ff8d31ddc0b297c34f2c95b45c0be1df8a16b

SHA512
7e680334f277b380bdba4c5d0494939da5d2aaceadd4cbbed0839871de8b6517d8b5c577c8f67ac60276f593e3bc9409e3a5debda983dee2b59598c7d695c49f

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
50KB

MD5
84d7820850c1aeb86d6d29627569baf6

SHA1
9b12871abc270548639afc798e038d663920b95d

SHA256
582e010aa3c1474e97faec4e10b6e89b7f6694c2118d93dd73ca653b09a7f462

SHA512
0f0899de523070439f61aafe40d3b797e5a638c0d1122e30c48e5360ece36861b521d7484b524470140250bb90dd81a578cfbeaccb939314114c0b5e4603e722

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
53KB

MD5
9b8acc6941b3ac1156d5a7ddc5d21ff4

SHA1
1224d3d83f10547c3ca9824a6891d13b2a99bedf

SHA256
f43449240b64df3e7c5b83d39f68e1001f95b10c2fb3e115d3481b5e32a1047e

SHA512
2000a668f5765dee198ae2a2be83624b4b8d4a1d2f5f9cf97761222bf0fa56a75961472bf02fab97b9fefe98fccf3bf7e293724fa3eeb82251b73cc2f4829672

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
54KB

MD5
b67dbd37f2ccc66803dfc8a46f9c37b4

SHA1
15fbb648e68fe2c359d1b0f2ba934637353f8ff3

SHA256
336a9f963cc563ae76c5c6bf6457863fb828c5955727819105cdb26dcf8dfd5e

SHA512
e6b979e1dbd2a0a401aff264d2d1dadf0a5879758006a324f317c4dffee80281be57fb0cf89ffd0c97606795efadfe89661cfc14304665ec70c1eddb168fb71d

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
52KB

MD5
f15c22b2ffb97d1978ac92634d670cbe

SHA1
6a1be6081a17528b39e794c245217d8502e0453f

SHA256
02ee9d526c087b4311f73b42352ff4835ddc053cc8f1ea85bdbbe133434e1211

SHA512
7c2918eb264856860eebe0b3a1f065b5596422dc9179b727f9bc214438f0e46a59fd031d039b830358cee50ee0b8477ab678af09630351797579f8fd9e302576

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
54KB

MD5
11c6feb0d30852e7f43c94f581200986

SHA1
8024f45b7ef52f029d1251497400862728b8f2d9

SHA256
4406e211b1cf287982dd0e6b2d184be0949bb9082961e7dc67cb577bbab9cba2

SHA512
ad3976fc40996ce2e7df75a6ee678b7bc96e2305b8323567c49d54e7209901985bc46737cf133e15ba8d536c3481190d59303f34eff04acada3ea577b6f91640

Download Submit
C:\Program Files\7-Zip\Lang\br.txt.tmp

Filesize
45KB

MD5
a60d6f35a8481613583568a8cf4e2c0b

SHA1
b4b28ca108ad5ca74e462307312f2c562b35c3b9

SHA256
b4cd3410603aa02c27e4ace3036619fe08b15815a1746a12e6254b1b8fa8659f

SHA512
6c9a42512306b8c8af1ae671e9b4ad8c12e53999413f1081ce21a3d73f46e411ae28efcbeb04507a9a67f8e324b8db6076d561ecfba4f9c875db6933114ce5f4

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
51KB

MD5
5239f0e041eaa742abcb87645b67750e

SHA1
9c7bb8295c99939b1e5fe3d900873a55448d6943

SHA256
b56a32f0b898f5dfa5128bd20531664c276fabf41c221122e12883689092955d

SHA512
7fdf23ba0849788096f6d428793dba4098ef3cc31c8ce25721f5414ec1e40ce77836ed092a245201b8ae7c9b75ece9e1e22993c290139c70782537c5a5dd7f9e

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
53KB

MD5
19d696d21374c07cb3068e3106203f44

SHA1
cbf72a600a4396d3a157306d47fb5cfe79040d23

SHA256
d4957273cedd732d906f3aad5ebab8ffa6c93e600ba12d59fda43f41190cbe26

SHA512
2a2c9335b85cfe034b75588c7c44eb5ab1e8d042eaca837a9ab7456c23a4e833122ca3ff56d599075fd791d62be994e926f1bb594f691fc20935eb21c3eab7a6

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
49KB

MD5
8c62d8f417a76f1c887285b3b191ffd8

SHA1
cfe1df31a54af3e886bbadd34b7af7e0fce7a370

SHA256
f02afe461f8da7f32e848439e1e39d23994f89bda3a45ae28dd22bad5a2a2783

SHA512
f231546ccf556f66434327e4fdd1fc7d633fe9dd4f126365cc7e0b4e923b9468579eeaf1c9e8c971bd90b2548048293aedfd91518d728b827e6a5ca6127e3103

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
45KB

MD5
9f62daa7e6b7a78d68ee731d1c951705

SHA1
242d0a73a4871c85b1ef5e6648ca1223288b87b8

SHA256
09464645f910212ef072ffdd6d33fac8095f488f7d43609c17b9f615f7e314ee

SHA512
e0ba16c1d7b6a2763360da0734b62058b58d1ea53f1692b2fbc7606d39f968d3322156cd5f22de7b9b17e8e8ee4b3cec46a4ca085e9c31c3376c01108142a886

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
48KB

MD5
611d5146ce9575f8e880a70eb63df6c0

SHA1
8fea6252afd0cf0ffeafab0d9c834c8f3b143459

SHA256
ce5e21d3a2a7e053ab3381a9a991cb28deecbaa52588165cfd69a68750d2f16d

SHA512
11ba10d935389282acb022cb043df3ad775850c39056ad1625bff05694b0f1c2247e8227d3ecfb2865acff0ff80e10dab643a22bc58221ecc451f31d34c537f7

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
45KB

MD5
3e6a2cfab4a24b78ebc735e77faee391

SHA1
37eef61995bab98d192900a5fe0a22b29d8e70db

SHA256
e93a16617c080b2527738657951cd52068980c6c2d2ad5c0a807a050ea09e45e

SHA512
6f3ef5ec0d7746d50502bbf93c8d306a641b2b3efb442d9fbb19348d7b2b9f5160ebcbab26e840ff0c8b31ae7fa7f02bcc7c154f01803449e7f5ba2f27d2cda8

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
49KB

MD5
3b55f82990e4a252d6eaead2555d819b

SHA1
5eaf6fabbf00dbb000c795e56d47c3680940aa8b

SHA256
b632a5e80ffa89efbf37099000e7982d49d21cd1a2cb4de3ff110e8a5124a8f9

SHA512
3ce0919e059e8ad54b1ae7ae1c5bf0c8b6b65acc43b94662cafc5a2381512d0f9b8e5af1965e0a41aec9e175484eebe9288aee4f3adc7575556c49d07fc39d49

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
50KB

MD5
3b7e4310b87257c4eb366160f33a3c04

SHA1
ac8fab1d4aaeb5259dc88c42175a9884a2c56716

SHA256
4ca3677f3f3b5b830d693acb4f9056bd26412ae740e2aeca29c073b4732a7fcb

SHA512
3f88719fe72c330a037ee549ab6a502695693c623a73991437d191938a7b7dabb99013aa91e0535f6bd78e3b7ab603504533e84707332b3abba8504e52beb0b4

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
51KB

MD5
ae5e0e7f87d080d287b0912e7e028bdc

SHA1
fb649fa470020178d95edfceb0f6d46439a983ca

SHA256
3e430824ff26c1cc4a50c9ce5bc4c763d013b0030b040079c5b429c1085d78f8

SHA512
78bec2ee81197778fd8bec3c8de82bd08b225686483c0506e1e5bd9ffacca483f0ece45c4a7c0cd0ec507fdb7e63905f498a1a181697f9e501a610272fedcd23

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
52KB

MD5
3d986851d1f32599398d09b0896c43cb

SHA1
a2e29db7dccd7d7f4bdf45a9b45c99dd851fb65b

SHA256
71168e9616e8479f7cd9ad0b6f1dfe2903a36db4fb5d0deded3f9bb2b00ca3f6

SHA512
4cc0b813cc7eaf8daf809ed5dbcef27131e650a0c4465c3f219e2f3462030098876602605bd298ff8360cd07b6551a90939de5678624c2a27b576e9b0fb21b83

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
47KB

MD5
ea98f3f73f77277ecae6f42d9e041816

SHA1
a04e1d18aba80935c2bba10cf8633b177c8c8323

SHA256
b5f8732189ef8143bf6f7f9a6e419ba108a7fd55aac156109721a89a69ef4746

SHA512
7b1076c0e4d0f1cfc63adea924b64f8880f1d0f9bde376ee555213eb53b55e02540a6703dbfc444565e246a611d9a7abca7a313d202af988cf03640fc0a5c989

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
46KB

MD5
6a4015a240a3cd26be51354a4fdc34b8

SHA1
15d4914afea61c32d624775bb4afb133019e79e5

SHA256
9ac468d7a6e9ffdeaf8169b4e862907757bcdf54a3ca0081d1c49178afc900a6

SHA512
1fe56749d0d8e7aae120ba78bf2e2d52bdefc94a8e05b09d38107761ef1a84bccde278fc9ed2bfa25cfc8cb352fbbd5e8d6ddc458f9e41cc5827f18f33dfe776

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
50KB

MD5
82c4c646b79d214c2b5560b95d5b2d60

SHA1
8204f6b50c8abbd30bb215d8e79a2367d4c01a12

SHA256
150667d2368fd05340180880af09851d2dda519d89abfe1733839da7b1927b4b

SHA512
177732dd14261a63ed0ce4d3f2a4d7306239ca2d2448753dd7a6e07a5026927651253194f6b718fa48e7a6ed3eff5bdfa43d41346d3b3577264e7be9dd44d0af

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
57KB

MD5
7c3ae28daa9e6c964d82c038f15acadc

SHA1
a56add0ce23bef31d980502e9ebb769d271651e6

SHA256
5654add4a70286cdbed2540f9c897b1bf58eb093a259cb5b4c629b1cdebdaf1b

SHA512
7b620460ceeee5071d5b26b5b7a9478b42bc9d7cab95c032c73be127d6dc9a7ea117a1d7e391391129cd8190824ecebbfaadf59f8d9d30c93e12ef08d8f772b7

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
53KB

MD5
ce8fcf81dffc9d9e82b28bd55513b9f4

SHA1
8242d100b66f2199e411864d879bf5387b94197d

SHA256
5be8a3774cd61341e2646b701a14b93aec30ee8deb47b0dc3891a889a806b1b6

SHA512
8beac57a17b4db4b11dfc8cdcf485cb87819b02d9d9d7c6878f07ae5d2b5dcc3b5b21a6f66fb0f795be19e2cb6148956020f3ed3eab6928cc170674f32641c06

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
60KB

MD5
bd002b444c866be7d8bb1551cf25c98a

SHA1
730b33dd1d9aed26a41d0e2d4059eac3d0a5714f

SHA256
f24c86e5c22cbc4f98a98b05b733fc13151cf0308056daced5017ffbc298f5cf

SHA512
9575a7bd35fa8ec6c95beab61b01aa56640a227d2793e2d3f5baaebdc5192505da7cbbf3e4be39a42afc052028ceebdf30999c6e9cbbbb1b23e8c1fd1a5b5d29

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
56KB

MD5
28864b391c7433c954b4103f2ccdff0c

SHA1
864a2d3e7aafa5f765d6c3665f35bcead55569d9

SHA256
63bd645ab04688646ecfee4900ff158c1888869974ff251551000b50b695a9e9

SHA512
1cc4a54ec80afd4a604916741a823135867e847906bcdc7585c9dbb5f5665f4b18317de3af59cb4b1afe06bc433d70c388f46b319d4c553e9aa1899ced0928f9

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
51KB

MD5
e9904cd6e0cfda8d9b2d1fe124c8f0e2

SHA1
cd577759502cdc4c1abf31024593d9ba6c94fdc8

SHA256
11d83cf8f1a19f0e77be0a17b8b4125742dbad1edf6153e424fde9e3725f2c4a

SHA512
e4590eec9ff8a8761d30161ccc168dbec3991c887174a55d15dc26efb5531376549eb9d36c22655f8f858396ca5a45312bedc7b81f8a16270426e6da635f4d1b

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
52KB

MD5
937e90c157e35cef4d15eb2b44d9113e

SHA1
66fa269dc910064152fa1efb2a406cc3c84e0e2d

SHA256
85eea65a82a5d399b6e9be24d732f2684783c9db58406c89a0f26ba298f2200e

SHA512
4a6560664692703293985bd0ca69cbaa94a5c41d07f0a757307dace099ba3ed9ca124acfa5f157303d14995f817a67df2dc18b7b2c482cad22c8fb8e3f672959

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
54KB

MD5
8177046f0ffba635ea66d7c09e28ef0f

SHA1
ba104a904c3f3e76841f4f353272362a1d4df6a1

SHA256
5bb658adf85a13f618bcf5488f4c6e86726fb4be5ae5b2cb0a3427b6e3911687

SHA512
3d07ccb5fd4f4db030acd5a31c8e5491f42a8cd2a34cff80979d5942f03b4e0e4199a3e159d8145d9cbcc02d6bec51904098e5ae0370bdc7ba6e6883ad35ce9a

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
57KB

MD5
db9081854d6dea25776a8debfa6fccd8

SHA1
a678f8aee19177fa83f132a0b98f0dee34cafdab

SHA256
4646f1933806f0ecaefb3814d5105cdcb13921f8622a7a356d38bbf2c5a105e6

SHA512
e56ec5eeb845dd24aeb3e69535638b08a06bcc778e661b9c557897426600a7dd82d4ad6064f6ade96881e42d2481fe6751ba6bb7e90cae0b2164f9613fa5aa4d

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
50KB

MD5
d2470673aa47c1214f0a2cf7381fd82d

SHA1
2a2b495ba57611c5ea5601692e10aeb7910abc81

SHA256
71ef18dba8b732018e9f785a017ce6f8cf17006bfa6da8e261f78dc622590141

SHA512
df2bb071980776e2d019258118dce9dbc0d051ea19858555f1ae30d8ab108850a3851929ff0951e8a0622c2ae01e110e87e3775bbe3de4079d9f8bfd4771231f

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
50KB

MD5
8cab5b600aa38baf6e42535f44c1864f

SHA1
ab39a158d0132c57ae31576dabc67ac5a5c927bf

SHA256
ac4deec0c27749acee2d39a5bd4fc8c7b0282b3a140cbb007ebd42b41100a89e

SHA512
e9711f53eb88ce7ca3ae7aacbbf495ca14bf2a05dbf24d58ebe70d149ba4083b591edfac93fde7d4a946304e9f6a0f4a60df0be2fa0a3a7a7795f572369326cd

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
53KB

MD5
d90167c7d968eda76f355dc46003c7ff

SHA1
816e34672a12c2f4a53169cea4b71dffa3a4210a

SHA256
291692f5c83a0a383b62d0d6f809a57549c43f9a10f1bf3e3973a3d6378df028

SHA512
5bfcd3b8e3190dbcbc871df7b19a58d5420acc7f612d6c2022e41ae2e7246b564e6b7398bd9e13181e6872e98ce2ef55b88e9d49e4891634f15f84ef70defb42

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
52KB

MD5
fd0df4d82c07149ac22cb7341152ff96

SHA1
b4ca168bc7ff0b1c3f920b8006e80b64622c3223

SHA256
dc87f68c9fc688a17c09c206ce353696972c7cc8aa42c96914f5b12e69f4f76c

SHA512
8892249fb1d988e1b67bf17cfa1bc6b756c25d74f45c7099d129e60529ab956fbf86ab05465daa06b727b07f972c7b410941eb63c5c2c920dcb46fd3bc18ca86

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
54KB

MD5
0ee60b95015c2d90d7c00e9143e71dae

SHA1
286d6fca6fc4b2c45dee148d875f2b475da05ac1

SHA256
ea7cbb63fcd60af574f884f008d30e8694f2c596ac6f537c233927fa6b91aa07

SHA512
c1ba46252b6e5f699554dc66a6f21822bd456be3ac2eae4afe8d8a4ee8117143d66b65d2d18a736e31059a428e813ac54a295d9f4f4453a3464ebd957bd53eff

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
52KB

MD5
06e68ca05726543d7bd3f93eafaac65b

SHA1
e4a1b032be1c66cf75296bfbd26db791ac218da0

SHA256
da79c489dae061456a273448cd3a27ca995e0e7181cb509d741fa5de6612f0c9

SHA512
348fc757ef6ba772c7b8cfa40dee674a1d341d16554b021923c4e3f3f3b3a94415c04f47ed0745e8e3e734ead664b24b97de89e043e560507f6033c881726553

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
50KB

MD5
f34d0d85337d4c6233ceabce455d53cd

SHA1
d038c5f96e80c197b01fd6d187f3c323b0e13876

SHA256
267705b549ef6d6888169d25e5fcbbf6d9b8a35d4e34067ddc36f283a7f71bf4

SHA512
45319347389bd715ed306c1be14d7bdbe7b779e219185810c84db6835ae2a0a1963453091205fead20389fbb8de6264e364392700b4d5c9cd048daea9b5e8014

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
51KB

MD5
e58354ed052cf8d3035afce1b987b353

SHA1
e5e4ab5681c68e299d73447c4e298fb7773620d2

SHA256
3b6d285a148cdce4443b43e0f077fba9001da1298028bd9c3582e32420cbeaac

SHA512
9d3c77845c0788e70adaf3e92a93fd9688dc8eaa7c6a41ad80571e3eafbba749544e70d515900f0689b7679a630469b518bb73b36ddc9844e6af170b62c8f389

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
47KB

MD5
7ab1d5e58555ba9bcccacf31ca6a68e5

SHA1
2d88b7df3717837d44c39710efd4609b4e2b08ab

SHA256
7491d114e15d4c0ad2fde3d0e28171cef07f9f857b2869b9a32b87a6512b07ae

SHA512
aa4445e468d18393550573f30b1efa733664226d48f5b5b7ab31e5e21022504e2342d4aebdd9ef2f3ffd16d7b1f50b7d07ff0a9ba87da73b665299e7818e38db

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
59KB

MD5
2c75b83159b5eabf97bd1e46167276a6

SHA1
83534983e0039945d124994ad2bfb73c190a0b54

SHA256
f432b9e5ba1448e486c957cf2778402c6ba0dfdc2bd7b681e87ad288116cc7ad

SHA512
91b2186a35a75222142c13351e40f17297d0729fe60301bb8539e1dd58e4c2fcd6a2784e65a6d9d3e37b88c943ef79345cf81b0f8f3204451be961ac36d6622c

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
63KB

MD5
1f8b64ad7ac329cc935d489960978aa8

SHA1
4dffee856953b4619f34a5bdd626752d3969d32a

SHA256
25636eec324f3ea488cdabcaf601933a093ebdf426f3ed2c43ed057490b13302

SHA512
6751f8281014598c05425a0e689ffa48d4ed5eaa2c1210d00daacf5ba101b52cee094ef9a6d2851af1970cd72814d588d36509e8fbed1bd83ba69d2e9dfd4635

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
50KB

MD5
bc9d89e3df7cefecff918dacaa90cf70

SHA1
c50c0069da5b90df09917af88113bffd51bfe631

SHA256
648ea09fe20b8047f3d11b425ac1c7d96953175f055aaec642529a3fc7590fee

SHA512
ae5aa7ee8bd646b82deca66febb82986cf2a9d6eaba196e50fac662e91d2d898386c05e0e9f2b191e5a3e1e196ff513d9fb9fbc9ab98a10d42d690587e90c5ed

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
42KB

MD5
10d1f6725e958d475912604aa1365249

SHA1
b7ba33a6c28495d0521dee30b65bd37a6063e23c

SHA256
e09fda1b7feca6c9ee8996c0f594484f0484a36a5f056576e1e5dc9692f57db2

SHA512
c2f7d16e98323d98f8bb1552bbfa7ad89ffb59efa089cd1b08855d21034cc63dc48a7f386419046d0df0a1a60727c756a66fae1be543fa15f2900a4b9795fb70

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
46KB

MD5
2ccf0a7692bab05972e8829a1912f038

SHA1
b906932b42f684ba52753592646f74e9cdd6828e

SHA256
802a89ebd26a57ea45f6af80ca1c8d34624b373b0c38dcccc4b8c4f7a80b0ac0

SHA512
17b8152ceeb54b5037d963d20da0e25ea34d693510752a6daae206e947b0c18461c35b5507b77b97c71f4d8d2061baf45863e17c8c20009268fb96efe9059c70

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
55KB

MD5
e8612ebd451a7d666773fd0e9e4fe871

SHA1
8dc61819e8a0b8d3b15e9004e2ffe1d9671f43c8

SHA256
13f899f239ef2a41a6de421873cc37d530bda4d6803193178737dcf3983b1879

SHA512
5ccadbb8a443ef7b69925076d8156d12bac2438cce5ef2e69ec854c776cecf59c12d2d34f013599e8fc2352d6faa025a5ff74525bd46b5226a4ceb17d71860ba

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
51KB

MD5
76b73377456c01d4aa8c40a28ec1fa43

SHA1
f3ad2b5429569877dbaf282c733677d254c1d181

SHA256
f8dc9d89efe3fcee79f7c833f8b1a944250fe99fd30c0c3240a4af45095df472

SHA512
92126f0720d3ec2afb94a7a24622a2180ceefe654b7c8bf25c93f1a012f0ae062d636b26ed62296eb92f861e4a83572df329e1916d28e490da1d43d7f6e30e75

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
56KB

MD5
457bb14b2eab0c3d054dcdcd3182fea3

SHA1
76b5c443c894407277dec113d97266741b9d86bb

SHA256
cc744b4fa7adf2db87539310f8d11f8d8e7988c6e4b5b23bc609439a7cc95b3b

SHA512
92fede65aa9191737cf874b88c369ba57af31fcc16354ca73f362a32d905e1d99072e38e58fa1619a71e86a42f902a78e895738b0fe2289a3ee4edf6d82c90e5

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
52KB

MD5
6ff837fc5e706c28421fe8a452679af8

SHA1
47f6d8429e644eec0130aac43e4f141bee177bb1

SHA256
56b9d3859f49bde311be304b8cf0ac152ccfcc0a45138a400c9b879a2eca1d53

SHA512
cd32d9b933574b3aa57321d40059e10a3b630cd86d053a11933410b0650099d20b05b9c1f567752aad9e737c31d788886083315dfcc7338c36dd9a88b11e9e77

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
52KB

MD5
7b11ec115c1373ea4334599107bc17d5

SHA1
aba7de209913ca77af9846c21a97ae2005953e42

SHA256
a2019d9e527d6a3b93e81507528758be5cf1f307be6b25f0961e772e92091a3d

SHA512
d8678eeaab50a0fa912bb01fbc3ac040ef866bf4fd98fecd4c83fa7f99062ee1d53d3a4dd90e36aac9283d9ddc2f2773487092123dbb9ead3bdacfe5f913334f

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
52KB

MD5
d201f768000f411f2ebb024099fb88cb

SHA1
b537152347075dec527a38c73b9dd3a3653a1543

SHA256
faa11004310fdfe557543c47ab7a77c706b960d285219ce059a6b14d52147e2e

SHA512
7a7b3d09b9d14b613e56b028ca237c0e819d0efa9466532ee3362ab83d7d98689c0803be329f13ada2233e593d04af1d20a9296a5f612645756ffc073d74fc56

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
57KB

MD5
70b18a6e961e6e95b734dcadd483e148

SHA1
5944fd249f08921e4337bdac126557da0e49ba99

SHA256
4d609dbbe5a3eec33c4c24221ac8bf9625d7f8710bc51e625f1d6a8ab1fd070a

SHA512
9334bfbaeefdea57c1c66354fdb29ce61287a70e9cbc1c5cf3ecfcbaaf0ce614b8b57d3812dbfd09cc32740271dfb6e2d3dbdaa1f4a04038a73b9722ad46559c

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
61KB

MD5
26b6e2b0ca64ce25d741b24a32720c74

SHA1
7708b4315471f3d3a41f31f3aa18f0f789814777

SHA256
cd06deb0e2e099344c6ba8c002a044e985631be0043f6aabcf26bb54777d2bac

SHA512
27d7d475d17ed9a349971d51fab6b18ced073eee27f0dc7539b61ebde10c6749aa791ae652a9f8a340589c44435e354fdc36aeecbd6e9b656eaf2f41232c1e31

Download Submit
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-CN.pak.tmp

Filesize
369KB

MD5
71bf4ea8049cdd9c866e617d5cc4ceec

SHA1
72b41957e9ab777f6a9b937484683dc3922268c6

SHA256
2b38fb101f148fcfe4df698856da64c31689d2e1150377d660817a882a7b8c03

SHA512
f38846d5b63636dc5f2134f627c2802020e818239b809404be9d392a90acbb93fe4cc5d30f055498abd3541f04d8ea847d58b07c1170ffeb3bf5cb48d561cf7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_SciTE Script Editor.lnk.exe

Filesize
42KB

MD5
6b72287dc1ea34e11454653595a977d5

SHA1
e2ff6413e73e6e2ca62d1c64e8bf0ee9c6e79156

SHA256
2f33750bf96092a5a4e2040310403280a8ee23f01f6a9e619d4f094fe029f210

SHA512
500211a51789aebc347135907741c71db4c3e5b14ebb8ef061869539b3d3eb287fe1bb8ba22918f11253a790b688c076761512f1dc88771bda65d296bff489f1

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
40KB

MD5
42e648a91b68ec67cd2940d4c5aeebdb

SHA1
536fa4e05c80b910d1495fdd8479a1a6965f433c

SHA256
a07beb093b418180d7bbedce37200ec42d31e4698bc4645a333491b7e3993358

SHA512
24ade77dbfe3b1c953a6b22fa9aa32f8a9653fe5b89c604c9d28862ecab91454d5d62fbae8b857fa07af40c8da64171944979d995cf6604cb21ec14228ba3eab

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads