6c8aee204389f6f3efd64dd4f7189f3c6552e506a5d680f8bcee9e5a90200798

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0c09d88e8172c08d2b4f5e914479540_NeikiAnalytics.exe
Size

155KB
MD5

f0c09d88e8172c08d2b4f5e914479540
SHA1

2a6494b69972031ac9ae50b5667b267831f8af9c
SHA256

6c8aee204389f6f3efd64dd4f7189f3c6552e506a5d680f8bcee9e5a90200798
SHA512

37d3ffc4d665db4ddd4c9f1eb22d17dbad42aa23f90def3dd1e4f1b2c8d57b46254bb3a4ffd2350d92b1c23c321f225d7be5c579c5721faca13aa7b9c61f3d05
SSDEEP

3072:6e7WpP9oVLQthbYY9oVLQthbUrt7t441e7WpP9oVLQthbYY9oVLQthbUrt7t44e:RqAGqA4

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4946) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
808	_Node.js command prompt.lnk.exe
3640	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	f0c09d88e8172c08d2b4f5e914479540_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	f0c09d88e8172c08d2b4f5e914479540_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms.tmp	_Node.js command prompt.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll.tmp	_Node.js command prompt.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp	_Node.js command prompt.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	_Node.js command prompt.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Csp.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	_Node.js command prompt.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp	_Node.js command prompt.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp	_Node.js command prompt.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL095.XML.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp	_Node.js command prompt.lnk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\te.pak.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\LICENSE.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\blacklist.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	_Node.js command prompt.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\optimization_guide_internal.dll.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp	_Node.js command prompt.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL119.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	_Node.js command prompt.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp	_Node.js command prompt.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	_Node.js command prompt.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp	_Node.js command prompt.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 808	3560	f0c09d88e8172c08d2b4f5e914479540_NeikiAnalytics.exe	82
PID 3560 wrote to memory of 808	3560	f0c09d88e8172c08d2b4f5e914479540_NeikiAnalytics.exe	82
PID 3560 wrote to memory of 808	3560	f0c09d88e8172c08d2b4f5e914479540_NeikiAnalytics.exe	82
PID 3560 wrote to memory of 3640	3560	f0c09d88e8172c08d2b4f5e914479540_NeikiAnalytics.exe	83
PID 3560 wrote to memory of 3640	3560	f0c09d88e8172c08d2b4f5e914479540_NeikiAnalytics.exe	83
PID 3560 wrote to memory of 3640	3560	f0c09d88e8172c08d2b4f5e914479540_NeikiAnalytics.exe	83

C:\Users\Admin\AppData\Local\Temp\f0c09d88e8172c08d2b4f5e914479540_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f0c09d88e8172c08d2b4f5e914479540_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Users\Admin\AppData\Local\Temp\_Node.js command prompt.lnk.exe
  "_Node.js command prompt.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:808
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.exe

Filesize
78KB

MD5
419e5f6a2b7b400ef9df495390360bf4

SHA1
644ff686f5b5b941b6f30803f5e05590c546ace7

SHA256
5c19ccbe571f3d1f9c7f2a0235d6ecea71078e892bef9a40d2aefb87e87cbc1d

SHA512
505044741577741267043e61e4090025c12b699709883f55aed25bb4ffd623020ace65c814d30e5642a6a34b9dad635dff845c276f205ead8888728a69864429

Download Submit
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.exe.tmp

Filesize
155KB

MD5
6f47ba5445b621f09e5837f7dd5aa49d

SHA1
0ce791c6fd0493b3ebcb053425ed97a97d39fee3

SHA256
6dc313dcf735f483b9bed4fb043c9527686371f044e612431e644f7d929da3a1

SHA512
16d2deb8ef64c3ce3ac1fe9d54a53eb77d110896a682ca5d1ee1a7c55e2631a4ceeaf37c58bc5cb3b8e0605df27b7518f35aa7b245906b584bd23f7f58621208

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
191KB

MD5
fe1b45f6365a33f2da679b6472157ba3

SHA1
710b1058d999320dfd6a99078304574d1ec8d2a4

SHA256
5062f509d665bafba824f15d95c824b4cb61822867a1510b57a45306fe639722

SHA512
8365538667620ca8128bf72a09ffd7b7ecabf0bdfc638968dedc1b67337b913630582598038efdd4c72084ad6129e76923bba95b67660d25f8d658d8e9be1ebd

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
143KB

MD5
ee73ce3e6f584e9877433bfaa3d81a84

SHA1
55bb94a85f9312d009f62cf63d24a11a8cdd38cb

SHA256
a2b9a15ba4c382a11f5d21e9ee45d7ae357d8584a9e144497ffc8b164d192974

SHA512
ce61eb944a242976aa75b28dfa92f21f76d97f86678b2ac1a128414c7d96b9eca7a4843b496805b5312e893a2acd0fc8fbb3cb2b63ec739993c6f3372d89287a

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
b48fc3f85664a82960e2698f64bfe1d2

SHA1
9a0529dea30966dd97adff58706ce6ec1bf56dc7

SHA256
42cf9f831ddb7d5f3ab137a1c7e164abd97e4e39dc45335b0003b696cd5b8a7a

SHA512
764883d6052c0a72eb34b0e71945cca3e36693f915533a35b8ce860b5ed9bfaa121b319447c0f629573d2d3f9332f2389e9ee5bbfb96fceab2e992563a9b8d35

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
622KB

MD5
1f9f7cb33a0df001934825d587e5e255

SHA1
b79ced1236f76f18facfe1122c88a7b7492a30dd

SHA256
46485330c34d72d26b99356dacbda80eabd76bb66ef3a6c9691ee9eae5731da8

SHA512
00d9da8b254ce585d1ca0074ab517fc919cd03e07dacfa60d466085dabda1b6f86676012a76df6733f338c2683506cbb09e8852cf7d2d81a1691d906b648fc29

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
267KB

MD5
0a65a3b53bb806cbf6d12b72db299c72

SHA1
ede9d7aeaa5ec50630ccf31063096ee38ae16d2b

SHA256
a62d7422d13973b703465d025599eda6b1de0eec6a6108aa7a8399bb97019fe1

SHA512
99770b39f455e3364676d073edae4aaa4e32a5220a541113a9d875a621c5aa1eaa54216c3b702933d601802dde1a5bd51bd72ec7af0bef68a6e2ee723bbd7004

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
760KB

MD5
983e2f37698923bb1b2dd2d8c27dc26c

SHA1
6b4f0d444fc1bdce87be76fd4db0bb7d3d485329

SHA256
100e4b17a1468f5c74cdaacc60c37e32d27e6ab8481b190bdd45fd010f03e3f0

SHA512
3f9486a987cbbf0b641e8ac127d54399bb96c81a5f25d4c451e624b3ec84c987d377e75a5da8ef4f3c7a0bd78e59ca38c38ccd7f3b453e90ebd84102b3d54d6b

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
762KB

MD5
ed741a4045ee06163c2ac311eac60149

SHA1
38da2a0ca47afc56220c2e55661f4e74a510fc02

SHA256
c56a4152647e9538176e6d7c54c2b2b5e75b5c73c064117be6bf823e651ba53b

SHA512
7b24947ccdeb3da8bba4d40d6005097b1e5a77531ca36fdfda7340b333e4a3c6f81b6d360fd62d925ae78bc1bf8344724608e66da3b0ae420356446241e3ef2b

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
88KB

MD5
f8a59fac2142c97b8c8f6696392c8072

SHA1
8eabd48f3a6a33670b0821444c0d2039345c9ca7

SHA256
6f4e6a69586934a8c1f3d9d5d031c93425861bbff5ee3f155f1af0a1d89597cd

SHA512
03dd38b1a653369bc44a7462d0611b4e64f3e2dc8fb23575adad5eb87679a5329bf77c43c4c83fdb0e31c839a48f67e2f53693958dd4aca8332cebb622f78600

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
86KB

MD5
a6944f4dbb108f1b8e07557be39e0d7f

SHA1
77690bb5d2f455fdc0700c24df59606214dd0e95

SHA256
e4de364aff8e4187fc82bdb7850b96806ec91653b18528585a11ce8288185b58

SHA512
fe719780a9729d53042738a870a5dc10366e4f94c6b6c2baaf6d5b7d54f6fabe74333c2d8633c309b506b7065483f0873a9aa21863de65ceb57ad7a130a41754

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
91KB

MD5
6b7ef4c16e4a28557eed777a3f64f300

SHA1
0636114a58f92b4f8e77a9859607a6cce373b0ce

SHA256
2788820f05152fc60eb0cf122348c032e7cdf50400f046fd10ef99d1eeb994f6

SHA512
e90b99973574ea2b567e9c938a54d92cd6e848df2dd5d2728104ce42b8df27c57d832e3a55f8cb87ebccb7c931f4a45f8287e4a6c531693ff1e9ab62f4119014

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
93KB

MD5
8a98729101ceef545a742686dc501cf8

SHA1
bad4513c3b5d7851c7f66360254a3efd88ab0f71

SHA256
9ef096d4d49ab6f64334a52a94361738e6266ebbfe8210b715ca62e934226613

SHA512
1eab153b6a6ba7e7157ab480dc47c542d5af218f79d0f9df4299200cb7e5983286654b3584ad64eb208b1a479afab61fb029a7c2d7e4919e0283a510c09f966a

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
76KB

MD5
a64ecdd2d31e02eab961387ccc52c77d

SHA1
d97a566d2126af26b89d3febb0e3e9877902636e

SHA256
7658da61676d59792d0415feec89100bd386d616d6dcb62f243d1b16e9276d34

SHA512
19371e9f434cc17fff45839cd84f11b2da2a89d9b29da79be3649adfe6b0065b28a468e445037a449e4f7654b06eadcc627bc573a376999682ade83f8595bd6c

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
87KB

MD5
ad0a37d7056591344e478bc2c25889ca

SHA1
2ed5d0d6b232f094733cd06d0774940e63fb2119

SHA256
20c9fbee1947af8f60e45b0e56530046d494f8c69a8f648c1ca4ff79fb662fb7

SHA512
6a50f52276f16778a4296ec2ab9e40cf94ccef1da0b34141ee659cfd142275eafddcb2aea077b8c9c93bff2123a0e3cf00acff6d5a5741bbc83033d7a6cced20

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
76KB

MD5
cd9bdc5109110c95c602e5a6a2de941f

SHA1
bc5432bdb8ee3c42bad7582b084595a6e557a27f

SHA256
9475fffc9587d2c7560fa24b6c2a94455e6ab2ae8788e36131aadc806f50f3f0

SHA512
48b7085bb1141f76a0499ba5c7713d1e2565a080d6f69c9e931abd041e8df37496394da7c7404c3b29174f8cdf0878c77e3cb548f330c0cd941ff1f589928bcc

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
86KB

MD5
859809534802790879db9c1c60bffc3a

SHA1
25586bd70b750bce7919e9ba74f2c51924860e42

SHA256
b94ad93d1b5ea7eb7e287c1af4ff44b123a85f20d486a6bc5db78c97d9d8bae8

SHA512
dedc8ac9590e2dad85d5697c9ff133be298bcffda79ebd69b5a74483dea12cf6d531ab134f8e5df831e7aa0a836bb9bd6b9b947353b65777e95708e5e996a2a3

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
87KB

MD5
70b44277fb2d8215c128fd761590b38e

SHA1
4d5e7daa8c73cfb7a9abb42d279fd9ac35f18687

SHA256
f39a0113e3a49e94ca0cced892bf857ab2a6b9aa34970860647784a30de6532b

SHA512
608d6f0d4661e5a4a217aba096a237a02d51caea5092dcb98733829a08bbd1afcf7169743df2a2d787bdb6c66d50aca8cb99e74cbf56bc22e6e15e0af856d2db

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
95KB

MD5
f51bd9059a36cc69baa8a915e1722ac5

SHA1
da58bdec625f5d4f7d5a6adcda0495ba3f32e942

SHA256
f542bcd26cfb503ff4e76517a4e772cb735460940796fe0b3d0a6719a8743c6f

SHA512
109e882378418030492151a7eb9edf0b2c0a685c0a17d39916c7c94a943ad7680c29ccbad948ca4e8c798dc42a24435c177ac55f7eef4cb6a4fe3c7fa5089899

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
83KB

MD5
c30a58cdf23787a5881ef2ccdc348397

SHA1
2516b6f7e8d68cfc2341a439e70e59f7d0290887

SHA256
1f24673f7ba13b831ba7d51526781d8df8b0b8b03a6e2ddabbbbd201a4969480

SHA512
9e4ad40a290e48d51e002d5363ee3a5b39dcf0b2a047ad2af2595b3d0631a200ccc5f0f099d73543b262168a1f03f5e0732e9bbfc521c5fc7b46ea90ebba5151

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
76KB

MD5
dc4d541010683f31bc2792f28d62c097

SHA1
1d8c00cab199924f21d91279f289f9cc841761ea

SHA256
60b4c6e49454a94698c02b9b27b4097970386d1cd11f9582b5c06bfe34619452

SHA512
490e267add4e16a43e98af61b6379fe9d83c1281a169ffedc008fb4497c083b57d92b50cde94f12dd063fbbd265457748dd3ab9ee8bf341d93969def0a375100

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
85KB

MD5
73413478a4a14a85a475afc8b4c20ac7

SHA1
2e31ae8ffa30fe2cea643989c3d0843f3c0d849a

SHA256
0b3f85b8889775798813de2c20af4954155a3ffd5e6f02730b7d0b01d4386206

SHA512
8273258cedaf1b15a255dde27c3664ef002119fd8cc800e6b0a4301393391d5d91ed4e901bc80fe16b426b4eb7e69099b9dee35527eea93b8b9ebaf2b70f9db5

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
87KB

MD5
7f8df8cea4fdf40d97a36cb1a603ce8b

SHA1
597818bbd32d7cef2c9d6a519212d04ee45d0200

SHA256
39e7ff0136dc24da671714e9a367990b5585ac584e504c774d960ca9cf41f87d

SHA512
0cb234c30f948a97a67668840409e9d63e4fadfd1ffef80a554670ce984bfdb8114d1b7a7c0d490e566d80c9e0f6005c42c935e0500c1294631116e1d104483a

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
86KB

MD5
5e3cceea0bdc6aba5f2544d17cee0bae

SHA1
a852dbbfc9a226b84552073a92125c85fb20ca72

SHA256
0d4dd05db7990b1c81e5f42e16234be6da5c574478431c4aa3e8f0495ac32824

SHA512
ed6f567fd20cb79d672cae6f9a1825e3bd2780e2abd7dbe9958b2be0df9081d9df51f798dddb1e634d8c29e97c831b73e203c8e93f6aa8db598f3fae2300c7e3

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
76KB

MD5
bd4bc676cf8093bdaea51326cab4cb5a

SHA1
e998572b4db773de1808af16d0e01c59acf016b3

SHA256
2e9df32b23442d173878a5f6a55f226a8bd1a1a9fc5a216c67f2eb096ced0bc0

SHA512
7b1b0d971b17b033128002ef899fb235d573a4a8aeb7cb07946002ba2f36b13a99d6c7aa8f7cac473e4cc49245776c64e82385da7755acf55308d2a1f037af83

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
87KB

MD5
479d0553ff4cf02fbe35881f5f489324

SHA1
b7875b2a01dd6cc481251362ec552cda854eee11

SHA256
f4a8957c9a332da288bff26065f6bbe8a1b89cc88d5f9e8898510ceb97d19dd5

SHA512
782a3ea9f09c6240b4a015e9a34a7b083de4aedf0d26ea995b73ca21ca4c324e1e4d8bb4be3b27a60d0c12e02eb43f815e936befcc29236dbeb2737fcc5e685d

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
88KB

MD5
bfc25dc61d29e53ba15a36fe31b83635

SHA1
1af730354dae0f2597feaff478fc559d2f12236e

SHA256
01500557ebc2bae2ac697157e33b52ec367566314a091fc4e52e39212c05c0bc

SHA512
ae1ccb910ba34719a51101d8e3fbded2d5188e5d49049361e80102713bd0e3c5225585f3ebe2cc9d77acb91facbe62bececd619f6e6abf60f78e4c2ee1ee64a9

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
85KB

MD5
ee032e862d4f479890b78cf3b33b9106

SHA1
3c57a4fef7efc979f938f8bdcc00bd541bfafbe2

SHA256
c84d8d4698307fae43d7be260c9cd05931d0a90c84ea7e3a672815d1a50d0acf

SHA512
7d91e0b59ec895f9d825a6e134ce137350c5ac7de4b78068ef1412a960d9683e1cee46e6315f07dd29ad1904f4fddec66ec45f23edaa96bdbf97517e8c4e133b

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
84KB

MD5
9b446b920c85a741b53e1f17dac05b6c

SHA1
63b94ccb01612481d729e14b63262d516e260563

SHA256
a816fb4ef912f2fece99502657a72b66ba67dcf85c02024bc824c8d3dbf16a00

SHA512
a2456b605273db3d8cc9911e2bc09e7cab362e1374c391d141355dd1ec14868c50e909f94be4119c12c51362c0351eb39a6eb51293332367705bce275392540f

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
84KB

MD5
2a4f44ec65c2867cf37e02e004cb1d99

SHA1
ea82363b25369672eb16f3d3667ac73486a3e019

SHA256
c524530e299374d019b920f95a9e2b06c6d2b3227c83854a75cdd953e0830350

SHA512
864a6b14fdb5756ea42597e82075c7c63c04443284ad0dfec92a00d9c2c12f103b7b439eb75dcf7806500df77eb2c7f2a9fe57a5decc29844ff17065e60750f7

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
87KB

MD5
0b57c9af2970816b11d31e4cd457ad1a

SHA1
728d0432efbb3562a72c4d36d030b597e813d831

SHA256
f7f678c8525f3cce28d1aeeeeabba0e0289140eb4906a329e86109423086a130

SHA512
1b475117120a6dc4f1c88916b297b8348e3f63e04902c6a1f909fef4753069a89c4c08ae9a1c578051e1dda2921ffb94989d4534f2bce257b51766bbe4d8a1e1

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
95KB

MD5
51e4c2d523b9cd5b9c091ae7178d80b3

SHA1
44bc0498d6792c616f18b19d6ec97d230ec73a27

SHA256
18b8381efe38bfd7d80b9a61aa69089c1193d90e3582d19121c799af799b0080

SHA512
3a71253a9b37df0de273eb4305b441db83885288e8b0b107a7bc1e900075971d1e72852dd63194e5a4bfaccbad652188285aadc335078d11b7e584d105e97c9b

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
86KB

MD5
8b269f49152f7ac050a2f407207b01bd

SHA1
d1adb74268308a4beda43c59a60b810af0f726e8

SHA256
67ed2eb1fb2fedf6ace840a569714582a9597e49ff1e9be58221d321cd3c6f67

SHA512
665a028975c77536f7bb18403578c1fa63bcaa58640517e67fee8914f5a858309f10cf8592c4c39f8a72e9a937bfd11ab871dc6cf1310be054fb05bf676271ea

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
90KB

MD5
08fc600b77a17cb706f82f1edffcd01c

SHA1
5ac8bf81a3730a2aa8bf7b4eb3ff68920720aa97

SHA256
f49ebda733784f4fb826d27f608a76da7802de6584552e6118fd9d5e495357a0

SHA512
65bd914496d78aaa1538edab8d7d8b242956ea620935c7ba140a4c8d8ff059a0d80b627e311ff0ef03220878706c00aff8555f2eb08a715b9d8334c219b9cf9b

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
85KB

MD5
b2351e89ca2901e97b7eb31415d74a99

SHA1
621a06950585b59190849270f04e27f93468f776

SHA256
2d7f9300854530d895745029e9c98f378e21a0ba4252ebeed0912382b0edbd11

SHA512
f67f7479386c7cfac3d72b070c619cae154f2e257f13484722722b91233af5ca9499bbcacfa8c521bbed44ae2fd308c1d3fde2674ffd1ea4caa6b3076e65336f

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
86KB

MD5
542e984a5a14fa231e23b3b1c5a869e5

SHA1
24ea4fc73e4ba3ef74579df867b0d3f6d86b0998

SHA256
fe4cebe423da7acae0217fc071ce5f71d759c405dd2c8d2adcf129e9f0048523

SHA512
0994f82d12b0521d63a8a2bc32f92ab4894bb600827c78391f642a96831af97c9b367de96f5066fa89fdf0224a98a925ebc2a856d8cf1ad957649f5445b0e88b

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
90KB

MD5
e17eaf29f778e9aad58ccb5ca0995054

SHA1
be25784456542af1acbbfdb6a953772bcb5384e8

SHA256
70c844ae54e3ed4d3509c279fb1951a18c4e26f5f41de137f8d48256d7921c72

SHA512
397870fd400dd26a6e21fe36bd8e8fe989470699160a93cbfb84b0436db14d14306dfbb64b65c84aad3a98049970de3f5ade870992bddd6ef2e1db527c2dc7ea

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
86KB

MD5
bf6daf648ecdec816c57cd5e4cee2100

SHA1
81856aaedafaac37b18e34b02a662f26dba4943b

SHA256
280adc86db8a4b94354094eb69ab2ea12803f713396651168bc71658e82719c7

SHA512
b5b31e6d10342497d24758ab31a72af5b1158b6b42d1f04a427fa154929263c24700fb761f8d037181495603a5665366d0f70ef8ea51354baafb2a3010bca259

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
86KB

MD5
0159d7e2401a71972b4577fda64d27d3

SHA1
b95a827e23819efdd4af9d6009cdf9af753e4af2

SHA256
1b86c396d8de9425f5aa97b8079e44d15609a27bfa79baced3d151ed6400b5ed

SHA512
1b8ed297b35e6a3532e0a7cfdd2fa64e078afd61eec4b4aebc1b94672876834c87611d77e747645c53959eb6e08272ca4a6cf06124aaba89f755ead838f43705

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
89KB

MD5
1526523c802f18d98df87eaee66bc143

SHA1
501ad99da4277d7e010196e53b75a3160c819faa

SHA256
54bd856799fbc06c92b3d0519d5821a0fa8e439b3af223714679767748dc6c74

SHA512
7fe812f99edde25201ce8eb765cf7e6fdee5ae92254a3da3081d925b6e1aa8469cec5aef53d97cadc662437ce4ba98d9381437a7a0d0eb9407086109ad4ff458

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
76KB

MD5
f89425e7b31b6828368bb213ca69ae83

SHA1
f34314a36c4fc25285a04e075ab767480f89b71c

SHA256
bbcf1a189a44c37661571e54684c0cd7309b934ae9a47b2d4ac23d631659366e

SHA512
fee33c29b2c30c0aad2de1df730237bf773d68e81a0c2311f4512279ec439e9d0ad9c700d507c878fa201cc11ac4a55ad1c6ea382a5e0d44c5591af085e7f9d1

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
90KB

MD5
1d8b248708ecebb1a0ce9464ef715160

SHA1
35ddb6108a18620dfacc30f954d1a88b42256944

SHA256
b81051e4cbac874fa868265699a38ba6687276ea1c745295a58b65195a894bee

SHA512
404eed1d6240a141f3ed83f59d6b5d4af75113bc2ba8253d522e81d8eec100d916143cbcdba21e5cfc5da32a4abe1c4d5ed850c9d0eaf270a34448017629177f

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
90KB

MD5
726764f2f695c5cf1c969a785d502380

SHA1
abe439a0788b491f9f6cc706a8342fb57480f521

SHA256
28e1d8f8db05723117e592dfcdcb043f5fb6bac46a835b9bbf0ec7b9b81d02be

SHA512
2d835d58f07b73edc57019e7abf98587a1345ac9b4f4269d506f1c25eeec6d92a8d60cf16b5cba289f0c39d77a3e79a4358cd0e479b0597da9063f2373a35889

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
86KB

MD5
06357960120acce021f21e17f56a1596

SHA1
933dfc03e86e7ff31910dd6c74610fea2dcf01b8

SHA256
32fe3923aeb088cdcfe8b4f72d411cc2431041fde0ee845ec85da525ab20ed27

SHA512
03f7ccd1cb36499e4ec5c3befbf9cacdedb6c9942d4d40dc9fafeda2cc080526d2cc79b73d5ec9d6cdf2492bffd370b2b1c355987edc2fa8e6cd659eeacbb538

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
85KB

MD5
910b0a3961266e88374ae55a96a5776d

SHA1
a95fa0242dbc449a1b0899cad1c25ae4f1389f01

SHA256
0ef58df38b7a970d858f962e1ea4efaaebe48026cf39ffcab27cf6c47159e186

SHA512
50f0db7be445dee50996317ee5d560d71d9981d3e29563a530b1d0eff025b5310a07e2f17ad59aeb4a4ded30bb3ce9c3d6eabacb4a10e3a62d104ca5c8bfc68e

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
81KB

MD5
07c821554d6988823d56c8d19a1dfb78

SHA1
89da02068d83fc96a6d16ca891e0116178b99e0e

SHA256
7589ff40eab2bf9e9fa8961a4b08f6445b7a719d5b5c680d067da81232339bdd

SHA512
5d14a2dc0a80236998072ac319a8f37f1e334c78b09f5bf5346bc6e40d29f9213eb53107f9ed02fffe79ea7408ead4fc88c910b482584e6e93938cea99657600

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
84KB

MD5
9e4d07d70544cc8ab43513110f9a0045

SHA1
0ae5ef891f848f1ca0e662a8baa79755115ffe15

SHA256
8b2587a46efe69edbda3d00863f900fb68ea30726c82aab22bf5404a9d48494f

SHA512
a35ebf1b3bb2c7f7804ffbe6dddd2d0848fde11f0998de768a6a21a254ae4a40d885b1a4620f3fa8c4a9ff12a1e6858eb38f97db8f718a1b50def0a98ac266c6

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
97KB

MD5
84090a907b9cab40d5da5a0913ac62a4

SHA1
e562ec53a62e1f92b112b9ab7ad986fc7a2ee139

SHA256
d34ebb5fdd37d6070954b1785d65965ebb7a3d847dba32633e242f0189315406

SHA512
81674ebe93f19efa4b42bd464c2a128ccb71f00669f0c8e22f8f2b34964320fb51a5cc0ea1a6b03fe7e843887a51ff6c4a9aac4002a99a4a258ed922013cb87f

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
87KB

MD5
46734148d3c8f280f5af27df8685b808

SHA1
1f32bffda1bd7d7edcfc3d2ba1da1ca353b35e7e

SHA256
73afba318e3fc75da7e0bb4bbbdadc9ec4480a7969f9ddff204ac2652cc210a6

SHA512
d71a7be380f355ff4f56289b22399e65ea97403f2a8527503ed0ff0b32ac6961e705f72ff6ddf510ca85d57a731ff9a40e66cf49c3ca38dfb8f887509be4adc6

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
80KB

MD5
8590c4fe388590168f86ed3f1d3041cd

SHA1
8eb07d95d0d624e836d71855554d8dd67ac64a57

SHA256
199b903104c999514afd1dd4c056d6340695fb5ce25f78237d3a80defb2a6c79

SHA512
3721cd2c2acedb31004a33deff11754613aa7b1819c5011886681b525ffb334cd39173e80546de2da0695d66d39cd9dd1503e4825eaa8761a367a9e5687324a4

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
83KB

MD5
b36c81067aa9cb4d95681c13dfccfbe7

SHA1
37fb468aa46d389b840f112f2bf7840fc73f7a53

SHA256
f47d4a4dff456ae5e1f103f5dbe19624c8f129c83ea9bf61b9b4971ea6166daa

SHA512
37e69d063b2bf5c6f2e55341ea5df3eada75e71b9db7b9f019fdc57c8cc1e3938a48482b6ea4cd041e0dff6e7853c13a3e8cb7806994c9e77bb113f1f553913f

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
85KB

MD5
a238652c9479d5379a743cdcfd0a8012

SHA1
7edec6e04f1cddee389e6b75ecdc274bd148c5ca

SHA256
85522a61e6cd08cc41161ba95fce2e77b93f3783a00ca1aaa0c717be9d0ff8d4

SHA512
792a2a8ae4e7970cbc95a3022fe34260eff60e1dfe0d4e2433e066a84c0fc7f5da60bd88b867bad93c33282a6ad4aa222dead9d86a2c0982078bec9a9eb5ab25

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
82KB

MD5
e7cb101ea969a74ce50903c942ad7dd0

SHA1
a9f3bf098733cb7c5895696fcdea07b3aade454e

SHA256
615856f3ac971df0df5919e682054dd7a8886cb0dd6e51a477a6df903597f57b

SHA512
307f7eef087843912ccd3250e0b8e04c41a41fc4416e8aaa4cc2e03186c6d476a249c274adb31cf3c0b9e4b63e6a05f50aa21af721c836764580e7998a5b09db

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
78KB

MD5
d67c2377911d93daacd315c2a8187a1e

SHA1
e78d74df3f93855a44996441c4aeae7ff224f0b7

SHA256
79ad0e365f48cf1a74dee252ac5d6725283e549256afd6e59d0177ae4025fb99

SHA512
97528f78ae16dc4039002c49fdcf278fd3ba6ca3f6c328099fc4154014a1442835f9ae98ae16deb452a16eecf864c40d770f728b2b48dee7be61dd69c0d02cf9

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
86KB

MD5
f7a972667ae24ada52acd129ca21e284

SHA1
629541ef445a005a982176358c47749f15e1b444

SHA256
6525928d3cac06fda365bd8b3fb865ee634a4541e8abedfecd9b2cf07cdfd0e8

SHA512
535bb27a41a3a4b6b4f41946510d8a8a15ca8d3ad46476eb1207d7d6402b3834c93235f9b4ef073a933901a75455e40c9c49a9e7f70238aa0c974d45a611f969

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
91KB

MD5
2c72dfe577b34ea4730479ce6b15bd4d

SHA1
d2f2ae3f3f4bc80d35d4f59b716793874a0fb354

SHA256
5f78c0285ef2550ead45f746b20786b9a1d39f683da5af7c72f609e253dcfce8

SHA512
d8b05f61af5b4fbf832fdcd9d0c4852d92f1ef63fc55c70271f2af1dbe6c7fd8a5d242e9fec18e331a20ad71ab38a1a82fc2162600caba525b3d075da69dd5dc

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
97KB

MD5
e315434788b1f410e5dddd3ec5bd4700

SHA1
6efc0ac6eafd51ee3e9145e23e1f1583c58a54c2

SHA256
c52a5ee5e54820130f0787a90aff8598db8fdcf7ceb4adff3cc6f2c4714b5a25

SHA512
ddab87894466145a5efdd3779e6ff581389d3aff17bf027dea73d11280aff7d9f30db92a88db6f8a60b17f05cd0bc2ef0fb06d5958cd550bc0dbb62b6c3d856d

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp

Filesize
86KB

MD5
5671eb3f3fc27a8b623920673704bbaf

SHA1
ae6cdd2a5d25716ab63b2c09a8de41ea065eb2fc

SHA256
95f6d172aed4a73749088301d55509679c284b056b1b706c43aa8fbc267add35

SHA512
29af2784b5f39d46b0fd4249b6071c6bab585bd46e4c76df767e39dcb3bf3ff4ac276137fb71174ae8ae139b1e1788d20aced3c122bf6edf6a6772de4f412459

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Node.js command prompt.lnk.exe

Filesize
78KB

MD5
99ce0a94ad15123fd414b9921a116dc2

SHA1
67f869cb31beb4e772aacc5dc1c9988694121560

SHA256
507c6a74c223533d069c39c28a157978114d0b04367668bbb61b6abc84511b85

SHA512
3c2b121185d41993d788d34ddcc1c728ba281a489f22548022ef0fd13888d78584b37906914bcfb3a83ee184c38a26493ec7965e8b5bbc4df5a0a0930ff81ed6

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
76KB

MD5
13fa1875154a97663bc9c996c3beb36c

SHA1
4d1b57245fbee07661a9f0d4a52968002aee62aa

SHA256
9f6effadce570d190c1d63b6b419acaf14914f3ce2bc3f4ac9310c2ce9b7541d

SHA512
57333ce9428bafb19b70b5fb54e28860d1355d44f0d8dcacd9220f2aec93bf98cded9f3ac4965065fddf02c9d281500a574fedb96d8c077fa9a3e7ae98f9a558

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads