b2d948032f2a940661fb736ed85a8b899a862699f72cca0ada4b56b01f1331ef

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06-06-2024 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10bcdb3d0861b5a8065f770211563de0_NeikiAnalytics.exe
Size

195KB
MD5

10bcdb3d0861b5a8065f770211563de0
SHA1

31deee4b5db49cdca5454f84ef92d002d9a5cb51
SHA256

b2d948032f2a940661fb736ed85a8b899a862699f72cca0ada4b56b01f1331ef
SHA512

1ec7f7cf2ff07a9c5c9db8a86d048f88b881b125d463d3bc8b0191678910495aaf95a8f1e0263086670e6fb5612d616abd867ce7a2f1715033161ae70fd4f99c
SSDEEP

6144:RqKvb0CYJ973e+eKZWaa1aaJqKvb0CYJ973e+eKZWaa1aaq:vvbxYX7ZWaa1aaHvbxYX7ZWaa1aaq

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5034) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4012	Zombie.exe
396	_SketchPadTestSchema.xml.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	10bcdb3d0861b5a8065f770211563de0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	10bcdb3d0861b5a8065f770211563de0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-GB.pak.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.png.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationUI.resources.dll.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\es-419.pak.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf.tmp	_SketchPadTestSchema.xml.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp	_SketchPadTestSchema.xml.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp	_SketchPadTestSchema.xml.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 396	2152	10bcdb3d0861b5a8065f770211563de0_NeikiAnalytics.exe	81
PID 2152 wrote to memory of 396	2152	10bcdb3d0861b5a8065f770211563de0_NeikiAnalytics.exe	81
PID 2152 wrote to memory of 396	2152	10bcdb3d0861b5a8065f770211563de0_NeikiAnalytics.exe	81
PID 2152 wrote to memory of 4012	2152	10bcdb3d0861b5a8065f770211563de0_NeikiAnalytics.exe	82
PID 2152 wrote to memory of 4012	2152	10bcdb3d0861b5a8065f770211563de0_NeikiAnalytics.exe	82
PID 2152 wrote to memory of 4012	2152	10bcdb3d0861b5a8065f770211563de0_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\10bcdb3d0861b5a8065f770211563de0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\10bcdb3d0861b5a8065f770211563de0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\_SketchPadTestSchema.xml.exe
  "_SketchPadTestSchema.xml.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:396
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp

Filesize
98KB

MD5
24899db6cd1e31f48d03e16fff3db9f7

SHA1
4102124d07fed0228f7bb8873de89dfda0cce33f

SHA256
63285747b39036f26ae3063574f4d61029cdc3c37799ee66968d635c9a2b3781

SHA512
d18918b1125a524256ba6d94b8eb2f68de2b5470454d0f44c955effdbe2c06ed96ddd7e0e56c17eef2a7ec0db297ad38d7743b3f3551dab9bc525611f0143d15

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
694b401c9c9bf1a61b855be5393129fa

SHA1
aa24b7aa9d727a01767d52fc642d85de9a03c590

SHA256
955dbc00f7f5c96f26fc0f37db01579bbddb3eecf813f107fb4de902b70e7846

SHA512
3e576afbd66f295c6dd97f5ae5f7ebda929127b8ae57f5b12f7dfbffaed69c6e185033634bd20f757c9ee174e7257ba6103dac65878eec6c96a6ee3df5940592

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
641KB

MD5
248d84320d2d84f9c983a3588931d2ae

SHA1
e727f833f8c5e1a5d333996bf8892f1a147eca42

SHA256
cd7834546b137a6850c3303855e24c288be1ced67de2848d0e8ed6a477917909

SHA512
0b06c875f305f9a3f7cdec9fe0a13b2801a97f33a316c458ac59499beefcbae49a330d8eab9b464b5c915f2afc4dfed940636ec483e4f4b0a29ac8b0bebd87b7

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
307KB

MD5
f476f8faa50795af64d331133a6ccdb0

SHA1
0a2afe164a3a292505400193436810839a9f8eb5

SHA256
60d2a3561ef67124801d521215de76a7ed42a8499a32eaa13104ae06a1aa0b77

SHA512
013f8efd71cab3cfcb0b51c1a725113e231e5492d35ec782fa457c2354683fc814baf64cc21f45f5762f7bf79f549ddcb4d3b6be1eeac3343f72822dfb96f15c

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
286KB

MD5
d8f022e57072b5de319a6e8f6897c5e0

SHA1
9901b27ea681163ca6c3231c6cd042ade35a80cf

SHA256
443d63480d863817afd3674053f296b2e062ae7b28fe59534d04860f19cba25f

SHA512
f47c1c26d5366239f059024c64a7edf3201677cc71e8e42078de56337167665b558c431d74d30900761992d17ee9714c7f196ed61d7d5b51a8879cc154fb54ac

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
a3cfc96a8d89703fd1d51477f92b2c30

SHA1
a5992c83dc5254e246b1de43953d8555cf8a88e7

SHA256
9c4ddcdcc47b8668b6e49739db831b1a314d8e6a5996443841555fff6f61930e

SHA512
24c1dd1d21dabf44f822a2dc181c0f321ce869668af5429cb6860459a34a71aef1bb3832890eba9e99c1b164f98d5e30cc19a4fe38662dc84f7a46dadd964019

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
781KB

MD5
71a1ce7ff44140c0fd900c31b62d4302

SHA1
71031f4cf1d0ded0f91a50ffa41727e7e11fa8f5

SHA256
261e3e42d95ecd269e6248b2e5e8f96b8f1a9bf6b513f0d1da02025d00cc6f2e

SHA512
f18049146a237881ad116b6b89969d4c0e8d20353b0c107121b4e927eff63a3e3f1d3a2fd601bf9f441ec9db88cc916cde98983644a90647a258b9a3e2d973fe

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
105KB

MD5
9d27757a5411c29bf8cfae9fc45499f4

SHA1
8819ed1ed391ed0b624dafa130f9d5f8d85b5c0a

SHA256
6dab90b73f97bd43aa24a3edeb073dfae583f70648bfb6e98c540c61d77db640

SHA512
d78f2063c0a36a6ae83f9048c0757857b2685d905ab3751b7dc3e8d6d92d9ce27fbf17a93489d1ffbfd2298fe82f217f9edb141d0b2b72943d95b0828bfce2ea

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
110KB

MD5
c6e53941a19a16a86fbbf9ef77c93a09

SHA1
11154ff06aaf8b669af7004ce382d523aefc8617

SHA256
dbd4b089cb5b555da67541977c611f7d68cb1f8a477d40919ab51196f63012f0

SHA512
b59baf1f83866d091b8f01d6306f259ad702a7805d2e6d9486e768e0ba32d60a65a5a54c0d1111c5c1e3cabe01caea588afc5f6c5771556c71f5c0181e95eda5

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
102KB

MD5
6d926606a5d2e52056374aedb8a16df0

SHA1
6e96199ee4b91775a6d957b19ea391988f27bcf8

SHA256
edf63342ec8cd89db1e31650068af9e039d8109af280f94c824e4ccd20831964

SHA512
b5b95b9a9999e2a5bde5aa64e2b97cce082d60ce95c26ef00e752cc049243f13dc453fe9708db41d3daff077dd00e7e0d62a1f97f794fe123ac0587af11a33e4

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
108KB

MD5
79b67e4c4a3078039444e95ed6eb729c

SHA1
0c2b08bc89a4dbd98676fd8e4619319d525dfffe

SHA256
22445687c7e92f1614246a8d70fdc78c0fa96358867e068d2ed42fd8e6d6f7e9

SHA512
11f82d2a359a5455b1aefe0069803c787be8f32c658951a2b3149e9953c73fe2847ba34162e5f7585947579db759c8ba77f815d8c999383ec8f48fff387d8970

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
114KB

MD5
f960f15b8531c2069038a5107754383c

SHA1
d71915504508301178342886f05b4e302529d8ba

SHA256
245fc19069624efd454f333041bb0efc9fac6d69ac2f261de10da8b231be6a3f

SHA512
53f805c8a605ca0207cedbd562d54d15f6ebbf9c021be4d9bb9ebaeabe1443c728d16156fc8f17198efd63095b96e7789a77b304b4eb108e2a4c7236a014e25d

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
102KB

MD5
f4dbc9a98abc85c9e08867463b3d3b38

SHA1
7250fe010acfb5315cd5a40501bc51f6fb79a742

SHA256
fc6ddef246c6c0cc29f215464f8cbbae76ce47d3c34bbe66fe601e2b094958b5

SHA512
29f124c66d19ff3d591c6532eddd8121f065c3878ce5a7b872869e618bf8a1b7a2fa8a5243bf63599419627339728478d02de242ed52c234d62a9ab841f39f5d

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
107KB

MD5
9062acbd7a4de965017f782878797af8

SHA1
4e9137c318bf2924d0cbd7c4c260e3ab0e3ee778

SHA256
84c34ad5a35f183a5a168be9d8818e4c646a043ddbce4b55bef5a33797d07287

SHA512
4a96adfc61188d259920a3c40da82710526208774aa13eea5fbc47607b96b91c0a7d6585f7be615aee0459812a83843db32b9112b35c124e1fe51faf6f527c1b

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
106KB

MD5
ad6f8740623278be95fac9f0e7a315ba

SHA1
563a744c07c8034e2af094c38da71695bd8fee03

SHA256
1607627de7fe2d1f7f0e6f163cc1b9908065cd7b815e3518a62c62f96c9bf363

SHA512
f8bb14b44eba2e94f72d9bb9e1131cfa8b92976428419f6fc8de31e107939c112426659b3e912d5b9fb558698ccd46b7d879bc3cc8f62213f75d837b01fa03f0

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
105KB

MD5
2de4d862e16995383fc9b356b29d0950

SHA1
4a6ec4bb9fd530c4f42fe15ba328c4d49976db2e

SHA256
e5fba37e4191ec337278f3f8a6d559b2aa4b738f2147852ca19f8ca75a82feee

SHA512
c13d0b11f63897d9ee29c579c55e1ba521adaf529ef7ee0aea7bc63e51d4afd3d327ec59ac9c818a2e83aa630c3459fa4b3e5f973b2aa918f0997a6b8f43fc63

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
105KB

MD5
7b5d473a8be2e4dff5d08ac8eef607a4

SHA1
c3aa9e179c5024fb867cd271a1194aef0a967854

SHA256
51db278498f862036310b3844e3639ebd174358427f8f87801b970177db02432

SHA512
863f810ef9f9e2a282a46687b3762a8d0142da7a2ab75bde3fcdb7eefb1261ea5ea8058dd895da62d7c25c4c6181187b497522b87106ebee3b04eed7882e8a1b

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
106KB

MD5
40cc7d85ea801bdc6d193d90dcdcd16d

SHA1
66ba8aba53e29e5b83e6c14cb3e6b721430ce2c4

SHA256
3a4c7fb4ac74f9bf36dbe57e65bc20879becb36fb97f0a45d15b2231d044978e

SHA512
51ab6cd97b2d00ff911eec871838cdf614338cd3824f6dfeab27b4eb7124d919d33503aab5c8610483f3b811e6933cf8c791691a4ec7182518e2d6660fa0c7e2

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
104KB

MD5
0a3884de4c592adff800e6515e9eff9f

SHA1
4856a1d88686e82ed6c2b62044ddd8fdf50902b0

SHA256
1b766509c4528a7448edbf606ba98371f23b536ae3ebe5cfa58c96511b5592a4

SHA512
cd65779609c3df06a6931cf0928d311f4954c59fe367d2de497e6e5e3a2ab6899c061355a148fb38565ef14508c14f46f36fe64b4e6e93d12e3343ff4f98c9b6

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
104KB

MD5
84a2ffd0223108aaaf2bdd734d818d3e

SHA1
9b9bbbd12854b4df1ddabbbc27cfee942bc983f4

SHA256
1debfc98ed3cc41a9e4f84ef3a669c78d8b092ee744a05c4c29baea44f4273b5

SHA512
355ed4232f0a7090aa582735ba1d84e13efe523a7db01722500c01558a72ecd9c3706dbb184f1bee6fcfd30ca5b335e2a7974c32bb071b320941c1a9ec93b12e

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
105KB

MD5
8fbe5f0a30dfa1bb9f8f30f6a07fdacc

SHA1
26ba640efe627807803943932c43b455976c2c3a

SHA256
1f9163d484942815e4fd4b1eeb0cdb17d86bd324e08a53491f966e3bd0880964

SHA512
fd156b74433e70b33f1d495593e1e65177e063adc0d461d90f9c9f5e6b163de2b76a978476205023cfd643ae3d0399a057f7f4363f4d1a5db3120a4d70d30dcc

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
97KB

MD5
c8f2a319cfb5be431d637496efb99ff3

SHA1
4f7fc6e42cce959df8f221cae6c33cb2a7898092

SHA256
4eab3530dfd2eb229d8db0ef3983b69af4d955f916db65fe93d06ce2d438375f

SHA512
a793b88d2e78ccca4c9803d682bd3fc6a435aacf527ce27e2f36b4b512d83e71b130db3051c4d018189c758dce813541c27f985f1fb3451f811b483429c23766

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
114KB

MD5
7fa45d2e636a99afc392757e51df9d5a

SHA1
856cb983a1a0997798a210dd428c316a2f763ab2

SHA256
74b21ae6d97768f7d54865789d69fcf9de3ac6f36ab689733e2de17e5fd20d18

SHA512
3773b6eb6e3490b3438ae743121db7289982b90044eeb97f0a023917e9bfc6743515c972599f7ad6cb2b1b845308d6bb4404b68a6b670156a010c87381a6fb0f

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
105KB

MD5
633b4ea5691ab92cd7cd23296a840e45

SHA1
b5f6b68d43b9c13c0be39467ce48947f667b8975

SHA256
4e3428136b4f77f9c9ccf85349a1cddbc54062647e27925a504d814d18c1f7e3

SHA512
c6233a67a6fca6f431945949d09756f803ebd30a020b1268b4fb643a872c8091d98cbe85e9334e5ad92eb4a91e670b930f8c42ef5d711c704d40fce96a02c3f9

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
107KB

MD5
57ae209544ecf8176856091d36ea2327

SHA1
36bc4f5e7645f4b7fbc6d7f0bc106643d9bb0aa1

SHA256
fae00f2f142919b6f14f777b5d1138629b0a81ca19fff2fac8b6d0c6d7f4b595

SHA512
844e50c16981af0930bd1a096dd88d8dbf7920e1d59624ac3988fdae00b34403663dccad9d806c122f9d0db61a3602364aec995a8ff5312ece12dabbb0fed739

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
111KB

MD5
e60f88144aed0cb6b12a3c7392ce8353

SHA1
a62e3f195b3e5799d5fdafa46c5a1f682d31f263

SHA256
158b7b40ee24333dc62f8e37184b9f6328d7c171194ad9ae9948de1d815b5c75

SHA512
d73a1a905f2c79d1a7ccee720d49ab628aede2a32647e83250351a5212a5bb1747634170a6c1d9b1fc878b75f831dd0cc504fc3caa33ebd4f72b79abc51f85c5

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
107KB

MD5
db589ecc53c9412f767279b60d091d57

SHA1
98df108b5d66cea5711f0c782505249ae283d354

SHA256
c18e5addb55217e45303bcd5dc9de6c9b37203b6436da93d3f43cee19b37e557

SHA512
856725006efc1b6ecf4e9732c96bbbd6569b6d52be0969aff0ec3d923daa15e9bac675d612005450450785e58045ba21327603c5726bda0234dbda952651fafc

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
106KB

MD5
63f7db548dc1aa0ebee55d2f61409a45

SHA1
6ca22ef22b31740545c1a0edf4326812541b6bcb

SHA256
42ba1d6eb0ab0f9f345829fb387cf24f796d8333e210da9f6459631cc55bd7bd

SHA512
efa10c7e578fe3becd02e8f5d01e7a197ed04819491c177d0ecdb7bb6723ad493401339ae5be7f0434940495b6762414a7fd7c0e191b14070021bf370447be05

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
107KB

MD5
cfd3d58087ad2b367bfde99fc4eaacae

SHA1
f07512a43ec0df58b698e36bd6c87e0022df65d1

SHA256
b91ef60b444f2c926bae025d28600221cd940436a9d2593e8d720a7cf2b5644f

SHA512
522e95d8da2dd48ee4f78938251e4afa9aa958d8c99e0354a6d0944a08c6ba4c8acb5ca727922be26cf716bf5089b14d6d39add2b43590a4e0c8beae47af392d

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
115KB

MD5
5f1ca6242d102d74c616c23422097f5f

SHA1
80b256dc39c11e34970581c6da1b281f397b610c

SHA256
6796093956f60b32f52e83d1301676994a58de47b24fa50d8c74201f49e7a33a

SHA512
b7d988d88706d446009ddde1d6fce1595d82889a539cdb7576d1e925678a0c1759da80559959aac611865197892cebd3e395fb8e88c575b43e61ddb4d30e722d

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
105KB

MD5
e7d811e6f699b6f78e88610f127e02fd

SHA1
2aeff1f1cd60e16b98fe36411bf0c6fe1a6de51e

SHA256
48f2636caec7ff38a24e8750fe8d00ed14349068c32ac4f6eeeb66fd2da91647

SHA512
8528f06e08e5b06fd14c4a5acd4c79b8d1ec508364dc5bfc178479aca8b51e8d8df2cecd456421b61c5cdcd1f2dc74f55c5bcd30d381f7a8302b19848b4dc5d4

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
106KB

MD5
ff04e9878829c0f9aaa56fca7d976128

SHA1
d6db5080ed7dd82e813c4271577c81e67deb3f6c

SHA256
e01fa886524a10aeaf4f20befb9c148d6b74a771431bcf80fe427cbcb76f6585

SHA512
f2c7a42cb1a27a79cd2462cb1b58393be19f4887edba498b48e040ef21fb2926ea0e5d87bbff9664223ff27834e79da0c61baece3c60c0abb6e28de48dc71a83

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
108KB

MD5
ae1ee8871f450f8e9e73c88ecc15f7e4

SHA1
4f4d3efbe4bbd4881cf400587f0e0d973acd97ac

SHA256
065a1b2fde6dc29f517df09ea30271a616420b0b6fce3e906d28f9ea51c5a05e

SHA512
1cefc0504d97a9f0dd0ed68341a7a4a3d037771c0287bc200feb4278034938251ba5dc12294c894e442354368d614bd903b0990392a4227684e68dabc540a7a1

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
107KB

MD5
fe0bd4911969ca67a593261a9558f52e

SHA1
53acae9436bb2ab585fb5efe0e69a2e6c3a025d1

SHA256
34782ecb27ad197beb50e82d8a2aa9376174b002ef520a61fce989826bd66273

SHA512
a8a289ba8e9b5a9beb10d031f490196f11d1e87e11ac4ff289034dc06d097dc5177904a80dcfaef818cc2cf9244ecdc3c07f98978a9fe0eae0230ed0b5237bba

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
109KB

MD5
48d9c0b2a500962a417d99142fee0a63

SHA1
6315c0995fd49845db9baf842c9e3988b296e0b9

SHA256
0f451ab4faaa630602eac3983bdad44cfb64001fb5b81876a3a9a796bb254df0

SHA512
61745f6cff970a03e9ccc2882164b17b66ccf9636ada339597444ebbd5f79d7bbba249b391ab6b6662b8eb2c0e02a660c9bd0e78c8bd50ee5caf7fb07692d298

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
103KB

MD5
0cbddf18e2652126119c6d89daa8c8d0

SHA1
280901bc326617c9611e13e5b03e72f782f390d5

SHA256
86bded30663d7a7c1a4e81eaa07b4de55805db766fab222c3d02f734b241959b

SHA512
2c0a6c1ad7236a68f47b179fb04339b38ffc04937c8173c7812ce37fc48b04d4040fd86344e67c0d193431b9bd728c59ff9623ead8097cc0815a44688eece12f

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
109KB

MD5
6a7ba7080ab411f898ac1f6fb690215c

SHA1
bb467e5dbbf056154be527c635c716436255c430

SHA256
7ed2521dd0cacf3bc9109eedc39d1a361fa13acab91516719e782b72db345059

SHA512
ff7138dfa2346e41d331999fb748de822fdff38c96eaca366320d84046ad4e9666fba8bde130706bce4eedc8f6761cb990e302791f275d5c0982d87b5942b3b8

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
106KB

MD5
74a354266a2e5a0da6fa306bc3c65729

SHA1
73eeebac38f594b6e6cc4a153c03b9622b1e7584

SHA256
76ecdbf5b5a91ba00d7f1bb3535011ad716750a25755f9a563c4f34592ae1da9

SHA512
47a84ef4b3a498f8c3999ac6d31fc26e85870fd466ce1fe0a022d4902dd2c0823a049d3c31808a633c779937ee2a8bf7ed7ea1922fffdc0608b080f9b3049d2a

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
105KB

MD5
dccb28e2002116588ca54c0fa373edeb

SHA1
b92b8ccf2379936aab2d4b77596c29e840f3c908

SHA256
77f99b1b58dbf0adaddd195becf9ef0f9db51f77bdb37ba6458cbde4b09a835d

SHA512
f28df47139de2b4e9966b612008b8f4f389ff2b682d40ccba5442464524177c071297163fff6028985045ea666380a60cf715bbb85492f8c66e33183062eda10

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
117KB

MD5
48f23f7bb9a8674d7aa97d8ac6fe3d84

SHA1
461a8490e9ef0f177a5e19b5645e3d6322d4793e

SHA256
ed14bbbbbd92dc341957ad86e686756e8edd0dac13dd4ef1189e9294b3aeacd2

SHA512
823c6b40bf5c70572f46f78d239245d9c8e8cd2ea37fcc8fc7a62e28c151b58db548034b932e13de39dfe801db02553e3fb1ce529c1786c721539fa945c1c975

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
108KB

MD5
091e126d5b2cc8a6820f1c49723b67c8

SHA1
0270899905097caea55f574b129007d088ff163f

SHA256
05afefbcad6d22d71863666ad3f2d78235eb7a025295ce2bcc7508a4d79e55c7

SHA512
1e9c942edd766f278842dbdc4db6c4bf210dbc67389c06d4ea6f6f9dac66595318d97083ff88bcf7fce4d25b9e9eee8db9ef89886c43ae7bf32a00fd34e77b9b

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
102KB

MD5
33772636b7bcd2520ab56edde9bf6fda

SHA1
05ce7f217463fe3b753e22ee6cb0bee0f120c3d0

SHA256
44fbdc2dbc9b0404035f8e744c7f3598d88fc380ea84de8b130b30b1cbd971d7

SHA512
5e17fb1a3d8596148130181b1dc7745d7119b2d5f4450fedb3df68a01eb32292f5edfe73f8f343dea1cfa8159b27177c1961b430d2a7a43a017493da8acc0719

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
97KB

MD5
67bbaf3919392e0a124c563061e12338

SHA1
fe1b182b6b864dde7e02c524203260a9d848b388

SHA256
bccd6f271742a5b64ef63737f27a4aad4761c81f444ce0c79811c274d77a06e6

SHA512
64baa3709bde43d782b2fe49e66795c02399339a93bb5a6641f28746d8470c59440826824b90ac74c9fb300cfd4f9d794c7fd58effe05bf2473f87caf45552fc

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
110KB

MD5
c89ccfec13e7c90f5bed801bfe19c489

SHA1
26691f9b97c25314fb38c41797d8972b005d71e8

SHA256
41476d96e9ba88a115eeb87bef6a3cd489240956a1cacb4f0a5e4c0061cad832

SHA512
a8b696f9d84989ef4e72c6efe25e299301da939e3d54e6d4f2158088d8cce8c6491099d3a15e4c842a9557b8b70cbd0360792438f9352ab2e43aa43ef4fab7d7

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
107KB

MD5
2e928f95fa20158e2e32c9294c4538cc

SHA1
b8e6372acef085ec2fea9acc6dfc064078b84636

SHA256
fcce09cdb5b96c135d349f4cba7aabe0fa9ab2b434d6fcda258bc73a638d27a6

SHA512
3f68dc577c99e28a3847b900cad011c6f59f8660819700b07e6b855a4c4b169cb7a7f22dcd2ac8f2d8584b8029ff3ef9c2cadee4edbf4752faa2f9330c60b49f

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
103KB

MD5
849348b289d4d4bd53e1a15f9eb35858

SHA1
f38d1bc551c1b28fe950238d2c25aaa3cd977a2e

SHA256
c9958b66ced8f4b1f397091b00bd07cd387184c933d6b5cff31ba5eb116d3ce4

SHA512
8e232538d43ab51d318949e3091ad5624258aa1233362d6cb1a5169632edfebf125f7e90465cb67efe46914172d595b1d4c31a1d6a63ac4f6fdca0a2280a9b6c

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
107KB

MD5
75321aebaa22eff507a7df8f575dcc04

SHA1
7f237cdfb5ac40dfd06f196fc90840bfc41c47f1

SHA256
2e0d041d1762dd2f0ccf8a2c43fb0dc28b58278db3fcd469fda15d1345c92bd5

SHA512
3cf7fb09d54c8562878e0c0d9bc3d763642dd72abe302be164b4532be0ac4f79ab1a74062b0bbe2c9b29e57ee0544aad699349214ee6370b8b67f15e6fd0986e

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
107KB

MD5
ab8902e7ed7ebcdecf5dad763ee94079

SHA1
8683e4b3eec5fde747b289eeed6270e1c09929b5

SHA256
18982ad47edb8affbd7beccd564b65905fc89191863da7a173c0817bc7f043ca

SHA512
5e796af8178ae94a90dacb74effe049e08d14e53b76551988b1ee3ab307aa9e5fb546bafb31dad33ccfd23e8aae8f528d2402c4e01ffb3fc16b03648eef5de1a

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
104KB

MD5
44b18a26d087fdd8d809ba505911162e

SHA1
37ddfa3a4571615714a90b219078527906b08156

SHA256
fa2e1b30c3f73c85bd519e7e25de7c7bcb6c40a1e11da491040ac753eb77eb1d

SHA512
c16941b5619a026521a5a50139b55cae3fcdffdd18d1e9b8f68b32b38ec48bc07eb4c6e7d368171c983981f73f2d1c55d694cfe7a80b470673d2200e8207a535

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
112KB

MD5
d07ad0d0fbac3440c616c38dc8674c14

SHA1
0eafefc44249ffff374d62c1bf8641f7312c24fb

SHA256
9b3a044ffe144fea213f5a64dddab85e17fb8172ecc72d020440af049d4e3d9f

SHA512
ea77007a530bc1f7a9878a5da3ad4ecdb45b4f4e90187612cecbedbd97da95c419fbd4ad489b128184d7a0ad0760c7aa09fd3670616ba0e188aca55e12f93809

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
116KB

MD5
9d13d2755918f1b1698e61ec61b4acaf

SHA1
d049719029b56da327d45bbf4fc1451dbccbc26a

SHA256
805e1f151ca7e47b3dbb9fb6524e6d35ca35f06f0a415d4822e665dc4d6a3219

SHA512
a6aa078a00303c6846b22466172b3ec551bbd460329833bba0bd1354455f9c53cd0d3ab2c49c0125d0378a50891973ce50a70d5d10b4b6cfa29f597980de3aca

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
106KB

MD5
a4667db9e56f3a2c3a55456204e375b9

SHA1
66edf278715a5aa1ce2ce5dbbc5aeb220cb7d607

SHA256
ce7923357d495fa176989ec60ee9528733652413f9b78b7f8d5a70f9d32c70ee

SHA512
de624f1576037c02eab6c6e6b7678b8200807d067af6763c15d66ffccb1b57ad5c998334947578ddb728929cac52548119e1085ec222e066fdfedd434ba90bb7

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp

Filesize
109KB

MD5
95da8aae91deca37b3672f4c9e7c81b6

SHA1
6ccde88f4147f9b839aa95cc75989c4db468a21f

SHA256
e99eb1bc34b3c071a418afb26ebde7a2f1d1121887ce33af47c9a584673c5c05

SHA512
78a4facc3038ccf1d7252ff3e953bb26eb74cd22197b9c2f21c174627fad53920ee248f763eef3fb9e63fd3973748db0630a4937e5a52e52c122a4f2b62727e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_SketchPadTestSchema.xml.exe

Filesize
97KB

MD5
f5c299d56d027e701035a2a8cae85343

SHA1
abfab6481a53bd16a5b5ec7f74eb623b2bb60ce3

SHA256
80ff410a7052c6618f1add59aa4381ed4d9b5cd6c2bc56718c60912b00ea258c

SHA512
48a23bf1682bd700ae5e010e325d76dd3c5350d847f80f96cb39436938c97ae65b6d97640ac6ff741b0bb189f7efb1acfa5772125c6c792578e3177f6834c501

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
97KB

MD5
e64693d0ba16cc57e55f8f2b46ea642e

SHA1
b36fa17f181962c4a5b72f9b0531b5cc4555fad7

SHA256
253e99f8311c6325f1746647285beb3482b090f10e51441eb3566bf27bf2fc0d

SHA512
c52c011c7040c4d97056aa78561c237297721798a59f18d9a1f128c21a640e63f872bb31401a3d5adfee6a4061ebbe033e2cb93baf20aab954c0b9f879abdb06

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads