7793fe1a98fb25e6f58fbfff0d7465fee170ed03e6c573aa812304c0d7f10a5c

Analysis

max time kernel
132s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e11199c78968885dfee193ee30fd700_NeikiAnalytics.exe
Size

184KB
MD5

0e11199c78968885dfee193ee30fd700
SHA1

93d6ba588cf3749323054fcf48eabf87cb738037
SHA256

7793fe1a98fb25e6f58fbfff0d7465fee170ed03e6c573aa812304c0d7f10a5c
SHA512

9e18ecd6877603c05c500f091ffe696bc1fd4dacb015566d544061e8d5b52c1561adb5a963adafac4709c48624f12850bdda415180675c8b60513b7f3069debe
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXaYe7WpMaxeb0CYJ97lEYNR73e+eKZ0VXY:RqKvb0CYJ973e+eKZ0VcqKvb0CYJ9731

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4760) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2552	Zombie.exe
3452	_01 - File Explorer.lnk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	0e11199c78968885dfee193ee30fd700_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	0e11199c78968885dfee193ee30fd700_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OMML2MML.XSL.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.Local.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encodings.Web.dll.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NameResolution.dll.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.CodeDom.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ja.pak.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp	Zombie.exe
File created	C:\Program Files\DismountFormat.doc.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll.tmp	_01 - File Explorer.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp	_01 - File Explorer.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 2552	460	0e11199c78968885dfee193ee30fd700_NeikiAnalytics.exe	81
PID 460 wrote to memory of 2552	460	0e11199c78968885dfee193ee30fd700_NeikiAnalytics.exe	81
PID 460 wrote to memory of 2552	460	0e11199c78968885dfee193ee30fd700_NeikiAnalytics.exe	81
PID 460 wrote to memory of 3452	460	0e11199c78968885dfee193ee30fd700_NeikiAnalytics.exe	82
PID 460 wrote to memory of 3452	460	0e11199c78968885dfee193ee30fd700_NeikiAnalytics.exe	82
PID 460 wrote to memory of 3452	460	0e11199c78968885dfee193ee30fd700_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\0e11199c78968885dfee193ee30fd700_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0e11199c78968885dfee193ee30fd700_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2552
- C:\Users\Admin\AppData\Local\Temp\_01 - File Explorer.lnk.exe
  "_01 - File Explorer.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.exe

Filesize
91KB

MD5
2434eacc507c936bbad7d7a49df1f2a4

SHA1
46e44ea597334eb5d1255349083a40e9fea9a34c

SHA256
ae6ea37fe7afdd929f02a441a49c074f64d4b2ab2736d83d4e472b3c0b7a46ab

SHA512
db4af61170311c7998affcd5430a8ef33b46fac4f0da809f0bda49972ad233f10e46b7696bb741fd043e58b11c3feab87de1d371829147c9db91436883986201

Download Submit
C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.exe.tmp

Filesize
184KB

MD5
818ef0ea5b692f90a55c904366de2f30

SHA1
265b52b205619784448352e72d84b44b25766afc

SHA256
e9ec08c11a64c56644945492875b464f85df0943ee316538d25344f9e4bf79a9

SHA512
717d192b7a75ffb6c99a75291e7ed5fc85ef7d2e7fe3c1fbc567011fa885c7d8f92badcc6f7f7459519b550d19555a92700f94db717cd95f8ad84383f8c68d53

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
203KB

MD5
e3032f827f78c1db9ddce697b43c3964

SHA1
a6f1f885aa1e8a1addfbedf865eba205fe13a9a5

SHA256
30f1044c2699c4c247b889d36fb5a8d8d6030918fde7e44d6e37906f8232c634

SHA512
a293a62bf14b4b7b8c239892b78d18bafcbe0865bf61eecad53bc59ed25308f1b2d06e6c84e8808ffac5ae389e60314f582cafec343e0f2a9f8108d612317fe6

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
158KB

MD5
1521b333a1a6d3f2e62e5f1236049d36

SHA1
539ee211ee5f9380f51fed4aeff9e25ae2e4bd83

SHA256
e8d645a4c740d31967fd0af68973f8938675ec754ce1be911d9ddac9e0ff4485

SHA512
b8ff4f4c201f976aed308c8ebfa8b2496057d0bb3554c1d5e7aa0e55c1faf5ca367fb05c80201700f0a52e44f8d89b67a38c4083be3fdc2c105f1a538829de17

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
b17957cad3af438f269f80b260c90a96

SHA1
ca129ac5a82ef130558d91287d5d7d90086b7c86

SHA256
0319df2eb2e7dc5ce3e1987c6624bd0e2f560a362a1094106b47fa0ccf79c7d2

SHA512
0bf2fbb81ed4dd32c7a59743837d68d53494d39365aeec3dccb4b3a80a42c508405b3fc2b357dc8fa7f3260922c857ad7aa55615cc1d5887173d08de4c83e455

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
637KB

MD5
5d7f947a9d6931faf5a804541296f006

SHA1
2949bdd8a14bda55f751aebed9430e6b7097b264

SHA256
d0336afd6e5a8b0ab6e3d5a022c654aa20a6b7aaf18ba516e6949e5f103569f8

SHA512
06bdb3f0d44b9ec3a0190da33109c33c334edeff5c25e0a003282d08e9a6a4e5f49f0596402733119a79b580dc21d752bba2b85c844d73f4e23155ba67b9dc7d

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
302KB

MD5
3eeab72b8b7486f71ba95cb19f5bf532

SHA1
6e4491b1228dba08337faaead2c468fe282d65bb

SHA256
c9fdc014e843b273cf880b58b3f829d088d232237e2953bd5e2ed56ac6bf5db6

SHA512
38dbfad347bdda75539010df121170f8134cf5b20a0acf1d86cbb6d18c3e0cf7677a2ed1615968ed2fed125ffc6da2e44537c7124f30bf3b13bb673b15f014ff

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
281KB

MD5
93e6ad6cdfddcf2ab6041a8f77a8b39e

SHA1
6b359ab84803be88aa2c58b2aaa084960d00978d

SHA256
ad38f7cc9d30f5bac8dbeb9a17a6889e5af5338cbc8b1627a8bbf750a4988d14

SHA512
4ebd15b1ef58f167447628397ea2efa87795dde7dafad4d9a1a1be30a46629fad714488dddf7b0640b5a51186f5b915111fdc15de226be8296965903efe534bd

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1023KB

MD5
aa04ae9717b4242e2fa1684cac51f7a9

SHA1
bdbe6f66a50aef0beb269ef5c4331b6189dc420a

SHA256
dba7caa4463721916041c00363614bce58f0faf0ed2cb62c857c8ba9ebdcbacd

SHA512
aba9a1509052ffbf30cf9230945be1d4d25f7148e727ed4da3bc58238e0a898e021c0dbc4ab2b4d221f6f9bbe1db2c080be3481fc264ede5be220d550b9bcd7b

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
777KB

MD5
a766b64c52cb6b4c6dd54ac6eed94878

SHA1
0949f6d0d3f24d409b690613f823f2d2ed46005f

SHA256
0d6034c92080a14d29f3bf99a0c66eda26d64a0bb9068ec7b186e6c0d9013b8c

SHA512
3b575a8f9698c04835ae857955150e6e8b1d57ca014ecb1143b57c8494098ee2f1111b00c8b355fc6b68b0f7df87708c1e7b17aacb2ac52f1794ec47b471b4d7

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.tmp

Filesize
103KB

MD5
fcbedc32d442e87f4a4932952cd31c28

SHA1
4268e75bed68808ebc4bc83d71086aec1294e799

SHA256
05c5b8fd66546ea8fd5f97272b47b3e20c9eab0b576ad1a873608826186ae8f8

SHA512
d89152a25052821b99a552e42f49bd334a60126e2dde0d87b76ead3e703cf53b565fc6e3d6b00143c369a988f58a7fdbf7a5d680b451746e3083cc0675a998e5

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.tmp

Filesize
100KB

MD5
0dab9b3642c3f50f29c1fd3739a96881

SHA1
ea0273e28151ec442e0e81745427e275469f6c94

SHA256
00473523807f27458afba9970ec6235147bad95f598bb51120dff5e70da71806

SHA512
e6409499fc81d40bfd3b3247fd56ca9272cddfe3b7a708bc84fdab61eb2c87556a6ca755ef313c04aef3665f2d8a7e0bbc3c5a03ba45c65a65c9644e679e3bf4

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.tmp

Filesize
105KB

MD5
a8ce938bc7fa643d481a07839587b124

SHA1
99285012ee00d9f43f66d0e4b7cb0702fe5d1b7c

SHA256
d1d5fef20cd235bd19bcc0b567a1fe06f2713086df62d2aca90d7fe9bc9a6b0a

SHA512
c3d37b43fc34dd5bd6c641b19e5a9ef23b63850a413bcbff2a0c894536c7ad903ae3fedf0276a3f36acf9160e2fb315217e9307db37a33463f177ff4d27a3445

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
98KB

MD5
b612d1d7e39f505a5cab0836ca5798b8

SHA1
10742b16d667ff43872bc3bfc42c9907ea5a72af

SHA256
56c057dfcf454a952935f9f555eebf1db1411b22fec920ef50beecad3e5c46c7

SHA512
882c801b14cd28e41f318b2840d32b0a9bcacec447c313af245c747f6241c6aee2ed46e408cb1deae93069892109dc50eba2a9bc34baef64a5809cdb5977116c

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
102KB

MD5
02a2435af2f436926468dfb5a1d6f199

SHA1
4c6748bf196b73398e950088be4606b3d166b650

SHA256
440d37359afd33bbb787ee8c33b63c701d1e27c5d030506062f868c87b06f810

SHA512
20cd5f03b7d78ff41772f7a277ec0830d01e3b4fc64c4024258329d5acafd79a26333d44e1c1bb4db29d2a562285ae65a308bc4508457a57f998bff9acc4401d

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
104KB

MD5
d145a7c3496779a720bbe0d9d8146d17

SHA1
032dcbc7594a6bfe5a6931e54f0aac168fdee897

SHA256
6e74232bb5ef99cfeb482b2413c0c35a31d212a0d9cb545599acd6368ce273e9

SHA512
720e688901c653e03b15d7f05b8e1eee3af4821442362fe926ca6a48880a6f5a2a8e848ecf2e51f8d8c937843b4ee6513bfcb7b866538bfdee13e64f0845ae82

Download Submit
C:\Program Files\7-Zip\Lang\be.txt.tmp

Filesize
102KB

MD5
659f769d1e1c098f8b820245a294414e

SHA1
e1b7b2d3bf58ca5706c3047a0423d4d2eb10efa8

SHA256
43b69649b7c23c37e91bf7dd5b2e762f3efecd83fafb639c79d5e2468fa21f97

SHA512
4d74f2c6b2349f751d4c4d30c35b654f5bee768f316d6dc86c16a98af2712ea40e3980ba037be75ac07f0dc94f8097b4e4964b85654a6f228a0b73dd066a5f08

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
101KB

MD5
5017a90dc072b2c26847bdbac534afff

SHA1
ea7b7c7587fc641a1dd6484170c0e7ed7c507433

SHA256
ac1e807e84e6782d056a1b68007420f3a50963e7ef08f238761ba019e1754e4e

SHA512
4f9f488739dff757421d118a6a3dae6c6c7d201603007ec2b663eae02efa0f292909194d6f1c5e559434eee98d73ed27e629d0f71bafbca0b179b0600f6416c7

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
96KB

MD5
2d8a771ed20af8c806365ea2632e012d

SHA1
1488c50c96bc6a808bbc218d717f102f640404b2

SHA256
c9b0040a2b43ba89e57483ffd3c589e2170047fbe33584fc626f2bd444dd13c4

SHA512
0ed597f1d50d31e72f0d667b2fe1b1926b467162e1e3dbb8f33b0c24ae33d0f73c89362f78a52572e3bc67e617622a438c98621706ced7d298bacedcaede5553

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
100KB

MD5
cdebaaba9fb1a3b38f2709e0b7955ca7

SHA1
25991bfe9bfbc0d23f7c6dd386895673bf854f41

SHA256
ad18e8d0818f214a350b3b5643cff0bd4961ac1dbb8acbfc4242d9b66a83bea5

SHA512
94514eefaec9f9cfbf00465bc405579ff51f7ccb594aef4b6684ea413407b64553c4e2c571956dde712c8ac66386a3bbf2aac0a18573ef788b2ff749bfce48ca

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
97KB

MD5
8c5bdb1fc71852a460d0917df31c922e

SHA1
a2596dde979b27e24235244ca50c3202b3fb3819

SHA256
7de13a0e77484b31d9e885a9683c7fc9dbaead9124056ce9cbcb6bfa7f18bd70

SHA512
9247a1234cfcd3460e4c2f355a3221752eb6e66f11568ac8e6f3fa9dd630e6f7ba37a0c21a0807e32a9878d83f6217c6042bf6dd387d797455f0e44aec1a32e8

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
99KB

MD5
c809f354d1a647767541a1212d21e37a

SHA1
f8dc161029bda4fb93af520347f555b8b3af5b8e

SHA256
8de9e6bc5012f248b93ead2c11dbed06657b5105543d63d868222b2df4fb3d8a

SHA512
1c59b41d68260f3b1e7526f98e19e5e55c16fd7c36876c97559c4369e8f95c0a2fa876ad532cb09f815ab08c1f602459e29719d2dbb1f891515ced43557208a6

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
102KB

MD5
8a6e42dc9ed64a41bc838e063b7bd010

SHA1
e077a9bfb1984cc1e7e48ba4a4fbe8e7030ed2f5

SHA256
06918fb4580c910349a7d5dd471305962bc710f85f3f6262eafa5feb28b1cf82

SHA512
00380910a9ab0807cad63bfdb80170587c42690e3418a18cbe2cb44e93ac1d4433931dc771aa3d23a1c5185e2637f442404cad65296b79d0e5482d00c20a9506

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
103KB

MD5
8eaf19d3da4355b47720055c590ce4f4

SHA1
09e908fc5ca75b532632b5da194a09b0cf013c49

SHA256
746238c07269ea8b3d4e6b22049d876d4de856fda4f1ae6bc946a66a40629994

SHA512
5e4b817ce8324d98f718eefb80f10b1949fa7d19ebe6bae7ad64e40663086103b4b63f34b5ac201011a75650592f59abfc5b2ec95087eee3a23c78124194850b

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
98KB

MD5
5fe23fe86834a5bc77b8af72247d0d4a

SHA1
9405e4504d45f438b20ae29438a8597bc74453c1

SHA256
9f35f59c629bf2337bd81606a915561444ea85051ba230487466dc9647679968

SHA512
59827ab06a62c14a7f31de1cae0b3f6fed3d8e73090170da3ca75ef5459419a5320599d338123695d15feeb97fc8e81a248478af2f3aa706620422bb4a946954

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
99KB

MD5
883f4c5cd7d03bd6a493e5f289eec282

SHA1
64e7644e6edce8417a5094e161852ffb92b772f4

SHA256
e89b41fbe6b12e9a72852f4707845ec9d23c82716c43b171a018007dfef96ebd

SHA512
1164e262e91e3eaac6af4d2a9812a898564dd72f80fb0243efc68e08ecaf666bad28f5208c36114ba7521b70cbe602b7332ca10be065a32eecd34ed4238fffb5

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
102KB

MD5
fc19c70f091b43a26de86613cee8c4fa

SHA1
c9a87a4c3edd93465f14cbc4a30e2e93f8e8bb98

SHA256
e4a121341b1807e62d3d607cdc81a24e4b852d50e1850c1d17306e3ba9827719

SHA512
ddce182dfa646bc94f02430d0cdf441fdb2ad7927809ca136b10bbd8e42f56003b059b62fb9dbd57b1f59d8dd273aef6a0efcb59ebdb2d204fe2a31a08ea7a6b

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
108KB

MD5
397b02d4c0eda0f0ae89e24a62b7a3b5

SHA1
321bc8975c802d83c77f34ff3a1fc387c43fad6d

SHA256
3e4f4309f710d509a8882733e1f21975522dad0e3f65405d8b9aa5e3f6276c2b

SHA512
da7eeaa6ebab47377903d26e03d66ef818e058827ac29367f84a3bb3ff2c476240c2cebd165acb7b6066a92520a8b74e831d837c92ab8b72c7a6c9cd483f1e67

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
102KB

MD5
27396f93adda7d388e5fe7751ae2a479

SHA1
3c466e9cb4a0703d1d1019cf4322c687f617b493

SHA256
76f00b108e276d7a854bc24d255db2bdce6abcd7c5aa3f264efe98edc26c3b8c

SHA512
d2870854d88f35565b1b92ee8b6688b0a9eef32b0dc1b255d674596cb4022c9c4f1a67f4a7a5dd8709b219b89ff8de91caf7889747d4a59a1e4d9af63ef587bf

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
108KB

MD5
ab93baadbde8daa34f5275893f8e8686

SHA1
44c2cbe51ecd482d1af0e5ab59257dbc3970e89b

SHA256
7f6f43930219ddf1db29459ac977cfdd2a4a2404932491c3ffbec4410edad591

SHA512
2aba69249b330bf7df53804b83681df5ab6d9c2c224c0dfc9ed7e3e58cff4af0bc74240041811c923886348d2b92f74ab6f2ec1454cee0ba0a9d46e824a03ebb

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
103KB

MD5
95e203df8f0ddf987b66015b5ea0edac

SHA1
8f89ab1bd19aff9dce7a025349131d3036cc4445

SHA256
5cf3c2ee33befbf55641080f93aafb2bc98046a7ab4e5e16f9707d7ab8b2cf9d

SHA512
4c65b2ff6f4fe91dbe9d561dbc1136b040b172c140d84d68f069c983fbf021f3cb403843ea0c83060833c9388d3ae3e934b9b630e853035387c1b07c0c03e756

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
107KB

MD5
60ca603905d97e04581d6dedd03b3447

SHA1
c40c7f0625ec014f9227e766e9d1ae5ef6294b02

SHA256
bbe068724c8e8b15ae4d22317a230cff43a402d29936066607b4d3bd3cabc807

SHA512
03413bcef55b5ccf4f1d0b3f081ef65eb076e908d1708ab9f630036ca72677e5f98752bca9836bb42fa9126c15dc248a3dc0ad90fda0e0c5e6d1193699c357dc

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
101KB

MD5
a35c7f121b22896dedcd4332ed59ef5c

SHA1
40c52820854c416eb780d682560c8978e3b58dcf

SHA256
639386f1eb24bbdc46a50f11bff38dc7af9b1c71e2275e58b3ce35bdc9099a5f

SHA512
77dadc5c7f6a7b84137afbf30a8eadef1276ec66c76967b1b55c810a05addd3690f9f11b5445227fc175da57fe4b6d74156986d84177ca9eda79838398f94cc7

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
99KB

MD5
9fa1735f80cf70c21253c8c00d76cdac

SHA1
fb781f20532b67c76a3e50ce8d563142d0be063f

SHA256
d8c822e8ea6ea3c2bf731c83f478603c4b34562166a05671ba74ecbbe5cc5599

SHA512
a19f8cf1a12554233b7c8e6e8078c45ad0dc16803b9d0c17365d8f7e2ffb8a68b531ef0eaec8653cdc345c8572bb6e9fb27e3efd3c92447f532b41c56a5510c0

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
100KB

MD5
acd4e4b9aeadb736fe5818fdebf5700d

SHA1
5d4332f68573f853920ab6118ca219e534e4969a

SHA256
cc2a5b05e3c96b946fc9cb20e2dc6eb60928420c9913547f0b60ea31f209d3fd

SHA512
4317eadd19c37b0ae31551de53f98c1b730b056ac97fab6d88a7d43e05e9baaea6126d3ee2dd2e7265cb9047f80812a9cc20fccbaa872b15d426b62f39832fb9

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
105KB

MD5
4dbf01e70b692a89474c249cd52a06c7

SHA1
ded50008f08cd31ab471d2972010c379a4ca9e87

SHA256
1fbb330d99ae04b145205e8f41a62b5d5f83c8e666d24e46b43231afe45bf735

SHA512
df39b6e52540c0fbe25d18401f3424a0df4c1975fbb6bb12f84491414be7bbb6fbed556ea165c6018bbf593b542f7875e71d592776cdc905cd8292694dcf4987

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
108KB

MD5
4f4dce180915c6e0b0ddf13402b64c34

SHA1
d5e5ab6dba0e84abdc596419361522f60efbb651

SHA256
3932a30ab5a97ed807d4c687ab88e0da55e4eacdd2d052335eb41affa6c478a0

SHA512
79405bb5f4507ee3ee139e98e795af2a548e2f85360ba411e14ba7f7883d830faf86043d0c5e19b6094622a461238916b02687016106d4bfe13cd6b466e678b4

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
98KB

MD5
6a9ca93f4b12bc2c1de53ddcc6da7b46

SHA1
2de8377d8ed747d458ba439f7e5cb7b719370253

SHA256
15f0044b325d5516f27fb2d9828b5cb22cee1934fd4488f532a2b89c575366f7

SHA512
5b5c48ad51671f0958f6e402f038fcb4bd5098788ff18ff81fc2c8df9fd54464b2f04e8dcb4c4c179e80dea6e1eb6b6f87cecc89fa33d3be3034a78a9959cd09

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
93KB

MD5
4e2ae896bc7031a6e56134a3406cdab0

SHA1
7b461fe44e7fea24751c0cebb50e5ca7cf6b70c5

SHA256
ff08e3873cfbbd87238771e11dd8a359abfd2a386664d8635492fff2138224f4

SHA512
479d18ee41f11f80ee36a2635db123d861bdfe3941395655afe9e732682b9f79fd83e57a4e6be02bdd20d1bf7098b7b27b1ceb205489613830263d6a91a60544

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
103KB

MD5
ecbb80fab2e49052e1806fb02965f7b6

SHA1
3179f6cbf4d92d16cc35c3c97063e4b4796d8b6e

SHA256
ba27bb24d5467856f01e98f8f159e1f75320f042b5be8b1c1c7316b3e0579131

SHA512
e35383ea024f7f40efd3cbee6d01f4cb2efecc42639996d22866968aa6377b2b67a5eba955c3de3898627490e5cbe2296f7a33030907de333b88a4761faf84d1

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
103KB

MD5
ebbb13094dba6e8cb2cb5bab1e3db059

SHA1
9b334d29b1d2215243e2107be1d6707bb96333e9

SHA256
7c622a7aee401c6c99b182d1942355aada92220ef358a1dd9be8d7fd7f135658

SHA512
11787dc66a1b987a6b9b5be8a33b3d61581f6b780882b3a1bf738bdb5ec1404203a48e2dff6b7850093a2c86885af2799fa0371b3cf0049d38fe50ce3806300d

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
98KB

MD5
bf515db95be268a519adf505e96f85e1

SHA1
feadc2b05f6c18587d28794306a14b69e9c08e18

SHA256
bc2d26df9f29bb6a70f3ffd25d45b9cd72720dec403ad258b9ac2692af3176bc

SHA512
737fc54d9fbe2351e206c20374375236f86c69e2e5484218f176bd606b8ac681d17de89f536165c67618988db9cdf0679cd0afbdc2e250eaaff25d752fbb39ee

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
98KB

MD5
13c77fa5795d8d502b44d68d67244102

SHA1
2d15a7063f111cdfde524f8bcde6f3303709a80c

SHA256
6b832ac1abc7ace57f35f2844b9afd10c6a71e85c7ba3f7b83bd88a46776c648

SHA512
79b264ce1666b086809c78bbf81a27d6a0133e8077400d8a13d018593e3033ba4006ab4056ae04dae9411980e346a9f696985f181a1d4b4f90975931935efbbd

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
101KB

MD5
c630579eb1229233d30dac3ac34e87bc

SHA1
1e5ac33ee9588914413dc10d5bf68e7bf1f5615f

SHA256
97e89fd820a5c881dd205caf84c26e9022775c42c4c294c5739a718cc455c94f

SHA512
08fe953f515766cbf5a5c50c00ed1ac6d183b5b0accff4d9c7468febc53fd111ed64914735916823f50bba1c3fc6521a4a55b59e133b7de92419e29b7a743274

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
101KB

MD5
a3f655d637d6b838548970a3965f7dfd

SHA1
75fcffade7402c32a83f59063055c95ee353b374

SHA256
351837a21adb98cc660b046b52e1fa9a9de4d7e959ed754dcaf7b127c805739a

SHA512
08084c8e6ade8bf63eec49181a4fe778e7834c18b6960ddbe3cd63c9ed1f55b84a22cb977a72cee1cdef0e91fbd5229d58b77708505e676bb04b0e88ce179afd

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
113KB

MD5
3afc26e51d0f93ff2389a56b3e2ed1c7

SHA1
78b78a3f5ba5112d4b2b0e2e3d965de1ee13cce9

SHA256
da2d1bc833d390e8222bffb81a35792eb4e365be5fc95e8277ed771f7c0b5850

SHA512
f00e0021d2476739486a993102496d6676bb109965f1acabc9a8cadefdd6b092633b168b65b790040a14d1ed619d45867d9acc5927aa534020bcce3a647eb7fa

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
114KB

MD5
ca56516cfc457f021b4f7159121e84f2

SHA1
9b8a0c10522679825a6c541bbceb3e5a31f4b98c

SHA256
b297fc1e52dbcfbe6c5ba8c884a0845fe2a212bc852809e519b2d8409a1e2c58

SHA512
85d05ca28e5a47c5d0286a0418519204b88e0e05b42dd5213bd0cb8de7c43dba659a18afca2ede2a7be163322b9afca568b3b1d3f1720c088d9bbe8220400d09

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
98KB

MD5
531364920169181cbe0c7113133cdd7d

SHA1
a59d9ce50ac3730eb5d5a2c949f6e512b777d931

SHA256
6403918f3454439cadb5b5f856a3fe0c6a3d7dac6754ce0756fb46483958f4f6

SHA512
b6d165795ac790c10383b67681d781a52a4cde02caa3f9a12265121f3eeea4ffa8915f0296551b31d2db8183cf7bd786b2b5348a722a68e8e5c18a3912c74b15

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
99KB

MD5
c76d91c358e18d5f19d90622d70b4715

SHA1
69bee300f9afff9ab50a57a0862ffb7da09bcfbb

SHA256
f9f565fdb8446236130d02725e7e9a4b83dcef409c48ba6a6cf63068481da9e7

SHA512
db131806c4d7456ac7ca8a27d5d3afea791284c751be1e500c5ec257cdc575d83f2defa76511f30a7821c515fef7645dac44f99af7cf68cb02e0cb61d7021c9e

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
106KB

MD5
38eec1ec8d32faa9cf3e82dfffcdfc94

SHA1
f6e5971c16e57fd16b751ccb25e59bba36fc736a

SHA256
f5dc956d7c1efde8c71b1503d99dc32508e323ad346775202a1b622528196e71

SHA512
7c64b4f3cb7a43a656919289e8259707f50dc12ceeac9deef0640ae5536ea8546044e2bea54adbc59279b5a23b1b0250c109edb34c4a073d21f6c8e39c47f628

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
102KB

MD5
ba0497437519b6f3f540f6b6ca4ace3c

SHA1
e65cdee772744b88ae9e1adab4789e760459019f

SHA256
c6408e89df576ff8c9ece9460fff163a6992a07e693c2d23c3382eb6a58e7d34

SHA512
dba0adc267765ee46938ce8013e6bfa8be94f7ff1affb645266f2028f68e998c435d0a00def8d1be7031f01bdfe5f379a943970507cbaaaf631370192d2f4b0b

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
99KB

MD5
1fb15e674a4a9c435256bf8f4494ab09

SHA1
62efb276ad9c54fdd4e5ab0f81319e6e667f1ade

SHA256
bc40534fa41f9494d22caa65011ee7960075058b0633a64c97ad1bb37850d85a

SHA512
0b091ef924d121cdb77ed2ee15de11fb1ae7faffacf1e83f4fa9ee841f640339d61f9435465f3d13d3d0a50b0f25b3d25bac7e3ec8e4ef63f996cb0f9b91e6e7

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
94KB

MD5
0eaec3bee6255d68a47c373e3b127eed

SHA1
e36cc1a582a4ac62419f503fc19779cab70b24bf

SHA256
f3f4a71ceb5143d411fa10572b4ddf7c6561a3ec866c371ab5e067b7d8b7456e

SHA512
da7587013e9e01eff366f48c5f8cfec6295a320d593f06d1a99c689482b20af75b31a0571437912e53c53c11525a8845e6e6f115e61c93ac0c1897e45786cdd5

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp

Filesize
109KB

MD5
4b11610dc51c7a3c923e8f4fddb4ba4f

SHA1
f752d68bf3d74feb1a1c1a5411c24ef0d49756c3

SHA256
a887457cd8d96f87cc1437df5726d19680ef90d35f10c809fb8fed16128c959a

SHA512
a226579f92bf5db64cb769fe901409fd0b56056442b3da928cb4f801f163f8a064a2bfff17712b9d37e660c57ca7e570e2de8b9c2edf54be600199222f80806f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_01 - File Explorer.lnk.exe

Filesize
93KB

MD5
fae847a0cc9dd83bb6ef95ae97e2607c

SHA1
db35e0456eb0beec83db4d2dfc940e51758fc3a0

SHA256
ae31b1de652c691721a5a3650ef1b10ebab4ca615566bec054adfa22dd6bad94

SHA512
46b0aa85171b48e8370f2e0b79d4e0f84aca097c6a2bc8c84657689f1f8b2a549a370a47a931e003c7254311140390e7b80baeaf1565ad06b8375e322bcce3c7

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
90KB

MD5
f052d15f1b566107764a2774908b6af1

SHA1
9e1028843bff7fdffbef8a8a41d0f96811c6316d

SHA256
f85dab0872df5adbdf677222092b0856a1838d56cae16021d069f293b4b34b61

SHA512
40ec41f35a125c28196e16365bd2b8b480edcd6d19c0132f248b3b32f04f22fa49efe1c7bc5acb9106215e1630475f4e3ba562d77b2d707b6dd1bc1562c798bd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads