368a6b69344776694e8e3e38579539780c3dd6e5e267c89c51daddc3e247a3c0

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/06/2024, 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

368a6b69344776694e8e3e38579539780c3dd6e5e267c89c51daddc3e247a3c0_NeikiAnalytics.exe
Size

160KB
MD5

3b88211d55b8b1ddb81d40e5b52f00e0
SHA1

e78824d52166c8b069f04724427b5d7506f5f4df
SHA256

368a6b69344776694e8e3e38579539780c3dd6e5e267c89c51daddc3e247a3c0
SHA512

9b266233b8522f3b56db4f5c354a7824b2dc9e0a03352e392cf4a39f06a1d936524337e363b662da25ffb5619ece4a898948c1a1125d15d6a09149da44f7fb92
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBn:PqFF2Ie+eF0qFF2Ie+eFR

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5137) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1264	Zombie.exe
4424	_MS.WINWORD.DEV.12.1033.hxn.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	368a6b69344776694e8e3e38579539780c3dd6e5e267c89c51daddc3e247a3c0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	368a6b69344776694e8e3e38579539780c3dd6e5e267c89c51daddc3e247a3c0_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteNames.gpd.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\ReachFramework.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Xaml.resources.dll.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\CompleteBackup.3g2.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\sunmscapi.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp	_MS.WINWORD.DEV.12.1033.hxn.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1264	1112	368a6b69344776694e8e3e38579539780c3dd6e5e267c89c51daddc3e247a3c0_NeikiAnalytics.exe	89
PID 1112 wrote to memory of 1264	1112	368a6b69344776694e8e3e38579539780c3dd6e5e267c89c51daddc3e247a3c0_NeikiAnalytics.exe	89
PID 1112 wrote to memory of 1264	1112	368a6b69344776694e8e3e38579539780c3dd6e5e267c89c51daddc3e247a3c0_NeikiAnalytics.exe	89
PID 1112 wrote to memory of 4424	1112	368a6b69344776694e8e3e38579539780c3dd6e5e267c89c51daddc3e247a3c0_NeikiAnalytics.exe	90
PID 1112 wrote to memory of 4424	1112	368a6b69344776694e8e3e38579539780c3dd6e5e267c89c51daddc3e247a3c0_NeikiAnalytics.exe	90
PID 1112 wrote to memory of 4424	1112	368a6b69344776694e8e3e38579539780c3dd6e5e267c89c51daddc3e247a3c0_NeikiAnalytics.exe	90

C:\Users\Admin\AppData\Local\Temp\368a6b69344776694e8e3e38579539780c3dd6e5e267c89c51daddc3e247a3c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\368a6b69344776694e8e3e38579539780c3dd6e5e267c89c51daddc3e247a3c0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1264
- C:\Users\Admin\AppData\Local\Temp\_MS.WINWORD.DEV.12.1033.hxn.exe
  "_MS.WINWORD.DEV.12.1033.hxn.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4176,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8
1⤵
PID:1304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
80KB

MD5
e606d32d6632feb340e0591c754d8c56

SHA1
f206005b1ebed57d21372fe903062a723264163c

SHA256
b35193850fe4ae6bd117347b2a0e641774c4f3e71af0cafbb3eb36d990e82922

SHA512
540257c390512eb1d6f59e8bd3eac62950a2c6cdd13538b72a38aef5d7baddd5fb9c761ed45d00ad0a98a4ab12797b48b3c9e064fdadbd1a6dbb33510c7bad2c

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
193KB

MD5
04e9874777b0a1a4ead7060ed062e522

SHA1
cbd62a75bc3f1d01f2c91d716f019cabc73b67a1

SHA256
40aa9a1a9d90f5926be1c92fc7cd38637491e7a2b4f361ac319ff19a2ee49b32

SHA512
2a1adfd1fb104f1f13afd86a4cd16b1328c9415612a41e25980a0e1ae8bac06f72fe3498fe471130735a6d91795e67ec2f5d7b10bf8fe8042da058feb9e2b3a4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
179KB

MD5
40a1248260fe35467184919714152bd6

SHA1
3ffd70b9f682d89beebc3663a604ecbc1e1cf998

SHA256
5c9c8d91e4c6978b427a65911dcbd4d3a55621a291d72630b0be18adfbcce2ac

SHA512
bc5c30fa2c2ceeff986346fbdbb1245c534daf6b12159c5d32d35a86c4d7bb14183b988765ba184386d64cd2aa239b799f9f793be1d5b954a798c6cdc8db4236

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
145KB

MD5
db9e44977d22d45adaea684f9370dbd5

SHA1
3e4fe8a69eee14118716a64f7f3e68e6b992e995

SHA256
2f8a716e757a524eb57282436dfe783c8e941dd733bddbf1d52dc0ef58bc5efd

SHA512
b34157d87ef2687d000135dc6f207ab0818baf3278108af70fbc92d5f4afea3c29f045602336d664af761f2bc63f90fa2f2f838c767fba3b10b082514fdbaab8

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
269KB

MD5
a7a0e821d19608aea91d3a333e3fc34c

SHA1
06b879b4c0d9927dca07ffb1900936b254962f7d

SHA256
7e9971a1b904431dc2d07aa3e8364b0337d1c5dfd35e2bc29f1e2284aee59743

SHA512
23413594332a7c03a7e2bfa5b989f3afd39a0129469889630473614acedbd12493770696d3bca49ae1052ae51d009d45b81749a9500979e1f09d1b34f5d41f68

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1011KB

MD5
a39e9873d288cbcd6d8a4f91f46e0ae4

SHA1
c3519fc472382113970921468752b1a1a8c57e0c

SHA256
8405b998c1dfe66040eb61d8d1952cdd29eb23cc096dc14ec227e2afdd2dfcaa

SHA512
1ac1ebc7c0add2e5085cf1fbc61973bad3447f691002ae06922b8f8865851298e181c426c14d1add442251a1fc037127647da7b53d82bafa124147b8423460d3

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
764KB

MD5
51215f1dd5e637c8667bd061d77b73c6

SHA1
3312ea4defc6a470542d779187b3a858b5ca4a54

SHA256
283717ffd3fb7b3c8df3aae209c30b41225a4f4ac354dcb68f753c3ed4420ddc

SHA512
6891fb123e1724e9d759bd1a97c912a0b69e164fd0530d2795e9541f7a9909abbb8bcfc35544f9225c3212365a09c1d2928735b48b64b8e2aaa6c6f0d54c7ffa

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt.tmp

Filesize
85KB

MD5
ae99754ebcb5aeffc151ec63c60c26ce

SHA1
3d3b47bdd327ad7ea516bd75e637c319a20b7ad7

SHA256
60c23c082eebf5deabb63f772da4b3f109d31b38e671cd1f08ad9d345e2c43d4

SHA512
5c7f519934ea10457748ef4328d84826b765f3d9b4648d2c79dcaa50192650d4cd48653d7c2667267fd0230e34b4d4fbb016159272c4b7fee841664befd5cf18

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
89KB

MD5
9acec62d1f1f8828ec31c2f0a0586119

SHA1
0a2f24f91792575c7b891eba64673c082f14ab61

SHA256
1294b7d3ebdcde60ae0c8f62598fe449224e88007a05b0c187237d094fc08d15

SHA512
31c7d34c95090f7c932e7084bc04e439518df4512a4a280084ee7756f15ddca13175cb984ef1756b3f9a8f3fdd168c86c3e792dc77ebc554a5b6cc29918847b6

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
91KB

MD5
a47185d580bff29b4ea9e1e2f2982e75

SHA1
cbe5c4b2173bcd1bab03d0fcf73b19b233a78d5a

SHA256
1987f1482016887222cf6185841c5c66be762e500ce47760ead68ac704c938a9

SHA512
6f542c8dd5910c757d911128c4279d2ff0822b881136ab8ca2b5c11cd17c72343adcc936c8dce2ae87622b5a8f7acff4ad5993f036cde18a6dc74ab82f235e5f

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
93KB

MD5
b76e2f9686a4ace4921222f5ff9849f1

SHA1
5aa932ff1e6926ff50b09c00db333227f212979c

SHA256
9d1b1e6e6d95918f20c274e237ed272c4e37ef309149b5368f64763511cd5b27

SHA512
7abe919185acc9e65c368d63d4e676fd834963f9f10a5c33312f0be92f0492993311ef7dd17b38a31bda68639c89f438f96407ccb74baae100ac05786d6f172f

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
95KB

MD5
e3abff4e04ea6183daf1dc5d26cd9110

SHA1
36c9542993d4f3579d339166ee7fe9fac056c0bb

SHA256
921d25915b9c77e90429155056e085ac22b641fd4b80893d16f3e582ac7b1da6

SHA512
c80889701a27a813e5018130513579936d0a3aa44e527ee2b4ec6587c754ae25d0713e80a74c3e17f570eb016032a569c60d847a0214b4b80ad80c0da57ff9ab

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
89KB

MD5
febd2cbcca3743a67b7c2f6322d3c389

SHA1
bee3ccd721d5aa6b9a853df4f267c3c9badee3fa

SHA256
8d0c933ede1ab072ca5142c3a008fde4978e92e2ab6c70276c67c65cf5a95945

SHA512
a42a55d0aa139aa5f2842177dae696cebb098e7819eb7490a79f97d9819ce942b699f7ee491f17cc83ae1a85b7993a450ef8fb445f4fb800fcc90dd5c453513b

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
85KB

MD5
ada7af6b385eff813a584a2fce63dfd3

SHA1
9ac11f19f3fed6b208670b202dab137a1b8e4453

SHA256
439475c7e6cb699a6fbb44a470262c7cdb1febbc255ecda3a53dd2079d94d481

SHA512
5ac873139cc25d1d6a0f52243cb3a229f0fb7f916a3aad9b6ec46b7affeec619872156b5d24e5c4a1dc85886879cb86b3c1ac3ba62479a7e5eb2070700ff7b08

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
97KB

MD5
a7677557acb11b97fd07565f974aa773

SHA1
2f115b4f2c73b7b35f2c92153741f0ee62ca2b67

SHA256
cc11ab0a7cc4f9bb653385a44ba6497db4d2172f9caf1be25896d29bbd14eb80

SHA512
2019a70a3ff8e84395490f28006c3c2523e0bb51d8a1fbce5602602e157896d59ffbb02b7c85bfe82ab17506797eac3584357090ad5b8c69902c2bcbefc3bb15

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
88KB

MD5
70cc3b4f5d180c9481c2e2563e855897

SHA1
28a47bf249a7ac458f478d6c1b21707f41e62920

SHA256
c544c242caff9efca2718fe8a6375ef7c35135b29a92cfbda53aace98c4bbcab

SHA512
c57cbcf300c16ac70f83d30ded7aade3f18a866b173f8f2766bba62bf29444c5ce7139d5d86ae8d9fcc27e8d05e4b2cf318c0b544b272839e933fb3dd0465d24

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
85KB

MD5
95e3e4b1186dd106ab4a669688d19da1

SHA1
042b1807d29db567528469b7f23258feb6d4a593

SHA256
c703b79667e55b89ac4480e9becc6640f8719876aecaa46b280b29eb743e6f9c

SHA512
50b7037b769a5f6de2e95418cc4783133172045d2c0a9c917795a9c33dff4d9aa7b874f9629c324ecb7bfedb28b60ec059dcf07ba6dcd338c14532ad97204e47

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
90KB

MD5
041a19e3bd571d06fe8d2a0390ec1a2c

SHA1
83189dec9fbdd0820abe195c76d258dc80e3e44f

SHA256
146aa26c565edd5cd575874430eaa236bcba3c8ea963a99773188beda034f214

SHA512
9d134de183bddf497f6f7244ac18cf3d7d20badfb9e9510f36e97d2cec74ec1e2454ca63310154caa726d24d3bad345a9c6d8ca74d360daa57424080ec77db86

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
88KB

MD5
7b0d871a2d695b5b1055a55f66564315

SHA1
ad9a57d0eac11ccecd47d915a46c62dbcc1cdf10

SHA256
4dabc61616042e8974706be843364a405715feebfb00888486f77599851e5fc7

SHA512
99cd63c529e0b4cff0069aeb026c5b41404c4eafcea2f7355b5564882b28849c36519b0f2e0dbca7f800340f92d2f42ec7c89d986c90b1382deae1d8581a7446

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
94KB

MD5
d95063b92dd977897946fa5e68fd3933

SHA1
8be809bd7eb2d4274464a99f66d5e84b9a40e506

SHA256
2528e088709200183834d3380009411778e20db0a6088152a1e4aaab6f1984f5

SHA512
1d9eed8aacb6d3530b5c14c1f34df836a301e1f837bcf8b875b598985cd59d351c76387d690a4b6c93d0f87d02da719ec5b913687cad918ae0e9db4c1655e03a

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
89KB

MD5
77be136f83620f4aa00a54359d9d90a9

SHA1
e1670fb1646ed4631f2987322d0f76b3c213b179

SHA256
1ce2e8d4deff0c4d7190186705156260067e9034d1eee13df869ed962530d8be

SHA512
4b5c68a3305bc9ac98c58e96c48ce87b462e9708874b339568fcf11ede34759bb517d0cc9fbd44a8a63fd5df0bdb3468a56cb850a51977ff94a2f4ab55b1bceb

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
89KB

MD5
7863a8f70ba1d594804b2177aa3419bd

SHA1
b923caf2b4589a4b29fbcdc498b6374da0d38750

SHA256
f51c60c056a1fc0913a0c826e6a84d1588d9193668d49ecb8ea964a0b06069d5

SHA512
26a75be509d784b3c9a915f0b617d965129a2e5fbef10a411adbcd2ed665be750f821346c3c9e9c2cdfa8d8260830f6adef9fc2e7103eb2ca778f943f2d8179b

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
87KB

MD5
6de5bbf865714c610e3197dcb3988bdf

SHA1
f3677f982ee3146478468abf0108350a264e2596

SHA256
fa8c67fad6ec483c982baf884e56688c0ba3760894fdc4cdb4c37e1d6d2603d3

SHA512
58aafe1bf7fc20ff1c3755a72c8f3b946f2c6406e194f3a5a0d455d4d26011e0d96e2d6fc6c269cd33ffc366193a7bb9336ac9cd1dead44b820c04a4bbde72b7

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
88KB

MD5
9e44ce509a0c3b12633f3ad84d52f16f

SHA1
57debd44d6b44c2764dfa72e14ce940f99844185

SHA256
e79f6f0faa3abbe2296cba48553d29b26050fd82b82aefd8338248d3133f2188

SHA512
1c6d2a6e7136e8a8018081fa963929957cdcce435ac811eec546e7d15abf05df1213b56d56e4dc85a54d9f5c999260538ccf40931bf34c6f1bd3aeb4aa740c75

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
89KB

MD5
a26ef220c5a6ca00c076279191ccc647

SHA1
8538a33da6546b9756afaa323c22b6b1f21bf282

SHA256
484535bdb30349167b4fdab3100b922c8638b33ee2feb78622daa7260e6130a0

SHA512
ee1b0009d2f3672b695b18ceecab664b73526655799d2f6e6b6b7117950646d57cc8479508e6f726a9559697d543690f90ac1974d8d0c979816b8b9f0aab8d06

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
97KB

MD5
e2d53f50f1f8976e674543c0a365aed7

SHA1
d11d74a0089d0c1a97ea3af8e98241b54f562d09

SHA256
82f3533f9504f77b819e97bfa96bbec5aef8965026ed5caa51665f97b493cd51

SHA512
b7e555f7ff77cf47b8a4642416e1323d14ea6d5ef35b616453fa1c21376ceb446ab54bfabeb0224b701bc3a1d43210b8720bcc7812067aa150a9239bf8275ee1

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
90KB

MD5
64c493b3afb46c0680e2ad33fe1f9176

SHA1
0152e07e729cab1b653bdff59368815c6ca449ac

SHA256
92db613a8b9a3432eda91deb479d40c4bf27c1e6bb734b16929f48877b9f2c15

SHA512
e7371875529ca70488953711fdc459fb3b0fe94a5e3a5ede0f4f0fdf1403468f0dc469750d06f3c16c4537268852502c903d5ebaa00b461b2901f6cc8f58a544

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
98KB

MD5
ba2ae8f8e0407a10a6beef7fd9f8e2e5

SHA1
1486492e785052f1fe53a9c8636513dd63ed6980

SHA256
12905482d8d088d6edec936de5097695826928b276f2056c31e98661626a508e

SHA512
9fc7627a3ebf8e4489bbe3f92c71b0e390f815d0bd41846daa003ec4a7b08c5551fb36053cff739a919de8ff277a2aef70b3667b465453e6250a49d993731105

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
89KB

MD5
b75c9d7e3aed1f90066dadcc85feae52

SHA1
49dea0ec757c037a2d91812e92e66e541883d1e2

SHA256
6e7afdb05bd432f43300f583c38dc76207e83f9ac83b4da17793ce08e786fe65

SHA512
a929e3f45175b381b7e84593aa034f9666521c0e6c481fcd1215797fe3d46467bcf8cf623c169a79ea6f16c835d1cd34197c3679a6559382ecc13947b30ffcfa

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
89KB

MD5
9890b64e8dd3fc9506bf74fb1da946d5

SHA1
4ae19798dae7a751d2bca9ab1713e40fd98f83d5

SHA256
a27df8158f72bcdc15067db004c952ba0b3e411119ca1e5bc22a5612e5aa9dab

SHA512
906687ecadcad7ced3cecf45ab1bddb173a4e7882ae6dabc07dfa8ee8f1fdda77ba9d634a4440d2a920123ff05394ef8cdd4d24409f9b2ab30733c55b82b6bcb

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
94KB

MD5
57fe92f07568c446cd079b787a7f3096

SHA1
5f2f7f8c4dac487a5e9174de7ddeb0c751a6d289

SHA256
fe1712eab12293e8206e40eb73d562a72a33454e17cc5f012037942171952ea9

SHA512
f12c0cda5e34128a8cbd0c12c40b507293323be59fb4e6d3d2b7598327e442bfda73c6a21a3c2701db36ccbf2af0fd8c02cd3d8b715bc1d186f4e783dae7e23a

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
89KB

MD5
d4003158d040e22b9eb924d3913b44b4

SHA1
1f50940bd85a383b282a1d83e49e47e4f2437dcb

SHA256
21badd133777e199713e47df14d3cdeab3d3ad3c120e105ba857460c2f4c3519

SHA512
1599059757f5580fbdb48c56df70de49ff5f3d64e5c43942d60d52c247b4c68ae6deb2f287f9b29c266580d748e6ccbebe108005e8190c11dac748e7073e61aa

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
89KB

MD5
19f9f8853d855b1ca6b9e956913c67fd

SHA1
e4c7f6f8d356928a4efa1703ac93428d91663360

SHA256
095973e398b03e9ea5be9360bda2c7bf3763601d178ec138682209674d122a7e

SHA512
bd528f365bee112205784f169e9bccdcd62152e1530fc313227a8c16c9163e2860049cc1e99d80fce40804c8972ce7f4922dd2ed9ba98bafca6e78fa8a200a7a

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
89KB

MD5
c2cdfb01419a7fdfc8c5d30d79c0148e

SHA1
aaa77d90eafeaa2bef1a5dcfd48126e247d28105

SHA256
ed078a8cc58fa23f07a807ed802aa82d0f89177b0446e7260a15514c8b3651c8

SHA512
6c8563439db99363fef4fbbc9ed02252aaca51ddbba832e8f5fe8f29b649fbbfdb6a37ebe1b36d0556e6362df875ec8fbc83bf69540353dbc4bb1647f5bbf29d

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
90KB

MD5
65f262573d1b3f4da56d215310dd815a

SHA1
8561efcd291ca12a078e297e736c938b9a32314f

SHA256
be2c9dd7a7114cb9ad1a59a5da65357be1238103365e3216a4f897231288e689

SHA512
9989e899746a14d47455a12bfabdf120360054621f52daf30936158544c8412b40f77d583952128346e681dbae275fc9cd3068520719d9def340b21368a2ab29

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
91KB

MD5
fc829e945ecb5b5b887a8375f5428988

SHA1
a0e832f58b975432ba62195d4fc3ec649326ab0f

SHA256
2a0e0abf9667a57ee192534ae7094b26d4492c5c31df3c8ce81b97affedafaa6

SHA512
362bec0df56040235a8e80a4b9edadfe8a726bb4be7c4047f597c35ca2af19f33fccea6169d499c0e245bc5090216918c5641663561a0d22bd9783f8d8d578a7

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
97KB

MD5
69950e984e8b0c157fce55463561bffe

SHA1
598334b31d5d102298699f2d74da88ec359a8307

SHA256
7837cbeda71457ba915d4a5b6dbf82c03980ed62e9548c95e380a368de29cfa7

SHA512
fa97f8f0d2fac7c511d2f5541528eb2c84b8e19573f57fa5749f8aa0f2e700f19e40abb5707834419d03dc88dbe08f1a0d9f73ab97ac51b713cdbc64b44580bf

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
90KB

MD5
6444616335bedcc2d37cae6586beede9

SHA1
d409c58349f081482e9f2d8d5742d9fbcf97b375

SHA256
65c4e5ca40f90e0e3687a77a4c085747afdcaba20164671f57a5df761d7bc1b5

SHA512
85654d919bb4c762f5bbd56f13055d16661a7d4f8b18c99595495ac3f3109ad08e71c90a1a7f4331f3a932f9ae897475c9fb45f3fcc9643a18c5c64edc1bbdab

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
92KB

MD5
b66c196a740f4751064a33c5c8daec73

SHA1
3222cb3e8d980a330e9ef2acde46d74a3b955bfe

SHA256
3154d9183715b90efcf0011b67789c62f07f433c1cab05bc6b7fb82726bf0b50

SHA512
dca03c112810325579d200d8c1f45e6828916df90054d2c7e04e633ba1c4eb1219d0108cfb5a0444811cbda2cd815f6d293ba51a681b133db2ae391ecd415689

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
85KB

MD5
bb646149bc653d42b8bdab2e39b1fc66

SHA1
a481ba9b70ff8e50dd7ed5f924e8839970be1a2a

SHA256
790ab8c3c3f7b62a87b699d8048ca390315a74b8948086542b047a2538297527

SHA512
b4b5f88f767a7be6821b1276427a6b036b01244bc18aed2b7d8f68055bceec674857c60e73562dbe311c69c6eea47900054eaffde4dd95dcf9a0bad1044b9bd9

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
89KB

MD5
74d9194f6a67b2cb47c4f1f812ec3d44

SHA1
c68171164b6bcdecac865182a9fa765af860871e

SHA256
6388bd7b7b2d55930e079071549c3081b619119e8b630f6a3e19abcdf422b810

SHA512
94d4efb02c4fee82ea791078cdd4ea80cf9a33239f9aa37f1fc567003958979b910db67f5e7cff73175f77f314a64ee2d62799f5c60ad62479f19da2bf3b639a

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
100KB

MD5
7f4e5659b9025d3d551c06224f5862d7

SHA1
6f08514ebab1d6e3afa3d0963ecf4cf88b69065e

SHA256
f5da339378a53fb62c09bddb82b7023968e9b5bda8736ec232ea083b8a7ec480

SHA512
bfbf3236d90d0928d050f994fd90949a58520c4b9e2a98e25524b18f6d59d010a9581e8146e5144fea0eeafa9501b2a405f798eb2cd8b320032b4f3619e70e58

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
101KB

MD5
5edac9c899f44819b58052eb7a436fc1

SHA1
274e813bb6f33d12472cea7c2bda5d9fa6a48e0d

SHA256
1c408b4eb0c6aa3f0b892551253cdd3f3f634cee925ed373b11105a98af116ff

SHA512
c4e2f4e06e18ffea34eb6ba0373418bb60de6ece7651a514a8ba53af053c8a8ddeb90b0b0105488b1e6b40e0425b25796814fc759e7bc8beed597db46ace98a9

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
91KB

MD5
9cb75738936cd37a0f5349b0f327f5a2

SHA1
c0233a51c3f48010604e2e2615312b69e50fbe3f

SHA256
0ca6f97fc3e20f3683fe7ff5bfbdea39b16fcba892b32020c2e93e42ac236678

SHA512
17dc1866a92cd77992705dbfa70316f99c61d39bb497f424caca4ede5fc1548b90488dde29ebf1eca1b4e84895a70c7818ee566b5264f3e9b5de6ca1cab5a3dc

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
84KB

MD5
11a3ce52f452e8c35bea59e033608920

SHA1
a3d3c51cc34fad4b6f5fee0676b6e69cbd4ee4b9

SHA256
60311d3a59df431edb485bc6ba8d6cbec240903ab70505e6c0b427625e70a360

SHA512
ab8315ec1788befbf12c0c6309fc9058aa5a74559e65bf1fba3455a049e8c9274b4412566ed165ba1dfd5f6c2aad18f08e04170b4d87af76b711479230c39d38

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
85KB

MD5
2e55ee6348d0ad99f43b43ef0638c496

SHA1
511211534492e3ffb035df17669fe9ff3811812e

SHA256
c8297bca6cc24bfb17d053156ec1cf55693919243e9809dcca9a1de79dc1247d

SHA512
2562412b0a5d767b729f55e8f89b8e48eabff206d419aa5e5fd70668c8c01207210660ed0e47ef6c30b00793c9b8140eb24a15697b5902acecca3d8db706be57

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
92KB

MD5
89244faa125ad67c0d054385dd305667

SHA1
7ed4db20d512466baa009358d59ff41beecf0320

SHA256
4d265fbeeee71296b689a7724d6e63b448d96fa555d8c0b642e58ff032bf140a

SHA512
a54a95488d6485528ffcab7a4e1944923c450ba40e8d82d6539c2e75da1ba978e433e83b2d3c99ce8f5464f8d1b49c006cd8c68b395e73bd6a456686289dea56

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
94KB

MD5
93643230c5abe64932a9dc8b2b30e5f4

SHA1
6204f8528a4fa302795ab12b5300ab51d9f6ecd3

SHA256
feaa02fef895376c96bfd77677182749f9c20046d7d0ed89d9528d1bd6bc94f4

SHA512
86a182833a499c9b6865c0c9dfd0e909bb800e47ed66deeb47723e24dedbf7bbd7323d6a2616d9ae0f1c071c6f0c9d0cae7761ba212e88644fd9676bb47729fa

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
90KB

MD5
9b1cdcaa72fa312c573d61a2543610e5

SHA1
ad5601c44c57359083222a0cb47c290c0526b175

SHA256
ce90014689a496b6621e91a9fdff6a349d7ec19dd2074cf4bd70f9caf44ca372

SHA512
6a995a7c9e0f0e1932353a16712b00c51b0e5a7bc52a6afce659f7b3a3c23bef5c21b27c54274fc614d89c04069cf504a4f7d5c34371f74da7bdc113c7ec176f

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
88KB

MD5
2e589aa24c7e80f1a5328da8dc05c54e

SHA1
ed504eedc8a3599dea4a1846957447b93beba074

SHA256
0cf55b00999d486e9836ea7bce0c9b51987844e728d0b785a7e1fbc3e1ed5a1a

SHA512
611d2643eeda23135b1c8e6bc91a683d21cefa398123917445f96a8c27b3ed196e6f17203fdf15dde9f958d457df4bc7c8dfaf63d6296e54b2fd228bbccff767

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
89KB

MD5
6d07edaf87c3c8c8ca0236e30682d698

SHA1
eff5b563a8a111af9cadb83057ea69c6db204a4b

SHA256
f9d94dbebd54d71d4da19847fa6fd46d4d0adb0ec4ee6b7f433763d34cfd2e1c

SHA512
2003684ebfab77c0b813e85e2589cfe64f78f96c0f937bb615ed6af28364e0526081033fd863d557a3757049a3610b0f7cae9090e62699717cd8026196fc48bf

Download Submit
C:\Program Files\7-Zip\Lang\ro.txt.tmp

Filesize
87KB

MD5
7af80aa8086e86ca6e61297fe52a0be2

SHA1
0f98d51c06232c7074e2c239948c14e2ce3b268f

SHA256
e32205c167946f3ebd5b8f1fdba7ba04a1396197b0b7b0bb9144d7c84b906a48

SHA512
4729bed82beaf76e98c265ad2cd06166604eaf3f092591fb09354506634cf0136c795272f260f62b60b569a601636eb5c6ce3e8964d53557d4b39bd4be0093ac

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
99KB

MD5
cacb01cb1b4ba1846ff11b10e07a329b

SHA1
a608a2904f2157b8e2f7f95274d029ef93d1048b

SHA256
3657a217f54af72ef88dac9d4a56d27d31589ee3496853e28d16a023b8884177

SHA512
7f1d4e842fe4e816a3a345d88712d86a198d0f0ca976a2b06cd5ddc4b7a3fdc0d4a812a8fc97eeff1576a791ea6b64a55fa5c965b583b17eff946d75c057f3ff

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp

Filesize
90KB

MD5
34d7f4d85e66c38a57ef71f62848ce7d

SHA1
739f68425b7ea36762f0c06bd6fc5cc5f51d288f

SHA256
875fe2ed6a0e5ce76171d840e7bafc6145869f56c59d616874e75e06ec70aa2d

SHA512
c0d0ab94e921cced38be74efdf54aa720980e296670b72f89b0c28e2c3d5ed10b0f007992698f7cc1a3aa7819d541f704803c7bb71d784908a8ff17c89da78d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MS.WINWORD.DEV.12.1033.hxn.exe

Filesize
80KB

MD5
ecac260b553597945f5615fdeb9d84af

SHA1
ee33046db627511f5c3985993efe4a2a4e61fe3c

SHA256
08e9ccf6ddd0392ec7795b41b370db3aebbd41118577c1f3f3786741f4c52a02

SHA512
64b91a1575fbf5297da9527fb2ee9031fee9d2ebbd393114d1ae75490b03805befc8599a132d39576a04dba0436de53f12e26f6892d30c695c8041b111929355

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
79KB

MD5
74c38205df54abd71a4ff1b0b3c2fb29

SHA1
8942bc125b08c1c30e841227e25ed705026d2b45

SHA256
179f5c7280c69710877ec5d52fb7b2d7fd23f9625b5deb8860a0d9583809936f

SHA512
9d77603ce32bd495c635f86c4c8d2a39f52e916f82825b520d13932ecc5ae3dc3d05194f65338b85ffc48ad92ca02e43dbee1b6ac26790645cc9fa2046cde261

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads