3ec534203b0bb7b276aa7edc2877ba0bd8f6940932f30614170fd2f005ebe38c

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 23:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ec534203b0bb7b276aa7edc2877ba0bd8f6940932f30614170fd2f005ebe38c_NeikiAnalytics.exe
Size

285KB
MD5

2ad0184be9dc9eb4a3af6322cf2237c0
SHA1

4e7e768ca7cc500c6ddaa169357c4aa50f5cbf6e
SHA256

3ec534203b0bb7b276aa7edc2877ba0bd8f6940932f30614170fd2f005ebe38c
SHA512

444d4c1407d4fa1751193a8246ff36ef47841b0154edbd057d3dfe85a662a888c2d49039e474e90581de61dfee8d8f0e51214298e497dad7b704e1cb183e45f7
SSDEEP

3072:Te76WQSoskRYd6W2QZwKS74e76WQSoskRYd6W2QZwKS7x:SeWQSo1Y52ZKS7beWQSo1Y52ZKS7x

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4753) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1504	_Performance Monitor.lnk.exe
2388	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	3ec534203b0bb7b276aa7edc2877ba0bd8f6940932f30614170fd2f005ebe38c_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Zombie.exe	3ec534203b0bb7b276aa7edc2877ba0bd8f6940932f30614170fd2f005ebe38c_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Diagnostics.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.IO.Packaging.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.AccessControl.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\de.pak.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_WHATSNEW.XML.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp	_Performance Monitor.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	_Performance Monitor.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	_Performance Monitor.lnk.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 2388	3564	3ec534203b0bb7b276aa7edc2877ba0bd8f6940932f30614170fd2f005ebe38c_NeikiAnalytics.exe	86
PID 3564 wrote to memory of 2388	3564	3ec534203b0bb7b276aa7edc2877ba0bd8f6940932f30614170fd2f005ebe38c_NeikiAnalytics.exe	86
PID 3564 wrote to memory of 2388	3564	3ec534203b0bb7b276aa7edc2877ba0bd8f6940932f30614170fd2f005ebe38c_NeikiAnalytics.exe	86
PID 3564 wrote to memory of 1504	3564	3ec534203b0bb7b276aa7edc2877ba0bd8f6940932f30614170fd2f005ebe38c_NeikiAnalytics.exe	87
PID 3564 wrote to memory of 1504	3564	3ec534203b0bb7b276aa7edc2877ba0bd8f6940932f30614170fd2f005ebe38c_NeikiAnalytics.exe	87
PID 3564 wrote to memory of 1504	3564	3ec534203b0bb7b276aa7edc2877ba0bd8f6940932f30614170fd2f005ebe38c_NeikiAnalytics.exe	87

C:\Users\Admin\AppData\Local\Temp\3ec534203b0bb7b276aa7edc2877ba0bd8f6940932f30614170fd2f005ebe38c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3ec534203b0bb7b276aa7edc2877ba0bd8f6940932f30614170fd2f005ebe38c_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2388
- C:\Users\Admin\AppData\Local\Temp\_Performance Monitor.lnk.exe
  "_Performance Monitor.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3169499791-3545231813-3156325206-1000\desktop.ini.tmp

Filesize
144KB

MD5
d7736d7672d8e7762eeb89bf3a1c16dd

SHA1
163900b45bb47a890826469600b95dd1041058c3

SHA256
72fece8f1fb4fd1d9173d1b87539a07d56da84763865eb5fa2c39f332c7a4f0d

SHA512
c3481bdea0920d241c63d80f98b5014412e915f99cf01a23e6a47dbcd3c5c4da8151e4b4da3de4f509c313d56c8794e62fd9d4fcc887ecffc71a176d6f63b0b5

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
256KB

MD5
48c858515748c912cbd5fcfc8a8a9f28

SHA1
26776587555322dde46287241dd84c18df47e7d3

SHA256
27f7e38c77f7c20a462b09c9b40bce7f337f981d2207dfa04627907b2aa3410c

SHA512
8c954663e3c389625e08c7c95b3fa2bca7c0b3ae3295e8ae6f8183fe1c55ba2096735e0d772065b367dfe50306983ab9238be7ff76fc5c061191c93e28b59796

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
208KB

MD5
8a71efa074eca3708302a2903630961e

SHA1
0a4bd9f1bd9e32c992d11575799aaa327cdf01e8

SHA256
d13f5267b540a17a7e60fb3172eb904a460c1ab771f147facb3e362542128fe3

SHA512
546add8acc49905eae006d8b35cdfa64a7ca70b15176d96736aa6426993fbe2858c77b35701906a9df81a8d02570a042dd67de419b699b3732bdfe0ff905eb27

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.9MB

MD5
7fcc8457f8683d86add5a289be0f5272

SHA1
95ed8cee5c68e2ffb6cc26b6133f9e043464d470

SHA256
071851393b0c547e12f63b1d5d8d217d8ee3b0ef312d7488a4240bd3a9f304de

SHA512
9c59138859300a49f533dcccc4c910b83d6a0db75a06975d77989e77d723457fbc6a6e5931974811cdb803c3c9c10f9c2558809442582a7d8f87f9f897e0f62c

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
687KB

MD5
4f8978bdc820e54a658d5eda4bd00f8e

SHA1
8190b79088430ee56c8a7bc8581861eafcd7f9b9

SHA256
9ffa3d9d5a853bba148c0fb404554f66285cbe4ebf5b0401d2aea77e15ce5d86

SHA512
44b7a45355f228251f39b92fe3fc72c25a97cfb9b163de7204cdd9cc3041bd43ff8f00e8da0473b27107113a306b5f57effc52ce9cc833445d456ebe42c749fa

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
351KB

MD5
88d8565bfb67d5b8a34285ebe2e98491

SHA1
59e8dc99ffea196e535849c193515b463cf3e497

SHA256
dc7648ea47efd778de4d6f4dd994ceac8f2907f5bfa85a2695d29d9d8a9b82aa

SHA512
e45918734dd077e0d057bc9c6621e1d57b2a01bcdd25641aa58d9055526a1cb7dc18505ad441a9aa031cdc791be9016c1291123dcd468ba444d0ee053b496e0d

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
330KB

MD5
c2bdee41771ea1ed0ed2541a335ca785

SHA1
91e3d60393a8475a6383aba3f710bb4a9c8d8afa

SHA256
9eceae4c0b4b49fcfd9637b32cddb57d5a74243c5d525d89164f61560f94ca34

SHA512
2dd296706bfd22d7a51a918eba0aca6013b3b519b6885a674204d1776259008e7f647f2717fc878cc0b0cfa3aa53124d202e893c61a3634f66390ecc8dc7b875

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
050d159bbf6025e7f5c3586814c8f943

SHA1
2527b827bd70a5cd632d3299c663c6a9c4abcb67

SHA256
07dde47a9d69888dccb3544d2a50f076497bee4383bc62d1d160c5a3474c54a8

SHA512
5e1bab93e9ebaa70286fc3ecaa420f7bc7f68b1ecdc3e6dfa6986d89300f81bce0f85ad30d1f020782e2f937a4a110ad8d00bfc92d52359e161c6c0055cb4b4e

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
827KB

MD5
4ce0cd9a65034f48ce2d681b504708fc

SHA1
59e179435e7ddec6cc7d4f85b94b94b2aa617c51

SHA256
48c4a749f3e341ebd475ebe5631b28da242e6e258cac80dc11a1b7d049460e10

SHA512
edad8392ce0940c44bdb8a7dfff316191166a16ea1a431ca9c19064cd686ae26094b41602bfd5195ae52248c9fd57048d2372e55d60e59154a47c80842e4242d

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
151KB

MD5
ba59c4279c3bb6ce29d2ab9a3f3f3ad8

SHA1
0118ce7a7326bee8923d1ae64bf7ba6e1913c9d9

SHA256
449e345e883ae25111855b411691fc16a5117a75b4550548e188fcb0ce0c17c1

SHA512
3fe9ca4f55a4d2d359d204b6768dee5e29f39278c3e26607881616d312bdf8a8d97629c0e5bc68bce7b1d986f4a4cd5659de20161f07442ded207308d98b8588

Download Submit
C:\Program Files\7-Zip\Lang\az.txt.tmp

Filesize
153KB

MD5
c5b46b35e7db4f7b1ec8cedf9fe99a60

SHA1
c6873078f9253c952a734fe5acc594bbb662cbeb

SHA256
f8c261f6e58dbba36d8367c25e8051386413d1bf5260f1f96f9fd68faca3b019

SHA512
6e43c55070d9ef0f5b9e424579a3034f1e558310276bc83a13f2307867f38592381092476ccb046dd64e4c0cb8d73e7146b912bcbe5edb0b98bd63d31bf4bfe6

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt.tmp

Filesize
152KB

MD5
3f6146b2f2f6a48af6ce0b70f49f063c

SHA1
bd5b698277b90ae6524f303b1200bf5b5fc71680

SHA256
050414a2f480abc0f0997c268e23d79d76724762a10fda9a570597ca156a7f86

SHA512
59ab28c1e5d100aeb24658431295e797ae58378963800a098b9750946f82d1ab3978090da675979d57b7230008953fb71fe2350962e3b8d3a42e19e3ccbed25f

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
154KB

MD5
16bbc8e42a025e219261468c50541392

SHA1
3a35f0b30c078c3c6f0dbe88c30a60ae07e23463

SHA256
8eafdea30b0ff7208dca37aed925db9ce47dc77d3710309e2148851a2fd47a68

SHA512
174ba9203341a47a0633a5cae41517a7d223a8af7a5c54593e46eb4234bd4efba53b5da90b0266acb97a9bf0d30daf63c3cca871ea09e7ed1072b54c4a521b33

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
156KB

MD5
f74dede97f056ace482970bb86e7c081

SHA1
d08bfd1953a52af6050447dbb43b3af26a4c9439

SHA256
8245fc151a0e520b649cc83940e996c8bd5ddd62130e0be1b1abb84f0dbfb754

SHA512
cd3fddbf08e83d3324bf02a1d249130880aaf3e4a9801bb5ec1704805dd39d181838480039d7ec550e138cfa0b86f91537bacb7923d279be7939442908a80078

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
152KB

MD5
aa40e11c17b6d61538c43a6a9b8bea21

SHA1
3095d703d2ef8ee8f9026d812881ca71fbad6d90

SHA256
e32ff0f2fe883ec76885aefb644ce7372ac55b7eabe71395ea5d38200c2410e4

SHA512
42eab662068bbdde0ba41f64d481bf18345d7023ba5c52592cfe904797dfcd1b0754bd79fa809eba9f7309ac2d46a0ea0f7bd82ad31c88980a77fa2721eee7e3

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
154KB

MD5
b22d1023fa225ced08ef6bade72e6b85

SHA1
e420f16ed632bd232556728f455a97214ba3ec6a

SHA256
8ce116509a2c230ac4dd02eb0f6c73353e2103424d2e93d245a4553712d98ae4

SHA512
8529dcdcf5ba1f158784ce688395997151c2260894a9e92673e9822aab8d05c3f196a27d2f841d705bb9d7fb376a8591a89727e7308daaae29f147afacda5da4

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
152KB

MD5
f81e1d9cd9d95ad56c33e3d10b793b7b

SHA1
661bb2a7ba59116d40d28ce818d05df091fc8be2

SHA256
a8a10f9e2e6be66769a18697d99bff22a87ad6e94830eea9fb833e646ba2a586

SHA512
e82452190ce0c82fae8252245639d1d451bcfe386d6aed7e185abab0d4d8f2e5b1740693c5f381ffb583919c99312ba3177dce7875a08421b267ada2a32e3aeb

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
149KB

MD5
df1957ea3e5a0f2eaae1f7dbdafb00c5

SHA1
dbc3898627cfa1d98aeaf77c747c24249384aa23

SHA256
a271a88eb3b4c760ac838b080d417bdbc18ed979cf0e43319430fa227ec26e10

SHA512
db0c4b47e7549d70043a63f4448a488c0e5b582ac9ba54411d47c8413828f0cb2e1cf597f47627a1c17da739d71c9e7c648362c0739ccb90976def209bdb6852

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
158KB

MD5
f291279e4df6e65452316ad513ed940a

SHA1
a8eaa5bc43618cb34b8a8304cb5a989211d693af

SHA256
a2e6e622157e050421ca22d78a82f0a92fde162399bee6d06602b1c00d930790

SHA512
4cd85d031742331c81534fdfcd062b135c9148788fb454c4f85b8a33e3ea576196da0a13cb2b0c06f5e6e972efce4902414c8c005a0bc6c5a528fb6a40674380

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
149KB

MD5
57873ccc64b36af2cf8b3d1ae3d204ca

SHA1
195cb78b28236bf935eb3a3fc64c090329fbc4c6

SHA256
036d2c91afc57e600ffcfcd675554dd495405d38b0990b7f9ba9c49548408fb6

SHA512
35c42ab10ce6a5bc56fccf15a06aede5f5b0a58a1a2bc80a1741cfbc2375f77fbd581389fc5ada707fc103c6a9852b936c2367925c633b1755ad6182831efe48

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
151KB

MD5
d0633753ac33e105ab77429dd78d6e14

SHA1
3c1a9f8551125ce5a14310c7f943a76c25adc5f0

SHA256
1da67c1f8d7f6384205555ee006fdc220e2838fdc154127e3ac3ff29304501bd

SHA512
0ab3a8a8f8d3b1f2f4e434b19e75b2d907840ddbcb9d1dae9eb3341993b380fca1a4632b8cff0986a808f640aa52c933afe3d65f5b1179e5a02aaacab537511d

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
157KB

MD5
69ee0336fa21167e8fae54501e640df0

SHA1
0d96f9c961ae71a481c0c5e91311c09736c8d49e

SHA256
bcd44f183d145a688032e25ead7262ec23e0d875823838ba7c31f31fccb5121d

SHA512
1d569edb9323937dcd9fa7c8bc193f0f3c8091d5c594c147cef5aaef9ae98c1dee53b1711d83b46a8dcf0424affa75e059d2b49961a3733c6170b0d93120d160

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
150KB

MD5
49eac5e187eb10f9a991ba38408e3e3c

SHA1
c3cc27a8de818930e6a24febec432fe9c5d3b636

SHA256
49167a76148788f25481985eb6bdc1462167fd8b012f307a477d78140004e2a4

SHA512
5e9decfed0b2f0b2d38dc087839f9253dbd753fd59bb5877488169a3f39ce77e50a6a71bf5ad4c9454219cb57f2cb0333f7ccdf1cc9350e56004fa10e0ada3e4

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
152KB

MD5
164d636aab716ea43aff13479d308bb0

SHA1
e326c23aedab6d189a46366c57eb59125e722d20

SHA256
f96f478cd711c7a2cdf1c8d467485c590e396083032739257d55bb2eafc8878e

SHA512
fd6981444b583a7a9ff10756d2a83786cdf9bda586ce1b44a16a8eac04c7af41db0865b84bb3133c602e8a27ee9cdc446c42cd2cfe22a5d5eae94f7707dc9788

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
151KB

MD5
60c9253d8763ca6807bac47b94f66389

SHA1
eed480f19933dfc7d88de21a5150fa1504cfa97d

SHA256
7c98ed429a90a8af97c0957898b473a172fb09c0aee04ef416da98bdf610f79c

SHA512
f59003dd4add125a5376fb03998370f4c7a5ca02a072b11870894cfd01e3f2df2d2f7411443ea069903001bf12138759af6a75d74e1ff9848422f509907bf669

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
159KB

MD5
46148076c2463c272d9d3ae264578616

SHA1
4f6a9b7d6e408f676ec0c8e121a391a9fe8bf900

SHA256
15684884531d487648597428363d94c95a122e637dd736942a69132abf3c5a14

SHA512
d59c519ec83ccee893549e46af1caa14a9caad4d9c2b7075cbaf8c2e815a9f04cacf30abcb131d3bc7cebdc094e7e1710563cdfc45a564ed3d1f963cf4f23ca2

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
155KB

MD5
adb78557952c839f0307002bbde0fd84

SHA1
43e4361f2a66c9b72272bbd555cdd2345917b924

SHA256
64caf73320079b04367bd4ade509d6a8acc1de630b2ecb759b8db26d69145842

SHA512
e910dee3c6c300f78e5b76d2b0832ed716733b8d820b81b168faa33aa75ad6037d1b142ca18214258ebd81563de4a129e414a16b36b00007e5d63d58bf7ac5eb

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
159KB

MD5
873c76e31068ce5689be32d787fc8094

SHA1
20237a7818bcfd0e0bc03048f9c3cfb82501fe95

SHA256
31d2f118fd33f72662f732e922d8bbe47bc58221dffa7089c9c183408a8cb4dc

SHA512
c394b131a4e0092af76a3524ab8f92f652177811709a01797cabac7065b467302334b7104a4ef193dc005b310ec377aa12f75caff80ddd7ddafa909c5c9afa5d

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
151KB

MD5
e037732047186728fbd0a7787ff3d719

SHA1
2a8668c98cafed39a91bf811b15aad16e36ae734

SHA256
fdaa0a2e900d7e91bbeeea58a72a80c22a5a8d24af48e3af8e28b22f0fb1dad2

SHA512
4caf525fa7ea67a82f907873d14822ea0b3c5fd4e0d4b39b470d52125ceb24dc34a944d8b815395ef2c83fe47167919b843a0845d2c3cf1090312068ef82760b

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
155KB

MD5
cb6c0c5befbe9b90388b3774734093d3

SHA1
47a4163b3159d520eb6d47a73b0fe07725056360

SHA256
a040f6e6ef4897ba435cb8aebc4946adb9d430357154868ee55e3898c00d4032

SHA512
d8cbbc6867f9ba3ffb3f75ccee1ebebdaf2e8ea60488079575710447ef4789c5954a2b55c9dc4214a92e6195eb4e0a4ba3af0c8924a390365c77f09b6da90ae0

Download Submit
C:\Program Files\7-Zip\Lang\id.txt.tmp

Filesize
150KB

MD5
545529b3cc755358ef27d78f50299da1

SHA1
bfa8a0f6769b4361dfe69f4ddd1c5a85c8208d5a

SHA256
074c7f979dbc90771bdafacd8679d06da68957c6f2f73520112dd08d79b62dec

SHA512
44fb329ab63ac10945b018611786406c5a1c2e8821a080ac009d54a8bb3f249facd98a102cccf0619e9a8563a9181580434a356eef04ddfff65e5300dcc29b4f

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
152KB

MD5
b2f3f238b20ccadea3e8f88b33c48842

SHA1
8efb42cbf690b585e9559507788e6f8379b78b2b

SHA256
6bc931750016f5174f1dd05127a0fa0242ad36865c32edd434f83ab85c9ac815

SHA512
986cc4007b412fa94c7ac58df40bd77bf0205b628412fe243b4b72d4ea0ef60d78c2f492036b38f7b9508175153a5dbd8296dbb10bb27b5ec670c4f600c50e9d

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
153KB

MD5
f0ff0d027cc21b72dfe1c0484b60883e

SHA1
24345fa08f206a46051d57ff2d631cb73da8fec0

SHA256
6d0e7cee5c3df9f26fc4c734933d9446e9d9c6f7418213dd43290773f57d7469

SHA512
1fb3496264e3d5591f86d9382a2aaf44fd3b2c480666f550709fd6a1d1ffe51fc4b42b49fbf9bc9e65e558f2ee50a69d87eeb81e0a4764386dbb814347b849b2

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
153KB

MD5
5cff209fab08501eaaa15f96513c04fb

SHA1
68dfee329a8af8448763bc67d423d822664fec60

SHA256
86e093ac86d58e5dd9d696cfa8249fd9798fdf0f7ec5ebd27ed8c54e1b9bbcd4

SHA512
34a1715fcf62a070424a789f76e27141a4690c582cb8ff509efae203c7cb1317598f6af37f9cb6ded99efe785c75d25c918767b0f10612c762d3b63dd67538c0

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
151KB

MD5
64999842b830e5fa27f42227f117a2cb

SHA1
e27cc63a8f003db5ecedc21f372da35168095481

SHA256
2ffd3cecc9ee675821ced03f62accabfcfab4a3a4c5ddfb2708833cced752336

SHA512
06eb15fdad6c41ee3e67013c3a558892796a887517d380bcbdbfd755d45528c800ae57725e0498ea6b1b4c4040a89a23105dcd83fe74f37f5afcfc440c48e4a2

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
152KB

MD5
eb553c169f621d61d4313fae1fc5cac7

SHA1
b5286f8cb2d3d0a7198a635709f11a43ff081cce

SHA256
d86d27d59d251f144eba325d19a7d708cffb82621a9a0ab74e2f4b33beaef541

SHA512
0efdf4399b04a760f440463d5b7bdb7ae9d91f1d6fce7613a58d30c39141a792ec4f7e5813f86b782749b751d395b4205d6f50d7f300dd5d769adc88d77bc24a

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
153KB

MD5
730f8ce8bdf3a201407baaa2680ac85a

SHA1
b2d6eb8cceefff51fb5b959d6e01d4c5d3ed7cd3

SHA256
c8c0b12d79c3719970a4ae2101c26c68ef509b8dcad91c52b6df799cbb5c7122

SHA512
8941e434e8a5df59233e858f886925d6cf7ea608e1650cfa4eb8242f941f1131ae5e52559e2e62e0dcfaecdade79288e464bc42479c84b3204da42bddae29951

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
155KB

MD5
18b268473295702184c826241f4232af

SHA1
557cde7c753ce53db49a76616f07cc55872c11c2

SHA256
d97bf080c267284c5d80befd5199fa215553de13a8dab1f23bc3e9500a72fece

SHA512
31c65ac63d80cea237f2b4ca82114326ff39ea9fe0ab3d87aa44a69381f0b97e0fee06ca8eaf92cc17b50a7eb46e09f80264f97a598ea01d60f09ca574f0d0cd

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
161KB

MD5
6cb7fbb7f698918f87c39c4c6a9d6cfb

SHA1
eab43b5435b97f215998dc55a9765952c7be08ab

SHA256
f50242f52cf8e44d8b6336807143ecee13f097ecc588a382d1dd5cad8e3ff320

SHA512
5d4a618faaf85561f0ed3c7e64190fadd480d9f353482451edf67d089b89b4e89f99f64021e77c949f439bf2b5455cf10d6472a61ece6aef22e65eb21cd5ec30

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
162KB

MD5
addc300bcd877eb98316f2208a1fd15f

SHA1
17abe43fd72cbe5addae9e6774335a57e35024c7

SHA256
b90cccf6dabbaac346e2d4b821b35eb4a49fce8747cd50ddd6d79b311234e78b

SHA512
714df920e8b548634fbeff2a28aa50a03d2bf40018d45e3f523ccdd70c550bd7f9a2c88dc8d4e3af6d5dc6ebda74a4763616c6d66436827ffd444dd2ec8d82eb

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
146KB

MD5
763f26a090d1ae44de44d82cf5285bba

SHA1
dc28f9c2b565ebbc3f9d5d553d5e764b6cbd93b5

SHA256
d316caeec7240bbb9c82d394419b42ae15d7941466f7aeb14a7176f8ec5b4a6b

SHA512
9b4d160d9f828b31c9d3da06be51d64f7ab7de9a1fa7de63b112cb441e2eb658bca636e19dfa99f09ebced0e1a74eb4ee9a1b7157e0c8d43b9954951cf483e2d

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
153KB

MD5
1d11b0ee32d6931d69e64c65ebe2c3fc

SHA1
ab4a37b16bc0a9e720c1eb1c8ec4246db0400a7c

SHA256
661b8daa39725749d51ae35c68f03d60009f5bc14d682239d85a257cb9f18121

SHA512
e50ddb9f1f2864b90eedcfa4413fbcdd12e4e08e7b864433f7d8597cc5107953dbad29fba7f28a6058da3638c6f676bea57184171379fc0f7ca8e0c95f501d65

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
151KB

MD5
fdcbc2bdddbf7ba28d722ae9e02e0b6b

SHA1
c9b9004bd27ec72647e5ae1e0124ab17e7c9844f

SHA256
4b7ad4aa26c216385200c5850ce18d00b604498b02d171811e5fdca5e6df4b87

SHA512
ac6f89c2c9857211b7a72d1b1686fb8a15e54a86116a218ec2135adae754e48fab455dd0ef5ce2a11db8f8054eda7d38ae573f593ea00287363b3d9e05530412

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
153KB

MD5
43cc26b4bee4d8a7cd8a21a6042636b9

SHA1
b8e7f7297e65a4bcb193d52acccc1da97e6fe70f

SHA256
cb97604cefb5790f5909080011b15e025a1faa27abbcedc8e9793f9f36774795

SHA512
5360cc9fcd2d236216eb911d64febafd884aefe542f330381d70e96bc2300a8cf076b7523eb598795168d5d35f4982bdaa3909dc22d7d21b98e8adda7112d34f

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
151KB

MD5
b1a839f411e4bf465937a79ae6b39057

SHA1
174cc5f817845d6ef3bc257a564b9f193a55b493

SHA256
c87c2715c6a2c7fd74663d4d357cbea3915c3e19593c41d04395e673dd76e6da

SHA512
6eb9646ade8f747f8575f8a6357d339794b8717a6b4a5a54ba1594f9b90c98fd2ff9b34e51b080a28e190b76980a78b85d17639752113fe7b9a757655adc3d0f

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
158KB

MD5
f8d5c2cf0262a0ffc016ddf6933f2b16

SHA1
51c751572d72ddea350a22494df51f0a97cbfbcf

SHA256
caef5bd2c741b46818e7421236428a0a580912fa595b02171816a5672fe0c96a

SHA512
1afc74decb481421c105ce4ee0d43eb4e3e07e82161f3573b19bbc9ee477f171eb5420b461965d51be84886a7d75fa894fad3bcd492ebca950b997936141afba

Download Submit
C:\Program Files\7-Zip\Lang\sa.txt.tmp

Filesize
160KB

MD5
2184834846c901c59095cff1e95d4b98

SHA1
566806450fb1b9749a9695d38590023bb221b1fb

SHA256
678636db89b54d592346f0245e4f5a848a24cec1a8c4ced66c726694f8a5af95

SHA512
be6b68c0dd40a10773b11101e3941475e92c74157d017f1d97551d4bba4c875dcade8e0977ba9f99264636770566ca5aed5e736d588acea62b5e0c7809721f0c

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
153KB

MD5
e32ae78dcbefe7f5cb85b0ef83b01922

SHA1
7c553855875e1b79d25dc36c50edc9e6ff0cff15

SHA256
f965813a515bf25e5e97961815d63ce752f107049665dc3f7e4cdd149ae356ad

SHA512
8ae900bb834b9e5c3672a35c9715fbcdd844a5c88695c307533f95f89cab3f10001c3f480c2d132d614ece6b02b56b787cbfce2437f9dee255af195c132b1f0e

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
152KB

MD5
f369d2218572b9f19c4bfbb58d3bafd0

SHA1
2ce018475d504a6a9320dc8f5570706dd92e01c2

SHA256
af31ba4379b901d1c5c09ea45223005a8417a92ac09f46c2e3dee4bea271419b

SHA512
4357a1dd4cffcdb2446d04c92599d2330afa3b42d236c310a67d59f1a49e19069e8fc8d0c42c69e1d67d35a38096bea398f57df97830ad2dd016b38679e39acc

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
149KB

MD5
62c6db1930fb2b2aa2601a93892905d9

SHA1
e3f001e56697910ac93b5b3375915c4466035ccd

SHA256
544c3a37d557e830e2c867f127d43d05488183269a701b2373a653f51500e4ba

SHA512
114e18bd0f436969fb280f30c05c2d852d5313cc1d4b8dca81f77a2f757f7ebc6b1212d0a5ea6c3c44a4a7b046bf8bcc31d4e02848d1075fa6b18a4a1a548ec2

Download Submit
C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

Filesize
148KB

MD5
472b304c9cd0f4f454e7abafe324be36

SHA1
816dad199757701469ab7d5c6e55d1d806ee0642

SHA256
f2ab9d93247fdbd71c95e68b57f33c10177ea41ad3c73f7cb19cf91910c50360

SHA512
b436cf94235c9f5f790e84362a33453bf8f81aa262c6735a2f470f99b1444f374a644c1570885a66f9d7f7ef89cad415f0b882e835052809587bad4173ea9dc2

Download Submit
C:\Program Files\7-Zip\Lang\sv.txt.tmp

Filesize
152KB

MD5
c39b676bd5a921bf567716703deaa048

SHA1
802c9e1d57249735d392e4a608bda91210849e48

SHA256
fe1133aa004e25aa6b0bcb6a48f2a2a9c5321d8e060b765de46896155d49d73e

SHA512
4e6bbd382eeec9ce3dfccee57834b7116e52f1cf7fc7217bd304f56e3517961b015c1dc2de763c72bd6d031d9aa6f2e2f5b52a87485824710c23f3b3f8afd8f8

Download Submit
C:\Program Files\7-Zip\Lang\sw.txt.tmp

Filesize
140KB

MD5
98e68a052dc8fcce00d916b9ae88300d

SHA1
9ff966ede70c7c8e0d359a6a1a1eb2c67d39be7a

SHA256
7486fbd5742032169914c516ac15da0d506f1bb27e718b423f864a1bf6e6e292

SHA512
2a190c8a3329c95890a8590075186f92d6943855889714dd3751dcbf570cdce00f752b455573d216b83e849d089550a771caa7c98f2ef0a951dcb764254fea71

Download Submit
C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp

Filesize
151KB

MD5
232354dfdf549c7b7d4f1e08eefe9b7a

SHA1
69d9712da35f1f476d8716b5ec2f6efd24c8a25f

SHA256
80c906e4cad422df9d3897237ccd130ede6477fde7a115708a51699ddeb418e3

SHA512
2dc29c31e65bcbf960d2b46c9c4809ef0479aa4dfa4f2c90f3e53209aa06cefe170c80dcc1c8c194917a592f62cffb77e160edb17eeba2850b2e99a61946b716

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Performance Monitor.lnk.exe

Filesize
143KB

MD5
1ef757da0b98048e87b4535c174e6950

SHA1
a4addbb9f772e272a5c9d0a91acc5539ddc1a26d

SHA256
5039e4e0ff0d5a309d56dc7e45c9f85147f69aa8f53871066f1ff6919c8f60cb

SHA512
67d026553b9c39dcb1589723de9caf4db05a604f696568f54acf6d385c05c4b3d42a91fd7411c4a2e9828ae08b1fb8dd52867b2d14f65881b4ac2d3acbec11ae

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
141KB

MD5
4be093efe71c48e69e21adb42c03651f

SHA1
000ea7ffae174e0653844444215d2ea686b3dde8

SHA256
e8552387da67d42a28ca99d6becb5ea70e74a831df7d5bbbb644c72c3f2ad919

SHA512
2b6c2fb155b76ca61aa9b429a27dee42174d53227586153f157d954ab3007d01c9b213bdb0caa6ac66142f0024e0ca89245aacd272f3efbc2b5f455bbe326a89

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads