3f8a008edf3db3dbcf44805d4bed85e9cb3e32d4da6a25a6c8a56b5b3b5b4684

Analysis

max time kernel
150s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3f8a008edf3db3dbcf44805d4bed85e9cb3e32d4da6a25a6c8a56b5b3b5b4684_NeikiAnalytics.exe
Size

187KB
MD5

7a6b7cbf9e111512cf537e2b7e97dd90
SHA1

c63053ca2cccd139679f2002ebe5c68b8fc3b9f1
SHA256

3f8a008edf3db3dbcf44805d4bed85e9cb3e32d4da6a25a6c8a56b5b3b5b4684
SHA512

8d919f9cc8099c7c33b0fa1c59e873af8557a9f2b35e684747a961f14ec5f0403e26b8a72a1786e50f0f449681d0ecd3609eeb81a51eb5bb00f6668985875ca3
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBX:PqFF2Ie+eFmqFF2Ie+eFz

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5067) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2484	Zombie.exe
2672	_System Information.lnk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	3f8a008edf3db3dbcf44805d4bed85e9cb3e32d4da6a25a6c8a56b5b3b5b4684_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	3f8a008edf3db3dbcf44805d4bed85e9cb3e32d4da6a25a6c8a56b5b3b5b4684_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	_System Information.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	_System Information.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms.tmp	_System Information.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	_System Information.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp	_System Information.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	_System Information.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_ES.LEX.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp	_System Information.lnk.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\nacl_irt_x86_64.nexe.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp	_System Information.lnk.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp	_System Information.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms.tmp	_System Information.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.tmp	_System Information.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV.tmp	Zombie.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt.tmp	_System Information.lnk.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Orange.xml.tmp	_System Information.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	_System Information.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\EXPLODE.WAV.tmp	_System Information.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.tmp	_System Information.lnk.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	_System Information.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp	_System Information.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Json.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.tmp	_System Information.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms.tmp	_System Information.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	_System Information.lnk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp	_System Information.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp	_System Information.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp	_System Information.lnk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pl.pak.tmp	_System Information.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\PGOMESSAGES.XML.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.CSharp.dll.tmp	_System Information.lnk.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML.tmp	_System Information.lnk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp	_System Information.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationCore.resources.dll.tmp	_System Information.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml.tmp	_System Information.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp	_System Information.lnk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	_System Information.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp	_System Information.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp	_System Information.lnk.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp	_System Information.lnk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 2484	3412	3f8a008edf3db3dbcf44805d4bed85e9cb3e32d4da6a25a6c8a56b5b3b5b4684_NeikiAnalytics.exe	81
PID 3412 wrote to memory of 2484	3412	3f8a008edf3db3dbcf44805d4bed85e9cb3e32d4da6a25a6c8a56b5b3b5b4684_NeikiAnalytics.exe	81
PID 3412 wrote to memory of 2484	3412	3f8a008edf3db3dbcf44805d4bed85e9cb3e32d4da6a25a6c8a56b5b3b5b4684_NeikiAnalytics.exe	81
PID 3412 wrote to memory of 2672	3412	3f8a008edf3db3dbcf44805d4bed85e9cb3e32d4da6a25a6c8a56b5b3b5b4684_NeikiAnalytics.exe	82
PID 3412 wrote to memory of 2672	3412	3f8a008edf3db3dbcf44805d4bed85e9cb3e32d4da6a25a6c8a56b5b3b5b4684_NeikiAnalytics.exe	82
PID 3412 wrote to memory of 2672	3412	3f8a008edf3db3dbcf44805d4bed85e9cb3e32d4da6a25a6c8a56b5b3b5b4684_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\3f8a008edf3db3dbcf44805d4bed85e9cb3e32d4da6a25a6c8a56b5b3b5b4684_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3f8a008edf3db3dbcf44805d4bed85e9cb3e32d4da6a25a6c8a56b5b3b5b4684_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2484
- C:\Users\Admin\AppData\Local\Temp\_System Information.lnk.exe
  "_System Information.lnk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
95KB

MD5
b28523ad5d67650cb071375dd1b9fb8b

SHA1
9c2fc388c2a289193e93a6c3fe6105acd2800d70

SHA256
ecc9945e319b20a3cf0bb75c7207c086683a730da2924c2da32d78db00038247

SHA512
57ff039b574ddd321aad40177e08fed2fe7f4b214c5e1b2a0c9fa7a10cf79fe2bd83e3e9e5509f09c964551d59d6eab20e28ab91b46b335676a0ddfd2236061a

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
207KB

MD5
ae1fd2335f8a16585218a4a49609463e

SHA1
7eae04a25f547320930f2eee21de91b450e26a2e

SHA256
798bc7b5854755e31627c2d5778e9f2b1e3a31df96e93997a970f71f7bf04039

SHA512
3372101ad9c5c70b8947501fab5909aa9d1193246dad64c3e5ea73499318943991fa000376d146a258b15b51164d0357581bf9e9c19a38a0618c7f67d31e3a11

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
194KB

MD5
cad0df12369801cff08c6ca51bbeff78

SHA1
8b7f094b1d8ddcef2d063e1e91f2b57e499fe2cf

SHA256
fe0e54f81a42277975cd8414e2a655c9da8a8a4f822d734798190bea47734aad

SHA512
91e42e23f09e62d4d6ba141d65b1b801b67bd505eff98047ca452ce280f54034f4a863a5c566c79906fa312a14ada846aa992414e5d63ebd7a4b213026f03a6b

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.tmp

Filesize
160KB

MD5
81deef99e2abfd55088c13d18479b0be

SHA1
4a8beec27b78c5f45294e870cfd7f6ce45e62ae2

SHA256
ba1985bfd776a2f8cd033e14048856f566ab9f1c4b6a932677e77d2b684c0316

SHA512
a3f8749dd969a83936df16acb06e31c79e203171eec21fa2d406aa01ad76401e3e615e12792c574723eec94e93f8d43ad0304ddbae0fc06a59500f32a2a93dd1

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
01ace2c86fea959988ccdabe14afcf29

SHA1
a64b97a5109a062903b6f0631e8bb5aa6b089f1c

SHA256
4367012253a6253202aa9124b5232c755fcccf0df578d63ea9d0734720c369cf

SHA512
8d084a60bb780e217667aba255bd97e6b14cf30d766a07b3957a255e7a0d982f1ecff8e4451889c5a0df01cee77f31eb5e8b34daf45a623493bc337c4d8bc054

Download Submit
C:\Program Files\7-Zip\7z.exe.tmp

Filesize
639KB

MD5
8adb999cfc8dfe8098daafd0707c7ec3

SHA1
de56b034792610c97bd5b13a9d63125f08bbccc9

SHA256
a6503a066b5b2d6efcac3991cf866fb0f255f63daac1b34539173343f002bda9

SHA512
b69cc00defdd97df27160905dc54ea8fa17e8c807232acaa1c65114855d800e410219d3564f4cd1d4d791e73f8c089bdd96c2e7739acea2b032b24f90ffc08a1

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
1.0MB

MD5
b3ec08a00de5bb79175c0d39fe5e058f

SHA1
a1bc2b68f19f1be897a812825d3add5bbd0a4e21

SHA256
47f14e3433252e638dddd046308d03b629013342c71b9f53979d990d9b82f8db

SHA512
3277e2cefa4dabfcd9828ea17c9ad4bfecd1653f3efd6ace46219de422593d4c5e2f2e6ca6abb2b9c8f912cbcce112b9b1e081c3f69c60d10b02b9f2cbdb3451

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
779KB

MD5
7ee023b06434ad6fbab7c491040122d8

SHA1
bf5b8d7926328e2cbe2169d0b2dae52d64f516fc

SHA256
c431353a1b34366de1929dfcc1256645a055a7be54a0116e2ab5c64e8c892ba8

SHA512
6ea5cdeccc12a8d53a63cf6915245f8f62b2090eae3686f3e9185629bc98b9331d77706303da434330a9fc891397d53d54cf90a9c92a18d3f9417be7ffb87fd0

Download Submit
C:\Program Files\7-Zip\History.txt.tmp

Filesize
152KB

MD5
a35fff9cd866b88d1874f0ac157a724b

SHA1
2a20ce406e0e86b20680b22f714958dc03e63933

SHA256
f06e78b91892db7eea940506308d3b6f5ccb18e9e144dab7a54a121ab26823c2

SHA512
604bd37ab1dbf1a9301e437b46a90ec477f1e3011be33f360bb28b8f977f8f4899ab80c8ca59e61efc33ed7382f5ee490b10eaf679f2c34a73a26d92a8511417

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
104KB

MD5
771a548d96049522c342c200863b47c9

SHA1
fc31bc72da355c55d181b2bc87de1c1b7a1d6fba

SHA256
3d8fcf544af76288c3395db058508bc031d4e8e3cbe95d70abd59b387c197ba9

SHA512
36ac6ef02c8b0c768e54482581c86c1cb7d22ef258891f4dbb07d659eb9039f2a86b3c81590ffef01eebc3ec31e92420f10ef806367eaaf1aa3ad7c11ed249f8

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
102KB

MD5
23b674e3fab407ec4a8ed21fe449e37c

SHA1
9bff0312beaf1ed0a4fb8ff939f11cfd93ceb825

SHA256
55aa11860b01517a3364e8b525ae6e08024a25c99256ba8ece9ffdb170b3bddc

SHA512
ae0106f7ee0bc1511b8c9c19e7a0e078399dba0f7ac32a774d9ec976c5b4b064469140fed9c6149fef2b70b1d4b85e3ba979632cd5eedbd1be1732de7d53c0b4

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt.exe

Filesize
107KB

MD5
c82804f52be40f36e9429db4fa025879

SHA1
653cdc935020878cd7471c9790a17018fb34c810

SHA256
aa33e1d2f453094f59d956d6175ceb078b69a20375d62378c315da10b8e2c3ad

SHA512
ab38a215e2f155fec6fd76bedc3234bc33e85f90da64aad39c2c0905fda0f599ee60f06466d721fe3bbafd17a7fa44ddee4da49139d583f8428fad5450ff262d

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
104KB

MD5
8eb0918757b4291aa498d37321156227

SHA1
32025b48a8a740ec68f770f60a679d0383b5c4d8

SHA256
5fd45977e7bed2234d1bb7d01e0da6fcda73f64f1c17c54b99a2346f50666209

SHA512
676531e1bf6b9cd863b8fd38c255acc04924f3ac5604598fdccf69f5e87d357dba3dafbde394ed6b9b84f7e706e7028ad103f81e7bc853d84fcf8855174dde9c

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
105KB

MD5
957372aec13653bd00dc366dcc6c2114

SHA1
30c43865afbe6959708f7c4999e0722bc68e771d

SHA256
035ac141d68a282accf5638ff4f687945198be75da2c5c02f74c647877f444ee

SHA512
fc86374b53f0f21c0cddf3721abe29e8f35745f7e10b156723bea317923167011ed52ba147647fb963578ab436f0c467ae80595a42bf14a3e49f149c5285876d

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
100KB

MD5
f76f37b0a0214e202b0b75e8b8eed251

SHA1
52b2dad0af950eb04793ccf45e9b1c1ad72792df

SHA256
665e3d2670062721914396a21a05515c13c62ecab3c288f723936b881c973c4f

SHA512
d18fa8ed837cbd00ea9a5b05328ac23414608db30c3062748b17907b5f35d4fc7861c70e9ff0a52ad0494da31a364957e37402aded268f295373398f0a44bd6b

Download Submit
C:\Program Files\7-Zip\Lang\da.txt.tmp

Filesize
103KB

MD5
b64e66b4b9612038fb6acd33e159d633

SHA1
756a3bc1f547aaff2afa2cece018a6692beae10d

SHA256
cc91d8064788f3f0d8ce29cf2a47d0d94bce2aee6c487be3a65fb6fe6fec0532

SHA512
68ecdd53af14f79d00ba1c624e3938afb7c5ffe6316bb0f238f02785d9ed674bfb33a37629dcda35eb9376fec8d83a1890b0bdfaf83594c134d687db4790d537

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
104KB

MD5
3575a4287df4fa5607744b044fd4fbf6

SHA1
c917c2abc988ae593b07611f0c4bcc5b1868c3d2

SHA256
c4fcf115a82ab851067480b58597f3dbf9bb4eb69484dee6fafc5fd2afe156aa

SHA512
afdd3b2376c4b2dc703c54bf70f76ec482e79fd89551c3a73a45bd7622c630d918562a42df93db2ea819c3aac868cdd73943136486247223b742aa24bf992634

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
111KB

MD5
1088c3697ce07929b110e37f66707345

SHA1
7fb7f27ce3a0c749c9048b2393a0ad9a5e24be59

SHA256
f1afe674586d0ee5ef293f9ebe17e8eddb243ba9cc26d75950a5c9ae0d79fec1

SHA512
faa479e542da54085cb1484941005537bd07c9faddc38a98b04ab4fe561240dfd141701ddf55dff1e76bbf472ad08cdc645ffc3e3149bea2195596232730132a

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
102KB

MD5
3ad52186b249ed9670e2075100c4eb2e

SHA1
16bdcc5e97efc38eb6a880bc5edd2c7337b06736

SHA256
1ce5b18f413a21f69a112db4695bdae5e3f0d64aa1226f932512dfd0c9f2fe1c

SHA512
861bea4d4d8304a68dc9ab69074efa05b056661b7eeb2612ce7172e1bd4f528a4465a6d5723bad01762706359afda5f9c828e67de29e30340e94b3701825ade0

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
100KB

MD5
a0cd9363de9761fcf4e09302db079f53

SHA1
def98b44e82f578fed021f54425b53565e9169b8

SHA256
2e20007a7c9a483dc0d5d17385358206507a96f292c9dbf2b7c1ffbadd28ee5d

SHA512
f76345d4c1395012ae349564f355caa66e883f00d9a54caf8494c51d39cc34b7a02a09af8a85a0381f3111c87c65f0bcf2adcc8ef2fb9e757b2506ac4c62c8fa

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
104KB

MD5
8018c910a751d58adcdf39d7b1d3351f

SHA1
f7a55cdb988e2e920f3daaaf31aae39650565c47

SHA256
5283c652486ff311bf9cbc7616a2269b6af346581dfe9f3e9c006d76ad8c2578

SHA512
ca1162c8c39895c1513dd3d2fc92b65ddebd84b0fb8404487365f5223ce1dcd8efb1b4cc03c2ac77dbd2276bbcf4fc02151143ee349b5fe9fa3dbedb596ed072

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
101KB

MD5
9e41073b12ad80d2c0bc3e6d4a8c53d6

SHA1
3d5518d01c62e054de4284b000429eed056f3202

SHA256
ed6547f26a4397fbbd6599905a08a5764f788990145b9f430095e4ac1db7599d

SHA512
d750e9f30f9a35ca119bfe7e6911ce7eb97b361c52b43193eb9a184b388eb99cc9c12b4fca0d4000e3f6424f7b41e61486774f86bb13cecf5773a5bbfdab8b3c

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
101KB

MD5
67dadeeeae655cc72a2ea9d6c5bcd7f3

SHA1
2c389ed796254091be59bc36b314d2dea8bce173

SHA256
4bc64ce5526eb00a5fe0cd0543e1d2d07043a5828def89c15c4ac58ce1129d8d

SHA512
12c357f3a671700647bfeb177cf8815b3199aa080fb12dfae1017a7812543a29b81c2e6a1f0460ede7295ba881a0594379ce36fe0d25439116d371671dfa469b

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
100KB

MD5
d85d240de6f6bf52e417830461c083f9

SHA1
6724c10f17dd4959b53e59ccf9bf7541ae1c516a

SHA256
ad1e4483a3b22a3b8281c2844419549d028d36b03f6b3fc3dec6e30d0ccdfb2a

SHA512
e628f6edd8132ea4646ce4121f126f0835b2ca9811dec6dfc5a330a899b226451db6697722019b8e3407ca3d907854acb173960a094b850460f401214094e3ab

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
100KB

MD5
bdf9f2aa67e5be2b3fc7b003abf2c2ca

SHA1
565d3a8755130aca541d0314f36123ac89982aa9

SHA256
e8dedf87834fbd103209112995631e20092787d58e2942419ca22e298c0e619f

SHA512
d313ca43d74e3d571b9aa314d49cc86a261177c8ddda749e88e8e2db8e66f3d0766cef0587e1b37740ffbf276a9dd125fb4c3672684992addd2408a22330b59f

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
100KB

MD5
cb1c1df7a8cb112780569e0fd114f1ca

SHA1
25ea98323ccb512c699996f87e3f767c485eb9ff

SHA256
86d7f50fd0fa0b9d11eaa8695c302dae253b7129813163468e87bf8a1f4e10d2

SHA512
4f77a52bcc312be3f75740db74a3bffd4efc6677ace81d8661a2e95c8827d55d0fb1948d7d53efdf37bf0595fc11cd944d88375ac5fd33c60c1791e2d4dc6f76

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
106KB

MD5
a3bc0d294493ec6e38383e6c2022b3a0

SHA1
a052e5f49c7ab4a841eb1ff91bf261d95686d103

SHA256
753cdb7f08c7278fdfa7a764f449f79efd6ed78a8180f5e17b4753ffc9efe96a

SHA512
b283c4a8a4ec531d5aa44c6f8f8fd4c49e91fba75b6290dbfb714f94b06754f150dac611fdb44d1f8c36ccbc9172580d636e900980046bc6fb164bc03e428715

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
112KB

MD5
afefc33294fdfe8028394540fa6ff86b

SHA1
2e668cec682e0614c942c7b21dfd35801c81e6af

SHA256
004d6e715cd3ac7cd097128d3e35972a704edff31720684e9c19959b7930c3c9

SHA512
f27a24e1c2d4196134011af244c80a6b04657d55e2281a882a662915b64a24e9fae5ece742de073b8992076d1b5b8b8978ed9f6887db604408e8a31657d2d350

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
103KB

MD5
ab189b3ceb75ccd18e333f731a9656b2

SHA1
fac260470e8fccc8bd1cfb0fb1d0306a40f3e444

SHA256
d33e7cfc8e682d41274d0ee1fd700fe8111484b4df8fcc33ce5cc65dad6278e7

SHA512
e1a96944f5609345545033f3438c28786ce2f1d51e1428dad3805e1066c60266d98aed8da798f8ce212e43b4dabddb4feb49b44369aa8057e3173d5fae6fa272

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
105KB

MD5
4bcfcef9ddea635f6698bbfa25a06d5e

SHA1
2b794eeaa2adf542179598d2d272b3a7af7e4231

SHA256
38e121989f413f9633a63e3c9c9bd48bda9130db7ce9476354532e435ba66240

SHA512
4aae7688c33ebcb3fa86d5fbc5c56544fe9d0ce24499f8311813e5b20355d057ee384822b9857c93c13b0c043ef4b83d184d3476674a37afa4c1f9d47fae7538

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
108KB

MD5
8e77bf6311e584b2692c692243d2740e

SHA1
3b0d0eb97587d06401ddf0f1dd4a620ee3bb9117

SHA256
5513d51b7a8827c785032430585de07323cbf2c39344697008058296e5dc71f5

SHA512
edc7cc5bc8659e2c8029ba4f5ac2d125b855ee37c8537304ead79a896d2e03901e8b6f66aabd6565fb5d7c93ad5b221e1c2d692bdf10e1bfd85aa9191187d966

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
104KB

MD5
caf8b99a27089bb298b2c14449675b67

SHA1
843c5152a951c213949c8e8218109811b58b81cb

SHA256
9eed0d0de3f8634eda6f81513df0804b749415a79ba8970bab20a99383ada2e7

SHA512
f6bd7ec81d5992e69615588e3ea110dbe23f73861641d8b293dc5e62693ecb0c11a29c6a4c6cd4eb32955fbc72d0b221af57850b9c8c0ecbdce99fbc2ce98bc8

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
103KB

MD5
5591a81723b667230a68cd3a4d875cab

SHA1
fc07fb28869db2057a8f76c543426e3481385bf9

SHA256
7a1c5da11ef97de0b9752bb9a3bfa0ab6d2ea558738abe716957f24d86ef11f6

SHA512
f649b99e50867704c745fb6ee6685547975716c7f60cb9de5505b2e285934f276e918ef98d85a83ce0888f2b4459ec1fc3766aa7c9f10de023d8c9a03da1324c

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
104KB

MD5
855d1f823eae964be8ea6444ab3aa296

SHA1
42441bd99aedda95ec815a3c61561f22b14de976

SHA256
c600c2d2550e8d788691a4f2ed39514709707b5f00c9bd185c0fa41bf22ace3b

SHA512
ca05d751d61aa82472fe94d0982acb2dfeb7ed78c136b29a2c709cacce1b9f70af1e01dbddf338f56c5012c3a0307bf858f220c17e64c09919e83020f9909840

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
106KB

MD5
e39e453913326e29bdcbf67159b0497d

SHA1
f830218558554bc0c6ba4097d9a9c16f7f4a0473

SHA256
099412532993626a62a46cf73700047094d94d8b190a1797d22882e3e5780e47

SHA512
4c2544edb499a0fa3f1689358e61d693a5cfeca02f2c17f8cff7691377e573b7ee36de85926f3ec944df4d1aea9c6571d0291bf27f2f502b5f85c658ca2fd18f

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
112KB

MD5
488c775239f6acd398b8bf0514c3b1b0

SHA1
cf8315f9f5bdd0959b5e2139cb21899cf951f843

SHA256
a1b616ca94b8e1b5b7c983d7e8cc402888f5484515ba6494027fac0b6862745a

SHA512
7c6995dc86f9fbefa7191ed391feb9f614b9de7415db1de4f83a915531727beeb5eaffa9dde08c3dc96cac06c338e40d08f8df8877fe446e890538fa9f9d86f9

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
100KB

MD5
1a3ce657836f278f99c354c58a5124c8

SHA1
7aded97c44884d0722d0037c6f367831efff067d

SHA256
721b21bee47742b5e54e376b40bfa1892d330633f22ba8cc5c54b0e7ec29daa7

SHA512
3cb73068e929bdf192e0868c83449ca62d207e399abcf0ee7a9b0a53696c0e6d2bb8fcf8eab56dbe791f8334239ce3e091ce1c555dfa0bc15bbc5b31cbc9d6da

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt.tmp

Filesize
101KB

MD5
19b1e892d71870b4ae2736f1800d2e7c

SHA1
33e602b3f83aa9d5a9881edc8d5c71384c4c2090

SHA256
7814c4df4650ff238744f7215d4f1f9ba384d06cd4ba4f0ea4dffcdaba9a8853

SHA512
ef9102f8f08f97c9bc0e4df7b00f3caa7cc1eacdf5896ba70b675f508c45a5d10ab194efa6f087d172f455823f049b26aea7bdfea8b62dde01bc821bb1e8715c

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
105KB

MD5
59ebc9d9002415493eeade48dbb32784

SHA1
689598f448c258c0cd7d787c2e24c2fa8355ae61

SHA256
1a0fe4f709f5b491f393d5bca24c6344c4c0dda587add5b4bb1fb3647da462cd

SHA512
26d765a8485f616faac98d5cf8e5b8d977d8ac1abd2123c5eb35616f52f96e05a582058a526ffb95a11fbe2501a72e71a761080dc53161ce7eb9bf3b96b1a57a

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
105KB

MD5
ba17b71be12295d8c3aa29f109cb7c10

SHA1
b9873d45b43ebfc38b7d7114b2ae8ce35b8bc5b7

SHA256
a7350493d3fe22b0396ed542b30871adf7dbbb3ce6d0ef5736c717bf2551a0d8

SHA512
5e159c37460091b32fbcefd72e99165079d10a9b95fae1d12e50dfb6a850ffe6a5e1b4f6c7c49abc8de930e871ce222f611a27b81660099c59ccba7c51cdf864

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
107KB

MD5
7518651d35d441b9c301d3608e1f54a7

SHA1
506a57d5771f838788c3434aa3a81be19cba44d8

SHA256
b626b35530a501aac506b3387fa066590db180dedc4709b893288413cc0070ea

SHA512
49fe3549df9c3b30771bad901294c8a8a2155e1239eaa89d23efd2a22d6c0ac8a1bd749d6c1397b8ee2cff9f25fe9ead1bce11b6743baef62907b644b0ba2394

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
107KB

MD5
d87a36ffb9820e0bf09f46eb8d3a1b9d

SHA1
65ab75db25882e9108ff3f4e998b029f1e4319fb

SHA256
ab5b3e8ed75fa4264568f61eb984e5431dc8847725ff7e3cee5c52e0907f729b

SHA512
3abab27859359cd6b87ead31b5aa1d2ff7667b86db49d80e0e782c083efddefff2c8f75414337e37f1e714ca6e73cc41376dea46cd51abda576facfda9b0b8fd

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
100KB

MD5
1c2ca4aa1c091f93035620e23fdbb079

SHA1
48b081bbb90d6c22031dac42c3a8bbf963d1f2cc

SHA256
243568960cbb4ebda07c2fbe4de73e5a29a76aab8b9330befe3ef69910b2d2e6

SHA512
e69c2c046d7832ca24e730398ea95e65424e9c7dc2dcdad65a6c96044fb93aa096a15f122e3ba9077e590dc0a4c54c66139f1374398c328b57fa1f70bc8d556c

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
104KB

MD5
d78bba5d665b733601fa384571030f6f

SHA1
02021c2fa5cc1d33b5ee66c200556218b902f75d

SHA256
196074fe1a1a7110210e3c903a669eda3d848970e1148d756f555cd7a68aa410

SHA512
d51d84f2cdf2314f0d36a16490473439e3e657c1d48066963f28642889824513ecc69cb43c17c7ee36dab69ae061f2e481eb2073928c2c70be20ef77cde93160

Download Submit
C:\Program Files\7-Zip\Lang\lv.txt.tmp

Filesize
98KB

MD5
2ea44683c596915f61637d6de30521e0

SHA1
3903eb7bb1464523227d8f5a1b461c08df523d60

SHA256
016b007e30f6539bcfd47fc57f23c0d9b380d75f4787d5f2efca372732075592

SHA512
cede11567fe8ff7cbf439b1619c4411ec88246070cef1bfd84b7aa9027a7aa4e99a75b56b58c29bf4a82fe60bd751ab9b9c74156fbe8cdbb3d814edb2a5d2670

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
103KB

MD5
84d48ff98df87c99c35d00baf4d5d341

SHA1
0d7e75d964a3a46625074b04f3b5e7754ca92a55

SHA256
129effc2a674a866a727b531ae65a09974bb5c0a3ef3204786f9a57e21c40cd7

SHA512
2ebdf7fbf2cfd26c3e9d1e9e171259f0dc2f86719264b7201ffb01e68a833d57e4fc00a2abab9879e07d886506a6033a4f3f5ae8051268e1017fde35e595eced

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
114KB

MD5
4c7365ac5e0041854fab3092dd3f8c93

SHA1
eadfbd86614613b9253ec787ef0981e1cf518e39

SHA256
66bb43e349ad61b3f82051403170f493e00433d1e4d8d6c44255b6a504307e03

SHA512
cfbb8f70b3ce28d72147dfe22ab5467b84336a5802bfc3d8adc83eb9a5ce80cf20878e93f6865bb29274946f8727934f7af7bc02c7287bba9842a4a21e56e8f5

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
116KB

MD5
3b1fc89be95f4bc554e06173d24cd636

SHA1
9b23ca98bfe96c2c7dbbe445b41bcddebb5ee8de

SHA256
346f42bf5700b19fa89029f0b0dac6d7205f732e0a84c7274514ea975aa5666a

SHA512
3d9adfe6f84c5327e708a404e735f8dad406a0be94f6783a9d2c72fc7e23d63c81000d1f144ad39c2792ac7ab9744f08a7333f2c12f5ccd4ec57796999aa2977

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
105KB

MD5
b0187162263424921815d5db16d89e7c

SHA1
023b9642480db71076d44bc0bcd29875e47301c9

SHA256
076fb8bcbfee7c4729489428c411624a9e51d4b47ac22da0c48190a93a9e2a72

SHA512
8dbcbcc313197ac4f9f8485ec1c9099450c8f70c6002df33f2490f6a13599676ae0992aebbcfb0d87a0ba894bca1688020d9429fc9e391457cb52df72807b41c

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
100KB

MD5
9d53593f24cdda6f7606bde4913ee298

SHA1
a4d22188472a48fbef8a499deca8229c8dc12e7d

SHA256
b41fd76ae8e20da2f3053b6ac3139c754f613b3620a649d66c670d35ad888409

SHA512
70a04ab541e7b5a4180abee1eac4b9a6abed37d3c64597a1544ddc66c09e131787215dd0a5d8238e357433388252eb6af9ac27894ec229dc151a752ac1f7fb63

Download Submit
C:\Program Files\7-Zip\Lang\ne.txt.tmp

Filesize
108KB

MD5
06215b28b8f5166c346d6a55bc5d2c5e

SHA1
5661dc49f9a8663cefe1fed2e82cc108bd7bb613

SHA256
f3d0604b7bc9b9db8713daad6f4664d94b98f03768376e9d01efc6c9de1e2f22

SHA512
0fe7adcf635b5b2e998038e7373f4fc3a1ed05ee042301477389d3d744b2527f1db9183ea2099838aa4345090a1bcd09d4919fd58a55b8d63cbc8b6239a5aaff

Download Submit
C:\Program Files\7-Zip\Lang\nl.txt.tmp

Filesize
104KB

MD5
3b093ab69262ca86a78ce631474d1bfb

SHA1
29803d6275c10bbaba2e2d7df0579041c99d3f46

SHA256
8dbef14b747fcba337c9898e5aadf7b0ca760017f58dddfb41e2ec64d891ae67

SHA512
21b252055cca0b911eb843c270eec7359bf81f2d72d7e02f8cb9309aa94583e7fdc875eca1f61d9862c4d1142e6472dadc2b68fffd8d8f79bdaedd37e6e4d9db

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
109KB

MD5
d4223c09e285833d328b54363affbd5d

SHA1
a505a342286451df6976a069e560f73288403224

SHA256
6f436839be9cf2221dd30e1e95256fc97bed56a46d8d49dd5dd9c43e8635188b

SHA512
69fe48834fa6f89355ee6b13d3ba49e7ec760609777a75351a43025df29e187b43370db9e33f438875f82ce52a4d70020f01bce88cbe9f4e48f9a0c681843933

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
102KB

MD5
8e5acb3a3deb0bceb4aaaf99548ca94e

SHA1
2994aa72aa7afec17bb6923ac0a8ec4807c03063

SHA256
57bb7a6ae5df7ff6ae8e3cb2d543dbc20cb0d3a5950c0c004a2b450542551311

SHA512
0e6cbdec7f4cf6c209aec3d50784f87cd9449ae3cdea32821a05af2ec6d58ab097664d3c075bfa4203f5d5582eed4e8dad2e6341cf8062e934812f6b5a7de89e

Download Submit
C:\Program Files\7-Zip\Lang\ps.txt.tmp

Filesize
101KB

MD5
63abd495fa5782c11006d9538e4b0e8d

SHA1
bd8225e527834f0b32d55abe2d10b6ea807468d2

SHA256
8885076009f82ebfdfeae2c69a91c383b64cc2f00e69872603c105086c76e051

SHA512
a26e9590ad4de6d49bb91498299989bf92c356643c3bc729286b4238cc0403f0e00170ea8d748bbdee5015828696f4fad03d409a8909d9e9e7b23869db181f30

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.tmp

Filesize
106KB

MD5
5a484154dc1d313a91b15a8375e00fda

SHA1
13b51605efef1454bcca9ca1c9c22bce77605e4b

SHA256
20d674e0b509418c040e559aebce722ee9955879f55b5b71e5c4df92b411adee

SHA512
21f9587d0eb6f2b873bbd5063cda0ba8ab1ed9d09238468202d4481008ed15b927d66a93d0c01488e8dfad6a8a72998d0139feef45446f86faa7530feab64b29

Download Submit
C:\Users\Admin\AppData\Local\Temp\_System Information.lnk.exe

Filesize
95KB

MD5
9b15c9b33d49e9250623b66747ea0ea7

SHA1
ce95515da315e54d7759650f69ff9e5fa1e7d1f4

SHA256
85855a619fc9e035586cb0a3c1570244f2700103fe3bc2c7edea558cba0f3121

SHA512
b4a396a434282f1b4de7a63895621c02c75fdc76a6c0e7cc582f54b62c116a302fc64c14ffcc8824f85da3c996e24273c5ffc8c1ee9365c5db7bc7c312ec5e51

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
92KB

MD5
4549065f75f2b2e5c379db6603cce465

SHA1
002ead725260e507a8396195e324730df5b2a4de

SHA256
c1115b858e778c5d5da87a6e21922eb7beea7d54830846abee216e702d032311

SHA512
53bfd25350b808dfce1b593db7d827c054902e8e1ff2e838f1b5544391664e07ba477f5b416cd5e52786f49ec9b0c33e037b2e03dfad770ae5b575e005472161

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads