7bfe9ced25e2ffbc994bb866cb0ed756e2350c3f8322609e8ee6defa9e853374

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7bfe9ced25e2ffbc994bb866cb0ed756e2350c3f8322609e8ee6defa9e853374_NeikiAnalytics.exe
Size

118KB
MD5

64026df6943868835112e1cd18e89fb0
SHA1

a4275cae325edbd04296062b275d324bcc84c829
SHA256

7bfe9ced25e2ffbc994bb866cb0ed756e2350c3f8322609e8ee6defa9e853374
SHA512

a796e79ffac27ec26d2dc52ea903508a9b64f02bb1fbae3bff21a085c5641cc1253f5c9cda0f5f784f3d9e87fc11bb7319c7fecc5d266b74fa6422c095298629
SSDEEP

1536:W7ZNLpApCZrt8PWGoPWGANdNO7ZNLpApCZrt8PWGoPWGANdNj2N:6NLWpCZIz8NLWpCZIzZ2N

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5354) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
3940	_.files.exe
4856	Zombie.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	7bfe9ced25e2ffbc994bb866cb0ed756e2350c3f8322609e8ee6defa9e853374_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	7bfe9ced25e2ffbc994bb866cb0ed756e2350c3f8322609e8ee6defa9e853374_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordcnvpxy.cnv.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.exe.tmp	_.files.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	_.files.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL121.XML.tmp	Zombie.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	_.files.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ul-oob.xrm-ms.tmp	_.files.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	_.files.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000050\FA000000050.tmp	_.files.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\resources.pak.tmp	_.files.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.exe.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp	_.files.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.ReportingServices.Diagnostics.dll.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	_.files.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp	_.files.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	_.files.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp	_.files.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3940	4648	7bfe9ced25e2ffbc994bb866cb0ed756e2350c3f8322609e8ee6defa9e853374_NeikiAnalytics.exe	81
PID 4648 wrote to memory of 3940	4648	7bfe9ced25e2ffbc994bb866cb0ed756e2350c3f8322609e8ee6defa9e853374_NeikiAnalytics.exe	81
PID 4648 wrote to memory of 3940	4648	7bfe9ced25e2ffbc994bb866cb0ed756e2350c3f8322609e8ee6defa9e853374_NeikiAnalytics.exe	81
PID 4648 wrote to memory of 4856	4648	7bfe9ced25e2ffbc994bb866cb0ed756e2350c3f8322609e8ee6defa9e853374_NeikiAnalytics.exe	82
PID 4648 wrote to memory of 4856	4648	7bfe9ced25e2ffbc994bb866cb0ed756e2350c3f8322609e8ee6defa9e853374_NeikiAnalytics.exe	82
PID 4648 wrote to memory of 4856	4648	7bfe9ced25e2ffbc994bb866cb0ed756e2350c3f8322609e8ee6defa9e853374_NeikiAnalytics.exe	82

C:\Users\Admin\AppData\Local\Temp\7bfe9ced25e2ffbc994bb866cb0ed756e2350c3f8322609e8ee6defa9e853374_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7bfe9ced25e2ffbc994bb866cb0ed756e2350c3f8322609e8ee6defa9e853374_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\_.files.exe
  "_.files.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:3940
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.exe.tmp

Filesize
118KB

MD5
cd14b6b25c3d0480120e4c59bfd47d80

SHA1
35850c2838f9be9a6b3ded666fc52c554a617b74

SHA256
5f440b23a6777858374794cdf1ae434cfa5cf83bb439961edc865b0d2a024d7c

SHA512
4abfe99f1dbe88ca09a73bcfe416728e8c987eb7c8649a123801761d1f24c601c4598c41e2a73146939e4634ce06539b56471d7b90c90c933e14bf601d0da136

Download Submit
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
60KB

MD5
a7a85a77d3079ec8aa1a88aa98834ba5

SHA1
9962f9eaa4d14f7622d892b9e6ca105aa9bdcf26

SHA256
7d6abef05b6348b9b29fff1b97c807f6a8316e07cad91c35f1bf95497d5b93d5

SHA512
d6d6133231d0f79d325dbec534249c3d097f13c408fd7abc75210ba186ead5b97286e92b7975ea3a85eb284f656f2a96a809149098ed0ea8696bf03e53b39965

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
172KB

MD5
795f77d7102add8534221b0f5a1fa914

SHA1
a35eca9ce00ccee068923eed738b80b55018531f

SHA256
fea8d6b79ebae5a63e136d98262406861a4140acaa83b6dc51301ee6af2d9b53

SHA512
8996c99208e1e1076ea901b836c480ec0f6e099e38d681821b42ed98659b5157efb126c06a2f74a323105e44ca63741cd292fc93153c907c9a864421da4cac1d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
158KB

MD5
b09fa42bb379363e04b0f926298e0068

SHA1
0e782a660caaa737283139f92f850255196b7844

SHA256
f9f3192d714e3795645a6b53550fc8cd7b9c7cd9863cb0f27566ec8e8b8f6160

SHA512
7ea3991928703458730b862c9f9b45c4d23cadf4f3fb98e3985bab665eb0703de6dbad1add83dcfc5e2cdf634f021fe269560e75fed063c8611250329f9544fe

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
980KB

MD5
45d08d65974659104d23cd8fb15bcf56

SHA1
89fd13af5ca394c2de928c5d5a5fbbe689815188

SHA256
c8fc7bebe8d187ab75b058d93aa8882ab2d41c006035edfdbd28c002d3e8ff0f

SHA512
89c2e1fac737c6443f5fcd4161bceba17c94c6a36fffb6d40ad29e78ee334229e54d68dc79b3a4e2f67b8bbee52891e6895d44ab60a07413f4f13db283c87d10

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.8MB

MD5
3cc2c83621193dff1472af1c2d721ccc

SHA1
0c4897827440490ee1ff3724cd8a34c83773273f

SHA256
802fdd8b37409dc1955b496521beda693a9ad7de1f909f818bfa11ee0a9afa8f

SHA512
e16e5fe3daa8b2462446e9da0e6f5593f4331042bfbfc2843fa7abf5385eca460c3efaf68634fcd2f3eb523ab076683d4016b81bea51002c82c4831baa1cde76

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
602KB

MD5
f93b5da2b76ed47d3778ac9bfccdb80e

SHA1
d40fde79fd7585b2523f6298734036c3e93ad825

SHA256
39c2100b44787ba64c96dc21c99cb4c889722311387c9c4057d67f9aecf68265

SHA512
ae9580f07006942018da68c6b43301c72a186fb88bd7cfd75c4044975ff67aa4a96784629db95e0ffb3965339e134477cd2365d1a6a5110de57766bd95804f5b

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
269KB

MD5
7943975d08c3487f1422344a341bf323

SHA1
f238ed203f54833846992ad8238234dfd72cf911

SHA256
d3fc484583576ee8f34b25614588b3024549d2db152c1687c976d13a43a30e08

SHA512
6a96893712e017edb9ea2146483d69ca116a6a3df1b6bd5659156de7b1bac2634afc9e6ceeb873d8ccd9ca526deeabb6c663ff3e346e2db240eab68d0687b7c1

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.tmp

Filesize
248KB

MD5
6f3c1430e54625179f84821eb7613c3f

SHA1
329ee8d65b22c061ebb704cdb1f9a5aebbd7d5f0

SHA256
da54ad6b2349709ac6602a6f568242f7af5d4a7c9206c20a02e603997e4c9381

SHA512
8c3c0fc9ab20aa81ec19ada172b3be5c0a411a63ae8e4a75052e6f6fb5b97d369755b069731ea159cb92a89d227c6607be5b758930ae147d3a1ddf57a124f4dd

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
990KB

MD5
a56853c707c6a785f3305ef612d93f00

SHA1
66440e3ae32c6965b82238a2a05551c89994e9a9

SHA256
40f0781e76a2cac7750e99fc24d672d78e2497a156bf9b9d8b94b5ff47d46505

SHA512
01b175f100ba2dc3837b28cf5d9bcb90e2db9ab933a9405e6f8f062dbfc1608053e1324aa94de7d5da4684b2d01d8aa12557329e967eb6dc30b1b82d2e5eb7ee

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
990KB

MD5
a2749f3589a04cf19de5484de67765d3

SHA1
d4a8af4c43209a1ea30541bfb651decc16c80c29

SHA256
cc3e950566eebff1411830287487f782784c14216b0626ea4732e795041599fa

SHA512
684e9de449ad4c46785760a2a46ba6ccef47c315fc7b2bdce748c569e53c707550dadd7163649c0394b4206aefe905e394e709601e8e9471ee3775b6e078c5ce

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
742KB

MD5
4ab8587de6673f1101613d77c804040d

SHA1
b2fbf761ae89190515ebe0512fe708b5436873cc

SHA256
a45e811118aca315187a2eb999696cfe6537568cc38beec77cee385b5cf0a9ee

SHA512
d4abace6db27994bfd40b4ad638fe102b67c5cddfc957e7efec0f3937ca27729d99da9821b03a74c76593c717d67513701ac6acd36a1afd785e59d3e4f99db8b

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
68KB

MD5
7777707f823920b96819babe1838e82b

SHA1
d08b562edef65ccb49f45aed618b80afcc272eda

SHA256
b283653ea1411dd255086c303ce595719fce1186808de8fc47ea3fba5c3df737

SHA512
330987463fb892217d4802a5e70b2f5c425c64b4d6cf086b7ecfde68a1b34e0ce1daf3060b4c15a0c1d2f026ea1ba42a8f122f5db5f579fcc65eac401d11c3e4

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
66KB

MD5
fa1410fd8225639b3dd299d9f1a5b158

SHA1
984ec392268cd6f59ed7b161ac2053a3d94c066a

SHA256
fc35ef2fbee5ab006942ee892f5897c54a85f70d0c431a3cb518959507d38f85

SHA512
b818ef9ec587a39deb81545e699e23ec80559f555b23cd61491cc42405ff251001be19a7b8b70d1e8855e712a3dc4dd04898387d2b0e77f68c876ac0f802e136

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt.tmp

Filesize
71KB

MD5
5d805f937e75143665e922d44b65770c

SHA1
d92b965edc188cb2c19f2d43eac79fa799d57b9d

SHA256
c678806f3129725faaf7e632e553e8065dd6dab33ee39be37fcc46538e5e56e5

SHA512
21a7ba04b948d8cf939b64a784be92d92e6e5602e501057e46f8b5cb060fd4ad483797cebdd3838f32b4886831704713766bedd6be3b9c5c2e462f8f6e7c03ff

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
73KB

MD5
c1846b77f9ebd3ef86ed466d9a2a5a1f

SHA1
fb6343041d19b7403f96a20f9e3743c06b4d430c

SHA256
ff1d5b0757907c369515f00a74e150a22faa9f0a902f43cdf220274556b7606a

SHA512
1bfe4305a38104a521f32043f71b7804fe47be1d3cb91c0218699cfc4f191c60415be76f183fe0769c39c6166e5600fe2d062b9c953c807f1312e038e7abdcc9

Download Submit
C:\Program Files\7-Zip\Lang\co.txt.tmp

Filesize
69KB

MD5
88697ff6d39767d718c6d3f2207d2631

SHA1
6175ac89fae3164e18448f1d2751fffde65a9cec

SHA256
b47bd5ed43afd1f25b5b8458b1441b087cd1baf2be0379837e40b8c55a0f1418

SHA512
66e1c1e7ce18b1fcb7805ec3972ec2ce5986a261ef7c09d6271c771480d548807d8e66ea1c53464127cf14e8c5fd9312637ed093925e44df396b28b04e9bc1c7

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
67KB

MD5
30ca4b8c30bc856e08ffe3d94e728322

SHA1
3acb2c48ab88e9f3ba64553e2cd545a2d5138c95

SHA256
eb71d967fdd4934dbbc58ef27d9b4c08ddc117ee271ba7bde5f757f9f5c98882

SHA512
a185af3870bb1aedb58c986d37b2ea0c7b80c6d700b968e62ad8706125ef3480fccf7230f1dca3564a20f5400a1f28e5418977d41d332d43410cc69386d0069d

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt.tmp

Filesize
63KB

MD5
9f5497a2cfc5f5a972291c05dfd8bfd8

SHA1
699c65ca499dbb6751d2bfe9c176309255d14bd1

SHA256
8020c4c2702608dbad031e93b6c97cf669d5fde3f1c2efd31aa53d24d4202906

SHA512
1af044e9b1305ff4d60d404e52013aefa070de1cae8923abf97067042ce1b9bf00ad530be70ac0be48c65d7a8263c41ae1ec383134c9d8cd8b77d392b3e063c4

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
69KB

MD5
b41c87a08477ab5b295b5485c58a3c2e

SHA1
94888f65d4ca2dc106dbfa28ae79bbff5cf5dc54

SHA256
47730390fc02f3eeee96a6cbf5c2dd4d420e7440b960ac3e4fa4d96eb7782789

SHA512
73a3ea0094a8b5e7ab6161e52884a616bd4689178f3856592a36a4cf927b2de8b817cace589badf66a9fbabba8a2378518b151f77266d8a823a0dbb198e5a1c7

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt.tmp

Filesize
63KB

MD5
29d14fb782e2268e0c82dba6702bee2a

SHA1
b33e97e34becea913fea25f7fb8086a44aca6f90

SHA256
5bb04323a610b2d36f3dc4aa2d27ec2ebd87dc40e618fdaa1bb006b44f031a09

SHA512
51b74c62d4c8c8d72d2f19eb8d918da300886f92b2c1cad28d98e6f9d9b55b8da78ffc5fcf707a30998d9eff06b4dbd88398612a3906e256719e7fcd011af566

Download Submit
C:\Program Files\7-Zip\Lang\es.txt.tmp

Filesize
68KB

MD5
d50651165429840baeaf46cd0a2d917e

SHA1
d0df3fcc00a02a0db4008c8ee94e0df4ee76ffd3

SHA256
ae7da834d74aa3fb15c8b1d28d1df871afb0d3029d92afd4fc51a2547772d5e7

SHA512
b762154159b6884144fde1a7ea73956de6aa44b0f6df60170124fe40c034168cc427edbe7c0690a203e1284a7120aa08b0cce080bba4fd8cd59b4d4b3bc10932

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
64KB

MD5
f71d2a35f715ecd64bb91dc10ddce95d

SHA1
2cd4859ec0b3547f70f54a8239b96fdf9de6f664

SHA256
5f6e76140b6945f63b76581e31e275c00b24b6c519256a128dce0c5320efecc2

SHA512
a929a65b2067a5acfc1edc6573f3a05470316596b793e944467f5900759b016b55d91ed2991ac69e156d18ffe6cee9fc3256714cc60d644e46e57d13f5d4e171

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt.tmp

Filesize
67KB

MD5
66e92a6b0e390b9ce5b6a41fbde9cda0

SHA1
7567e5d56488f1ddf168218ce89763ea3879e9ca

SHA256
4cf0a7abc08fb5d75a77072a4beb02bd00866bff6ba10139c43e8e840328d426

SHA512
0132c6a49c15068bfddc826e99d09693ae2bfce3f1dda7a887ca826acbd413f65003c52a2f6d3bcbb17268963358b3839b1a80bb297eb185e181a8de3b24bcca

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt.tmp

Filesize
73KB

MD5
3db1b2094fe44bf0442fd45cb5787fec

SHA1
6e03e470219013b9bbcf9af93b341f42c59273c1

SHA256
e3c8c9352a0de3ab79585a5c41b1bee74fc381d0d5c4d3b5668b9df7f47dc4d9

SHA512
8a81d716244ee48c30d0298e5588380e3a610ee5c341eb76a91c016fa3430972e7cf4084128ee3b93e67e5a92e30f013af39e0e85d9f63600cb96b5a77b714ec

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt.tmp

Filesize
68KB

MD5
ec5cf14a0478c2e75ce8d507afe4a4e7

SHA1
221f73231a8bf14f790786ab30e51219cfb96cdf

SHA256
0d29dab591bfd6f1f37e148f455987238ac1a2eba3c271cc0de05951186cd933

SHA512
8a413d5faa56661930c82f3b7c0858172df53dea16c31e54a09a3cdc8c74bdaf0ed9f87885f949fbe7c7863b8b18bc8ac0ebc1e76ab50d7fdc74a361b3bfeb95

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
69KB

MD5
bf4285c965d84c0c242f935114af9a82

SHA1
655cba5d22c2f76530d7035308c0d56e9a03b8df

SHA256
308fa85c1eb83499274e6471dc615bc872d23394d5a7dcf8148cfd95337b613b

SHA512
b0f24036ad251c7569185366b719a10afce4938b64e70560c03a25f8f0f8847a35d712891c72e6acec547b5d93c14b5ea8d626b5b4b41e9dcc0903aac7213e25

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
67KB

MD5
f9d32a684b9b189eb7c8dc19e5c6b9f3

SHA1
f3e3a7221ddd62080502018dc799a9df382c741a

SHA256
e242c7b14af8cde508e45208b2b742c64c14b74e92efdecf50091147d3d10707

SHA512
5302b843503d6f42d05fe86e0c4de6224cd5956b70b17a31a51cced589af6f575b444430c4f794cfa1fb41cd974e6f06252bbdfe7c3962f73e28515bd64248b6

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
58KB

MD5
da1c096b7cbe8d0ac91be957ea9dc017

SHA1
7a3945fe354bf078f1527487c42de7bd54f3deb8

SHA256
e055b59f97b0089db2e3531e541cac8834b35b9a25e458fa3e4232e7646acb92

SHA512
f27be0efe1c49e369e5fc46fac28411ddfba00d70deb86521fe438111367e83839f1e983bfefb8b4bc4556555549e7ff2123341d4d79abe7f7d43c0c842f3502

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
77KB

MD5
8d6f85693fcd3fa2362c8bf49fab88bd

SHA1
d634106546780685a5838df7843e4c50981bf798

SHA256
8b8bb6eb7e6a75f3949d2ba1cb382115d8fea24ce8ae556b94de7b6dd94e0daa

SHA512
4de6cd1843663a7e213386877dfbb50728c9d293e61e1c521743c955d11be49f844c20c4852c2d30227fe2fbd7add1c8cd273d217fae360d5ad9a47e762d7849

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
71KB

MD5
e95103a9d936ca5c249f2bd5f9f09f36

SHA1
610041ec461315e2f021bb528ac4506c5b9fed9c

SHA256
9d58f9b4b6b419035e0de80b67e538ac482aa5edfb51077f8b844a776b75466d

SHA512
d3c068c37ffa2f1fa47239456574c9dabd3f9a7bd446b867c56e6a29e6ba85e1d19d7e1de78a4780df9f2e2303e5e25507b9f790a82c3e79aba08df9ada7dcb5

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
77KB

MD5
1358b2bead034d88cd18cfc3405f7d96

SHA1
82b4dfc641bb3005462b00da872cd038898acc03

SHA256
2d6a611262b8e97ce3154ba60e186a9a87b4f806d264c09ec32236f274e8a9bb

SHA512
a72da2f4d9c80de15d098d96e8ad769ac343c04fa2085be0c33da6e61b0499b01bd510079d1f5c2ab31916d5963cfa88d42115bb9a001b5e249453896be3d061

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
69KB

MD5
76c14835491f5318fa86f3a3a76cf613

SHA1
634b37b2f54ca0e1e27a446516bbadf64cec1e5b

SHA256
9e26808ad2992dcabfe8338e63832bde9c495682c58f89f3e67e0ccd518ce1bc

SHA512
44349fadd5f4181be0f4089cf994f3557539849dd6a80a54bcf2cec5954cda854988bf65dd31da521b234321125186a789a95dca3e748f55c358aaa2671b0613

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
72KB

MD5
b6a8a275ecf13d7660b5f777b16267c3

SHA1
e5b394cdebbd9aa63497c2a29f5152cfbebe48f9

SHA256
13fed2edf3dca131562df50091da280737d35e9b97d3e04c9377d1c0ceaeca4b

SHA512
9309ef7facccebd1b09ff4597acb70216e9a6a4efe6c06026dbf044ea16982ca2848bd91a958fff951e50a86b960067f51d811843e7a281b5e0abadb4be77731

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
69KB

MD5
fa70189a75804f45ced506d0221a2915

SHA1
ef7c22ce113eaf078a550bad6294f02653072d0b

SHA256
5dab26c0f247617ede36553b6a1939b9196d93931b351cf0d0ee26d4997cb831

SHA512
1bb96381ed51045693337d69284e6f9c7242e54845d00be84c96cc0fe8d1d7a5d89e45a7f01347cd66acd64e381d9215224b6468bf97f5e4875a4753dbe6f938

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
68KB

MD5
7b87b8a3cb7ef51e035bbe6b66e5ad46

SHA1
5558c5ddb408d2f4aa135fe3078f1776e52a9a39

SHA256
0698b4d9e27d7742c37ea4e5d0449a695a4946c2a074b7058c479a44833928f5

SHA512
166b90f48bb646532d1354d4eb738fd5497071fe80075dc53c95a3b09311e83c47087e7a11e294bab2359e6b66849b811c4db0c04bf26608f5abc02fbb7d491a

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
69KB

MD5
62b411b731fb3965cdf082c8d291f99e

SHA1
2843939c0c1819efa041858de41ec6ae82faec8b

SHA256
e7362e9796356127b22479b52cc3279b4583654ab54d999ab61f3a634c17ff76

SHA512
098d2263a691bb67ae46a047848225f253d702d4efa5e58a6cffe0079b2d37721dfcf6f64bdec3f8afbddbf5e5ee13cbe87730defe6ad849467c7e0ade283ef1

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
56KB

MD5
dbaf18ec736145a3a793f7dcb0c0a168

SHA1
948847158d3508d379e95896a4a1e045b37599ca

SHA256
54b6d2b1c49e8ca18ee87a48b8871676f244d83b1380ba3f7b550c5e33920122

SHA512
7ae41842e1e4a2bfa5925f9c64a02fc4aad011a82cef40fed9725beb8d35793ba2476ee1e0b6b35e6f1fb03bb708f144e61972c935321a2d2bbc7bc93425fd04

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
77KB

MD5
2265b488c3a44b9c8101e6cb1128f330

SHA1
bd861d8678bb89c2878aa37a482dd47460964e12

SHA256
4cf17b8bfc5038bb3be77f049358e677045684970182d30184e85b9d27828a33

SHA512
1210dfe77783e798adcacc5b10c648f64877e17a29b11560c6b2362d47fe8777ed7226e6e8e9a29fa62384567a819e144daa5f5456729f31df716f38bb3a28fc

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt.tmp

Filesize
67KB

MD5
416c7a69618a3d150a86119882931d1f

SHA1
37a8b0ea52e8608fc5de79cc3860b01ed0008b79

SHA256
35e210c735fb522c0a4b9b6ca04ca88496862dcfeeead8d4d2dd3f83a075c0c1

SHA512
47c8d15accc301f9e54456b7a4567aff10ae160654cc813774640d973058c5d6174c748fab694a054d44708ca4a63083528bf3cdd91d8ace6684bb7b205a6f93

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
70KB

MD5
582daea49d18ba2daf032791436dc90d

SHA1
f5a180fa616690d7316d176fea16e225a3d72792

SHA256
06388e4f8a02e991f1c53df8f104af1c98b89bf73e8740af1c7546503f4ff42f

SHA512
e44b5e051671041f4c4274889b2a4fa1157df3210938b312f1ece613a3a62a5ee770d05e0902f9a69b5b7283673b7465eb61835ec259a9ac7ae065637821f278

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt.tmp

Filesize
69KB

MD5
2379efefff9244fa3ee14c3e59f3380f

SHA1
390d7af969b3c16dd0cd5dff06d9eececb5a74ee

SHA256
bfdf0c10aea5d888a5119084cfe123864ff42a4410476d93a593f35867c043c7

SHA512
c56df25cc3f13f4a13937321013dd69d000bac4ed9c6006673ddd5513e06975c92f95fb6471e3ef4bb8d473c44b4b0d82435587d1dbdbc143bc50e3d5b9bb7a1

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
71KB

MD5
7df5880deffaf3c121374620df0e020b

SHA1
fd65dd705693eba1895bb8063c81278296b07a84

SHA256
ad92629f941f3d7c8fe0f7a1260aff951a3b1efd51b0c7e70d2dcb11fb8fde7e

SHA512
e554857ad906108eda9c2ae8f8a1813a237a8404aadc9c41bcfb5f3d7eb7d030f45375c12c58db1f1b0666f4ec0f3b59f0278e0ebe98d0b72bf0e7f8b9d4216a

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt.tmp

Filesize
58KB

MD5
a7c6c4cdab187d0964589f20f5deb136

SHA1
d8657c4fd4e59052ced53d03303db1cd3ff65034

SHA256
ef14964ccdbb03c2440395580303cf88c9b58b180865889dfd6cd4ab3e39143c

SHA512
0bd4735fdb29bb7287136ed8c02f84a6833bcbb5d5d195182188f47c991116b6250ba508ba30fbb932e56c80bac5a2d120b32f3dcb8300af2cf9dd0c293cae5f

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt.tmp

Filesize
58KB

MD5
6b075a91cba44c3c6d9c02a675dafda0

SHA1
6d2ef20adfb5d03701bab6ee194f4ddbdde996a8

SHA256
debfa40e2f5ca68322a75e4866e442e692e56d174f92c0e9f3c93aad02d69fa3

SHA512
b003cd1a27a1ba387df9387e65a666f2eaa129af7ac20e46f669b01871a57543e2303d82ff7e7f578100add3ba9045fbe37857b370999dbb06ab4b3a63bd7e12

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
67KB

MD5
6490b5154b22a1ed279e7f71fb57017b

SHA1
647b1d024dafe926b44079529ff22e5cbc620aa2

SHA256
8b0e9853f2b6ced68d890d02f106a52e9da4ca0d5552a624208943ef5b60f1b9

SHA512
e4ba0603b91e256e19050c73a58ff3adb0ff2adb3101e3aa9c570db4600f03e7242d3ef462caad3411b59f4b25727b853bae6a0c7238584282c63718277a308d

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
67KB

MD5
cd37f8c188c5597e2fb5c1da1c223ebe

SHA1
df0f9fd02989868eabcb0c491bc9994c1b753fb0

SHA256
9174f8be9b70d3b5e1aca8745475ac8528d6aeb2e0750b92c5000931eb575a54

SHA512
aa875da0d780a8b5afc8bdfce509e3f1d8e3184ffe834369e045e2b674949eec4bdc42a616026ec1fe06655d747d0c030de978f87af3248fb99e168d163c85ff

Download Submit
C:\Program Files\7-Zip\Lang\mk.txt.tmp

Filesize
59KB

MD5
5242c7b83bac2e31f06120fd1224a682

SHA1
4b4e915bdecf32c7e159d1ae05ffa65d04cb7e2a

SHA256
c5618f8cad4a753491031ef830d3d1e4546ca5e7f9f844e8327f5ac0d4e50224

SHA512
c64dfa400317093dc3ad42502d58f536fc78ccbadf65d1cb74bf7fa8ec9db51eff06a10057616d44ef0a2b8d8b7354d6581870569bb353e1aa1348eeca964ef7

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
59KB

MD5
d4452f4b92610daf19c1da6027a55634

SHA1
45be3d30c38f7399e8056f5dc1d437fb9e496303

SHA256
f646c55e54bde0d2f18c7cbf2df75fc3ec802145e216835535c13b4b02a59462

SHA512
3e8423d46c0b018f8aa3b4ac55c3108ff726af3fe126fe0ae487e174792d70b202b192acc3d51343b16ce22ed8d860f61fb92434fcd0ad8c8da281efb956c5fa

Download Submit
C:\Program Files\7-Zip\Lang\mng2.txt.tmp

Filesize
79KB

MD5
dd962bac968bf899025ae40041e11063

SHA1
b27af0b58573cac07d5627bb79813165d12cadfa

SHA256
d73cd7a0fb75def7f8434573999f2a86e15beb32ef7b12f54c1192ebf099b143

SHA512
d8477b114a3e8ceb8d7b4fa6069959e2fccfd34121e5c076def2316aed7642b33750b6e308262fc17979abede80df704f325b31587bc25d830b8095966057614

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
69KB

MD5
fe8c55ae7ea5e3c8ae1385561a622347

SHA1
04feaf05bff0f918b8b7e0b76cd09bbf719c7572

SHA256
5470a646ceb98cc68bd924136de872ecd29fd2a0fb4bb8350828956421072b6a

SHA512
f21614f5476d1d771c7a6640603d3b8b752a4716f804d22dce765b266079dc55d24af7638711a978adb7c49c853cf9cfe469f58a913ff1d096ed671b18a93e27

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
63KB

MD5
3f676481ac93e77b3322dd1f4f331d8a

SHA1
1a87b291ea00bc8895e4217f64296c93ced5b644

SHA256
eef1b754df873d5e1282916df691e4f15411ce60c10c99b1d7dc18cb888ed0df

SHA512
dc669dd3ba000ff252a5b30f0074f86ff6c567174b82a7942665c426879e61efc5dc637f175f10dc530baaabf5143c5581cca3f44a0d2c446bde53c57f24f404

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp

Filesize
68KB

MD5
ba4df8f4b8e390168bea14961bd6c5ad

SHA1
e69f9f4d8ee4a6fb740fdfd864cd62066e5ce0af

SHA256
7e1e89056779b1dde4314aaf62b96f7a7c41a16364fc778b12e89d9055a8bf1a

SHA512
b5aaa44b45860c72ffbb5be036d7c9a9ef60cc68dfcfc46ac32d0f87d2f3a8a041483ad4c87060226a00c86264dab809b27ccee304e920f347a0e17d598a1317

Download Submit
C:\Users\Admin\AppData\Local\Temp\_.files.exe

Filesize
59KB

MD5
1fca9e2b8860ca743240bcc657d6890f

SHA1
7f85db42b6d173bd904c62f8096e2d6d78d007e3

SHA256
4b75e3055d1d4bf73785ce0487f0babad42b1f4c805f1c1ec5684df7a630c8e1

SHA512
8306baf3074018dbfbc469c80b67a4a466f1c259240effdf71970ea98dc640de94c73aa5be1d5937b0d585839e73660f6eb759dd4d9aafa46c359957d221fc7a

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
58KB

MD5
b32bec1bf5a1b40410a3e9c28a072132

SHA1
000950840b93b972ab49a4d114df7a1c0f801402

SHA256
981b47508aeac2ec75fcb1cfcc7e6f9bf6b2da888ba2b8aaab3492aac0cc31b5

SHA512
72d52d48c6f67d91d7ea91c3cf91824a0ff7bc3d1299eb58c55cf85b881e3728716e6f2f494bcd1a270b10a9080b7359c210750cc908b17f514c3d773c4117f5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads