9cb52e5581a3cc9398d999cc4194599735c8375aabd8020f1b6a29ee60a53f22

Analysis

max time kernel
150s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cb52e5581a3cc9398d999cc4194599735c8375aabd8020f1b6a29ee60a53f22_NeikiAnalytics.exe
Size

132KB
MD5

d2e3fae4133c39b39e04caf8cfdbc9a0
SHA1

2331e643c40235c8d81cef7e8258866d986ea058
SHA256

9cb52e5581a3cc9398d999cc4194599735c8375aabd8020f1b6a29ee60a53f22
SHA512

78ec0bb1c53abaea49ebcf04cb49c7902e8f54dab7cefda6b2e6595f318910a5fb81bb053e31ba6c5c91c957ec84a3ceb8f8cf9ac4dd31add2c710049e402b7a
SSDEEP

1536:W7ZNLpApCZuvIYYoYoN7n97n47ZNLpApCZuvIYYoYoN7n97nz:6NLWpCZLYpZ4NLWpCZLYpZz

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5371) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4548	Zombie.exe
4888	_checksum.exe.config.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	9cb52e5581a3cc9398d999cc4194599735c8375aabd8020f1b6a29ee60a53f22_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	9cb52e5581a3cc9398d999cc4194599735c8375aabd8020f1b6a29ee60a53f22_NeikiAnalytics.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationClient.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.Unsafe.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp	_checksum.exe.config.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ValueTuple.dll.tmp	_checksum.exe.config.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	_checksum.exe.config.exe
File created	C:\Program Files\ExpandOptimize.ppsm.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Java\jdk-1.8\jmc.txt.tmp	_checksum.exe.config.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	_checksum.exe.config.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.tmp	_checksum.exe.config.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp	_checksum.exe.config.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMK.TTF.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.exe.tmp	_checksum.exe.config.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	_checksum.exe.config.exe
File opened for modification	C:\Program Files\dotnet\ThirdPartyNotices.txt.tmp	_checksum.exe.config.exe
File created	C:\Program Files\InvokeCheckpoint.wpl.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp	_checksum.exe.config.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp	_checksum.exe.config.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SPREADSHEETCOMPARE.16.1033.hxn.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp	_checksum.exe.config.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationTypes.resources.dll.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp	_checksum.exe.config.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ko.pak.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp	_checksum.exe.config.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	_checksum.exe.config.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp	Zombie.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp	_checksum.exe.config.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	_checksum.exe.config.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp	_checksum.exe.config.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\WidescreenPresentation.potx.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll.tmp	_checksum.exe.config.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp	Zombie.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-MEDIUM.TTF.tmp	_checksum.exe.config.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4888	3116	9cb52e5581a3cc9398d999cc4194599735c8375aabd8020f1b6a29ee60a53f22_NeikiAnalytics.exe	82
PID 3116 wrote to memory of 4888	3116	9cb52e5581a3cc9398d999cc4194599735c8375aabd8020f1b6a29ee60a53f22_NeikiAnalytics.exe	82
PID 3116 wrote to memory of 4888	3116	9cb52e5581a3cc9398d999cc4194599735c8375aabd8020f1b6a29ee60a53f22_NeikiAnalytics.exe	82
PID 3116 wrote to memory of 4548	3116	9cb52e5581a3cc9398d999cc4194599735c8375aabd8020f1b6a29ee60a53f22_NeikiAnalytics.exe	81
PID 3116 wrote to memory of 4548	3116	9cb52e5581a3cc9398d999cc4194599735c8375aabd8020f1b6a29ee60a53f22_NeikiAnalytics.exe	81
PID 3116 wrote to memory of 4548	3116	9cb52e5581a3cc9398d999cc4194599735c8375aabd8020f1b6a29ee60a53f22_NeikiAnalytics.exe	81

C:\Users\Admin\AppData\Local\Temp\9cb52e5581a3cc9398d999cc4194599735c8375aabd8020f1b6a29ee60a53f22_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9cb52e5581a3cc9398d999cc4194599735c8375aabd8020f1b6a29ee60a53f22_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4548
- C:\Users\Admin\AppData\Local\Temp\_checksum.exe.config.exe
  "_checksum.exe.config.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.exe

Filesize
66KB

MD5
1895d7fc7e89b03e848912810780112a

SHA1
ba21c8afaefbfa8cab3996fc1a3f1af1bbe92611

SHA256
729c3aedde51e178e0250d4d3fc21caa4fdf88afb14aee0809b6f8f1a0073bef

SHA512
868de9693910cfcb745e1e5d7d7a971e19c846eb28b30362cf9abb2b1bb0fd95bcafc2712b57c1655fb4f851712006459f739b3e7121f11aa65469bb059b2ce4

Download Submit
C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.exe.tmp

Filesize
132KB

MD5
45fc7ba9e104a7c70a6091cd6c6d3038

SHA1
45534d9c853761b43d981a593d5521689e2bbc32

SHA256
8bbdb42b2125b1d3d63ce0d8fdec7de498e35c13907b06d07df1c3014481ea03

SHA512
7cf792081729772145cc3c43b3e9dc7d1beb39f191ead8071dcf84f0700917b96ec867f6aa7a1fd4210ec336113d5cf87a82f89d8d886feb7db53b88508d73df

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
178KB

MD5
6fc5894940636594fb9555ea398fa145

SHA1
e5fec64711d10fea1e6ae7e4f62e8378130152a3

SHA256
b061c57a51ce7f8d5e36cf8cba81ebacbfec9620e8de2f271d480448defb6bc5

SHA512
6318927ef7951c272c4570ac3ed541f4e9d631c874e15e65ac67d73034359ee63f4e5064f6c918253800ad2c9faddf60fe2de3552a4973819a8b0c8a4a5590a5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
165KB

MD5
c59ca449104c730fd2629006295b230a

SHA1
1eb4b1875db56a9a9841545029fa9adbcdcd272e

SHA256
661fb7c4e00acb3cc03dc7949dfc75442d898cc0e1f0368f07d14ce7eabf0631

SHA512
9f0f7165c9c251baa773ab98c81ae2b5b7c835a3a46663bd19c0f3c932363d8131bbb98f3d1c70ac1c85e338465964bc4d5768419f477c6e0c01b71d8f6a1870

Download Submit
C:\Program Files\7-Zip\7z.dll.tmp

Filesize
1.6MB

MD5
8666ca815c33bb23f7eeef67425caac8

SHA1
8698667cfcac95b35c4d75063134f755ff4009f4

SHA256
2624c786cd8c15bc65920c1e899b97b46f9181ff2204b71005068fcd53ef730f

SHA512
24f331278aefba1782f2e51a4dcdb2fd6c97ad44b6c35bb8c0cab7ae79c7d0c9984580712689da621920423f09e8e6fbde7290710a4d941e6ef874fbd6e7229f

Download Submit
C:\Program Files\7-Zip\7z.sfx.tmp

Filesize
276KB

MD5
eeb09afe08fc5e0a2d422a63dd874d61

SHA1
d0495486b18fd66ed4c35b3a4466a685455bb4ea

SHA256
7f6790e44bc559539fcbde2e074c8e06ca6476b72f251fc11f517da560e2928f

SHA512
5e6a503a89ced89b0122b67513d3d2fa85da22b5728b9ac45a2bb55a67be8c64de459970b00f15b2df1951a8d20a1e64aea800385123dc3234ef6071d473d568

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
996KB

MD5
0447d0491231c49b6e18ca5ad3267bf1

SHA1
9ffb2d071aae8df37745edfc6da303bd810da0db

SHA256
033bcad8346f5f0385c3650b5f5ac98804e7651a6aefc06c672afc421a3023ad

SHA512
31ee9c95730846cf69d45669b313c5e52146d77936827bea6d8980cbb9fb9a3323a3e536903e2d592e4d92b1d6036b5c83125d69224c24002fb0bb7ee701c12b

Download Submit
C:\Program Files\7-Zip\7zFM.exe.tmp

Filesize
997KB

MD5
c17d36df5e79b036a27b76469b4ff519

SHA1
02a0c1f6f4c943d7899b9cb2278dd89b9545e023

SHA256
ae932187f7bd7b5ee52035ac6bcee64cc467191de6ac21e6a692b30a385faece

SHA512
af265bb6354ac9625adaeeeefcad75d7ddd36e7115973678eef309ec9225271928d1871689dd8b59f2d4599ffa808f95f67ea9d0289ff49a17336e56070349a8

Download Submit
C:\Program Files\7-Zip\7zG.exe.tmp

Filesize
750KB

MD5
88e9275550bf5fec96ade8113a7b5bfc

SHA1
086fcd98aff4ad7983662aadf52da16b0e1251cb

SHA256
22392f1ec2dabb7c10cbb8088687c6e7a8ed6138fd9a21d4eb9d7121454b3921

SHA512
f7ede8b344b999ad81254ca033240b14bfa0feabfbe6e9d9f281f3cb484403e8b2a7e45da02cbc899964dec81573eb6ffb0155ce7c6e25564a923bc807496d95

Download Submit
C:\Program Files\7-Zip\Lang\af.txt.exe

Filesize
75KB

MD5
9508a37bccad651b5f4b21c2b20efbb8

SHA1
e078e08d0cce0e6616b93de169ea10a8d0aee752

SHA256
d060bf755355c3cd9628315be42ab099c4571b414abc00cb45858e8bf7f730b6

SHA512
f6f5fb91f0137c8886af53c1f378220466c4ed71decca414fe83b2fd21be8b053179d31bdee0c6fef267858453e5855efa20f790d91097040f5f6f25447a3a3c

Download Submit
C:\Program Files\7-Zip\Lang\an.txt.exe

Filesize
73KB

MD5
d612cb2db279a3287669bd4ab4c25fd3

SHA1
cc4a3185542ac270b3f3778de70632d491eb88f2

SHA256
341ecedfc444f595525ab4e047671abdc3cb787ee132253e80d03fe83ba0b57f

SHA512
7031482e732fd7bf60deaf7d3f3e3e6b31f1e8e8fd8bd5609fb8a1ae64c077d0edfbdfb54ecc516939bf09117f5f1ff4f28d3ce2fe3ffc64a0eca53a7014f08e

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt.tmp

Filesize
80KB

MD5
23e843011f109bf03ec6c3195d98f01a

SHA1
6bb443eb7c1869e07a7b7f927b6ad559c1901353

SHA256
bb7c303cb15a575679eee6a5b8a7acde635aea9711be8dae7842366c8f792634

SHA512
4f6a828a0363c5bbba0fd51b7836bac43eb3968840538fcd3c0a9f8fa5384daadd7bcaf45e17528613fecc894e0f4fd0f5541b994db180665beb2efd5b5b9c86

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt.tmp

Filesize
75KB

MD5
8b8dbfaa60d65a392a8e016a5e4a2ac3

SHA1
84963854c6b19a935107d53b69226f9177c5f6b2

SHA256
4c62a6a085eec09d60950339ac35ca169157fdd50184c1b47e41cd7c6bb168ad

SHA512
e57f07c6a205d96a0c3b0bb5e9866e4c22f635cfd342af7d6ea225af3fe635b0150b49e965b7573eb903016e46f41dc8e8ae59b055a3c8005bcec46850f87105

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt.tmp

Filesize
75KB

MD5
c08a18c99103d0af178d57afa0c5789f

SHA1
c203c69c1cbecc87ee119765be5042b4ad4ffb34

SHA256
0cb97e00117521445eb7ad57e6fe0c8786f97f6a13c98d68461b3bcc9fd1628c

SHA512
d3358bc443a85afd82679045ad18068dfd654087ce9359b0d749710c040dee53cdc7caeb0497cb7e1108396aa6c4e962053e03711f587f201a4aeef73c88ab6d

Download Submit
C:\Program Files\7-Zip\Lang\de.txt.tmp

Filesize
75KB

MD5
3cc056d226357a6ab59fbe32be1fa107

SHA1
eb5e9775a125a01460533fa412ddf090f31d96ac

SHA256
3c4d958c39525a6caeca1453ecf531a05fffa375ccb7edd31e9735b374a6cb24

SHA512
74343f64cdd4c7a4e262cba273f18cf7d3d942e1e46ae2a2b3d8689b4410ab8c3c912fb0982e5dcb12d40c42e43b005cf4ca807679151acc0c68212f80044e32

Download Submit
C:\Program Files\7-Zip\Lang\el.txt.tmp

Filesize
83KB

MD5
8e7cb86c037a6e839cfde7085da6478f

SHA1
44381659f581ee92365272cf2cb28c130331c139

SHA256
10d64f1320ee7df70d287f582e83e465ea4b556756baeb0571b7cecf8dc237db

SHA512
8813a395df8f2353af8e63458282c15029ef4bdbabadac06f936b514a6299dff67c5caeeca64bb0c084be97c282cd553d344beac2b7209a95bf27df777e0eb7e

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt.tmp

Filesize
74KB

MD5
479721fc178d7c8277c50eeb7311ce5e

SHA1
5bec3359dc345e8d34327abfffcd967241f8c4cb

SHA256
31db495c9128ce7c28b5131b76d5e311b3160afffcfb985ad3b3c69e1f589ddd

SHA512
9716b16a46a6f31dbfc41d947ed196d0efab5431e64828fc30052ccd33756ff779b47bf6477aa27d2b6df6687bda2cc3c4edd3a9bb9957c2c39cf3bf441f8e4e

Download Submit
C:\Program Files\7-Zip\Lang\et.txt.tmp

Filesize
66KB

MD5
af0cebc9d7f94b6902b89c1d1b86fb6b

SHA1
51d161183d9edaf996c3f1cd847bf26be8bae489

SHA256
f9218f0f4940cd4e53ee5d2d77e8e953c79cc612bb96c88f3fa413b8b1e1973a

SHA512
4b1ec4fe8d1f231f079f29ff31cbd468307e19d908efa00345d0440d0398bd3831fc7ad20d240a80bac92025a872bc2b2f2f008efd1cf97c0b926b74a92ce3fb

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt.tmp

Filesize
75KB

MD5
ab0ab6443f27b32271c291a783767628

SHA1
78a8e90b2660707de17b657eacf9ace7b640559d

SHA256
9e0097d4f8a6d748a0d0da494b582ea2a8dde336847f9b5082b771fac2b2b824

SHA512
246386f693044ae8af8907235798e56a9e3d0c1c89b42ccd084eab17a0a8b6b2beba4c15c4847acf087599c86946e0c720a954f212b82ef3f6903eb000a96e29

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt.tmp

Filesize
76KB

MD5
7717ef9f4c872bc74b8da1adf567a18f

SHA1
a83994e0a36ddf3729bf665e0c8f76545d818b2c

SHA256
d0f28fe2420bd11e59be1c71c776588ffdc5c8d13db4046edaee5057eec7db3d

SHA512
33d48004cf2920c88f51bb1ed6a28f92f4807768e82d6a43e5a74868618d191c22bd9fa8556cd592745d4488fea943b57773722dd5979ef1981c9d1516571b09

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt.tmp

Filesize
73KB

MD5
7f59f98dde86c5d650960344abc985d8

SHA1
4f1c41b0bd02d4a4087ecb9390612a45338334a6

SHA256
d681c738c75c7d6331111c2fd7a7258aef7f8ccd05f22fe1223f87362350a054

SHA512
3d63b8b58b2eb113a95a2c0c393a2bfdb67b328e5d99860dd5cf658ab201a80297ca1999e53bb34fb88ef4bbd7abe140127ca6aaebd6ec49bf05b67ecd1e8ec0

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt.tmp

Filesize
72KB

MD5
85173d38338f143231c5dc078f29a75d

SHA1
1e8db8e63339de77be303ef48ed04cf9babe4815

SHA256
7528be28757f398a276e8a2a60e1e3f5efff88b3c69244b0b93ea5c77d8d1b88

SHA512
c4266c82ab5b7c9c0b85bef1ab6f4d5f7cd375a38474177d1b764dc4a7a72a52d7113b64eb75e828258a7c964695eef0dd6a0f701670637467c41a388fd38593

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt.tmp

Filesize
74KB

MD5
c1cbdfd1c3a5afd12acfea4ef8d98863

SHA1
383a208716690765a39276a0077c6fe48eb94b16

SHA256
e29a96bb6643a8884b56ed0844c5e204cfcafab5fe4a8d99c2c146cb17e31779

SHA512
98ee3355164acce017e32365b82a1f27bd7e32d85672acbe998c7ad723d896c94e859d7cc033991db47d9b546d629ed636b598ef38c5ebc47481d835c91b4a46

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt.tmp

Filesize
75KB

MD5
488d738835ec894c9019b5f4ec499817

SHA1
153cddf2ff374dc8eeeb94260162469c588a6c06

SHA256
33b14239f1c2bd5d9444e671afd9a9d2f29f96f5dd6fbd36047223b0da94484f

SHA512
73b7e99da6489125efd316c14ce83151725e749da4bca2e0d53cb00a425d01096307242077a4d4a9a07d73b75aa2d61f51d35bbbbdd55a023956fa2077e3cd1a

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt.tmp

Filesize
83KB

MD5
229b0db16edf9a2af0d461e7e2522a86

SHA1
4ef2e618ecd71c03b10fb71a4a5c94d7026a6da1

SHA256
627e0760b583318d85b2323dad517df295f16c7ef43dec749b90ebfbc1d53b70

SHA512
70eb4ac049c614a36fd4c2bc549eb271f26a8b4213bc735cdb3fd779fa226ce2cda7172e84f0b10fe14f7a842b0c958d7cd7279037d39f1d393d9e2b383ee856

Download Submit
C:\Program Files\7-Zip\Lang\he.txt.tmp

Filesize
77KB

MD5
e0f757d0c5d15258deb5a2051a7ec15e

SHA1
7c83155f45fd9f0bece772a332ee154b8d5ab5cd

SHA256
80cfbb73b7a2574797279c283405d3ff55ab01b511456bd48fa4fb793ae46571

SHA512
40212aa08ca8a85c80feffe7fab45a75d7db32dfe12b11a2a137e66d5389cd9c3ed4433bc270e73d6248a2385c4df471002f9acfa9b0005c0c1338fa12d71481

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt.tmp

Filesize
83KB

MD5
d5f24815cc24a32ae87f74cc2a2820e5

SHA1
e30a1c35712a0599c4f327b603a8bc296e380907

SHA256
0d74021a6472c8e254ef5213dcdf9bb22de139735bbd1b8ded4256b6fe9a61c9

SHA512
e56bce9a603f49a71d00fb7cec8b97e38d0190669ffa6cf6af021e7cd0c3d02b16927bcdb164a7bcd25c6a6a0272c1987c04214f74afcac14dd5beaba761ae6e

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt.tmp

Filesize
74KB

MD5
b41c082367c13e638241f9fc015b7ad6

SHA1
ff8f621ae6fcfd98cf39b0c543e856905e1a5227

SHA256
931cfa625a0cfffc173a064d43cf64983379c3eaa3b7b82843b99107903d2d4b

SHA512
1e9a5b571e5663de8618d606883f25c813ca3181e2c7b3abadbdb63897c280567545acb20871bd5625c806b94b0264296544595322ea3b93872155613ad4b1d9

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt.tmp

Filesize
76KB

MD5
29316da33b63285dc452630b5d5eeaaf

SHA1
ab192b20628a8ce2eae60bde4ffb18da31414987

SHA256
30046a1da99aec07b168bc79d60f20e7025b91a6f50db7efd140d59baa034d2d

SHA512
c2c9aa21a9c1b0d3a3b6b9b2ce37968126aa50d2d6e85fbd7b354f6754f7566a09e7b71f6744bc0e49daf13ebd2b07adfd42a1dd141fde932de4066ae1649bb3

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt.tmp

Filesize
79KB

MD5
23fff755024a25068a19410e1661ce83

SHA1
12dd64e55e310fea23e7c526c3999d0113ae024a

SHA256
e4bb877852d9eeca1ced1de7cfae8857f46c1b7ffecbe91174a9b17c93f4ff7a

SHA512
bd21278fe2e2ed45480d2780850feb1471b3b11ddb356b774cfa36458cf1d41aaa80f1b8f65805ab120bd595ef9c95152b72c20b1943ee5cea8dff555bb233b1

Download Submit
C:\Program Files\7-Zip\Lang\io.txt.tmp

Filesize
75KB

MD5
77c540f517b861f9b353a77a0838e7ac

SHA1
f7561f766328600b2fe854c5879a34560499ecc3

SHA256
2c96476721d6dc8294fde5fbc7e7abf329a0f570dbcf3069181d683adcae07f2

SHA512
5432e82c7d39cf978bc0c8412f9d43a7a96a8717c9fc1e16829ffdf690b3f7c62def7f18cdd7e2996f6ff6fb5adb4f0d2945a3da56ac4a49eee9f911ecdc7972

Download Submit
C:\Program Files\7-Zip\Lang\is.txt.tmp

Filesize
74KB

MD5
9f58e5e03859d70abb35cbdf6b6eade5

SHA1
8fba49cd1349305188286d432136a1519461e3b7

SHA256
e9ee795331c870dd32d2ac2c3c20d4cc824aa1c3a0eb40a28d0b976d035a8411

SHA512
ba02ddf7718e22b458c8ab7f4c6c593d1e1bb5d0054369f4fecefc00ea8809fef937d8352c5f29b5dc8c6d9825d93afc4108f63a221d9c06fc062cda2bc54214

Download Submit
C:\Program Files\7-Zip\Lang\it.txt.tmp

Filesize
76KB

MD5
f48eb896ac85c97b5e0de28cb0f42bf5

SHA1
94930f5c934b89181441827019fdb96c10a7708b

SHA256
6cd1e3d4d0402998cfc7dd439c8fb4c648b2bdbbd470f5e48dd143be8b00ca63

SHA512
b8b135075aed2caace46c58922f1419335e186ea2003b28df29f5d823db503c3f2c82f77ebed09e206e4d20820cfb4cc1b37f58ba8867deda97df744810cabdd

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt.tmp

Filesize
78KB

MD5
a344c73517169553fc44e8a81434990d

SHA1
c8baa3bc7ac5b3da212dda06190270ff9620fcf4

SHA256
9ceac5685aa91e65b8e59fc47f0cd6d5777c297ce3ca60240c4cfa132e6116fb

SHA512
7ea477e20a18f0562913b7690791319afc14ecf57a9745386896bc48c330f4181f8ecb864ee5f64a07ba1d607c42fb2d27164fc4aac94a1eadb113531bc42041

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt.tmp

Filesize
84KB

MD5
708ae02475dbabf61d55d729fb56d519

SHA1
2ac3a8cbead2d529e4cd19a49a39e7390d2968ba

SHA256
778497fd24786b52f062729a513680eff3e8f4b3f2a8e3f4054fb86ad145918e

SHA512
ee1cdd2134e778b61f7143107e8de747200b96ef8065e6d5efb48b18b17690241ca959804451d10800ae8d85fee7978a744d46eeb9ab92f6c1fd6883292269a0

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt.tmp

Filesize
77KB

MD5
fbee120bfba4e0457320cec42a078168

SHA1
4704f13e65ec32e12118baec61927a9382660c31

SHA256
aee8ebc6fcaedf4e9c97ef1c1561836b46af484c2d04e4327d1b79040bee6c24

SHA512
1f8fa5f9ab7f6d15392f8fc9779efd3c6990f14598032b4a241bd5f300857bac95ac3ca0a116449a52c6a3c499dd4f991f8a317a248a1316cf2b1c29c301ea1b

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp

Filesize
78KB

MD5
e0e271628f9aeb8249b59cac2df0372f

SHA1
3c3dd06da386874d00d2244e5660b9d926a6f82e

SHA256
5de0a22e54b21f5e52d000b40669d7370e04fb60493f606d5f86b1b43ecda647

SHA512
981661ceb6128eb696af87054f21a27d54a3bad55626d3477fae7e17359ba09f2cf81e374b167cb0832c8a7ad91712df31a53ffc8163bab5e6f69e5a1b74a3b3

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt.tmp

Filesize
73KB

MD5
58ad5dc8045a23d2198c0933e544a513

SHA1
13e40a3e5d87721494097374806b8e44218cbe95

SHA256
ea1d3141263d7163673201c95b2ecb8dd55fc2ff0a63754817ba1032aecadbaf

SHA512
6f36d26a6f89fdcd2d36fd354dd9fe2486d79e33224bfdab29c20c63e412490a6a8fa128a016bb72fdc9dfe4b286c103758fa6d191558d54ac8641c237c483f7

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt.tmp

Filesize
75KB

MD5
7c7b3581784bb306fe84e6cec02bec05

SHA1
05fd61ff34066953fe3f7a4c29f79e2c492119c0

SHA256
1d1c2789dcba9aaf253df5d0942b7a1586d640bdd12989687ca072dbb526c336

SHA512
335e3c53ff9ee90f9696393c1ec4190b207dd167426d8cb56159817042277027ea4daea134a1d73a63ab41f4037ac9d49a9af0b98d5984218d5a0631a419b136

Download Submit
C:\Program Files\7-Zip\Lang\mn.txt.tmp

Filesize
74KB

MD5
b685053800f4b178f6dd7c571c840be0

SHA1
20b3a138d34a54e8f232ec124daa060b5153d10d

SHA256
9842f4f314055f3f1c4ef86dbda839bee24246a301b32b2b5806fc6288b47f24

SHA512
ccd3a539f767c98ff5cd23eefc370712715cab5bfa9bad0c0c15ba096a15cd904bdf41640c90bb6d2a4ecabb2e96b61eb2d228b9e935c4fefd66ba59fb9eca69

Download Submit
C:\Program Files\7-Zip\Lang\mng.txt.tmp

Filesize
85KB

MD5
cf73061cb8e3f89c997f2d427f159f23

SHA1
b557c5a79f592da0a5b4b860aee7391dbda9ba62

SHA256
cf3ba90fcdd55ee0ecfceefa33bcba7ef9d988110fbcdc6b56862de6fc8bf124

SHA512
a306d2bbd71617ef8c29a081f4643fc955bd2849b61bd9a13ac5ec558254fb8fc8beecf91a6cf0ed9b3bdb4dfa961f1cbf02d43fad6e3d3ffd4e0ce57794b4fb

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt.tmp

Filesize
66KB

MD5
43bae36a726fbc216a502166f74a0eee

SHA1
953e35538f24b0055e2e2f8589a8bd0c59f1e8fe

SHA256
c1bdc4bbc2f9cc7c801187f28acf075b72e18f7a16a247ede8241eee38992078

SHA512
e3920d25c3ad9a9f9340e77a2ef636ba2974cce0c8cd48b8de2e4764d9cee52bcf1aba726bf212a645f1a8b36aa26adb2762fcbdab4458d1b56d964efd7665d3

Download Submit
C:\Program Files\7-Zip\Lang\ms.txt.tmp

Filesize
71KB

MD5
a3d7c72df564f95c4957cd6f89dd7f6b

SHA1
b0bc2c804e33a6854a6356ffed7cdf2dea70e8b8

SHA256
285939ffcf5afcbf9fa429d76d8585520f68b896f7a539a75003c001030fd71d

SHA512
17d164d34cf77d34f15f38ee201e0bd034c16b7fd39a87c53c94461c37aeae88a0b914eac905ee636e90466db7247cb20b5643414938751e63daed6d25eb9a4b

Download Submit
C:\Program Files\7-Zip\Lang\nb.txt.tmp

Filesize
72KB

MD5
eb76e35bd0e4ebc0e4af89418d3b2766

SHA1
445ed8d8c90cc8bb2f883195aaf6ecde6eb0a2ad

SHA256
f3fea36442981babd37912cde5a4b6fc437d84b36a788bef4fb55fb9dbd5adfb

SHA512
a6531a31e18c223922025a35579177e0f8e5bd0d3c97afd4c68c902dcc8ef4a4383d8c93ca62f0875939f209c7462dfa0534a1aa6b267001134ace1fda56ef74

Download Submit
C:\Program Files\7-Zip\Lang\nn.txt.tmp

Filesize
72KB

MD5
caffbf4a65eb1063ae663dad4a07bd10

SHA1
a1d6600221a371af104f6f953d11cddefc2e4191

SHA256
d66d179cf5b584779f87168b6525baf40006041ac0a2d39704b1555f64155ef0

SHA512
42cc9634d352c7281d8ff315cfe05c5ec8375e0cdbbc0a5a4690306c4bfea0444c86a362c5a4101b17c8cf3eb86b148e1def7ad0946169ef3cf3179d9256dbd8

Download Submit
C:\Program Files\7-Zip\Lang\pa-in.txt.tmp

Filesize
80KB

MD5
c0d34a49ca4e4424ed8f0d2c5f00557e

SHA1
7495dd0d9befc4ad83c2973f07d70333a439fc34

SHA256
8424d999a844b27f52bc30ab445c43eac78cb68c1cd9f2dfd9ed13a6582f2a83

SHA512
1547a8056674081d10465e9e5063ee16032ad4bb15b3da94792d988b665523fad947e06838ab9e9e94ed5ff919e658fe294faaa3c927c3df66b1c58ab6138dd0

Download Submit
C:\Program Files\7-Zip\Lang\pl.txt.tmp

Filesize
75KB

MD5
b223f2595f4d74eb409625eadc83b2ff

SHA1
20bd5197cda1d4e76e81e6bcf9853113780dac8b

SHA256
f70e15f7a0e2ce2f048cf45d702c613f281f744c53c5b2c80e49cc3b8e4cbec6

SHA512
70528c4bb5f3c526e5563c9619c8fd9e175974d2f8099145460f5d0903ed25afe4ba5350ca8d0757a6aded8251a37f2d89da6ebd43b90550ac646c93c7166001

Download Submit
C:\Program Files\7-Zip\Lang\pt-br.txt.tmp

Filesize
75KB

MD5
f01e47746d43c447555efb7c9825930d

SHA1
a8cb60c6829eddc708fb186d8bb0785647e55ba3

SHA256
fd224015d3b7073ff44c8813f5a412d324a2b2809d0f5079af2644ad015f550e

SHA512
82d4e38508b892fd67f8bee0887c37c0e3a46b6a189f1c8e0ace1a2ab4fff3281bbdcb2ad57848e136e6cd756e71e3064f6b2d9385f08a5c86ece030d32f9120

Download Submit
C:\Program Files\7-Zip\Lang\pt.txt.tmp

Filesize
76KB

MD5
978d6e38e37f9c9268e2611f979c9ea6

SHA1
f72d0220e44c3aa9b6d3b2960ccf24734564aa23

SHA256
029d4e501c8181dfdc3beeb65ca22414f4dcd574560631d4321e794332c5a89f

SHA512
1930b6de236fcc4467f967e57ac65014abd95c3636fcaf57eb7a8147274f5f9690912a5aa2cc9c8ffa0aa28ad9d40edcfadbdf0e103eb172e2c6b2f5b01edf61

Download Submit
C:\Program Files\7-Zip\Lang\ru.txt.tmp

Filesize
66KB

MD5
f505977a12f53e8ac51ff7c56fd43bbb

SHA1
9d52563359332ef8f9d1af68b0694f136f5a53e8

SHA256
9c34125b91706b17049bb555bdbb8bc3daf57b8446a452df1f83faa28378fe95

SHA512
a4582050aab89ba94434c986d8740a763cb7b4d9276b38ebff7984e0db520bdc50bbb0b1cc6c9c9a3c204077237f1247043832b4e0bf1f82dfcd5ac1a118102b

Download Submit
C:\Program Files\7-Zip\Lang\si.txt.tmp

Filesize
85KB

MD5
12bd49b382dc8f77fa7eb1565b61fbed

SHA1
e3d2ba13750f54ef7ef09413fd33c08db89b40c7

SHA256
64e8ee4690a6db150d706837be1e172b94a5470515f364715853e8c3e7beb9c2

SHA512
62944e6b3e277b11db8a12a69f57892220a2165f0d7fb3f23965d4f9fe76745603d25450ebd7c1ea23a913711bcaf8c1e4ac8a7b753a010a59d83ca048e57383

Download Submit
C:\Program Files\7-Zip\Lang\sk.txt.tmp

Filesize
75KB

MD5
890d264042f70d8e4e2f9054536333a3

SHA1
99c72664b0e5b681b8b96e6af36140d1e39c30be

SHA256
0646189fbf8fd3e3526672be27e89b630cd28ce6dcf85fd800d9ba33faa1921e

SHA512
9a08309b9cdc9d48731c1b1488a752606e9cb988f18de888807358c1168d5cb8db6771cc668ad4264df7ff5140e2c8b0c7c681e963e7ac33318bcdaffa41ecbb

Download Submit
C:\Program Files\7-Zip\Lang\sl.txt.tmp

Filesize
75KB

MD5
e40d90087027ba3dcc0485f89c6d8d29

SHA1
e98cc6b5ae9a57f74de3e22da85ea108f5a78326

SHA256
4a325c63b7cec8a668048c020f29b46ba40e7ef565dfe218aec2485d0af3d14e

SHA512
e6733991c07e238c90e27510d5be25ba189d3bda99fe9194811fe45d6c5d5ffcef71492767aadf9436aaeb94d598c04c494d5fcab1fd3c6850053514df77e24c

Download Submit
C:\Program Files\7-Zip\Lang\sq.txt.tmp

Filesize
44KB

MD5
a7d329d37e7d979ad768246693640f64

SHA1
8cbc0cc299e09283480c9ce73529127c8b52d61f

SHA256
7572e41a820a3f3604fcf85c6865c4f37716eda84cf77365167f05ad22e4df45

SHA512
9bb7eefbd97d6936a954f0b3d63884d8b8e5df1229641412b772addf7cb85c87c92c081f72e68e67f445a98c67a577891691339659448fea18f619cf880b5eef

Download Submit
C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp

Filesize
73KB

MD5
c814a1a1f99b5a76ddc81df4d0a9ddb5

SHA1
cf35540b3012a31b8bef8ce80c48fec57697afbf

SHA256
48076cfe0deff67b33c7c64b00011d4ce73b3b2da4f9aef21a43a692fee146ed

SHA512
ad188fbbe61dbbd8f491bbda4eae3f4b251539d7049c4c4c66314d1b522e501eb8491a80a21d9ff694ccedbad0c3d642ef72e52a3798110f9d5407cb2beab33e

Download Submit
C:\Program Files\7-Zip\descript.ion.tmp

Filesize
66KB

MD5
b44538591f653d3dd25d8f6e991a4ca8

SHA1
21581b5caeee3134cb1f57d727e7457a7d238488

SHA256
c69a3f8f49b63354d72a671c6861cbe8ad12ea76b3578e3fa6f28fec738aec3b

SHA512
052fb39550dab124e465cc11222b28fda9a149c2288503b858204ae048af24625d49218e6ba92bd446ab3d368083f49575d4e24695444ef8b126ef320a234831

Download Submit
C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp

Filesize
76KB

MD5
edd58136f6bc1b12ea966cc4e5f32de7

SHA1
5b821daabd4bddc46bc73135af282dd323cbf672

SHA256
389a2142c2ba89a548ece3075ac535d96b005b68e5cadf2d4d21873c4c97c8f4

SHA512
78dca620bfff9ecfb570bdf5a3b52e11e27e6ea92ca9cab0a6cd0be974f67ac425d8171b1f010c6a309799e593939fa498a1d172dfcb1f612456baf372cce655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_checksum.exe.config.exe

Filesize
66KB

MD5
fa042ea1dd40994ae8a5ab31831c08db

SHA1
e9db7127b809304d442723be6898298e85f1ecb8

SHA256
3b15af8961e3958832041279579c65544f75d829ea7ad7522748e4212860d7e9

SHA512
eda0da4d7460881be9e0697d1a79aadaf476f8940651a1607992ae8d0aa75a33ab5f8d623e1a4bf72a6e2a51d5475bc2ab864062eed331e2479bb4c797d6cbe6

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
66KB

MD5
066f87fd944c7604b7ba50479591e5af

SHA1
000ebcaf9e81a997ef889daaecc6035276ba66c1

SHA256
2a35dd3f210abd2a232b15fa37a82ce893ad4c8d482046f039b119f5b2ae9cdd

SHA512
caf12bec6d2cf4b0e72de9d10d017465856fbbc63840ed0795356726f8e903b7cb070289cad2e15092d4610aec92e785ba80d66142a4fab87612ece01957ae73

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads