Malware Analysis Report

2025-01-03 08:36

Sample ID 240611-camxgszgln
Target ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39
SHA256 ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39
Tags
ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39

Threat Level: Known bad

The file ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39 was found to be: Known bad.

Malicious Activity Summary

ransomware

Detects executables built or packed with MPress PE compressor

Detects executables built or packed with MPress PE compressor

Enumerates connected drives

Sets desktop wallpaper using registry

Drops file in Program Files directory

Drops file in Windows directory

Program crash

Enumerates physical storage devices

Unsigned PE

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-11 01:52

Signatures

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 01:52

Reported

2024-06-11 01:55

Platform

win7-20240221-en

Max time kernel

140s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe"

Signatures

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX1954.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX19AF.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\RCX18A1.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\mip.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\7-Zip\7z.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\RCX1880.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX1969.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX1912.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\RCX18A2.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX19EE.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX1913.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX1956.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\RCX18A4.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX1966.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX1A20.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\RCX1881.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX196A.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX198E.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\RCX1A0F.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\RCX18A3.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX1968.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX196B.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\DVD Maker\DVDMaker.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX1924.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\7-Zip\7zFM.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\windows\readme.1xt C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\windows\WallPapers.jpg C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Desktop\General C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe

"C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 960

Network

N/A

Files

memory/2724-0-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

MD5 0d472c9720e55e9c249207de6c69722c
SHA1 7244426a440a268cb37b49005812b8f20f052776
SHA256 bc1d3cfb69f97bc930af3af7be8601e60eb1cc78516aa844e41c65e51c316de3
SHA512 f77bf33604691e0f21f1f3548187153495aad5cd5beb80b409ff50c71502e5303ddb7d64b652edc5b4177bf88e8cee0df914f91b9532b9b1116af32050291cca

C:\Program Files\7-Zip\7z.exe

MD5 a62a638055fb26e6eeb84f10bfb562f8
SHA1 fa77d235fd2aab7e9fbb1f8616283ffe162b608c
SHA256 f775cb4420de790200d4da8466fca171501b8de3849c08b75c2408251feb4ab1
SHA512 ba9f31a079926bebdbb78fd4523596ce2174fb1b3b64c528eb432c205e970c5d6956db45ccfbbb05ede08829bcea069fcc4335dd8b2a09af063bcf36efa6ae67

C:\Program Files\7-Zip\7z.cab

MD5 9a1dd1d96481d61934dcc2d568971d06
SHA1 f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA256 8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA512 7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

C:\Program Files\7-Zip\7zFM.cab

MD5 30ac0b832d75598fb3ec37b6f2a8c86a
SHA1 6f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA256 1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512 505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RCX1912.tmp

MD5 8d9797194e3826b5ab1050f637275859
SHA1 e633cc82c5ae2f57aba7cf83738a592cff2a8fc9
SHA256 ed8e457251c983d7acdcd3dcbdf750d21509aa056e62fee6525034e1721941dd
SHA512 aaed0b4b27ecb5616d5967226c3d6e2b9aaaa432380747f8cc5c9b83659d1a72cc175fe0157359f3b622fba4e7b94bb4626726ed97150662d1f4ded0fbb1ab18

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.cab

MD5 f45a7db6aec433fd579774dfdb3eaa89
SHA1 2f8773cc2b720143776a0909d19b98c4954b39cc
SHA256 2bc2372cfabd26933bc4012046e66a5d2efc9554c0835d1a0aa012d3bd1a6f9a
SHA512 03a4b7c53373ff6308a0292bb84981dc1566923e93669bbb11cb03d9f58a8d477a1a2399aac5059f477bbf1cf14b17817d208bc7c496b8675ece83cdabec5662

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE

MD5 f952ba4a41167405e39a0aeb43a3e7ee
SHA1 79e9b64b3aa44e29b3efbb2b221171cee33f9fee
SHA256 96fff4447325336e414766927336dfc989fa2e044ddb23d200d90ad91512aa89
SHA512 17761c9548928e2fa3b0340745abd466f355cf92532cf85e0aea54a180dad2a1c761c1409efbdf1b4a1f784507abbcba5dae694e731ae590d56d072af9af5e65

C:\Program Files\Google\Chrome\Application\chrome.exe

MD5 e24b57240b1f643e4fe2d9c2c6d494af
SHA1 fec24607f55434b1fb7c58e323eeccfb1c4a52ba
SHA256 456751f12a0326f15f7bfdea37af18068d1f565c0cfa1d5688286c4a966b2741
SHA512 fc0f5f9262a31387f3186150b29083d23fb7e43d328450d3331aab6b41df8012035e5b5ee6b6a901404a0b14aa4cc22ec2f7f2c02c94a6cdd3f9367d24ae6456

C:\Program Files\Google\Chrome\Application\chrome.cab

MD5 095092f4e746810c5829038d48afd55a
SHA1 246eb3d41194dddc826049bbafeb6fc522ec044a
SHA256 2f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588
SHA512 7f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 32dbb41c16d3033827f1af647b3b8921
SHA1 f807323e512445d56d7ccc53fd0a4e42ca4bffc7
SHA256 2931e3d0881b68c10faba6d4aef7342a9050d33e2ea0b2586e9cefeb14a07cbb
SHA512 48c74fdf677b9c3e5e21fabc930da4dd3b1384b0f72020c89d036456ca10c7600ecf895c2ab1b3521217655d1f60b83afaff9b9c783cb680da346c7dde31c162

C:\Program Files\Google\Chrome\Application\chrome_proxy.cab

MD5 b65d7344b0a7faa207d2e1a7adaafb60
SHA1 755ad15b1745b0e730d658d4a92e2b754425b7db
SHA256 f4b91fbbcba8a46eefe4965e4a24c6ede3decbd1fec96e141a1953173efd1c92
SHA512 f17ac73c2df7c73a31b11ce0f533d6db91bdb0cdeea653dcd52ac72c3cf28da0c236b79586ddc7a6c825fdd171290722f888465e776f12ac2cae75be82726b22

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.cab

MD5 527e039ba9add8a7fac3a6bc30a6d476
SHA1 729a329265eda72cada039c1941e7c672addfc19
SHA256 4b8a72fc81b733ed2e6e70d4c5401f954002783dbf14927849ad579860780b94
SHA512 9e73e14e33a5f07a87e9c1fecfdaee09d1408471052aacfde3d1e877dad4d253b525ebefca6bddabc23cf81d8dcce0785aedcc2f135d171ecbb1feaeb922c449

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 ac1278a7cd13aad0d57387023c93d4e7
SHA1 8fa3da4f345845a7c242f41353364281fa74a88f
SHA256 536ed7c84de346eb429640e48e81ca8d3f08d84c4300aca503942947721714ad
SHA512 1e74aebd72a473a59f4908cc1de012a5ec2539edc030be263c6a8564a94a936c1e86db41c9068a6cf5a8006311de1c4d3e3f08d623a465909b9502cd5828448d

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.cab

MD5 ec6386b63c3a5ffe0577905e94262c3a
SHA1 8f8c428d0e7f32c9d733ca28384ded413a060588
SHA256 302c968ab3e1227d54df4e72f39088d7483d25eeb3037f0b16bc39cef2728fa4
SHA512 ddbefb759858493de1f9d7addc6ff4488c8be3164374e0a88c3cbe97751510005dfe6d91c5499fcbdc35aa33a8eda2d45591a66e54ab9462277dc833faef77c3

memory/2724-238-0x0000000000400000-0x000000000046E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 01:52

Reported

2024-06-11 01:55

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe"

Signatures

Detects executables built or packed with MPress PE compressor

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\Desktop\Wallpaper = "C:\\windows\\WallPapers.jpg" C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\7zFM.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX4FA1.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX4FE1.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\dotnet\dotnet.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX4F6A.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\readme.1xt C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX4EF8.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome_proxy.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX4F5A.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\RCX5004.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\RCX4DF6.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4E36.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\RCX4EF9.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX4F8F.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\RCX4D85.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\RCX4D95.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX4F90.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\RCX4DF5.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\dotnet\dotnet.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX4F7C.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\RCX4DF4.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\dotnet\RCX4EC7.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX4F6B.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4E48.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX4F58.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX4F7D.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\RCX4FF2.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\RCX4FF3.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\Program Files\7-Zip\7z.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX4F59.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\RCX4F91.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4E16.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\7-Zip\RCX4D84.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4E47.tmp C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\windows\readme.1xt C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
File created C:\windows\WallPapers.jpg C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Desktop\General C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\windows\\WallPapers.jpg" C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe

"C:\Users\Admin\AppData\Local\Temp\ae26c12864ef06ee366884cafcc6f6f7e5856454ebde7710881cfb5e7d22fd39.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3980 -ip 3980

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 940

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

memory/3980-1-0x0000000000400000-0x000000000046E000-memory.dmp

C:\Program Files\7-Zip\7z.exe

MD5 5c1c1ec850874a94c4379659e84fc352
SHA1 48af10169bca2c1596efa9dfd171f39547f7c2d8
SHA256 1b8a558be71c222aaa6ecf8293b73a40bff60453feab71a11fc0710ad7b08446
SHA512 2b3cd56ccb2cb2f09f9d847a4a046b7f7c34188e032a4a96bee9837f2437e29dd13a1003757fc5662d62e0fd92c46ea3d51ab0e31b0632fbb251a75b3c5851f0

C:\Program Files\7-Zip\7z.cab

MD5 9a1dd1d96481d61934dcc2d568971d06
SHA1 f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA256 8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA512 7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

C:\Program Files\7-Zip\7zFM.cab

MD5 30ac0b832d75598fb3ec37b6f2a8c86a
SHA1 6f47dbfd6ff36df7ba581a4cef024da527dc3046
SHA256 1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74
SHA512 505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX4E16.tmp

MD5 8d9797194e3826b5ab1050f637275859
SHA1 e633cc82c5ae2f57aba7cf83738a592cff2a8fc9
SHA256 ed8e457251c983d7acdcd3dcbdf750d21509aa056e62fee6525034e1721941dd
SHA512 aaed0b4b27ecb5616d5967226c3d6e2b9aaaa432380747f8cc5c9b83659d1a72cc175fe0157359f3b622fba4e7b94bb4626726ed97150662d1f4ded0fbb1ab18

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab

MD5 b8d69fa2755c3ab1f12f8866a8e2a4f7
SHA1 8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d
SHA256 7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd
SHA512 5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab

MD5 3dc3594fb3b25c55081fe4b3226abbc2
SHA1 7eaddfd597fc76244f71f98877f7149c9e85dc9e
SHA256 6d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e
SHA512 8f268673c86e2c38d1713696ed25b75a565d8beb5b05ea755c9cbb12f625b8d4abfc1bb3f9f54c297ba4bd7dd9e465737c30f492aaef0034b0e1568ce13d2445

C:\Program Files\dotnet\dotnet.cab

MD5 33b4c87f18b4c49114d7a8980241657a
SHA1 254c67b915e45ad8584434a4af5e06ca730baa3b
SHA256 587296f3ff624295079471e529104385e5c30ddc46462096d343c76515e1d662
SHA512 42b48b4dcd76a8b2200cfafddc064c053a9d1a4b91b81dee9153322c0b2269e4d75f340c1bf7e7750351fb656445efaf1e1fe0f7e543497b247dd3f83f0c86f9

C:\Program Files\dotnet\dotnet.exe

MD5 bd83997377955cd71556676c1caa7d80
SHA1 f7fecfbf35e7912772035dbb22661e9e85d01418
SHA256 f01c11f38484acf0b647b4a21406811949c1f9b2be19243e6555a7c712c2e83c
SHA512 595926dcfb5ff5c8256ad790c9426c5e8b9674c18986c75194b9aad7ad6dad4a090b8a4eb06aad7dc0e1a88c8e2e862ebc7642527bccc3fc0cb3954626f9ad39

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab

MD5 8e4a401d4862a3ab07d4e7e17cbdfc78
SHA1 8ff6d2c100a2ba9b8159b9f733da011c8e448534
SHA256 6e25f414dd65440cd0c285990f4eef789a831fff640dadb4afdf79a5dfd95bc2
SHA512 74477239112082429db839be011cbe3d7d8fa66c9b8089dc93b18c1392ae57c935f39446227049e6f7f29e86122d191fa4f2f8d59b87f1f7b6eba3ae4d61a579

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe

MD5 8b53570ae1ce487129b203011f9c1eb0
SHA1 a42c681ac31fc79b600b03cf81bd5ec9b44c2677
SHA256 c79e55ed201cf8a4f13831ed0b4d66c197a48017685f2e8bf175d9b0c7948eb3
SHA512 ba27b3c93b0d841022b36faf2e0744cdf2634d642ccbead3ef71b49b1bf5b488027815f2b3833a273ff31dea319f8375ee07de9b1c0d00d63aa97238bca54a73

C:\Program Files\Google\Chrome\Application\chrome.cab

MD5 bfcb32781aeefc243ce925c9e558c21a
SHA1 320e7a68e6a57bdf4bcac921be7c0eddd3d87cf7
SHA256 1d5984c3c178d0bdce409fe302369ca192f252562a3e2d50bf7501f0d6695f7d
SHA512 a9387b7bd491ce60058d1a459d0b08ff73cd56af0bfcc2fba36e2cfb767c759ae5f0dec44635ae635ed2b2adf02213735c416d729404d5d03ba4bbf7f1d4c41c

C:\Program Files\Google\Chrome\Application\chrome.exe

MD5 95329ee224136c2df8c2487178546ea0
SHA1 b51065030ba6114542229dde8a2c59505ce7a99f
SHA256 9735f88653ae92c70c8ccf78b6ca45437bc3f0aa92f77914a50849fa4fdc16b4
SHA512 951e017b39aae4b0051b94f26d90d43af83b8cdd3c4619688848b05a91edb9669648326b71a087597120db00c7bd1afa72213ae01260b12e47ddbd717e7b48af

C:\Program Files\Google\Chrome\Application\chrome_proxy.cab

MD5 1d299dac46c67a0ce7ab712d934d0a6f
SHA1 3135016ff17ca69aae5a2d748a8e7d36bd008add
SHA256 b6d3291baf815d909264816c91be07c46bd9de2a69fc49cd4a50942e81edc161
SHA512 14a90184ccdd2db298a222efee7d76c00ccec31b82af7caf6d6d5e8a3cbc078b77e238cdce0e29fdbb2f58ed337571b91e119011fb7b2f70af520d19a7de7488

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.cab

MD5 47ed928efd1c64f26622c99a2b6532cf
SHA1 4abade6b7774ee188bc9359e0c72d92fc3918e33
SHA256 bc2e087089efc2416135a5b1a75c5b54c0c7c684862e543cc94b989a889f80d1
SHA512 3fb5bd979b08e005fb1ac06dc7672c47ad64fba499980868560706d503a4d7b6d079ea2909d61791b1caaeee4d0b1cc03a665076deb03156723edb5fcad20dc5

memory/3980-237-0x0000000000400000-0x000000000046E000-memory.dmp