Analysis Overview

score

9^/10

SHA256

7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4

Threat Level: Likely malicious

The file 7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4 was found to be: Likely malicious.

Malicious Activity Summary

ransomware

Renames multiple (1370) files with added filename extension

Renames multiple (3664) files with added filename extension

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-14 00:32

Signatures

Unsigned PE

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 00:32

Reported

2024-06-14 00:34

Platform

win7-20240220-en

Max time kernel

150s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe"

Signatures

Renames multiple (3664) files with added filename extension

ransomware

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\Zombie.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File created	C:\Windows\SysWOW64\Zombie.exe	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	N/A
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libjpeg_plugin.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.png.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\service.js.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\drag.png.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\34.png.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Brussels.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_display_plugin.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Management.Instrumentation.Resources.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_settings.png.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Mozilla Firefox\notificationserver.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\clock.css.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\settings.css.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\slideShow.js.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter.png.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Oslo.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_disabled.png.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\picturePuzzle.js.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\America\Montevideo.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider_right.png.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libnoseek_plugin.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\service.js.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3040 wrote to memory of 2660	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	C:\Users\Admin\AppData\Local\Temp\_287.exe
PID 3040 wrote to memory of 2660	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	C:\Users\Admin\AppData\Local\Temp\_287.exe
PID 3040 wrote to memory of 2660	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	C:\Users\Admin\AppData\Local\Temp\_287.exe
PID 3040 wrote to memory of 2660	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	C:\Users\Admin\AppData\Local\Temp\_287.exe
PID 3040 wrote to memory of 2484	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	C:\Windows\SysWOW64\Zombie.exe
PID 3040 wrote to memory of 2484	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	C:\Windows\SysWOW64\Zombie.exe
PID 3040 wrote to memory of 2484	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	C:\Windows\SysWOW64\Zombie.exe
PID 3040 wrote to memory of 2484	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	C:\Windows\SysWOW64\Zombie.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe

"C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe"

C:\Users\Admin\AppData\Local\Temp\_287.exe

"_287.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_287.exe

MD5	1d1dfe9af875eca43aded55dd4371543
SHA1	2edd6658873e2cc97c33d8107354b6727efac16e
SHA256	6118b680527759f64b4f8b6f5721dddb428d4a2baf90b6841819facdb542a771
SHA512	fbf2e049cbb3f5c54a9c4db3e683d2bdfa6c61f18736a8118ea9128dbbef571d1760338545e03631fb66adf98f9251c6ca61cbfe80878274ef9b6ea4ee1dd067

\Windows\SysWOW64\Zombie.exe

MD5	dac20187d8fddab7a342cf5042502ce2
SHA1	57b6e91494c739b24e4d923afdcaf66e70ff309c
SHA256	7191e0ca0ff69e17675743798a50df7c864cb58969c9f802bb1eba5ad8500aa4
SHA512	1b70d8f441f47c70cf352a50983626b9635ce78ba6771068dacc713fa62a7146ad44d694bb25b4c439454192407d2ef0e571f9e5156f3a37a8d4b60281f0154a

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

MD5	dc6516e10090bc5b16c06480cbd85291
SHA1	f31fbafe80ee94830b50299088d0316c27881868
SHA256	1987a3abfe53c78a2224b249ae5c2b21880d1905e0e7165a35338f355e3273e7
SHA512	b4ab11ee4bc87f5aadaf5cb4b153743df9726945a40c6e1a7b7b20535387551c8b1d6bd45fb17902bd510b06eeb7449a455c1d436c18721cb874c4e30d9fffe1

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.exe.tmp

MD5	70fec3e1848d7f941ca5f7e5e022172a
SHA1	51d3527f7b202105490b71b88159647894de5503
SHA256	e9539f1be3c47fde97b1f23db4c9f7c3726d09375775f1a1a7c08b251f0574d0
SHA512	9047053f535f89b103bd3cb5ee78b0ecb517815d2a68e49a1601f087049aa00c50e4f16cc8db19c009c84cecf6b411ea52dadab594a58ac77ddd4cf126dfc45d

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.tmp

MD5	cfc3cff17fbea6610f78a5c05982955f
SHA1	bb37c92761b9bb776630889c1a117722addea099
SHA256	f721ecaf37cf6bd1d42ab7bb89291e97902125cccdb9692a0abc5dd9115e9727
SHA512	677b09abea6ed927763adf2558ce547dff717d9c3957178282d9fa4ebab8906e23fea90ab45e69842033fc8f10947c0035b9d46c18e72a2bec155920bf37f6fa

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

MD5	15af7636a8fb01670f6665d0fd9a0c26
SHA1	22237848c16a525c931a86474b1c5084b9f46acc
SHA256	12a5bd1507f55e321ade4aec7c289609403906780559a90ded0409a363b3b89b
SHA512	2dd61707194e64a5f6081e7267a47f2a533de3bd6443f531e258a975093e362d5d68dde32fb6ace97e413dbcff34ba3a0b66567493c7ee2fffdee7f66d267ec2

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.tmp

MD5	4f550ac5098051dfa2bed95fef42843d
SHA1	94f9a821ba23772a121457403392b626a5f7d544
SHA256	92412c5a4a8acd9b7e5c72e1a64bf4381dfc5f8c5f14017bb653d0e0d417448a
SHA512	55c577a771e5c1b2983447b5d099f026cfa9437b7ff547893e8958cd019dd1b9b8a01534818c4ba40dc621d64c32229df0692d16e5ac8820ee5f3cf3aead6f91

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.tmp

MD5	60224c5a1a8bda6b93262d1ad3d8e2d2
SHA1	1be60e861252466cbaed014a662f7a64a4da26c8
SHA256	7a431c1c5d86b9bd487ab986ef8f49706c969f4622c58126c7d75f3032d7ace4
SHA512	da31c40be05b2ca905f554653605b4432e0c407ce20aa34267eac9f50f2993b80652ee30c8b71fab14d3b4200c6ecb3a869c909f6027ada5432176af903cbcd0

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.tmp

MD5	697e6e2a80c681f425b4b38b25017bd4
SHA1	01a876b3d20044f7e4c69dd88b70b6090d4fd6e7
SHA256	59f83d8aeee21a1cf9c0a0f98482f3f21add228929f0379edf418dea8b295770
SHA512	32c634932d2e11579224353b38377f49fce159d046fb6f562efea8ee96f6f3af1fec7f614c6fae9e501068e6778c460eb66f4e5b4c80487531bd445aeb24596f

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.tmp

MD5	0b24161716e0f4de2d0d485db7298efe
SHA1	2c0426db8c4ed7a42dfeafa9e253730355434671
SHA256	bc3461692d116ce85c02319753ea587f18769ad9f2fea647dae74ead1aad1327
SHA512	ed9197ab8c34a80a9eee9b45382acd8f69be540ce776aff0b5634c7084c2f04cb9eda3a870c011606aa943105de0eb74a57fa8f849a56625d66e2d3a23aaf81c

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe

MD5	dfb238e661a86683ec0a17f495a63eab
SHA1	5f4ef47855f2b33d04de5e87ef46712ead630ed4
SHA256	656308f12a8530493e3bb903468e19fe1123f5a6a67de4be45e42709eb770220
SHA512	3ac4a73a16518096ee4281f0ef4fd4f5d09600cd9d377e5f29144f6aac5bd02a19c537c0414bbf952287f69adf844930d26bd80634edc0dabe5c5d8810670caa

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.tmp

MD5	f434aeb0e45c46cea6bac5bec751ff10
SHA1	a64979d4c128d65ee8eb4c20eb1d958cc41a5913
SHA256	03118c88ace827635e6eab8126b13dfdc5c1712f16038d343711dd03a36c76c1
SHA512	de97dd78549dfd7acfc36d96e5b3b305b681cece0ccde5646048ddef3b042452df90f4289659b23771e7967f2b20949e10bdbd48c5a7a3d3e9716494a441a7b8

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.exe

MD5	1c0d769cbe5ef98df05489eb2255c6aa
SHA1	172fa1e7afda74a1186810cf911da360af6b68c1
SHA256	44f61de49a825a8e6397266ab8c82791e5a23bb1b1f2c826c6e10c07f020953d
SHA512	517b066c90a7799aa1117c0a351c00289fb3ddc4bd99ebf81fde693e1d0633d58c1f9daea4df045996fdd7217b99bf60533c4a6b5faf7e9a65013cc3991cc9b4

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.tmp

MD5	15d35503ef81b669bc5881242528c858
SHA1	ab88d5e5ab2a62aee2d5ad5408e4856f7890ab1a
SHA256	889fa7d20c346825474ee4faef9beca7e8136dcaa00281cb41cdffeb593db210
SHA512	bf55d81cffed8d9a104a99fdd84dda2b52d1921c4259ffdc924c4d3db30f377da5702a855bddbdb2510481088393e75c0a430f339e4c374b1a4b50bb21d724f4

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab.tmp

MD5	36b7417ff9348cc0c2931fa98a01a4cb
SHA1	96920e93dcdeb24c53ec5b15722ea004ec2b5cb4
SHA256	4b12d87418e8d040edf0d0faf8db11b3ec6174ad5c735dc56ead5ee1d097350c
SHA512	ff2dff29c6f7c98d1b639db6a119563e21898a7db73ee9bb95ad99d807513f3af297dd03553927d331c3af3563948e73840fca9fef5d27b16fab802555c35c65

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab.tmp

MD5	8fbbe334a21567a434ed0fb669fe95be
SHA1	41ed3c68fba53ed88b53de8620876c742df6e605
SHA256	e39484c29e005cf08670840e3987ad268121ff3fcd5fbfa1e7e40073df959ece
SHA512	cc3998a40da4d296ece067bfd9bd67f5a9ca3504d2aee1f62a9c975a9b78a0c92d269f4dd8ad1156e33c4b5343178d6fba23921af5346bdb893b8fb6a93757ee

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.msi.tmp

MD5	8d26b1e945a818250910468024006d70
SHA1	e299dd06442424bf358400e14d6e7c01630e84c3
SHA256	32e5bca12cf3f055aa23cb69a451cbea8864d732e9d4d524969abc49918b6dc3
SHA512	56949ce949aa33250346eaf74c3847baad944363424bb6b4cd6ff211b3d61933ee13c767ed891b6c9670f1db777644d45672d5ce5fb27f7880215f68aaaedbae

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml.exe

MD5	d17e216803955ed3f252056f5b79bfa9
SHA1	a9a3cbe9fee3b65dc89c043aae3e068eb1d6b6f4
SHA256	00f98eca75b5110f762eba73dc945e49996b7db930a1b804b042e3ffa33f6d23
SHA512	2dd83b971deb6aa16d0281d30238ef89f28216bc6f0bad8cba6eaf796ac2005e01739cfed3edc975a6cf12ec6d548d0eb25a4f402da150cd7e70a290b7b5d95b

C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.msi.tmp

MD5	0ddd164843a26ccc87c79f2b0d7ad97a
SHA1	a89569d282811d80994846f87ba5d3cba4201def
SHA256	75474f8416352d0b636020dd967ff6f256b50743a40489cb532f5442ae0e9073
SHA512	fd7a3e87e9461abb9354a9fa3baa895b915d2907fb639b270d38eb6df56c68ce2e7f918ad85003094e49c8c54cb619320efaed53fd14328ebacf82466b06f3fd

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab.tmp

MD5	86e95506409e41ecc28e157b7c06d62b
SHA1	d8402191efc8cd5f992d539095e525593fcce299
SHA256	3ce3e80402f3431fdeb6269541e1cf320cc447e869430c96bed71d2a05c595a0
SHA512	7579953836b9d1ee9c2df8893430324c9a9782b57ecf396b4dc5807fd7ff8aa4c311c444d9f2920fe06811f120f1a03f82e2f367238e1c7f047327bee403b72f

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.cab.tmp

MD5	b37bd526dc9057aa49e5cc9d18f621c4
SHA1	12210b2e51a53ece30560bc6d4b0a21303bca57f
SHA256	cc8f6267d0bd004f0b49756ff9e4f95bd36c55c13b8997b30d8622bded837cd9
SHA512	b143af014215afd3c140757fe9d037d8a562d806484b10830191193a7ff22a9249e5a83f51ed71a96e2c485e7c8ee7d88622abdfac6a9db65aad9df77fc8009d

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml.tmp

MD5	b21e1609a01e91bd9b32fbec051b0667
SHA1	3cb676a9f3cd1998a5b052aadb3b087996ca422b
SHA256	7e142119e0130f523d44b2a8aaa8ab076a5eb8168b1c2bcfbc111e496d43cdc6
SHA512	04b1be68e09c19fe16c8539b249fc5404ce0cf5404f5c4d9d3d9f764f763c33d601b7bc07bb778122b8462ec6f710fff30f1abaf278611a71c4a983b3df1fa9c

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.cab.tmp

MD5	b4609f301f70e335aede6baaaa680877
SHA1	5c59b9efa690e992089ee950587202e2777385e5
SHA256	97aa580c2e474b733db004740929f1a0a0482c9616bfe3efba4f78f848c7abe1
SHA512	641bc182d9e2e01b5f12e33930fc341b66b5302264653447be5044289f5da5a7efde0684b2cc5c478546a1ce1cde1d245532855a2e1fa20eb5c86e8b9dd73f1d

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.msi.tmp

MD5	5272927edb5d371efa1459c80191ca15
SHA1	60927fda50f056c7c5f4ac1e7e9c8471c4b37632
SHA256	618a6f28daecab9afb479da43a27bc769e4a6b0ccde7a6af88f1ce99b4fa9939
SHA512	dfc068e3bf1a2080d0fd5def47601a5a2b3af5149c52446ae4136f32d8f5a411816a317b22646cbcd0a133a0a071720493da1178c375215eb4c73c33d4372c34

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml.tmp

MD5	0dc5ba981781ec1a27f85a997ca2281c
SHA1	83b99a517bca6a9c459c1741601729d297f014be
SHA256	c7708eaf6d638082dd4c8b27c175908edf6c5519fe3ea0ad66db8ea4bfa6f24d
SHA512	0c5c9fd8f2acea00f0b55d09d4009d442c169a5b01cefd71b63d1350b0d7062504dd6978d7dcc0c1ebb2467db1e03acf57953848a941fa302ed083398c0a402f

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.msi.tmp

MD5	a1dc001228469ba6143dc290ecbe5f26
SHA1	b2010c01d9fede116796dea22d5262b18e803c08
SHA256	726e985818572f6275cd49ea5297338c37c0496f87cfc67b43532b78c9f3bcdb
SHA512	9a7801935a2e797f1d649f16a4455086e221e02ed06304e30d80b727aab0cb24e967a3d8b5280be498ebcf4214115136e66afbc5b6f509f23c92e4c930c05a68

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml.tmp

MD5	590e9faad06f79fdb5ad65d79397d2c3
SHA1	f0359045eabcd0c12fa97d3ab09cda619bf9e2b1
SHA256	8a5e299bf67252ceb0fde55fe6c59b595799f26f0d3fa045798ec132bc7703d9
SHA512	957ae2804995648461c81f4861cec5b46d03b9fc91e9c6787f1a4b0f1ee9cccd28c742d65ed2ee26231baee21dc546a14cc51e8c06e7b7ff6f32912796ea583f

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml.tmp

MD5	af403e8bee4e6e276a06979aa2e177c1
SHA1	a984a8aa9e76fcdac2f831d1913656eaf422e769
SHA256	78965efce88bc178c206a0f70a113e6050459e93c67e0c8af53bc308a90cee0e
SHA512	e595fe642a29b9f5d2cfe45b95d27fd767b5996fe2a7402d79d59f2e405454ada055fad9b9b4e3687aee5a83ae4827c1b241b125c63e7b5c3d7fb0694c23f800

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp

MD5	d10e022f0250ba38d8c97e40009cb23b
SHA1	6374968e37cef382cdc88e51ab479b53cf14f6fa
SHA256	7c53e377fd1432cad7bd16d8832649e59266c4339741c432c98dfb581be2605b
SHA512	da7fa1bf108f99bb130d0d578367a43d2aa3c47b856ae833dc1bcd2b5d9b9b71f61f079c27528a59e3a028883af12b54bd25fac697154d56c7622a315d45a0ef

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfLR.cab.tmp

MD5	8dbd9f7865d371166beb9371223cf695
SHA1	c94c7c0b4bdb071ff66b9135553aeb45a4b1f511
SHA256	6720e5762a0b75ddd303792355f0bd6409ca8165b877c629f73db786177fd276
SHA512	82771955c29acaf62d3927869d615e2f4be1eb11036872da5f7519869c0de0139fca6d33c110c83dbc16a64779be235a0d7983ad7c188ade7abac288effd41a3

C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\InfoPathMUI.msi.tmp

MD5	270cf91b60d11aafb5b5e5916df9b3be
SHA1	68925adbf583d94ecf55a633e517dff45995103a
SHA256	2629c0156f5863245c5d73e09062e0483d0203bb4e835f287c06608c71ca00ec
SHA512	38194f9b9d53e89bd4ad08f1b913d26bb3c67f825ac8075f83e8b0bb891fcd023afde5d3497b1d033da2cd49b3acfe6cb73f9f040785d5a3b67c24b6274ca4eb

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.tmp

MD5	5cba2abff9c038d880ea52bc04c4a709
SHA1	88dd455bd5fcc6ccd91dbbe78067c039b753744f
SHA256	27942bd3b35418f2a3b7c16c5b7cf1a1101d7aeb0cdb97240992f7723750d6da
SHA512	ccd09b5afbb7c43ef9b5cb429623a9be94f7cdcd147839a0db19f4a35e3704f3bbcbcc61e6a546404708813d79fe5d575dc2689b958ab9f7c2d7b4ea8f9125d2

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.msi.tmp

MD5	d488717c1303ab4f76df84c6fde9c5e7
SHA1	8997b0fa9bfb4baebe34da1b77d1470730cafa68
SHA256	bfd3f7209a33e4a948e44f3ff98e98421a25fe2917f23e955ca9cb83f35fce1b
SHA512	e8701616791d8e7bb682b77764e58a6a8ce421345a707416c9f9459fda3d7d6d1c181093a98a230a9a0d8ef0e01da8db277fd8ebcc8faa5fd35c60de153b7dca

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml.tmp

MD5	5f0f467a3c4c724c6162937e1e20a583
SHA1	90274f8af7c9d8d79d5a36bbaa781317bf461b23
SHA256	1e9d354eafb64d716a2ecfb51e3782ebf2481cb73fbeb5757aae41f6cedb2e7a
SHA512	a94833a2d7692037e3fac22b8dbf5a5ce022256e37a0a0556016d861385e80f0fe378e7d2c488e7b13a1642c6d861f74dcbce89ea0b84a658da55e5d309ede20

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab.tmp

MD5	8e6d00a49e1acd5d5db7bab4c99c2592
SHA1	26291ef8a56277da11250df46afaa952e49dbf43
SHA256	564e23cb100a2c197222d080c3f3a198d5f6cfb976a1515e79906a5fe13e0b82
SHA512	c42e15e89bc3b8522663506de8e08e94f2f04408edd3bdb97cf519f974422c1daf4236fc82abbe721dcb2f332a085670b86c81d9c8e60743a8ad7c369fa95745

C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OnoteLR.cab.tmp

MD5	4810fb40d57ae1d9fe0449d3cf16a742
SHA1	3275f5aabee996f85963257e24d6c7574aa027d6
SHA256	b297b168aa0acfe06d83c158512ad29368b35f7c173a5ed7be41301ccf2c3415
SHA512	67ead018370bc2cc1f99604818100da86b2c055295b3055a879f6c0d810f02bc8ff5fc4698663e69d7b32635bbbf493309e31d77496364ee6f141177294b547e

C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab.tmp

MD5	82fb0e68be49b9367a8ebbfe7ebf5089
SHA1	326cc6d625d7471e2cbe536e9abe0b91d6060a85
SHA256	fe0030bf87de0675f02b5c531c46cf3d7a5430cc67d115e7caf7dc20bc8845ff
SHA512	4cb61a7a27f5d7a96db2ff803ac8eba8c4a9bb110daa8a95f291e70772485d4d1df6270751f4cfe63a03f9137babf239a510ad3f4d11e64806844ef043b20483

C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.msi.tmp

MD5	ab63501ee4cf05a944f1811aac3814ed
SHA1	90825798264ff117e13a2153a0c5a30db0717085
SHA256	edebfd09f0575ac503010d3bb802ff6909a62be87078ee9077a3d8607320bb0c
SHA512	6cd3ba2713ee2713e58d57e4ccb3e2c6466a959d1f3f7c74de8977b669b056e79cf910a58a79cfc851ed8368870d1be4b3c78396dd3b56e5ad097358a458d11e

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\dwintl20.dll.exe

MD5	1cc0512725d2006a3920628553c297da
SHA1	c32028629542c2928f690d61f91e041ee4ca01f1
SHA256	20ec8066bd039180ea939ec29fabac43ac9ac151913c40818c98cea6816c1913
SHA512	cddfb13b5f17a3910da31348e84e14ee9b8315ff2723aabdc9c03f4493ab6a6d314c2c1dd4c4667fcd713e2566fcc728a56a93f735b7ac8543d44a62ffa88e74

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml.exe

MD5	86925568395ff030387c894adea94b7b
SHA1	88172d934260e212ed06544c2025e81f96e20525
SHA256	c3c34d055cd8dd11695af697ebfc1228fc3d01e7dd85818e9fcdcbcb36d96d35
SHA512	a73dfa96da1d861d2444e29d3b660c5e6a5d9464d5e7b4dbeb981ef63eaeebd9532ac8542dc27711e7d75a75a0fdc341d2955446b7e05b3fc45b4f17c7ddbe81

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE.tmp

MD5	93554e6be39eaadd54880eddd1ddea7d
SHA1	e8f6beba9e2ad89d7f195599f75df2f95d25532c
SHA256	e2743316c75f8241ddf37f54486305b7f54a4e146512eeda3cdfcb8589d278d9
SHA512	53e70d6e3cb679af067d530e077b2ebff2146638968d60a056188172a7f59499870bdeb38d108e86f104f6022d06692949796a90a199a401f093236289cf9a6d

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwdcw20.dll.tmp

MD5	f65cd46528a45727f0795f2a22821b6d
SHA1	a5fbfbbef922dd0842c2e7130583d342ee681d2d
SHA256	8d25c952f2969827e85e06f19e724c84169d7ae890cec383ce6baabc1cb87a07
SHA512	231c51a1986df8a61465de6c183b148eee383624560035e23d218e19af9d3e6042519e1064d88e3f80d5ebfd254a3f646e89fa7a44df018542acb56c40b946a9

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe.tmp

MD5	375212ab59799ae72357ab64528173fb
SHA1	a89325ccd1df07c4c6c166efaa503ab4c4eca218
SHA256	0270b193e7e1f117a6c0ed0ec121022392db25d921dbcfce6f38deffa87c1b29
SHA512	abae414bdffa3aac7fe9762647f25726b3c85dcdbca18554f1ced344d8fb53e8617e96641e26b6128b68113f43d995dc1d39270e71e381d450a0a1b8eeb2a0c7

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\msvcr90.dll.tmp

MD5	675ace62e1a20cb28b35e9bfbf9a036c
SHA1	065c759d3238274689e2f5789ecf0db0fb3577fe
SHA256	ffa2960829a3e491bad2c836e04cebf03924551b4405a0461a74288fb6425267
SHA512	117fafcfa69e9f5c278c064af3c2942dc3c141962923d62c29f5600c684530104b4dda45e65dfc572719551872cb93cca45a3a122defd633a619126d6291df6c

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab.tmp

MD5	d2c170e763518d38074941a4ea56090f
SHA1	ce65ed122fae67c117d31d8ad31f655701b70ba1
SHA256	9a05c0d9fbcaf95d75b3f92710cfa311aed7032219a821c4a556a7a3b8bcba17
SHA512	19c3e8d61c842ff7013c2752d38151cd3233fe96493c71081d4b1bbe56fb1c11e6fe24fbe7f32bd393bcb056ad7fa6498205bfb7282825af1105c3aa64086b87

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeLR.cab.tmp

MD5	c94dd47fcaa7e3b0b2d120cd70f69d8f
SHA1	b792dd1a41770afd1a9a65032dfb0abfb80d75fb
SHA256	fcab5364a9af6fefd1fd035003d42d6d2af9c2cc115aff32f39d8598d8820a2e
SHA512	7726a09a485ba63228fa2b1e078643e6d4c4521ea82966f9ba5e952fb1f63ffc25a00c25d2026531a9834ebd315dfeada8368017815b1269cf0d6a36cdf7d638

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUI.msi.tmp

MD5	0935c7de75adce2d793cd6616c071d9a
SHA1	691ac3202b7c53ec53ce430222c3b3a1dc1ee752
SHA256	f57fc093c411b1c5025385bedb8fbbe60a2b2442690326f636514d36500afe05
SHA512	693a5b35b08381be88e55c8776d11261ce99d4d5403255322d432856c6186da321a01d7da9e9513f562b39d0a3b970d2f9538f09e61b98828454168bcae2cdbb

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\OfficeMUISet.msi.tmp

MD5	82530e65486712cb8200109f07bc8f75
SHA1	e8816a05ecfc10fbcd4649d6dc1e755234d3b60f
SHA256	fc7344dcaf577b9d5088d9863f029f43797313d0e298a87895a400af98159a06
SHA512	eed4d33aa9ada625f27cb8797f919dac2200b8fac7965b0dc39c4121017cb81eb81e2cd9a1e29f8a40bd85d46b5d1279f69bdf2388d111cf820c74d8dc1193fb

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\pss10r.chm.tmp

MD5	ce44430cc32faaa430ca3a4716f12486
SHA1	a98eb1332e1f680b02f68ffafbffe12e4edca041
SHA256	3a872cedf9d0c7dacbd904918cd6d34d95ec1c68e16cbe7e2e4b18f56bf60bab
SHA512	6568c53eb0609290bc9be668df6161fa42057a8101209d4b94566423259ebe37fdd244396c748d82e9b7ac7bb4a65b22cada096179edd2a838b61c9fe9424dac

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\setup.chm.tmp

MD5	fac6c471482e26bdb3252d91e63ceadd
SHA1	02b985e0b18550692abd3b4fd332f5fc0c3c9ace
SHA256	16425c91042f26ddaec32630f17e75859572281735d9649c8b65b41bd0b9fb57
SHA512	98098673d399a6faa40a9dab81fce2a91358111e8bd645e4e9d761ca4030b916642b630a4c4d44a90387ddcc2865f4577bddd640706a31b7b9d972be2e105b34

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\ShellUI.MST.tmp

MD5	c8596a0a367e2aca76b6a5e5990f2a67
SHA1	b47ac4958c2b8a55ae7f9dbcc4df5174508b341e
SHA256	60d3cd23674d3e110147f5bdc6574c64fbb3fec03a129d11da99585ba981ad7a
SHA512	010d97f775095669807b36ba3a7e0f3f86ac637bdee46b7b706f2829876581bbeac3040fd0c1e866b1b273a84db5169e08650b67d3890cf3dd794dd455e08c9c

C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Setup.xml.tmp

MD5	da4a52a6a4948b2bf68c12335fea5bda
SHA1	17c00af5594ab0db1d37602359390cc2b054156c
SHA256	98303e4d5ad0e04eec7fc3a315bf0dac6a258f4474bfed7b09d582763a3703ff
SHA512	cec4391e113aa3125f101fd2e073f854bdd46ad7946dabd9788c27386bfac633a9602d464b7f30be22fab271d4c2ead56dfdf14d4dc2a2788f0b8976c052e148

C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.msi.tmp

MD5	ac0c6f28c3c83893e33dd4822c7da664
SHA1	f97c27fb9fafe787d6ad05ed34efe6cc9da7ef87
SHA256	eb04566375225bb5facf9c723e213b8d69db93c1bc001f3707024751d22ace68
SHA512	30cdb18e6f2f3a1b5e625ebebfb92b0ffdb1b666411792e3b9483d327e2487935f2f3985fb7a3ce4102e8071d0f58f9074676ad2c590f0fd06d38a98a35d2a97

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml.tmp

MD5	7a3f9451402e66dd8bc3a2d61754d7b1
SHA1	dde0c6ad7f32d5e4ad3fa604681fb30ff5cf01c3
SHA256	cc29a42beaa91a8e1c174dfa8aa381bfadfaa24b23032413927b9a65f6e15ea9
SHA512	bf57d13d90b0077dcc0c4f8888544a7efde0bdbe9b88118b49ccbdedddf6cc0056369d933dc7d15d21f5354a0d484d7188c0874f5103cf1cf5829c780abf65a0

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 00:32

Reported

2024-06-14 00:34

Platform

win10v2004-20240226-en

Max time kernel

153s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe"

Signatures

Renames multiple (1370) files with added filename extension

ransomware

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\Zombie.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File created	C:\Windows\SysWOW64\Zombie.exe	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	N/A
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\PresentationFramework.resources.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\PresentationUI.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\System.Windows.Forms.Primitives.resources.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Http.Json.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationProvider.resources.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Controls.Ribbon.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\CheckpointDisable.vdx.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationUI.resources.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.WindowsDesktop.App.deps.json.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\PresentationCore.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XPath.XDocument.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clrgc.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\UIAutomationClient.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Input.Manipulations.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\7-Zip\History.txt.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.IO.Packaging.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\System.Xaml.resources.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.MemoryMappedFiles.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\WindowsBase.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Forms.Design.resources.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\PresentationCore.resources.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Primitives.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\WindowsBase.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\wpfgfx_cor3.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\7-Zip\readme.txt.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationProvider.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.CodeDom.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.runtimeconfig.json.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationProvider.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.TypeExtensions.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\WindowsFormsIntegration.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\dotnet\dotnet.exe.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Xml.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	C:\Windows\SysWOW64\Zombie.exe	N/A
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	C:\Users\Admin\AppData\Local\Temp\_287.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4888 wrote to memory of 2624	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	C:\Windows\SysWOW64\Zombie.exe
PID 4888 wrote to memory of 2624	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	C:\Windows\SysWOW64\Zombie.exe
PID 4888 wrote to memory of 2624	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	C:\Windows\SysWOW64\Zombie.exe
PID 4888 wrote to memory of 4428	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	C:\Users\Admin\AppData\Local\Temp\_287.exe
PID 4888 wrote to memory of 4428	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	C:\Users\Admin\AppData\Local\Temp\_287.exe
PID 4888 wrote to memory of 4428	N/A	C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe	C:\Users\Admin\AppData\Local\Temp\_287.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe

"C:\Users\Admin\AppData\Local\Temp\7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4.exe"

C:\Windows\SysWOW64\Zombie.exe

"C:\Windows\system32\Zombie.exe"

C:\Users\Admin\AppData\Local\Temp\_287.exe

"_287.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
GB	96.16.110.114:80		tcp
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	75.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	159.113.53.23.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
GB	142.250.187.234:443		tcp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	13.107.246.64:443		tcp
US	8.8.8.8:53	65.139.73.23.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	11.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	91.16.208.104.in-addr.arpa	udp

Files

C:\Windows\SysWOW64\Zombie.exe

MD5	dac20187d8fddab7a342cf5042502ce2
SHA1	57b6e91494c739b24e4d923afdcaf66e70ff309c
SHA256	7191e0ca0ff69e17675743798a50df7c864cb58969c9f802bb1eba5ad8500aa4
SHA512	1b70d8f441f47c70cf352a50983626b9635ce78ba6771068dacc713fa62a7146ad44d694bb25b4c439454192407d2ef0e571f9e5156f3a37a8d4b60281f0154a

C:\Users\Admin\AppData\Local\Temp\_287.exe

MD5	1d1dfe9af875eca43aded55dd4371543
SHA1	2edd6658873e2cc97c33d8107354b6727efac16e
SHA256	6118b680527759f64b4f8b6f5721dddb428d4a2baf90b6841819facdb542a771
SHA512	fbf2e049cbb3f5c54a9c4db3e683d2bdfa6c61f18736a8118ea9128dbbef571d1760338545e03631fb66adf98f9251c6ca61cbfe80878274ef9b6ea4ee1dd067

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

MD5	e404a55437581e058626403d4fee8f19
SHA1	315b398a53d59310a3a23571a2cde07e6cc2c1e4
SHA256	7a126bfd37a25fe7147b2a818f5a3a76fd461c96a1905c2a61b1474a008b1c7f
SHA512	4242d9d0c41be0e3015af1bd0aea9d4eea0925abf6e9127104c5bd0ff72a1cfd9593449705ea49ca9dc8722d3f58038400c00e17b40a927231557050e29b5777

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.exe.tmp

MD5	730ba46e632104e08548458b660eb576
SHA1	d214acea596ca48632379c1526faffb2f2c0c3e1
SHA256	3656e9128e2086f34e11bc7d62398651b8eb5828c95242b0d8ed96dba3caf929
SHA512	8a67c6d33779168014aff3a4b43c5d4d603ae1350015b1b1f1629fc54606e9ea6929591642e86fc6fd6c1476480d9f65ab6a90ec486ab2c482b2bfadd83469c3

C:\odt\config.xml.exe

MD5	102e964fe42feb6f8b725c05ce8c9465
SHA1	f461b1fef8b2d8a5b4c8175a6309bce77bfa2d60
SHA256	caad26bcaaaa1665223f72887dae7093b7c675abab3293e9cb3223578565ed6d
SHA512	cc5059351d123252abe255053469449750807229f8863f00586003a3487ea3a1bbe230ca674db96a9664df7528a79384602539916706063cf9cf266d2854a0be

C:\odt\office2016setup.exe.tmp

MD5	7b46c7d25c48633c9a367db70efddefc
SHA1	0afca3787a679956c84bac81af16f3ee858aa4cf
SHA256	49813a882065f07c06c6ae6319eaacf538b243e5a655a3a8b252cb4e764f4932
SHA512	fb6304dc519a37fd43afe5424c6708097c03defc8a8b90150c1a71f8b981d3b06495c4a250ddd5a582dc78e09558abc4456175a3134182b6277d35cacde535d9

C:\Program Files\7-Zip\7-zip.chm.tmp

MD5	05c7eeb4be51567282b27fb47824b5e3
SHA1	a7d8c91b134c171b45f60057b751303ac234ac9d
SHA256	de54de7a00873c789b97975b38010ad532e029d7f4d5bf00f17f9c2bce851804
SHA512	bd54b5e10f11d515623af684567105510b47794a4c9cd01893474ce606de614c0976d986933287c93d3fdf245bc76576297946e5ecef9ad878a0f7bb4a09fc38

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5	5c6943e90fbcb90741f0e62b28fb68f1
SHA1	48ded320893518a14f24f8786c4a462ef06ad59b
SHA256	47b9138f7e5619d17d9297644cf85209de97bc8b10738d215ba7b52e8c945008
SHA512	946bc2ede0a19df61214c7980220441bf4503b43346745ba8a0d5797de70a5fbf116c769bc63ff3216aa75a8e9847b2991bdc0dc16c42f68743dff12951c262d

C:\Program Files\7-Zip\7-zip32.dll.tmp

MD5	341566de93a08af241d37e00d9bd8565
SHA1	10c12e6171a020016dadf5aa72e3a19fc22a69df
SHA256	2c3d357d91baf1bf8e2ea7633b8db34e2936e76d8950d84fc9a590c3bdcf3840
SHA512	3f0e4c7ac7ca50de4093ce698639fc307c50fb968017c12ae3f92e1d824378de2e939e010b5dac9844258bea5d1feecb05e3bffc424502ba6212f9e65afacc57

C:\Program Files\7-Zip\7z.exe.tmp

MD5	159a8c8935efe2c56b9db6ecdf70c6f2
SHA1	0bff1291e651127ad7ec73694ae7542771a788f0
SHA256	800ea88b7b45a7f9679d6fca57d103a79855eafb8400305d4bd9f4d538bda530
SHA512	e711ad14bcb4307f32e45b299af14ce7af868f1394f967033101069860745f2459630215e441a82ef8295b588eeb7d48dfe74bbd0ec1867e8479044bb67f6e35

C:\Program Files\7-Zip\7z.exe.tmp

MD5	1feef9b9c8f6c33f3608f2b782ef55f3
SHA1	0ebd68399999fba6240200f949cee5b9e2c11306
SHA256	fa263a4e7ce39f630ccd3f43f4d8a6e1791775d00bc54a47eccfd0553111f792
SHA512	a6311db04cea6b7084a0ec53934e8bf331401c9ff30fe74ef71078d1fa1aa0d71208a280344a26a1f99baf2b514536a7c7597cf8d323e9aae6978215723ce5b8

C:\Program Files\7-Zip\7z.sfx.tmp

MD5	1456082276ba718942a9a088dfc88659
SHA1	e872bd867b96e34dbe2b4f20657c635c7bfabb74
SHA256	731c1a8a2f7520b7962cfd88464b4e0373d25202c8a4441f0a3c8af5ad726ac2
SHA512	4312eb87a7cd80b97cbd4b535e35b6685bc1a88a26f9735618d7c61ada1a6369559eb118d489789c722ba664c16edce6eee83274759a4d07f4b4fa13056329e7

C:\Program Files\7-Zip\7zCon.sfx.tmp

MD5	b8ebfeb04c247f9820a6fb9dcaba0446
SHA1	21f461027b54bfc117cb633a12f1ebc48be02c9d
SHA256	b737570db6987d8646e4683b8c1fc90095c1eb61f0e2d106903d952b57f1889a
SHA512	3716d1c48cae2889f0b4f0c20fbc6df4467039235655b843bbc3645c2c17a32d46431429d1d1af1774cd2a86bdaa9f6ff14e8ed8ac725bffd89f33c2756d5c52

C:\Program Files\7-Zip\7zFM.exe.tmp

MD5	7664c8c81f66d96045f6bf172e731204
SHA1	972a4b61e3c68d06ea3d86d4dc1ffd7b4e413c27
SHA256	63ff4731931c537d23586bddbf727a9eda05bfa6c854654523f9b53120745fa6
SHA512	b875671fd7457c245b30f67f1abaa61bed5fb136b28596175f3ad2bbe7620ff76b832a3f2d807dcd460fc5ad9c71ad5ce2e6ecd11dbf313e6f96426fa3c684ae

C:\Program Files\7-Zip\7zFM.exe.tmp

MD5	ced9731c6b4ba76d90b2ee6dd2cfc624
SHA1	89937b7173f1d1b9f1af5a052461ae9afac1bb14
SHA256	5bb2ccd5cc6a9b80f8d85e6874a7aa5c6bd6a6d510c469f1a9265c756c28adcb
SHA512	0c69cbad71ac96b3bfae541d796d28c01630ab851fdefa40936a48d293a315b1727410ab294c026b35482f35c82c63a28c4e8c73569ba67fbe68e95c8f79fb5d

C:\Program Files\7-Zip\7zG.exe.tmp

MD5	a1ed8a4021191d3a4cf862f480729cd0
SHA1	6b0daac66823ebb7f17a92de9a61150fd0e5c666
SHA256	bc014347aadca6c2f93e8346927572c9b436afa2dc2e0715ae822dca6ea6ff17
SHA512	f36676a67bfb7f42dd6f683cd6ebb9f3862cb4b6d4dc8671968a000d5b1a4b57490a7447cb969d8607e488d679081d3b3d920158655e617a33b5b1b559ad989b

C:\Program Files\7-Zip\descript.ion.tmp

MD5	476fa1fbf09a4e22eb57776bca38812e
SHA1	5692a057d6943abcc0edd5a61f28b2ab67617b89
SHA256	a672048eb95202a0f64a268605f9dddf63a1baa3af2bb4100ad97ce7b618321c
SHA512	ccc63c60fec2a219e5a3894d7bebd6eaad20069007f592b41255d35d1a687a8579eddecbb2a4a36e5cc873400980e43ca842fdad0f5ec3327567d25ba5135e95

C:\Program Files\7-Zip\History.txt.tmp

MD5	58ab66cfdc193c0631e3c001bd86b06b
SHA1	3f0edd44a23b61cb17736ff1dda3f2f82bb29888
SHA256	8b9f191dc688fcfdfee469a0ef63c5f443b93c3e21d3c34c0df7d9adf27bfa42
SHA512	dc49f1a98e3df95f6a7043d598ee2e344097f7b8f1fb9a8ec995736ad54c89e21f2cd1637e367a93b56f62f7de67482e96843bf633636e865cb5b74eb643a1e4

C:\Program Files\7-Zip\Lang\af.txt.tmp

MD5	d32b23549737e7cc44c7a0b375711d81
SHA1	75262659fe16b7473dbaade2aabcbe6170ceee2c
SHA256	70399c64d544b37cf9f99c0bb9f4d71ffa3df483152c070100153655ca050436
SHA512	efaa169d3af8d44c5d712bc5c5730a93b652db39d8552133f2d2ceec2913dba4108840d03c6e33947c77cd1711fc8c14d7bd18df2f5db5733589e1e77dd24a72

C:\Program Files\7-Zip\Lang\an.txt.tmp

MD5	ee037aa325586986688ce6afaccbe6c1
SHA1	dd7d94b8bd60910b10cc264a34392177de21a5c5
SHA256	115b317bdfa8ca5cfb9a1da00851946b5fa6eb98a83539afc746e3dd8fb7501d
SHA512	6a80f7155c5af93604a2892932193558f7b39fb02c97b358fc8054defa6a17628464417cc9fbaab6ca3f49f60c877f99f61c89be411da7c38b655bcec1b2fc26

C:\Program Files\7-Zip\Lang\ar.txt.tmp

MD5	a9e4951a29a5eb94d3ac7d20b61205de
SHA1	b6476da45f3e786f31a83ac0b97d2f3deb899301
SHA256	75dc25c828f65b9be804cf5af84a744ea294817853b9e07b93daaa129bbf8543
SHA512	f6cd87f16b8197c62e642c1c6df4235f96a4f2c2a1adf400268ecc16a7c4ae1d2234d2f9b117d2b12cd4dafc58b29b9575b7fb35b4183e41335a58bbe3b6896e

C:\Program Files\7-Zip\Lang\az.txt.tmp

MD5	390feea658a09bc18759ce987cff2311
SHA1	dadbd464516c37737e4e9d4d1e74676e6f6b281d
SHA256	9be3ee73640be51092674ba8f989fce0c6bc5934b2eeeab46438d089cfb24da6
SHA512	1ad7721ea44af361575c7630a68e6fbe0e6f55ff71fcd1b544d37fc2db843251ff22aab43460b9603d82d0817d8c1619066f4318f909ca6aeecd5aac69be01db

C:\Program Files\7-Zip\Lang\ast.txt.tmp

MD5	82b21056ca7b2165d0122c7b33f816b5
SHA1	044a9a75cdf2a535abd605125408813f874aefc1
SHA256	eee6bb13d7ccb03b37f57e0afdf6eab645388ee3769625837f5de77be5029f52
SHA512	69db8a554b8c1722150a53cedc49887537ddee4fe605d5abc8be6182a773e8cc9579b9520ea41fc678333a168968e95e546e728ba64e87b9d325fba8dddb953c

C:\Program Files\7-Zip\Lang\ba.txt.tmp

MD5	3c751881d5c10c3c62debd8f0997891a
SHA1	0f34eaa0852f1a8ccc7120f007c206b5a65fbb91
SHA256	fcff84334b06dc47db4b08df5479af4e4dfb43df93c33c8efe9afa998bb46832
SHA512	f5897950b66a2022325daf37f43a3333734e8e511d652d29990546e38b4eb4948a3365f2db4d84ae68ed3296c56166d532a0ac22e94c7b35bd034ac449c59c38

C:\Program Files\7-Zip\Lang\be.txt.tmp

MD5	f4d85120347c6713341179de2189b9a6
SHA1	c7a9ea9b1da31e07dc43ac4bef2e3f3bbb91851c
SHA256	bc3bf4acfc655f41d65b48364b868207fcf575511cd40a92ee77406eb8a99d4e
SHA512	cfa0e6897e16e6f823a1ba2dbb383d6aa4de48833a48f15c0260241c91dc2df2bae2568f10871991a3e04e5c2d085d8af139d9223ea102d77886e33722d87d5b

C:\Program Files\7-Zip\Lang\bg.txt.tmp

MD5	56624de6b55cf1febc1b38650d200832
SHA1	79a9f574dc60a52e0f1fe294c62bdf8f3b98c549
SHA256	eaca04948cf16599fd3afd7d66ae70bcc134025fcf3b7165b8c2294f93b26032
SHA512	4b2007e6374c9e092b121a873a0f8d3e95bfeb9075b2e1b8171742ee54a358ec51cd66ec980e4614e390cce28682f16a2d28a0c21e251c292793d43918d0b44a

C:\Program Files\7-Zip\Lang\bn.txt.tmp

MD5	36ccb3bd9c3bdcb93a53282d0d90d9fc
SHA1	331e0c6043a2d794df4d12f89eb53906e2a55a6d
SHA256	45295e42d950eeec701d92fa2adb95f4d725747fd7db32e3adf3fc750bb2218d
SHA512	75accce34fa80f7bd3db181edee8a4a7e42301a774f242ffa66a399407271e946b7fcf85ca9ecf62d57e7ab82670d18baa9cce7790de2ff52fe96567b87932d1

C:\Program Files\7-Zip\Lang\co.txt.tmp

MD5	c89aa6fb38ba3d9da56b064ec7488606
SHA1	8751f97a865580bfd614a0d9a60514215a74fe7a
SHA256	dfe90461c499557ab6015339df551643f7172c0536f510995e297a325c90adbf
SHA512	c34b25b778c9fb13022ff69abe3fb90113331ff3e0055a644295bd903b0e5acc44c8ff8f40eb899b5ec69798833df0a26a5d419643dd61e4d47d0e5e3693918d

C:\Program Files\7-Zip\Lang\cs.txt.tmp

MD5	fe136dafdd88173bfc0c2b8e60664cdd
SHA1	cc7d005e9b005255ebbf6384b1b54fcd9b0e453c
SHA256	6c46afe9065fbc374833e325c8f9f08bbf98f11b493d5c3abd0de2047955eb21
SHA512	1d13a03e0631b04dec6a6540f659ea85767d5088d3de0c160cbd5e5561a5c76c8fd4e94bd18ef89388b2d571e1701769abe202afc50717c62316d814b2c340f0

C:\Program Files\7-Zip\Lang\cy.txt.tmp

MD5	8f377bfeb2aed2d253da2e2e54fa3eef
SHA1	0ca75de27cebc6d54942b6cd12c4e3eb9aa29fac
SHA256	a7a5447644a4a227acbdce22c877088d3a3bb819566a6015e24bf7fa414741f5
SHA512	8d0bb0fbf4b7a0a0bc79a47a3a61033f29cc126a56ddccacad6b73f471270a1a1be30703954d34d2691107a8b74eae78a8044359b2c265337d5f89e064143261

C:\Program Files\7-Zip\Lang\da.txt.tmp

MD5	d3dc0bd10429117b9db3f41122016a31
SHA1	c5fbd46d7be601967a9d8a01d62fed58ea0e6faf
SHA256	d50b6f64dc88c3d84b5ca71402b52bdfea09e1697b2c1cc65d7419561337ae09
SHA512	67628bb0d0c7ea8622a458687cf071575741b45244a1eb836d0acb29eaf7787182694ecf3c0092aaecf2b0b82360092b1cf51415f0e2a01205f0fb99a965a2da

C:\Program Files\7-Zip\Lang\de.txt.tmp

MD5	a65f8dcfd93e1134f116ba7baae9865d
SHA1	f6b01a3d2a6a1ae2e3328853e968130b80a63183
SHA256	d322f4443a8406cdf44084073498f3ee56345eaf32f7f6bbfa1d36edd4e9dc31
SHA512	d805bba6cd6e904ec2d80b22caf3d014644121b779eec26fb2155b06220d72b626a7315e906e66965749c8498e856f02c2b26a506c16c94a00805c3796f71fb3

C:\Program Files\7-Zip\Lang\el.txt.tmp

MD5	65298a1ec80ac672574c5d1c43bf2eb8
SHA1	e6b829f19b6d388e857e4aa8a2a7b56e95dcbe99
SHA256	088b83fbe1754e34544e87a9a233f7e4c760e36efdf0e153f270012457c81688
SHA512	7ebf333173f3f643db68b1d0085087e33863943a7550f18a4aa95bf6c763e78f258dee02a37f74a3d827b5db3daa868cf9654768e671dd84fe93bed2ec9cc196

C:\Program Files\7-Zip\Lang\en.ttt.tmp

MD5	dae5c0a9d7ee41d693a30a4f8a927e5b
SHA1	5212cedbc3d5aca555f6a881887c62133ef9eb19
SHA256	aac27772686f2fff41642a02f9468b9535707ed2d198e78b59815004958f5548
SHA512	4064a767c4ce5b2bdbf66ea1b4c27b22696d59d0b837e8d1c66723da37329bef0f1d446e10db087180b4c6b2885819d5fc670c0c1055774f6a3fe42c16ca2112

C:\Program Files\7-Zip\Lang\eo.txt.tmp

MD5	d1b2fc58a80842efb5f81db1f99c9126
SHA1	514043777c2efa0e7b42e622eaf8f1c406ca7c41
SHA256	0346a7db74bf8c492ae1fefa5c6f1aa68a0e3afb8568e433dc532b3aa80ac6bb
SHA512	24968b781cb56e304c9b2ec97ad049941811f49cdd265d9598ce9f97a11100fe38682092655aa22f7f31e9232da5a3fd913f4716eb2af88ce21ac5c1b47770b0

C:\Program Files\7-Zip\Lang\es.txt.tmp

MD5	c8c9c15559d83eeb3f2889e5b33d04ed
SHA1	083a68d418ded21b6b17b4af8ba06ac77811074a
SHA256	f6ebcb140e4000304d74d804950ded58974ba4d8dcc47a9e30e74e056a927619
SHA512	1dac2eb5b49b265124d569ecad24df2744b96ef9d7a26600731317ed24ed78362a37111fc994178f42eccba2575350d9973dd3068cc278c3d7762d3ffbbaeadf

C:\Program Files\7-Zip\Lang\fa.txt.tmp

MD5	391282c48bc9c8848fcaa1191e736c7f
SHA1	e82aee54ae3c76ea784261c0ec2fa0d477ceb931
SHA256	8ca31ee0d74f33886ae1bed770173737a7229099f53528b69c53911ca879c166
SHA512	717778d67d8f0d7f0844b49e744e52c7c7f388678cb4e8e9f5ab5f65cee88e38a0fd67bd6b033630ea53715242dde6a4cd721e6a009558058ffe532b454f5050

C:\Program Files\7-Zip\Lang\ext.txt.tmp

MD5	2640f7e4d5efa277369bad1145e7613b
SHA1	02f22f22358a2f351a354c144e5041f0af0b62fe
SHA256	21703175958d15d7984c1e8d9e906093c5449a1f706802bf674933d617fac975
SHA512	cb9680c52c0470637fcd2a2aec7118a59b44d4f3fbfb8f40ec9569aad7a0612287907f7044419fb907cab7b44b3d1ea271240a963f5dd245674996e7e2b27426

C:\Program Files\7-Zip\Lang\eu.txt.tmp

MD5	bed4bbdcb39b5595ec7a5f65e9d1dad6
SHA1	f8147940eea0d87b11cd1ff84193e9086e05b857
SHA256	8d5ec8f3c2a7599fa2d07cf49ac55e7a81c9a9fb8e5b6eb9db7e7d188e4e7bdc
SHA512	6c2e08140339bdaca72eec3d0a7fa472beb3910dbfcc22450a20382efc24c9f326e35fafd79112773a83e4eee30ba10bad3af5a221f94eed1aea555a8f52f942

C:\Program Files\7-Zip\Lang\fur.txt.tmp

MD5	0bb3befaf98992a526ee3ba77511d12c
SHA1	96587ea07dbd4f35919a77ad4440065cc977e1b1
SHA256	a54f8d372e8516444456a5649ff5821a8dab9cea397fdd2466b52d81e7663725
SHA512	df8dbb7c211063cf4b9e884161bf919de485ae84137c0fceadacda834395ed11719a6914be6a9fbcbfc85be5b14ce88a1458458fb80531ea09b1b760402c3000

C:\Program Files\7-Zip\Lang\gl.txt.tmp

MD5	188a7f87a21960a87c15fa3dde7e78fc
SHA1	ce98e4cbe585690b87df57735d50ee40e7552b96
SHA256	1c5c3b9b6a1abc536424131b57ef05106f0595c9751a61de960f69b590b3cda8
SHA512	fe2071e0be371542c435bb625e96966dc684f95aa7dd8fb361517e2db35c1bca2e6e2aa3c451e98538b1b42d8cae6b1afdaf8629280a1d1dfdb7d10ecf33c4bc

C:\Program Files\7-Zip\Lang\ga.txt.tmp

MD5	efdec27e2ee160c1ecacbaafc6dd1baf
SHA1	76b8a6003645d1b02d3a4d7262bb4f9a37f026d0
SHA256	91c1e6ea1b319db6a3a77cb1c9d04a49d833b29b80d1ab17c599667910309db2
SHA512	658a689b546aae61a372c8326eca3d35aa6f3f9b3ac44acd21c5a1fe2f8be0d2025a3b84aa76ea5a6d819eef68a4a6d0b857813d248d548a05de135bc48c2b34

C:\Program Files\7-Zip\Lang\gu.txt.tmp

MD5	24220f8e4b9febb37e6b9171f993e5cb
SHA1	114e585683eccf57cad69d382010f1cb42cf600d
SHA256	695edf2d2bc2327d6d4224c7306bf6da3222329a292b65ccef6aa095452a914a
SHA512	3d3139303d04af69ab210244975654e981b4adee4d3e19a59577cdef3e504e6b9d22919a31f4f5e5de688e23a13647db6ee6be2bdcc709e87dfcaa135de37f63

C:\Program Files\7-Zip\Lang\hr.txt.tmp

MD5	0e88c019c5fbba30054b9148064c8087
SHA1	04de6f82cdae82882a136a709ae7f37256bd092f
SHA256	46e13516abc34529c649dcacce1a12a78a718a133e1006097b6dd786441e869a
SHA512	63ad25fb031d72586e14781d33260c428532c57a4938040d0cac64a79564e2443ea647dd74afc9d0ab455bef4485f9ef68476f2d2d6e8842bda6891630288ff8

C:\Program Files\7-Zip\Lang\hi.txt.tmp

MD5	026c8f0b5e9f9925fd99497d1588d1d4
SHA1	371475921970408a30c3d70ae79940a3b1da3921
SHA256	49f3244aa7f6c49dae1eb379ff26482852d8d1cea4d5d10eaedd5694f98b8406
SHA512	7e11b8bd9e63708770b63301b7a7e642a18a6a12ab473d8ea5a677a38ab63fd001f82691d51d7b896fd1bfd95cda4df88617057675ee01a571767a4324e33752

C:\Program Files\7-Zip\Lang\hy.txt.tmp

MD5	83d0a59178e65d352b8bb118ef3e648d
SHA1	349290da2a142d2bfce5239c1600a6d01094cffc
SHA256	609bfaacdb635c46e7d6f69afc85f272a3a287d90aadbc99932b97459159582e
SHA512	41ad1075e76a553b99b652f5398f9c20e9ea1663c161685728e91af68cdb821ec28d730d3d29ef3008784a6dc3e56a9de6de1448273bdeb5049d6b32e95bf726

C:\Program Files\7-Zip\Lang\it.txt.tmp

MD5	34b93074d16accc63a00a41c707bb314
SHA1	1aca9ce601c16999ef43cf56b8e0da65133c13d7
SHA256	ca3155cb5468d464a5489bb36a83c9562133cc35b310bd7108c3bf8816ba7cf7
SHA512	0223c0aa9a33da2f0af5a3d2fe6baa2f529719927a2fc359fda7e988d74ad685d7e7077b30c2c38c33c923e453ceec1a07cfe2383089b3f6bc0a4fdce7a38d33

C:\Program Files\7-Zip\Lang\ka.txt.tmp

MD5	7a60603eca5605bd4d5cb06c1974c454
SHA1	2f03e6bc703d8d3c048fa56e35ab11e403022777
SHA256	e17f9e8fdac0b7805d49f4b26a2f1be045532856d1deb0dcdc8c0035ef448e84
SHA512	77983c1d593a391bcd17637ca3bb3d620ea86c0fbbce7bd80a1e66b12599dd6756e274f26c74bb6a51adbf34915b6c5695bcd7b7258aeac17a873c9c605a2370

C:\Program Files\7-Zip\Lang\kab.txt.tmp

MD5	47da73d665411a2a022e36be1806d235
SHA1	8059986c772ec9d4a8c06a88301038b197c93b31
SHA256	ecdf6668d3405e744768aa7735ede0cd89a38269582953612b4fb4ef09c062f8
SHA512	eb320d0f5583b628c34f52c33c34a8d8739d3731d5ab304032e9372d443e6d714bdadb14b7b3bd7492220d96ef59d6ef1b989499ee0dae427c672453b94b3393

C:\Program Files\7-Zip\Lang\kk.txt.tmp

MD5	8624ca4ede98872ee68080a3a2182eb0
SHA1	427a00320158239bcd013c95fbf714e46d67d07d
SHA256	52b7ec1e87fdb254ea10c3bbdd52cc324d400927e1392bb28d9a2dbdbaf086ce
SHA512	a26d27923dd179f01d70dfcf3cd1fb899d2c9f9020a9d739a77cf43cc6058180d0b0ad29ffe80d6fcd366e93e8c4640f342022d7086c93800a38dc4d62250278

C:\Program Files\7-Zip\Lang\ja.txt.tmp

MD5	6520a8515f16ded6a30cecb4ec2da750
SHA1	d0153dbb444e0b8266359cf0cc5217512e0d1e5e
SHA256	c0d1eccef46b037b18074db4abafed1c8688126ac78939666a92c600c7d21d0e
SHA512	51be22e7e39802534799c2c7d8b5927ebb66773b2be2a439ab90afecba688f29a1d80402f3b75236208e26e2691ae808f4da94bcdae958efa996812e38fa845f

C:\Program Files\7-Zip\Lang\lij.txt.tmp

MD5	72347652050556ff65917c2166bceffd
SHA1	3ac19318008ce8bc64f5450f428877019cefa807
SHA256	6c93e8f2a67a690888f2b6fce5679c82ed248c7ba867b4bf093d5412f11a1f6a
SHA512	23e7b71b86beee3154f59fbff81df7bac4df73ae7171b0e57a8eab8c51a13f2a456e6f50207532c2faad9e1bbbcbf2c728faecfbc86459079b6c164d6fc30f56

Sample ID	240614-avqsrsxfme
Target	7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4
SHA256	7c244f2c2f2728371100169e9a522566f875e3c9cd296df4ab7c8e30830734f4
Tags	ransomware

Malware Analysis Report

2024-07-28 16:26

Table of Contents

Analysis Overview

Threat Level: Likely malicious

Malicious Activity Summary

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files