Overview
overview
10Static
static
10020db58e3c...4c.exe
windows7-x64
1006cbef0e90...f8.exe
windows7-x64
9083c5b43df...fb.exe
windows7-x64
1015cb04fa5c...4f.exe
windows7-x64
922a1f50db9...85.exe
windows7-x64
924cb5e44b6...8d.exe
windows7-x64
1027c9f44e0c...d6.exe
windows7-x64
102c2aa8458f...3d.exe
windows7-x64
72e9e18954a...d1.exe
windows7-x64
102ebb2a34dd...c6.exe
windows7-x64
102fff52aa0c...21.exe
windows7-x64
1037ca1cfa1f...60.exe
windows7-x64
1038cd67a044...4c.exe
windows7-x64
93d4f84e20d...96.exe
windows7-x64
49cff73125...4b.exe
windows7-x64
104c0153b979...a5.exe
windows7-x64
104ded976d2e...5a.exe
windows7-x64
34ee95ee627...68.exe
windows7-x64
105b439daac4...d7.exe
windows7-x64
1067df6d4554...78.exe
windows7-x64
36b3bf710cf...2e.exe
windows7-x64
66df64a0a92...fe.exe
windows7-x64
1075b45fea60...34.exe
windows7-x64
1082e6b71b99...5a.exe
windows7-x64
108a6aa9e5d5...47.exe
windows7-x64
108bcfb60733...fd.exe
windows7-x64
108bf1319fd0...6c.exe
windows7-x64
108d76a9a577...20.exe
windows7-x64
108dd283ca01...4c.exe
windows7-x64
108edaee2550...e7.exe
windows7-x64
109bff71afad...75.exe
windows7-x64
109d7fb7050c...20.exe
windows7-x64
10Resubmissions
13-07-2024 09:54
240713-lxbx6swdmm 1013-07-2024 09:50
240713-lvbvdsyapd 1013-07-2024 09:46
240713-lr1dksyajd 10Analysis
-
max time kernel
1200s -
max time network
836s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13-07-2024 09:50
Static task
static1
Behavioral task
behavioral1
Sample
020db58e3c552ead23b18bb04bb75781e51347dab4868d1fc55e2854a6647d4c.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
06cbef0e9051e2f54cf17e0d191f890d82cfec91bbc3e5bc429a2f364fd925f8.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral3
Sample
083c5b43df8bee2a6235c3f5038cc9860b4a4bfd1675d367a67fcfff93ccfcfb.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral4
Sample
15cb04fa5c58299e320c833b62a6e44ec67423aed9fcc969d5b90f4380ccf24f.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral5
Sample
22a1f50db97e2f91417a668d7c31379012b9f756d37a6697220b10aaf1f8b585.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
24cb5e44b68c9dd2a115de3415ee96e78d2180dfd287133c54dfa29c90c1088d.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral7
Sample
27c9f44e0c5de68792b684355a68ad83eba89cbe46cc9cf3a6efeb448c9f39d6.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral8
Sample
2c2aa8458f3d138a2cfaa38b2da75b541ccdad655b5db374733e4cecfb24833d.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral9
Sample
2e9e18954a73762ae06eaa6fa85c4dbdabf607fee4ec2ed016a689c7173dbfd1.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
2ebb2a34dd6633e785f67d118a8c778969e4e34d667cf554268997e13920a1c6.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral11
Sample
2fff52aa0c2fac4e53008cdf0bbea4ade2243bf42418330a03d5ce6f0d598421.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral12
Sample
37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral13
Sample
38cd67a044a7da3eea806129a3ae9616cfbe1f49a68997ac932e5214b1719f4c.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral14
Sample
3d4f84e20d5cf317edcefcc98bdd7e126078b25cdc56b816edbec532a8763096.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral15
Sample
49cff73125bdbed98cdda85572228372cecaedc8fa98fd48706fd23e6ad1ad4b.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral16
Sample
4c0153b979e65346c1d6f863086082ec5ef103cbf6b0f5e8652d61da678a8ca5.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral17
Sample
4ded976d2e5474b5ce1562ceb032981e23f170e7d6ec07fadd131aea82715a5a.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral18
Sample
4ee95ee6271482c7939ce3b9db210ffb7a73ceebb6500b978fa3e6fe1d6ea168.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral19
Sample
5b439daac4faa9078a6973301eaeed339f77bbbbcdaa46f3452c1fc90499a4d7.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral20
Sample
67df6d4554cb4c82c8f41d8257174c8c39059cd386744fc0f36ef84faede1478.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral21
Sample
6b3bf710cf4a0806b2c5eaa26d2d91ca57575248ff0298f6dee7180456f37d2e.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral22
Sample
6df64a0a921bd65006968d7eb146f7ceb60ffc1345575d39edec0eded41eb4fe.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral23
Sample
75b45fea6000b6cb5e88b786e164c777c410e11fdcf1ff99b66b43096223d734.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral24
Sample
82e6b71b99a6ec602cfbdc00e0bbaf34c719d7b6879b6e384004886d491ad45a.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral25
Sample
8a6aa9e5d58784428d0b1641e99f024438b20747993039e16b8d262f3f5fd347.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral26
Sample
8bcfb607330063b60948c0520fe2ccbce3562a9cc43a55ea45f16878fc6a9bfd.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral27
Sample
8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral28
Sample
8d76a9a577ea5ad52555a2824db6f5872548fe4bcc47d476cae57603386c4720.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral29
Sample
8dd283ca012e7a70a2673d2cc211c6a616ff23bc5bd3599a1da077ba946a044c.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral30
Sample
8edaee2550dde9df1fe2e8c26965be3817f0d66ba13510ac281bfdc8dde1dde7.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral31
Sample
9bff71afadddb02956bd74c517b4de581885b0d6ff007796d00d3c2190c30275.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral32
Sample
9d7fb7050cf315639502f812d25d49c19b14c93948827484c2514bbc87261920.exe
Resource
win7-20240704-en
windows7-x64
General
-
Target
8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe
-
Size
3.3MB
-
MD5
acd46f88a6f90143090c342c10544ccf
-
SHA1
bb90bed3b0d747feeac32536d75c6d153b34be0b
-
SHA256
8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c
-
SHA512
82e91a14b2a7bfb659a566df7caf7f8dc28b61a14c504dd6ca23166ff2bb142114a43c5a3c70309022d813f34fb3aa63d321d964f3b6178e42b650ac0e56e84f
-
SSDEEP
24576:v54IAnWrfdt2Zj1vpo4ajyKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKI:CIAWjdAp1PagjLuSh3i+FtvkMzT+
Malware Config
Signatures
-
Detect MafiaWare666 ransomware 1 IoCs
resource yara_rule behavioral27/memory/1976-1-0x00000000009C0000-0x0000000000A0A000-memory.dmp family_mafiaware666 -
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
-
Renames multiple (3507) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 6 IoCs
description ioc Process File opened for modification C:\Users\Admin\Desktop\desktop.ini 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\desktop.ini 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPWEC.DLL 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212751.WMF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00523_.WMF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05665_.WMF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Adjacency.xml 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\OISINTL.DLL.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\PREVIEW.GIF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099153.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14513_.GIF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\setup.swf.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01186_.WMF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02426_.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0149887.WMF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01294_.GIF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ACTIP10.HLP 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115841.GIF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15035_.GIF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0251871.WMF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153089.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0213449.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Composite.xml 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198021.WMF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Thatch.xml 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEOLEDB.DLL 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Essential.thmx 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLLIBR.DLL.IDX_DLL 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01660_.WMF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099169.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107452.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292286.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0324704.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00232_.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01301_.GIF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPWEC.DLL.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105414.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099159.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099205.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107254.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232171.WMF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Apothecary.xml.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187881.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01158_.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10290_.GIF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\MCABOUT.HTM 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01301_.GIF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOCFUIUTILITIESDLL.DLL 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FINCL_02.MID 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21310_.GIF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\LAYERS.INF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00186_.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02288_.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\PNG32.FLT 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00444_.WMF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0197979.WMF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01161_.WMF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01749_.GIF.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099148.JPG.clay 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01148_.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05665_.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0199661.WMF 8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c.exe