Malware Analysis Report

2025-01-22 23:10

Sample ID 241202-dzrgmsxlft
Target d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe
SHA256 d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1c
Tags
banload discovery downloader dropper evasion ransomware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1c

Threat Level: Known bad

The file d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe was found to be: Known bad.

Malicious Activity Summary

banload discovery downloader dropper evasion ransomware trojan

Banload

Banload family

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Renames multiple (249) files with added filename extension

Renames multiple (200) files with added filename extension

Checks BIOS information in registry

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-02 03:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-02 03:27

Reported

2024-12-02 03:29

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A

Renames multiple (249) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\af.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\nl.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\History.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\ku.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\ext.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\fr.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\sk.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\ms.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\kk.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\nb.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DisplayName = "@C:\\Program Files\\Microsoft Office\\Root\\VFS\\ProgramFilesCommonX86\\Microsoft Shared\\Office16\\oregres.dll,-403" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DisableLowILProcessIsolation = "1" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocHandler32 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocHandler32\ = "ole32.dll" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Microsoft Excel previewer" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe

"C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

memory/1360-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1360-2-0x0000000004930000-0x0000000004B3C000-memory.dmp

memory/1360-9-0x0000000004930000-0x0000000004B3C000-memory.dmp

memory/1360-13-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1360-12-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1360-14-0x0000000004930000-0x0000000004B3C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp

MD5 f29231d1d1c6539cfe8f7f96a4d22c91
SHA1 72f13c74d209421b23d1703b53eabb2a5a912b39
SHA256 5f0e5fbd94c3e44b85ffa968b194ecf9b8ffaa98236a6451a614ab0fe4ebda84
SHA512 4bb5c10da629cdeabfd31bfb9d90a3c68a78b1716a8e3a98001e880620e13820159086a71269beef8db4735703a3af59044b0ff314d440c10cebefdd83b434e1

C:\Program Files\7-Zip\7-zip.dll.tmp

MD5 dd5e94bbe1ab99a989bcd8d0cd8c46bc
SHA1 be74e049bbe2f3ab467f2a3455175867c27988d5
SHA256 b1f805012c9853ed4677d00dae9dc598987b81db73571dc8368084fcb7851dcf
SHA512 4c1d0b7a1c11a4bf9bdb20a8d0af162cedb36631e451484b10f7e9b2dfec7642d1bceeb644a1c8900886cbf9c79eb5b11d338ae2cf31c94b08ad5a0e9166dc20

memory/1360-33-0x0000000004930000-0x0000000004B3C000-memory.dmp

memory/1360-32-0x0000000004930000-0x0000000004B3C000-memory.dmp

memory/1360-78-0x0000000000400000-0x0000000000616000-memory.dmp

memory/1360-90-0x0000000004930000-0x0000000004B3C000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-02 03:27

Reported

2024-12-02 03:29

Platform

win7-20241010-en

Max time kernel

120s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A

Renames multiple (200) files with added filename extension

ransomware

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\7-Zip\Lang\hu.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\ClearSend.contact.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\it.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\7z.exe.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\ku.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\tg.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\da.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\gl.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\7-zip.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\th.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\pl.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\7zFM.exe.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\az.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\fr.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\tt.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\kk.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\co.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\uz.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\7-zip32.dll.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\br.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\eo.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\he.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\is.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\fy.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\ps.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\sw.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\en.ttt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\fur.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\nl.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\sv.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\lv.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\nn.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\7-Zip\Lang\eu.txt.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "Excel.Chart.8" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Conversion C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Conversion\Readable C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DataFormats\GetSet\3 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocHandler32\ = "ole32.dll" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0\Class = "Microsoft.Office.Interop.Excel.ChartClass" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Insertable C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\PersistentHandler\ = "{98de59a0-d175-11cd-a7bd-00006b827d94}" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Conversion\Readwritable C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DataFormats\GetSet\2 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DefaultIcon C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\RuntimeVersion = "v2.0.50727" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Verb C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Conversion\Readable\Main\ = "Biff8,Biff5,ExcelChart" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DefaultExtension\ = ".xls, Excel Workbook (*.xls)" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\PersistentHandler C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DataFormats\DefaultFile\ = "Biff8" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DataFormats\GetSet\1\ = "2,1,16,1" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DataFormats\GetSet\4\ = "NoteshNote,-1,1,1" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalServer32\LocalServer32 = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510000000000 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Microsoft Excel Chart" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DataFormats\GetSet\0 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DataFormats\GetSet\3\ = "NotesDocInfo,1,1,1" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DocObject C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Implemented Categories C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Implemented Categories\{000C0118-0000-0000-C000-000000000046} C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\MiscStatus\ = "1" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2} C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DataFormats\DefaultFile C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DataFormats\GetSet\2\ = "1,1,1,1" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DocObject\ = "16" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Version\ = "1.2" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Conversion\Readable\Main C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\xlicons.exe,3" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\MiscStatus C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Printable C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Verb\0 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Conversion\Readwritable\Main C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0\Assembly = "Microsoft.Office.Interop.Excel, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "Excel.Chart" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Conversion\Readwritable\Main\ = "Biff8" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DataFormats\GetSet C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DataFormats\GetSet\1 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Verb\0\ = "&Edit,0,2" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Verb\1 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\AuxUserType\2 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DataFormats\GetSet\4 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Version C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\AuxUserType C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Assembly = "Microsoft.Office.Interop.Excel, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Typelib\ = "{00020813-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\AuxUserType\3 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DefaultExtension C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\AuxUserType\3\ = "Microsoft Excel 2003" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\DataFormats\GetSet\0\ = "3,1,32,1" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocHandler32 C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\Class = "Microsoft.Office.Interop.Excel.ChartClass" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\14.0.0.0\RuntimeVersion = "v2.0.50727" C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Typelib C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe

"C:\Users\Admin\AppData\Local\Temp\d67e72a4ea3f613d54bff1272fcbcf8a4038783a15e83609e6c5839c6d37ba1cN.exe"

Network

N/A

Files

memory/2224-0-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2224-1-0x0000000003030000-0x000000000323C000-memory.dmp

memory/2224-7-0x0000000003030000-0x000000000323C000-memory.dmp

memory/2224-11-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2224-10-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2224-12-0x0000000003030000-0x000000000323C000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini.tmp

MD5 fffe22e4c1a36c0359a8f928ec7ae244
SHA1 8003ab4f76aa463e75d6b8bab045b389502b8968
SHA256 becfaa1e2e6078aea916a53dc8481fb1c73926741ef6da6b085ffec9639d3b07
SHA512 d4d53978a122494fb0d07ad5a92a62fdcd342da49a2887c5aa36e124c5324d845c65c5462716af5fb716332afd39f3f928ea89d3e0d7fc6783d612b58e63d380

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 eb38ef34492853c5d0084c72e181f5c7
SHA1 2b42ad404ee73431cbad8222312a8d6e99145742
SHA256 5f0f00818cb1738278e828cd1932b83d81ea92533564811bce6f6c810ef08c87
SHA512 fdbf1985f42593fd81b76700e0d29724e2da7f274098f789391c143f9694522ac3abb52b515da8a2ca9255e3892a2c71ab52643b8516abbbfe2003c72fc58828

memory/2224-24-0x0000000003030000-0x000000000323C000-memory.dmp

memory/2224-25-0x0000000003030000-0x000000000323C000-memory.dmp

memory/2224-36-0x0000000000400000-0x0000000000616000-memory.dmp

memory/2224-42-0x0000000003030000-0x000000000323C000-memory.dmp