Windows Analysis Report 7z2408-x64.exe

Source: 7z2408-x64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Spreading

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7-zip.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7z.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7-zip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior

Source: 7z2408-x64.exe, 00000000.00000003.1756539856.0000000002740000.00000004.00000020.00020000.00000000.sdmp, License.txt.0.dr	String found in binary or memory: http://www.gnu.org/
Source: 7z2408-x64.exe, 00000000.00000003.1756539856.0000000002740000.00000004.00000020.00020000.00000000.sdmp, History.txt.0.dr	String found in binary or memory: https://7-zip.org/history.txt
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe.0.dr	String found in binary or memory: https://www.7-zip.org/

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_004017DE GetModuleFileNameW,GetDlgItemTextW,lstrlenW,ShowWindow,ShowWindow,ShowWindow,SendMessageW,PeekMessageW,PeekMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,SendMessageW,PeekMessageW,PeekMessageW,SetWindowTextW,lstrcpyW,lstrcpyW,lstrlenW,GetFileAttributesW,SetFileAttributesW,lstrcatW,lstrlenW,MessageBoxW,SetFileTime,SetFileAttributesW,MoveFileExW,GetLastError,SendMessageW,SetWindowTextW,MessageBoxW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

Detected potential crypto function

Source: C:\Users\user\Desktop\7z2408-x64.exe	Code function: 0_2_00405F40	0_2_00405F40
Source: C:\Users\user\Desktop\7z2408-x64.exe	Code function: 0_2_00404061	0_2_00404061
Source: C:\Users\user\Desktop\7z2408-x64.exe	Code function: 0_2_00407430	0_2_00407430
Source: C:\Users\user\Desktop\7z2408-x64.exe	Code function: 0_2_00406A85	0_2_00406A85
Source: C:\Users\user\Desktop\7z2408-x64.exe	Code function: 0_2_00405692	0_2_00405692

Dropped file seen in connection with other malware

Source: Joe Sandbox View	Dropped File: C:\Program Files\7-Zip\7z.dll E79DDFB6319DBF9BAC6382035D23597DAD979DB5E71A605D81A61EE817C1E812
Source: Joe Sandbox View	Dropped File: C:\Program Files\7-Zip\7z.exe 707F415D7D581EDD9BCE99A0429AD4629D3BE0316C329E8B9EBD576F7AB50B71

Sample file is different than original file name gathered from version info

Source: 7z2408-x64.exe, 00000000.00000002.2968372960.0000000000197000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zipInstall.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename7zipInstall.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7-zip.dll, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileVersionFileDescriptionOriginalFilename_winzip_.rsrcCOFF_SYMBOLSCERTIFICATE.pdata.reloc vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.dll, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.sfx.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zFM.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zg.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUninstall.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe	Binary or memory string: OriginalFilename7zipInstall.exe, vs 7z2408-x64.exe

Source: 7z2408-x64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: clean19.spre.winEXE@1/109@0/0

Source: C:\Users\user\Desktop\7z2408-x64.exe

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_004025C5 CoCreateInstance,

0_2_004025C5

Source: 7z2408-x64.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7z2408-x64.exe

File read: C:\Program Files\desktop.ini

Source: C:\Users\user\Desktop\7z2408-x64.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\7z2408-x64.exe

File read: C:\Users\user\Desktop\7z2408-x64.exe

Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: playtodevice.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: devdispitemprovider.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: portabledeviceapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: networkexplorer.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\7z2408-x64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32

Contains functionality to dynamically determine API calls

Source: 7-Zip File Manager.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files\7-Zip\7zFM.exe
Source: 7-Zip Help.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files\7-Zip\7-zip.chm

Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: Install
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 7z2408-x64.exe

Static file information: File size 1624144 > 1048576

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_00401FB1 GetSystemDirectoryW,lstrlenW,lstrcpyW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,malloc,free,

PE file contains sections with non-standard names

Source: 7-zip32.dll.0.dr	Static PE information: section name: .sxdata
Source: 7z.sfx.0.dr	Static PE information: section name: .sxdata
Source: 7zCon.sfx.0.dr	Static PE information: section name: .sxdata

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_004071E0 push eax; ret

0_2_0040720E

Persistence and Installation Behavior

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7-zip.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7z.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7-zip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior

Drops PE files

Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7-zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7z.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7-zip32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7zCon.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file

Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7z.sfx			Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7zCon.sfx			Jump to dropped file

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7-zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7-zip32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zCon.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file

Source: C:\Users\user\Desktop\7z2408-x64.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Qdc
Source: 7z2408-x64.exe, 00000000.00000003.2087105031.0000000000668000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRA~1_VMware_SATA_CD0^']
Source: 7z2408-x64.exe, 00000000.00000003.2062199390.00000000006A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ef&&
Source: 7z2408-x64.exe, 00000000.00000002.2970058084.000000000A330000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:T
Source: 7z2408-x64.exe, 00000000.00000003.1979640351.000000000069D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.1978887267.000000000069D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2333268101.000000000065B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD0^'\
Source: 7z2408-x64.exe, 00000000.00000003.2393903090.000000000A34B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Tjh
Source: 7z2408-x64.exe, 00000000.00000003.2561954201.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}^ff
Source: 7z2408-x64.exe, 00000000.00000003.2311360135.000000000A2AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA{']
Source: 7z2408-x64.exe, 00000000.00000002.2970058084.000000000A330000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:h
Source: 7z2408-x64.exe, 00000000.00000003.2724562565.000000000A346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: E#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2561954201.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}~QG
Source: 7z2408-x64.exe, 00000000.00000003.2394625067.000000000A34B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Tjh
Source: 7z2408-x64.exe, 00000000.00000003.2394625067.000000000A34B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Qdc
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}2-00a0c91efb8b}\\?\STORAG6~
Source: 7z2408-x64.exe, 00000000.00000003.2171636830.000000000A2A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA{']
Source: 7z2408-x64.exe, 00000000.00000003.2725173354.000000000A33D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b})
Source: 7z2408-x64.exe, 00000000.00000003.2888976790.000000000A2A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: }\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2480395971.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}^ff
Source: 7z2408-x64.exe, 00000000.00000003.2749161396.000000000A34D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:e\CLX]
Source: 7z2408-x64.exe, 00000000.00000002.2969841456.000000000A2A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!
Source: 7z2408-x64.exe, 00000000.00000003.2724791506.000000000A330000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: 7z2408-x64.exe, 00000000.00000002.2969841456.000000000A2A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2888709824.000000000A351000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94@]
Source: 7z2408-x64.exe, 00000000.00000003.2889013936.000000000A348000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Qjc
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}11ee-8c18-806e6f6e6963}#00
Source: 7z2408-x64.exe, 00000000.00000003.2725173354.000000000A33D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}C
Source: 7z2408-x64.exe, 00000000.00000003.2311246255.000000000065B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}uu
Source: 7z2408-x64.exe, 00000000.00000003.2229433583.00000000006A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}&&
Source: 7z2408-x64.exe, 00000000.00000003.2061434167.0000000000668000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}--
Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}a33c735c-61ca-11ee-8c18-80
Source: 7z2408-x64.exe, 00000000.00000003.2725173354.000000000A33D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}6f6e6963}#0000000006500000^
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000002.2969841456.000000000A2A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000002.2968725040.000000000060A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0uWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: 7z2408-x64.exe, 00000000.00000003.2061506490.00000000006A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wgSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ef&&
Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7f
Source: 7z2408-x64.exe, 00000000.00000003.2725173354.000000000A33D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644824463.000000000065B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000007
Source: 7z2408-x64.exe, 00000000.00000003.1978887267.000000000069D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}$$
Source: 7z2408-x64.exe, 00000000.00000003.2724562565.000000000A346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}}\\?\STORAGE#Volume#{a33crcG
Source: 7z2408-x64.exe, 00000000.00000003.2562065555.000000000A34E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.1900346230.000000000069D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j8ycSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2394494523.000000000A2A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA{']
Source: 7z2408-x64.exe, 00000000.00000003.2480395971.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}OhU
Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2561954201.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}OhU
Source: 7z2408-x64.exe, 00000000.00000003.2561954201.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Tjh

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_00401FB1 GetSystemDirectoryW,lstrlenW,lstrcpyW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,malloc,free,

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\7z2408-x64.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_004059FD GetVersion,GetModuleHandleW,GetProcAddress,GetSystemDirectoryW,LoadLibraryExW,

0_2_004059FD

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Name	Type	MD5	SHA1	SHA256
C:\Program Files\7-Zip\7-zip.chm	MS Windows HtmlHelp Data	99B88F4D6D13713053DB06B449ED6A9F	F718E09A42E9EC49DB060589D24135CA6929E8E0	F830DDC5280D00E1CB160F9E5DD114292D5EFEF66C23C3C03C224894250BAC2F
C:\Program Files\7-Zip\7-zip.dll	PE32+ executable (DLL) (GUI) x86-64, for MS Windows	D346530E648E15887AE88EA34C82EFC9	5644D95910852E50A4B42375BDDFEF05F6B3490F	F972B164D9A90821BE0EA2F46DA84DD65F85CD0F29CD1ABBA0C8E9A7D0140902
C:\Program Files\7-Zip\7-zip32.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	82E994D93BD2EED9EC406E81C27542B7	F7B4A033BAA1CDB812D8D606535BC04ACA264BEB	96313194A8ACE0D6FBE037DDE8C85D1430A5FB1D8CC62E68BDF41FE2E838F440
C:\Program Files\7-Zip\7z.dll	PE32+ executable (DLL) (GUI) x86-64, for MS Windows	1143C4905BBA16D8CC02C6BA8F37F365	DB38AC221275ACD087CF87EBAD393EF7F6E04656	E79DDFB6319DBF9BAC6382035D23597DAD979DB5E71A605D81A61EE817C1E812
C:\Program Files\7-Zip\7z.exe	PE32+ executable (console) x86-64, for MS Windows	0B24892597DCB0257CDB78B5ED165218	5FE5D446406FF1E34D2FE3EE347769941636E323	707F415D7D581EDD9BCE99A0429AD4629D3BE0316C329E8B9EBD576F7AB50B71
C:\Program Files\7-Zip\7z.sfx	PE32 executable (GUI) Intel 80386, for MS Windows	2DA1E169833D1AC3697DED688D0C5A11	59937A1F6C4C2B67870A9D5EFF222FEF230994CC	6B57604755BD4410A4F1ADBCE90498E205F4255C5786D5C4DDB34327C161B125
C:\Program Files\7-Zip\7zCon.sfx	PE32 executable (console) Intel 80386, for MS Windows	DD69F1774B4A3FEEF30E5923F846FBA7	9C31DC7109A1051FAA0253E0B666FAA0EBBFA66F	062C989AC695CFAFDB4C83A8517B2F6716E1A8A1255360F01A49216C4A21884B
C:\Program Files\7-Zip\7zFM.exe	PE32+ executable (GUI) x86-64, for MS Windows	004D7851F74F86704152ECAAA147F0CE	45A9765C26EB0B1372CB711120D90B5F111123B3	028CF2158DF45889E9A565C9CE3C6648FB05C286B97F39C33317163E35D6F6BE
C:\Program Files\7-Zip\7zG.exe	PE32+ executable (GUI) x86-64, for MS Windows	4159FF3F09B72E504E25A5F3C7ED3A5B	B79AB2C83803E1D6DA1DCD902F41E45D6CD26346	0163EC83208B4902A2846DE998A915DE1B9E72ABA33D98D5C8A14A8FBF0F6101
C:\Program Files\7-Zip\History.txt	ASCII text, with CRLF line terminators	86D07103FB8D487D17D33974C0BDC0C2	D0318DD9296B5FD92A190329FAF5F16F9CC131C3	EE3D0EB585DA90D0BB36A2F3D2A7FB5FDCE5336141EA8F779D7450D8A4B16C42
C:\Program Files\7-Zip\Lang\af.txt	Unicode text, UTF-8 (with BOM) text	DF216FAE5B13D3C3AFE87E405FD34B97	787CCB4E18FC2F12A6528ADBB7D428397FC4678A	9CF684EA88EA5A479F510750E4089AEE60BBB2452AA85285312BAFCC02C10A34
C:\Program Files\7-Zip\Lang\an.txt	Unicode text, UTF-8 (with BOM) text	F16218139E027338A16C3199091D0600	DA48140A4C033EEA217E97118F595394195A15D5	3AB9F7AACD38C4CDE814F86BC37EEC2B9DF8D0DDDB95FC1D09A5F5BCB11F0EEB
C:\Program Files\7-Zip\Lang\ar.txt	Unicode text, UTF-8 text	5747381DC970306051432B18FB2236F2	20C65850073308E498B63E5937AF68B2E21C66F3	85A26C7B59D6D9932F71518CCD03ECEEBA42043CB1707719B72BFC348C1C1D72
C:\Program Files\7-Zip\Lang\ast.txt	Unicode text, UTF-8 (with BOM) text	1CF6411FF9154A34AFB512901BA3EE02	958F7FF322475F16CA44728349934BC2F7309423	F5F2174DAF36E65790C7F0E9A4496B12E14816DAD2EE5B1D48A52307076BE35F
C:\Program Files\7-Zip\Lang\az.txt	Unicode text, UTF-8 (with BOM) text	9CD3A23CA6F66F570607F63BE6AA0001	912837C29C0E07470E257C21775B7513E9AF4475	1DA941116E20E69F61A4A68481797E302C11FCF462CA7203A565588B26011615
C:\Program Files\7-Zip\Lang\ba.txt	Unicode text, UTF-8 (with BOM) text	387FF78CF5F524FC44640F3025746145	8480E549D00003DE262B54BC342AF66049C43D3B	8A85C3FCB5F81157490971EE4F5E6B9E4F80BE69A802EBED04E6724CE859713F
C:\Program Files\7-Zip\Lang\be.txt	Unicode text, UTF-8 (with BOM) text	B1DD654E9D8C8C1B001F7B3A15D7B5D3	5A933AE8204163C90C00D97BA0C589F4D9F3F532	32071222AF04465A3D98BB30E253579AA4BECEAEB6B21AC7C15B25F46620BF30
C:\Program Files\7-Zip\Lang\bg.txt	Unicode text, UTF-8 (with BOM) text	2D0C8197D84A083EF904F8F5608AFE46	5AE918D2BB3E9337538EF204342C5A1D690C7B02	62C6F410D011A109ABECB79CAA24D8AEB98B0046D329D611A4D07E66460EEF3F
C:\Program Files\7-Zip\Lang\bn.txt	Unicode text, UTF-8 (with BOM) text	771C8B73A374CB30DF4DF682D9C40EDF	46AA892C3553BDDC159A2C470BD317D1F7B8AF2A	3F55B2EC5033C39C159593C6F5ECE667B92F32938B38FCAF58B4B2A98176C1FC
C:\Program Files\7-Zip\Lang\br.txt	Unicode text, UTF-8 (with BOM) text	07504A4EDAB058C2F67C8BCB95C605DD	3E2AE05865FB474F10B396BFEFD453C074F822FA	432BDB3EAA9953B084EE14EEE8FE0ABBC1B384CBDD984CCF35F0415D45AABBA8
C:\Program Files\7-Zip\Lang\ca.txt	Unicode text, UTF-8 (with BOM) text	264FB4B86BCFB77DE221E063BEEBD832	A2EB0A43EA4002C2D8B5817A207EB24296336A20	07B5C0AC13D62882BF59DB528168B6F0FFDF921D5442FAE46319E84C90BE3203
C:\Program Files\7-Zip\Lang\co.txt	Unicode text, UTF-8 (with BOM) text	DE64842F09051E3AF6792930A0456B16	498B92A35F2A14101183EBE8A22C381610794465	DCFB95B47A4435EB7504B804DA47302D8A62BBE450DADF1A34BAEA51C7F60C77
C:\Program Files\7-Zip\Lang\cs.txt	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	DBDCFC996677513EA17C583511A5323B	D655664BC98389ED916BED719203F286BAB79D3C	A6E329F37ACA346EF64F2C08CC36568D5383D5B325C0CAF758857ED3FF3953F2
C:\Program Files\7-Zip\Lang\cy.txt	Unicode text, UTF-8 (with BOM) text	6BDF25354B531370754506223B146600	C2487C59EEEAA5C0BDB19D826FB1E926D691358E	470EAF5E67F5EAD5B8C3ECC1B5B21B29D16C73591EB0047B681660346E25B3FB
C:\Program Files\7-Zip\Lang\da.txt	Unicode text, UTF-8 text	C397E8AC4B966E1476ADBCE006BB49E4	3E473E3BC11BD828A1E60225273D47C8121F3F2C	5CCD481367F7D8C544DE6177187AFF53F1143AE451AE755CE9ED9B52C5F5D478
C:\Program Files\7-Zip\Lang\de.txt	Unicode text, UTF-8 (with BOM) text	1E30A705DA680AAECEAEC26DCF2981DE	965C8ED225FB3A914F63164E0DF2D5A24255C3D0	895F76BFA4B1165E4C5A11BDAB70A774E7D05D4BBDAEC0230F29DCC85D5D3563
C:\Program Files\7-Zip\Lang\el.txt	Unicode text, UTF-8 (with BOM) text	5894A446DF1321FBDDA52A11FF402295	A08BF21D20F8EC0FC305C87C71E2C94B98A075A4	2DD2130F94D31262B12680C080C96B38AD55C1007F9E610EC8473D4BB13D2908
C:\Program Files\7-Zip\Lang\en.ttt	Unicode text, UTF-8 (with BOM) text	BF2E140E9D30D6C51D372638BA7F4BD9	A4358379A21A050252D738F6987DF587C0BD373D	C218145BB039E1FD042FB1F5425B634A4BDC1F40B13801E33ED36CFDBDA063ED
C:\Program Files\7-Zip\Lang\eo.txt	Unicode text, UTF-8 (with BOM) text	29CAAD3B73F6557F0306F4F6C6338235	D4B3147F23C75DE84287AD501E7403E0FCE69921	A6EF5A5A1E28D406FD78079D9CACF819B047A296ADC7083D34F2BFB3D071E5AF
C:\Program Files\7-Zip\Lang\es.txt	Unicode text, UTF-8 (with BOM) text	ED230F9F52EF20A79C4BED8A9FEFDF21	EC0153260B58438AD17FAF1A506B22AD0FEC1BDC	7199B362F43E9DCA2049C0EEB8B1BB443488CA87E12D7DDA0F717B2ADBDB7F95
C:\Program Files\7-Zip\Lang\et.txt	Unicode text, UTF-8 (with BOM) text	D6A50C4139D0973776FC294EE775C2AC	1881D68AE10D7EB53291B80BD527A856304078A0	6B2718882BB47E905F1FDD7B75ECE5CC233904203C1407C6F0DCDC5E08E276DA
C:\Program Files\7-Zip\Lang\eu.txt	Unicode text, UTF-8 (with BOM) text	C90CD9F1E3D05B80ABA527EB765CBF13	66D1E1B250E2288F1E81322EDC3A272FC4D0FFFC	A1C9D46B0639878951538F531BBA69AEDDD61E6AD5229E3BF9C458196851C7D8
C:\Program Files\7-Zip\Lang\ext.txt	Unicode text, UTF-8 (with BOM) text	459B9C72A423304FFBC7901F81588337	0BA0A0D9668C53F0184C99E9580B90FF308D79BE	8075FD31B4EBB54603F69ABB59D383DCEF2F5B66A9F63BB9554027FD2949671C
C:\Program Files\7-Zip\Lang\fa.txt	Unicode text, UTF-8 (with BOM) text	741E0235C771E803C1B2A0B0549EAC9D	7839AE307E2690721AD11143E076C77D3B699A3C	657F2ACEB60D557F907603568B0096F9D94143FF5A624262BBFEB019D45D06D7
C:\Program Files\7-Zip\Lang\fi.txt	Unicode text, UTF-8 (with BOM) text	A04B6A55F112679C7004226B6298F885	06C2377AC6A288FE9EDD42DF0C52F63DCE968312	12CC4A2CEF76045E07DAFC7AEC7CF6F16A646C0BB80873EC89A5AE0B4844443B
C:\Program Files\7-Zip\Lang\fr.txt	Unicode text, UTF-8 (with BOM) text	A49801879184C9200B408375FC4408D7	763231BD9B883692C0E5127207CBFC6A2A29BC7D	397A3AF716EB7F0084F3AA04AD36EAB82AAB881589A359E7D6D4BE673E1789A8
C:\Program Files\7-Zip\Lang\fur.txt	Unicode text, UTF-8 (with BOM) text	06B08FE12C0F075D317CF9A2A1DD96BC	0062BA87B9207536B9088E94505D765268069F63	6BA88938C468E7217BD300B607D7A730530E63D1F97562604EC0BB00D66A06C9
C:\Program Files\7-Zip\Lang\fy.txt	Unicode text, UTF-8 (with BOM) text	03D38F09189799A0D927727D071C54B6	17FF3A2C83E6A0B0733F2A9A8CE6B83AF4F1B137	C1C050ED6FE2F8FBC048FD7D82944B8ADA784415B6E62316D590C3C7AA45E112
C:\Program Files\7-Zip\Lang\ga.txt	Unicode text, UTF-8 (with BOM) text	236CFC435288002763C68C4BBEE7B39D	E74A2402C2CB744DBED8AC1C2154FB1DE38148F9	B18730124208D26E5E88B76BB99985BF61938D7A994B626B2DE5230557D2D8DD
C:\Program Files\7-Zip\Lang\gl.txt	Unicode text, UTF-8 (with BOM) text	6CD7C2B4D6BBA163B1623035FEB4297D	5DF07BCFD1EDBD448B566AEA5789EF251303DE69	9280AB90261B0C8F206EEF7196D7531E4E4932C9174AB899CEE4F8ED97CC87C6
C:\Program Files\7-Zip\Lang\gu.txt	Unicode text, UTF-8 (with BOM) text	93CDC8832328A22E198920630D597268	315E5B1C77FB4E2D0C3CC1F48B6DB4C79CE9488A	C6E54E2A93B821BC974209CD7E2D10E9FBC4FF07D238AE84F552E4ADE271702C
C:\Program Files\7-Zip\Lang\he.txt	Unicode text, UTF-8 (with BOM) text	0771F160D56B1890A1CDC2CA040D2616	36E69202682BF6993273B521424EC082998F6CA9	03B4EA89CCE3AA4193A7E3E1E6180DAB8359388DF3B574379935EA39D7B8D723
C:\Program Files\7-Zip\Lang\hi.txt	Unicode text, UTF-8 (with BOM) text	18D9C82F12E07B71E03D6086DEBA0DC3	C6C11C6F1FC00A25DD53E1C78F207F6C8C8B8B13	5F79AE167A917860F95F73E5ED007FE250F30AF794BCFCE17941F9EF87D22A05
C:\Program Files\7-Zip\Lang\hr.txt	Unicode text, UTF-8 (with BOM) text	9D8216183493AC2190A4D6E142ECAB9A	E534EBB714DBAE2A9E12ACCBE96C6F2568B814C4	210AF273246D30CFDE87295CD5F4FF135B0BDFB04FE7173BB60F935E685B8E10
C:\Program Files\7-Zip\Lang\hu.txt	Unicode text, UTF-8 (with BOM) text	A41E4D16C3B29603832FFD1BBB82283E	15695A0BD98D429E9AB191CECB185B70CC492668	486A382483096E9A86CCF6CA02123E48025DE5055F1880AF7F001C5C3FA25114
C:\Program Files\7-Zip\Lang\hy.txt	Unicode text, UTF-8 (with BOM) text	FE73C2AACF07D5120AEDD08792CB8268	2C6E7D2FF42C5F65EF5F4C27600819354CAA03B0	91AAC9368BD116AB11FDA0B70EE4D75911A65713A272A3BA55D1435C33250F5A
C:\Program Files\7-Zip\Lang\id.txt	Unicode text, UTF-8 (with BOM) text	BA3591CCF26438CBE93E9C1D56BD1818	758619A702D5A0794E4412AA6AE93FC46EA3DFB9	90308689870AD079E1206A877157F7389BC4351A6B104FFA2BD9311409D6D92D
C:\Program Files\7-Zip\Lang\io.txt	Unicode text, UTF-8 (with BOM) text	0861AE63DA2D00590369BB11B3857551	8272F4761A3F2ACA2BFAEC6FCF08C82A9F36A65A	B87A4FCA8A0024A915AE86E36951CB7CEA442948D9982D4247E49492445BA664
C:\Program Files\7-Zip\Lang\is.txt	Unicode text, UTF-8 text	C8F31D6ADEE368CA0AA00350DF0D82DF	4146C7C62DD46B2C43C92CDF33E45FA7E2272D04	DC61090369E1269A68C75E472D863AAF42207F702B3D3E12CA48D2852E1478E3
C:\Program Files\7-Zip\Lang\it.txt	Unicode text, UTF-8 (with BOM) text	AA7B46B6DDD673BC06BD90187E552743	2C11A1E5F97AC1415073C2C953CD92018CF3EB93	EFB1AED5C52AF731A733C720B6F5479898C9DE28367A5DE4C80F697FB745546A
C:\Program Files\7-Zip\Lang\ja.txt	Unicode text, UTF-8 (with BOM) text	A0C7EB5D5A5DD7AB6F4C1E4FEF092256	F121129211DBEDBA3C440267FD9BD1C636E263C2	9F70F1943A8E0A9B9040D1F769CA2494C2B83CEB8DC55B08DB1FC3E6973AD835
C:\Program Files\7-Zip\Lang\ka.txt	Unicode text, UTF-8 (with BOM) text	C99E6572F5638599DBCA2CEAC337A320	73C64554A00C6D5A3DAB8A2E7BD50426D6C7B6F4	8DD6073B585DD2E9D8CDD8E0FCE7DFEAF2F5A2D8BFC3059F67EAA3D8B5EB2D9E
C:\Program Files\7-Zip\Lang\kaa.txt	Unicode text, UTF-8 (with BOM) text	FFC17520FB68FE464650B2F78E15AB5D	2B83034AC04640160DDAA8E797FAA5D8C80F956B	24F7325271DD7AD2B63E977841D2F06ED0194BD9257F0DB460DF32BAEEEC4746
C:\Program Files\7-Zip\Lang\kab.txt	Unicode text, UTF-8 (with BOM) text	5AF10C5616E0487D236C8CBE2F23A7A4	2049E1A82A0AF13A8ED2CF9E4EB51F1DFD377480	F249930089C374EAB59078CF16B8652D443CF2A47485D737AE5A9FCA2957D6B9
C:\Program Files\7-Zip\Lang\kk.txt	Unicode text, UTF-8 (with BOM) text	407130A212CFAC68FA4873B0381B2CB1	C0C9B84CC79619D27536E9F50F25D81237B234D3	F813EAC0B284EDCE156DD1E6B7EA75B027F4342E04D8B8DB1131894A227A4562
C:\Program Files\7-Zip\Lang\ko.txt	Unicode text, UTF-8 (with BOM) text	E85AE412871344211D00326D3DF2534D	4A770EEE2EF9F302B8190C8BBE3988A5D7C90E5E	3EA103FFD2FF97E211C7ADE3A79A882B494FE416BC56BD05F42F2E82158A7A03
C:\Program Files\7-Zip\Lang\ku-ckb.txt	Unicode text, UTF-8 (with BOM) text	8C3F9AD9C824DCF74A09C9D406DB22E7	0C683BB56A13C3FBCA664F1E4C6C98D0F7AEC8BC	B8B7DB8C139B19D414CEF35AE96D854D5A8364C32B0C3FDC4CAC331B5AF44C16
C:\Program Files\7-Zip\Lang\ku.txt	Unicode text, UTF-8 (with BOM) text	28E69DD6E397FA98C07088E4CDBEF1F4	56E4A46B5C7360F609683562E617C75C28CD447C	57AE544F3F9E8BF5D96CE1F9CFE5648EB6C1E2F5604DA6EB0C80AE24BC1A40D7
C:\Program Files\7-Zip\Lang\ky.txt	Unicode text, UTF-8 (with BOM) text	E50C04D913DC92251AA6781C02E0BD45	57E68C80B23A9B1BD689CCD81CBCD91E0CAE6AAC	9A9E4DDACC494EAAA386F1220837020F332A49E7FFF7F0BF8C38C847390DAB18
C:\Program Files\7-Zip\Lang\lij.txt	Unicode text, UTF-8 (with BOM) text	58FF044FE195453F797DD1AC6903ABF9	4B8DAE21DD14AC6DAA1DECF804336A1AAE169AA9	D9BB6BFC127938C47B43290241378887085314AD1326095934A362CD9836B560
C:\Program Files\7-Zip\Lang\lt.txt	Unicode text, UTF-8 (with BOM) text	B8056CBA4EDEB98D298D16EDBC34D678	A4D39C3EDA31F8CE72C62E1DB91DEEABC884CEB0	9C15DB408E32DC699F598AAB30F539F91A212E5FBAEE2095022E24B3F1F09ECD
C:\Program Files\7-Zip\Lang\lv.txt	Unicode text, UTF-8 (with BOM) text	056327042B9CFD5FCB5F788F22112D62	FAE6324417DC88E9A9BB0FBAC9B4D4CE61C1980E	533F9FF016E7BB36216665CCA1065139A35D8DA71651678814415FF457A9BE7D
C:\Program Files\7-Zip\Lang\mk.txt	Unicode text, UTF-8 (with BOM) text	C16E6946F912B49963BFA7E44BE2F7A0	496922AD3E59737AC64289EE685F2FADAA942755	90EFCA5F6B8E37B963F7E42F700938440171942E0DE0AB8BAEB08912C0952957
C:\Program Files\7-Zip\Lang\mn.txt	Unicode text, UTF-8 (with BOM) text	1088565A362EBAD250975F46F8A94328	406593AC2E74B8911DDA720952B7AFF6C4B5C145	C6A6CC400EE7420BFB680D71B43A9BE1FBC75D7B98AE2B6FFE98229D5EEFADCA
C:\Program Files\7-Zip\Lang\mng.txt	Unicode text, UTF-8 (with BOM) text	A10D62CB5875CC96D53E4BC02724F366	BB8D2F73109084A9A11246733E5DA148D964D6EA	2E488EF05895B93ACA2B5F72EA08DA887722215D1B4CB85B12942EA32641DA2B
C:\Program Files\7-Zip\Lang\mng2.txt	Unicode text, UTF-8 (with BOM) text	2BE2F9C77556CA413B590B8477DF5499	DD5CE617642C977470AA20C6DC6815728C779245	5A85CC532F802DA683374C3F4C98E3F37425CF304D6772BA554D2C49BAC7BE0B
C:\Program Files\7-Zip\Lang\mr.txt	Unicode text, UTF-8 (with BOM) text	B681F52BC54B1B340A3184CDE7FF59C2	BA8D38155C0C81416233A360F7387EAF48C57DB2	F6D67CE2EAE4C125BBF54C04AC783005BDDC07007398CABD3B9603020AF67BFD
C:\Program Files\7-Zip\Lang\ms.txt	Unicode text, UTF-8 (with BOM) text	E3267C5ED8158DA2B7E2679107CE1394	6550CDE7359A1B3450D8C0937AFFBF0252FA4B82	C88BC7EA0C20769847A0403E188E273A0897D1C77DD72CC4B45471FC67E0D5E1
C:\Program Files\7-Zip\Lang\nb.txt	Unicode text, UTF-8 (with BOM) text	3B1958DA0544A6C318D18EF5779E81F5	67E991A6525DA165145C4584C3D9B398583D7E68	F349529EA4584EBA51CD519B8A1D535D2DAEC762CD7369673B237FA03A526CC7
C:\Program Files\7-Zip\Lang\ne.txt	Unicode text, UTF-8 (with BOM) text	04CFC22F9293329C5EA7EC5C4A14D3BC	57AA51DEC6BED50703054060F46918AA26AE0E4A	E016E8872F2DE7CBC1F4FC786C747CC26B2E250E6C1B8F1C46040B72C523D90F
C:\Program Files\7-Zip\Lang\nl.txt	Unicode text, UTF-8 (with BOM) text	E888911310C0B6D7A1932DE36AD27250	928D9FBDB0C0C83042CAC9059FFDDE48EA4E9F71	4CB5F08449B5E22ED15F8A8CC038D021CDBCF56548587023D1AB31AB6CFC232D
C:\Program Files\7-Zip\Lang\nn.txt	Unicode text, UTF-8 (with BOM) text	780514AF9E967D8AA65005365EFA7D78	9E060F149B110D0A0675B75D4A7B960563ACCA05	DB540E1A6B8FFFF2497F9C1A63F85CB5F345F8CBA767F05377C0365ABAF7B7D4
C:\Program Files\7-Zip\Lang\pa-in.txt	Unicode text, UTF-8 (with BOM) text	C9AD9D02C661644F79820E779A6D3F0F	92BD000AF1EA18B2FE8941CA4DF15858B4B53106	E542C19640D39F3C56BF11A9EAADB554D7E74D8EC525D41A321E97C5AE5191C5
C:\Program Files\7-Zip\Lang\pl.txt	Unicode text, UTF-8 (with BOM) text	F8821C75507199F4EF041EEBA8B82281	96759A3B826BB5DBC18730378D0F8BA08C1DF7E1	B4B96FDAA023A3988D514C1CB1E2914817CD538D3BB7F062778360338B73BA67
C:\Program Files\7-Zip\Lang\ps.txt	Unicode text, UTF-8 (with BOM) text	23502D5CDD3671B634832D5F722CF5EA	443FB98DF15B8BFD081802938E180A87EE24104D	FA12CA0BE49F4921D06268FAD673838C3A4644A70DC374A931997178F588E8F4
C:\Program Files\7-Zip\Lang\pt-br.txt	Unicode text, UTF-8 (with BOM) text	F0CBDAA70D567EE71C685250958EC194	2DB013E6608739AA45453D0F69BA953FCC78B14D	6B21924CAEA51B395EFA0B8FA5D7E2492CE6A6B86DCC08565A5A4DEE5C182167
C:\Program Files\7-Zip\Lang\pt.txt	Unicode text, UTF-8 (with BOM) text	F868C8FE0F1CBDED1AEC5CD29754B289	5E0113E3D5BFB938441CAE077034E7735B18C324	3C76D190EA88CC339392FDB46E005E72E16658CF07FA83487E1A77250E027F41
C:\Program Files\7-Zip\Lang\ro.txt	Unicode text, UTF-8 text	9A2FC6431192E6FC18871DA5D4ADC467	EEA02FAF56E746DFADF67C5FE4E12A79EA2FB089	4FD993DBAE9606C062DC3511292274631335956A016B74B3061BAB55F7D9C736
C:\Program Files\7-Zip\Lang\ru.txt	Unicode text, UTF-8 (with BOM) text	447E681A030C82C3832DBA0B51CC790D	401BF38C2122AE2493470820C92D069F3F6C7606	3E76BC88DB5CB108CF8750B01BDABBB3772DBF2BF14592C6AB18B7339817D6EE
C:\Program Files\7-Zip\Lang\sa.txt	Unicode text, UTF-8 (with BOM) text	FD1B984BAEA0E5A905F756E9FDC54E86	4DA8DA9154115F6BF0962FD02DB9D7E166285C8E	02CC9032C117A7818865AF3DCADBDD3C7B348BE3507681CD0032DD9BD15B76FC
C:\Program Files\7-Zip\Lang\si.txt	Unicode text, UTF-8 (with BOM) text	5203E172ECB9F384BCE04D243684551F	5F6A09B52D729F3F6C95ABA9D29BFD6C7CD0340B	5405E5B04E670FF7A5B5242A3872803725053324FFDC31F71511EA6B2573F6E0
C:\Program Files\7-Zip\Lang\sk.txt	Unicode text, UTF-8 (with BOM) text	3FDECAE1FF188894295759380B0378DA	935A4797540CE26828569C50924BAAE230F2D41E	B53FE26795B01F3347B614EAA499D28770D94EB5B51005C842386E97D8344CB6
C:\Program Files\7-Zip\Lang\sl.txt	Unicode text, UTF-8 (with BOM) text	722551A008A99008006AF6CE4161537A	294ABEA21D393BF624A4A97C1B4DB63D3332C312	6B53FB390DA88BD79D76487FF30466AE972976D2EED030ADE6D9B93991B99CBC
C:\Program Files\7-Zip\Lang\sq.txt	Unicode text, UTF-8 (with BOM) text	69720A6D09230D9747BB2AA3C0EF650D	4750E61EC19BA905D6F2BC5828510FD08D915AF8	B6EE3C8A14230AA7D1A17C5493E0A410C5C5C638BA7A9D81681FFED4A8DE6884
C:\Program Files\7-Zip\Lang\sr-spc.txt	Unicode text, UTF-8 (with BOM) text	D95E6FF9DAE7FA22083D9ED73588FE1A	F061E9E1AFE02B7B92D626432CD9DA55BD8BC2DD	817D7A33F2ADB19F47F45F78C314F6AE6DF4CA4DA133C1F7A82703E0CDEE7E20
C:\Program Files\7-Zip\Lang\sr-spl.txt	Unicode text, UTF-8 (with BOM) text	9E08D57D48B4D8CB16F98736C5C0511B	85A597B74BCB1CBF918D6366705F0B0C0727DE31	D8C5223FE423129145C5B55A756E499D4680B1DF0A7115D72736F09E51C89C1F
C:\Program Files\7-Zip\Lang\sv.txt	Unicode text, UTF-8 (with BOM) text	9A27F7E51E2143F4258AAC9975F78F60	49DFFBD91FE27A81DA38BECDE87DE6B2DF28962F	233596E0D29DAD356CD31C302EB1EB3A263736F166F5A7628A753BD808668EBB
C:\Program Files\7-Zip\Lang\sw.txt	ASCII text	BAAC3FF9FC4B6A656AC7C51D44117BD9	FEACD226EFB71EE149424F39AB47EBF6F64CAB04	9FED3C0B4E67673BC1D8BBD67D1F6651FADE030F98D12173C3564F2C492A67F8
C:\Program Files\7-Zip\Lang\ta.txt	Unicode text, UTF-8 (with BOM) text	DD0AE446AD4C5D6F20DB6ECE80F21606	CDDB5DC08DA094FF69E48C1AF7E329F6B83FB6A6	AE1A795105574BF2674A5DE98A4F06CADD9C79DEBDE9FC288F64B3D607FA329D
C:\Program Files\7-Zip\Lang\tg.txt	Unicode text, UTF-8 (with BOM) text	EA08A1D73A4A150D7EC590B094D4E0D5	E4F3172CF52DB8DA27F7D95CFBA2EACFAB12D533	E029F34DDEA8B1358E1F519526EF643D79BE37CFCE55BB5EA21B4BD0D026F9D3
C:\Program Files\7-Zip\Lang\th.txt	Unicode text, UTF-8 (with BOM) text	6BE5BA977C60F103B54C4289399CE43E	48DFF625438573A366D56ECEF43BC43A10E124A8	A1967002746961CDC4F3AD4F5F081BBA6DB231660CDFD5F2AB4A572EB11DD67C
C:\Program Files\7-Zip\Lang\tk.txt	Unicode text, UTF-8 text	1F610DF86538A3ED788D6A8024C1982E	3180F829602B83148C73A47EF4DAF841BB379A14	A0F485755CBC6356CFA4BEF5CB6134653DC6743F4BFCA89CED92D43EC31C5649
C:\Program Files\7-Zip\Lang\tr.txt	Unicode text, UTF-8 text	CD44EF9F1C6526A18D9956517E510C16	DD65DAD1B27F26B538CB3C8FC11895A7C6A81F20	D8DDEEC7A1D5F98BE9FE727D47F8BDF733E21693E988DCFE48089AC3344DCF30
C:\Program Files\7-Zip\Lang\tt.txt	Unicode text, UTF-8 (with BOM) text	730C16345E2A2366C2221D5F22980666	41E92F0B3AEE2436183E1263AAD85787ECBABF34	813B5264F3F2D2B632B346E800E738E04DC098C7B3A1A2AF64BCF3A6ACBCA037
C:\Program Files\7-Zip\Lang\ug.txt	Unicode text, UTF-8 (with BOM) text	47C628C679FF488DDF4E14C457D2FCA0	E8DA632E677A92224B5095271087A68C60504B9C	7FD494130F9B96DFCA492D495EF3FD7B4EAACF59F075172898ECE5AEBD1F6FCE
C:\Program Files\7-Zip\Lang\uk.txt	Unicode text, UTF-8 (with BOM) text	14C60B55D5400607C7B6443D10B0A37C	B92D556FF934F83AC3BEEC3DE20FBB909D0E1AFB	262BCC4EBAE464D1C96FBFCCDCA7813E6F6CC8FDFD78FBB933DE72A2B7AC8367
C:\Program Files\7-Zip\Lang\uz-cyrl.txt	Unicode text, UTF-8 (with BOM) text	0E053B461B1840743441F2B74D73E3EE	C3F211F45C0702531C0BB09C13EAFE32634EE9CC	DD414D39F8DA2FBD5CAA0C7A7A9155C5F802B4D45F2E8828A79C7B4B63BD1179
C:\Program Files\7-Zip\Lang\uz.txt	Unicode text, UTF-8 (with BOM) text	4479712709B19297483D020D11164745	ADBF9F8EF1C44E7F7D13EF5E0ABE1F49C4ED3F1B	D62F8D3E7AA1F2636A1AD1B2AEDE0DA9FD725941A5F81D24A9B0B7599CAF0F50
C:\Program Files\7-Zip\Lang\va.txt	Unicode text, UTF-8 (with BOM) text	1651078BE7CE617922904CA7941FAE20	1FE33F74AAA6AF59B5055B968EF6424107544538	C0D985DEA02778276BA3D3DF96B50B33F7BA0C1EC7C62761F0DCD67A05B62270
C:\Program Files\7-Zip\Lang\vi.txt	Unicode text, UTF-8 (with BOM) text	A0612FA9EB8196659D15C67AC965A5E6	AE733BBAEF962F3A10C5855ED30B6D084C8C5D5F	C73634402C3EFFDB2750AB5CF6F1083ABD8771529BFF6F7E513D646E0FCDAE23
C:\Program Files\7-Zip\Lang\yo.txt	Unicode text, UTF-8 text	5D90F9C7771022E43C15A4393A0670CE	689269A4B3AED23CDF59ED395732C592B515AC83	DE2497946932D806F822082C3CF9F2F26A18752D9973F9D09E0889A94CE4C28A
C:\Program Files\7-Zip\Lang\zh-cn.txt	Unicode text, UTF-8 text	D13839AF103477DF8CFD0BC2EB876EB0	93AF39EBEB9677003DB67B386588409329104F4E	D04E5BD3BF1E3F3754C3603889AA1B659D1DAC518C5C6B5C1C49ECF16DCA1C01
C:\Program Files\7-Zip\Lang\zh-tw.txt	Unicode text, UTF-8 (with BOM) text	E6C38C199079BE58EE81E8DA55E783AC	1AD09B0146F317786AFB0A09C7907E6CCB5C207E	76A17B0A97925E5D6DEB1EBE8AE14F83BD49957C492C3733A0EA178E28B0D74B
C:\Program Files\7-Zip\License.txt	ASCII text, with CRLF line terminators	761B393DAC39374A072E58AA6A4872FC	FA049F28E907AB6A0489D1FEC1746DF3A26D22E2	3A9A7BCA133A8AF4560F48DFA351F941E110D80A2C2466E537EC6680B9FC2DDA
C:\Program Files\7-Zip\Uninstall.exe	PE32 executable (GUI) Intel 80386, for MS Windows	5DFDDA860BA69DF0AE0AB193CF22A4AD	631C3B573B87688A9C5C5F9268FA826B315ACB22	2FFA1C010889DC2C03DFEF2271343AC6032C3966530C383B92D3DFD99A3AADC5
C:\Program Files\7-Zip\descript.ion	ASCII text, with CRLF line terminators	EB7E322BDC62614E49DED60E0FB23845	1BB477811ECDB01457790C46217B61CB53153B75	1DA513F5A4E8018B9AE143884EB3EAF72454B606FD51F2401B7CFD9BE4DBBF4F
C:\Program Files\7-Zip\readme.txt	ASCII text, with CRLF line terminators	800E525E791CE8CA84A9200DDCABD6B2	69800F0C14111FD0CA7F6A41268AD5F4D8ED24F4	7687C86D1096D2587A8EE0A9E585725ABD1AB7A8AF98FDF1CC8234AE94624F33
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Oct 3 09:51:28 2023, mtime=Thu Oct 24 14:36:44 2024, atime=Sun Aug 11 12:00:00 2024, length=986624, window=hide	242B910B1ED5EF7B7FB80F1D7F81CE82	6816BD742728F2A905D192AE2FCDB139E0463A36	048AF5DFE5138FECA362FCD9B1CD3DDDF53BE659D0065481A457938A4C6F2FF7
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Oct 3 09:51:28 2023, mtime=Thu Oct 24 14:36:43 2024, atime=Sat Aug 10 15:00:00 2024, length=120396, window=hide	6C3EBD0B07522B84DEA5581C1E5FF276	28E21629E3B3526F57953CB633C92A8372DD9CB3	77183DAB79B89EBC61CD8BBA6735827B91486D42A5FA8813DB7674BFBDACA029

Source: 7z2408-x64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Spreading

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7-zip.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7z.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7-zip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior

Source: 7z2408-x64.exe, 00000000.00000003.1756539856.0000000002740000.00000004.00000020.00020000.00000000.sdmp, License.txt.0.dr	String found in binary or memory: http://www.gnu.org/
Source: 7z2408-x64.exe, 00000000.00000003.1756539856.0000000002740000.00000004.00000020.00020000.00000000.sdmp, History.txt.0.dr	String found in binary or memory: https://7-zip.org/history.txt
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp, 7zFM.exe.0.dr	String found in binary or memory: https://www.7-zip.org/

Source: C:\Users\user\Desktop\7z2408-x64.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\7z2408-x64.exe	Code function: 0_2_00405F40	0_2_00405F40
Source: C:\Users\user\Desktop\7z2408-x64.exe	Code function: 0_2_00404061	0_2_00404061
Source: C:\Users\user\Desktop\7z2408-x64.exe	Code function: 0_2_00407430	0_2_00407430
Source: C:\Users\user\Desktop\7z2408-x64.exe	Code function: 0_2_00406A85	0_2_00406A85
Source: C:\Users\user\Desktop\7z2408-x64.exe	Code function: 0_2_00405692	0_2_00405692

Dropped file seen in connection with other malware

Source: Joe Sandbox View	Dropped File: C:\Program Files\7-Zip\7z.dll E79DDFB6319DBF9BAC6382035D23597DAD979DB5E71A605D81A61EE817C1E812
Source: Joe Sandbox View	Dropped File: C:\Program Files\7-Zip\7z.exe 707F415D7D581EDD9BCE99A0429AD4629D3BE0316C329E8B9EBD576F7AB50B71

Sample file is different than original file name gathered from version info

Source: 7z2408-x64.exe, 00000000.00000002.2968372960.0000000000197000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zipInstall.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000002.2968559714.000000000040E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename7zipInstall.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7-zip.dll, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FileVersionFileDescriptionOriginalFilename_winzip_.rsrcCOFF_SYMBOLSCERTIFICATE.pdata.reloc vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.dll, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.sfx.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zFM.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zg.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe, 00000000.00000003.1759096947.00000000045AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUninstall.exe, vs 7z2408-x64.exe
Source: 7z2408-x64.exe	Binary or memory string: OriginalFilename7zipInstall.exe, vs 7z2408-x64.exe

Source: 7z2408-x64.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: clean19.spre.winEXE@1/109@0/0

Source: C:\Users\user\Desktop\7z2408-x64.exe

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_004025C5 CoCreateInstance,

0_2_004025C5

Source: 7z2408-x64.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7z2408-x64.exe

File read: C:\Program Files\desktop.ini

Source: C:\Users\user\Desktop\7z2408-x64.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\7z2408-x64.exe

File read: C:\Users\user\Desktop\7z2408-x64.exe

Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: playtodevice.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: devdispitemprovider.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: portabledeviceapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: networkexplorer.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: audiodev.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmvcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: wmasf.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	Section loaded: mfperfhelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\7z2408-x64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32

Contains functionality to dynamically determine API calls

Source: 7-Zip File Manager.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files\7-Zip\7zFM.exe
Source: 7-Zip Help.lnk.0.dr	LNK file: ..\..\..\..\..\..\Program Files\7-Zip\7-zip.chm

Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: Install
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK
Source: C:\Users\user\Desktop\7z2408-x64.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 7z2408-x64.exe

Static file information: File size 1624144 > 1048576

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_00401FB1 GetSystemDirectoryW,lstrlenW,lstrcpyW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,malloc,free,

PE file contains sections with non-standard names

Source: 7-zip32.dll.0.dr	Static PE information: section name: .sxdata
Source: 7z.sfx.0.dr	Static PE information: section name: .sxdata
Source: 7zCon.sfx.0.dr	Static PE information: section name: .sxdata

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_004071E0 push eax; ret

0_2_0040720E

Persistence and Installation Behavior

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7-zip.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7z.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7z.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7-zip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7zG.exe	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	System file written: C:\Program Files\7-Zip\7zFM.exe	Jump to behavior

Drops PE files

Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7-zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7z.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7-zip32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7zCon.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file

Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7z.sfx			Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	File created: C:\Program Files\7-Zip\7zCon.sfx			Jump to dropped file

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7-zip.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7-zip32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zCon.sfx	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\7z2408-x64.exe	Dropped PE file which has not been started: C:\Program Files\7-Zip\7zFM.exe	Jump to dropped file

Source: C:\Users\user\Desktop\7z2408-x64.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7z2408-x64.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Qdc
Source: 7z2408-x64.exe, 00000000.00000003.2087105031.0000000000668000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRA~1_VMware_SATA_CD0^']
Source: 7z2408-x64.exe, 00000000.00000003.2062199390.00000000006A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ef&&
Source: 7z2408-x64.exe, 00000000.00000002.2970058084.000000000A330000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:T
Source: 7z2408-x64.exe, 00000000.00000003.1979640351.000000000069D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.1978887267.000000000069D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2333268101.000000000065B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD0^'\
Source: 7z2408-x64.exe, 00000000.00000003.2393903090.000000000A34B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Tjh
Source: 7z2408-x64.exe, 00000000.00000003.2561954201.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}^ff
Source: 7z2408-x64.exe, 00000000.00000003.2311360135.000000000A2AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA{']
Source: 7z2408-x64.exe, 00000000.00000002.2970058084.000000000A330000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:h
Source: 7z2408-x64.exe, 00000000.00000003.2724562565.000000000A346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: E#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2561954201.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}~QG
Source: 7z2408-x64.exe, 00000000.00000003.2394625067.000000000A34B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Tjh
Source: 7z2408-x64.exe, 00000000.00000003.2394625067.000000000A34B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Qdc
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}2-00a0c91efb8b}\\?\STORAG6~
Source: 7z2408-x64.exe, 00000000.00000003.2171636830.000000000A2A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA{']
Source: 7z2408-x64.exe, 00000000.00000003.2725173354.000000000A33D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b})
Source: 7z2408-x64.exe, 00000000.00000003.2888976790.000000000A2A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: }\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2480395971.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}^ff
Source: 7z2408-x64.exe, 00000000.00000003.2749161396.000000000A34D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:e\CLX]
Source: 7z2408-x64.exe, 00000000.00000002.2969841456.000000000A2A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!
Source: 7z2408-x64.exe, 00000000.00000003.2724791506.000000000A330000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: 7z2408-x64.exe, 00000000.00000002.2969841456.000000000A2A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2888709824.000000000A351000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94@]
Source: 7z2408-x64.exe, 00000000.00000003.2889013936.000000000A348000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Qjc
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}11ee-8c18-806e6f6e6963}#00
Source: 7z2408-x64.exe, 00000000.00000003.2725173354.000000000A33D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}C
Source: 7z2408-x64.exe, 00000000.00000003.2311246255.000000000065B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}uu
Source: 7z2408-x64.exe, 00000000.00000003.2229433583.00000000006A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}&&
Source: 7z2408-x64.exe, 00000000.00000003.2061434167.0000000000668000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}--
Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}a33c735c-61ca-11ee-8c18-80
Source: 7z2408-x64.exe, 00000000.00000003.2725173354.000000000A33D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}6f6e6963}#0000000006500000^
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644936228.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000002.2969841456.000000000A2A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000002.2968725040.000000000060A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0uWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: 7z2408-x64.exe, 00000000.00000003.2061506490.00000000006A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wgSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ef&&
Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7f
Source: 7z2408-x64.exe, 00000000.00000003.2725173354.000000000A33D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2644824463.000000000065B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000007
Source: 7z2408-x64.exe, 00000000.00000003.1978887267.000000000069D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}$$
Source: 7z2408-x64.exe, 00000000.00000003.2724562565.000000000A346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}}\\?\STORAGE#Volume#{a33crcG
Source: 7z2408-x64.exe, 00000000.00000003.2562065555.000000000A34E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.1900346230.000000000069D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j8ycSTORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2394494523.000000000A2A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA{']
Source: 7z2408-x64.exe, 00000000.00000003.2480395971.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}OhU
Source: 7z2408-x64.exe, 00000000.00000003.2644291325.000000000A342000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7z2408-x64.exe, 00000000.00000003.2561954201.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}OhU
Source: 7z2408-x64.exe, 00000000.00000003.2561954201.000000000A34A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Tjh

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\7z2408-x64.exe

Code function: 0_2_00401FB1 GetSystemDirectoryW,lstrlenW,lstrcpyW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,malloc,free,