Malware Analysis Report

2025-01-03 08:34

Sample ID 240611-ast3eawgrc
Target 8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9
SHA256 8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9
Tags
ransomware upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9

Threat Level: Known bad

The file 8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9 was found to be: Known bad.

Malicious Activity Summary

ransomware upx

UPX dump on OEP (original entry point)

Renames multiple (847) files with added filename extension

UPX dump on OEP (original entry point)

Renames multiple (2845) files with added filename extension

UPX packed file

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-11 00:28

Signatures

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-11 00:28

Reported

2024-06-11 00:31

Platform

win10v2004-20240226-en

Max time kernel

153s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe"

Signatures

Renames multiple (847) files with added filename extension

ransomware

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.NonGeneric.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\7-Zip\Lang\bn.txt.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.HttpUtility.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Configuration.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\7-Zip\Lang\ky.txt.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processenvironment-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\ReachFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\7-Zip\Lang\lv.txt.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\msquic.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Extensions.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationProvider.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.StackTrace.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\7-Zip\Lang\bg.txt.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\7-Zip\Lang\nl.txt.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-namedpipe-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Input.Manipulations.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\7-Zip\Lang\tr.txt.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Specialized.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.TraceSource.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.Concurrent.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ObjectModel.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationCore.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-process-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.AccessControl.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Handles.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationFramework.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\7-Zip\Lang\be.txt.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-fibers-l1-1-0.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Controls.Ribbon.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\Services\verisign.bmp.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebClient.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Primitives.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\7-Zip\Lang\ro.txt.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe

"C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 172.217.169.42:443 chromewebstore.googleapis.com tcp
GB 172.217.169.42:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 42.169.217.172.in-addr.arpa udp

Files

memory/372-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

MD5 9fd8ee676535b03166100856d1b76ad1
SHA1 e34d37476ee7de8dcca6053500fcef656d1734f1
SHA256 aadb3556e58da6cbe76db9caef2af206e8b5ceac39f359cfbebf2229c213cd57
SHA512 577af81dd8bb8b53e8743a73cdfc64b48b387962853537ad3577aa66be717e6b38a06238d09d85ff421ca63996d631ee253fe2baa1baf8624f12d814ade01569

C:\libsmartscreen.dll.tmp

MD5 875128111de2db6b6b847afd10b10190
SHA1 2e664791c225773fd4a4c66df628c0bd484b0b37
SHA256 e3490b74f5085df9acd9d201413205ceec38ab8fed8ea3b8587ca5791371373c
SHA512 a8b786d05f38da148974efeee1b49976876e587de198691c80d44129b13d314d3d44fcf5c233e04ffe88de620249fed705873c33f626ec6b009c3c26edd1e546

memory/372-288-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-11 00:28

Reported

2024-06-11 00:31

Platform

win7-20240221-en

Max time kernel

150s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe"

Signatures

Renames multiple (2845) files with added filename extension

ransomware

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jre7\bin\jpeg.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Microsoft Games\FreeCell\en-US\FreeCell.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jre7\lib\security\local_policy.jar.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgRes.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\RepairUnblock.DVR.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Speech.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\ClearMove.aif.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Asia\Baku.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\README.html.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe

"C:\Users\Admin\AppData\Local\Temp\8cf1b85762a8282c98f155f987af99fc36463394f7db3146daa25d6c7f54e0c9.exe"

Network

N/A

Files

memory/2928-0-0x0000000000400000-0x000000000040B000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

MD5 8b915ba035b6949f0b5a70e99a5321a9
SHA1 46983f9ba06b1c9c6c1a4b0a2b21775b1a44ab2e
SHA256 41fd568adc63877668de2ff87bd9af151e18bcf1e2aef68753a5678584157013
SHA512 609e330f69478245e3a8bd304f0aaa18ecff0728cad0c8e23107f50313ff8ca458812ad6c9a995a2c6680217cd19a7dd1e82b4e714f41b73148c18527130673d

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

MD5 580703f0cc101615f958b2aaac50c155
SHA1 9d2ce497ec1b11b92983fb1c862deb8a2bcdd51b
SHA256 47baa0a1a7e5dcf79a69d09c56c9026f0471107f675e70b28abdc9048df0af23
SHA512 b725878a1dd7a1360f57a70dda77ba99d80feffbec4b32f26ccdfc5b006b3e33f74e566f17bef09aa64faf77e2a0a734572afc70f7052a4a5c4d6366c0b62f95

memory/2928-448-0x0000000000400000-0x000000000040B000-memory.dmp